ML18093B002

Design Basis Document for Ofn RP-017, Control Room Evacuation, E-1F9915, Rev 9

ML18093B002
Person / Time
Site:	Wolf Creek
Issue date:	06/27/2017
From:	Wolf Creek
To:	Office of Nuclear Reactor Regulation
Shared Package
ML18093A810	List: ML18093A820 ML18093A876 ML18093A878 ML18093A883 ML18093A890 ML18093A891 ML18093A893 ML18093A895 ML18093A897 ML18093A899 ML18093A901 ML18093A903 ML18093A905 ML18093A907 ML18093A909 ML18093A911 ML18093A914 ML18093A917 ML18093A919 ML18093A920 ML18093A922 ML18093A945 ML18093A947 ML18093A949 ML18093A951 ML18093A953 ML18093A956 ML18093A958 ML18093A959 ML18093A961 ML18093A963 ML18093A965 ML18093A988 ML18093A990 ML18093A993 ML18093A999 ML18093B002 ML18093B004 ML18093B006 ML18093B008 ML18093B010 ML18093B011 ML18093B013 ML18093B015 ML18093B017 ML18093B020 ML18093B021 ML18093B023 ML18093B025 ML18093B027 ... further results
References
WO 18-0011 E-1F9915, Rev 9
Download: ML18093B002 (227)

Text

l l il APF 05-013-01 I REV. 04 E-1F9915 DESIGN BASIS DOCUMENT FOR OFN RP-017, CONTROL ROOM EVACUATION ENGINEERING REVIEW: DRAFTER: CHECKER: ENGINEER:

SUPERVISOR:

IZJ ELECTRONIC APPROVAL 1. 0 APPROVED-MFG.

MAY PROCEED 2. 0 NOT APPROVED-RESUBMIT FINAL DOCUMENT/DRAWING-MFG.

MAY PROCEED 0 YES 0 NO 3. 0 APPROVED INFORMATION NOT CONTROLLED UNDER DESIGN PROCESS 4. 0 ACCEPTABLE-MAINTAIN AS RECORD (INFO. ONLY) 5. 0 RESTRICTED FOR WOLF CREEK PLANNING ONLY-MFG.

MAY PROCEED 0 YES 0 NO APPROVAL OF THIS DOCUMENT/DRAWING DOES NOT RELIEVE SUPPLIER/CONTRACTOR FROM FULL COMPUANCE WITH CONTRACT, SPECIFICATIONS AND/OR PURCHASE ORDER REQUIREMENTS.

COMMENTS:

None P.O.#: N/A CHANGE PACKAGE#:

15240 REV.# 9 VENDOR MANUAL: N/A PAGE: N/A INCORPORATED CHANGE DOCUMENT(S):

N/A OC REI. EASED: Linda R Kaminski

1. -----o.L:

Released by Document 0 ..... ) Serv1ces.

Release Date: 2017.06.27 16:02:40 -05'00' I COMPONENT NUMBER($)

I; N/A i E COMPONENT NUMBERS ARE FOR INITIAL (REV, W01) DATA LINKING ONLY. ADOI'f!ONAL COMPONENT LINKS ARE MADE IN DATABASE ONLY. l .... = """*'"""-*

-.. '

• =-*-"""""'""""'""""""'""'""'

• =*

Design Basis Document for Procedure OFN RP-017 Page 2 of 102 E-1F9915, Rev. 9 TABLE OF CONTENTS Page 1.0Purpose .......................................................................................................................

....................... 32.0Scope and Assu mptions .........................................................................................................

........... 32.1Scope .........................................................................................................................

..................... 32.2Assumptions ...................................................................................................................

................ 33.0Methodology ...................................................................................................................

.................... 34.0References ....................................................................................................................

..................... 44.1Wolf Creek Documents ..........................................................................................................

......... 44.2Nuclear Regulatory Commission Documents ................................................................................. 64.3Other Documents

............................................................................................................................ 65.0Background ....................................................................................................................

.................... 66.0Summary of Timing Basis .......................................................................................................

........... 76.1Reactivity Control

............................................................................................................................ 76.2Reactor Coolant Makeup/Inventory Control ................................................................................... 86.3Decay Heat Removal ............................................................................................................

.......... 96.4Process Monitoring ............................................................................................................

........... 106.5Support .......................................................................................................................

.................. 107.0Section-by-Section Review .....................................................................................................

......... 127.1OFN RP-017, Section 1.0 - Purpose ............................................................................................

127.2OFN RP-017, Section 2.0 - Symp toms or Entry Conditions ......................................................... 137.3OFN RP-017, Section 3.0 - References and Commitments ........................................................ 137.4Step-by-Step Review ...........................................................................................................

......... 20 # of Pages Appendix 1 - OFN RP-017 Credited Component Evaluation ..................................................................... 30 Appendix 2 - Control Room Fire Consequence Evaluation for Motor Operated Valves ............................ 37 Appendix 3 - Control Room Multiple Spur ious Operation (MSO) Review .................................................. 58

Design Basis Document for Procedure OFN RP-017 Page 3 of 102 E-1F9915, Rev. 9 1.0 Purpose The purpose of this document is to provide a technical basis for procedure OFN RP-017, Control Room Evacuation (due to fire) and define the timing basis for each action step within OFN RP-017. 2.0 Scope and Assumptions 2.1 Scope This document applies to procedure OFN RP-017. 2.2 Assumptions The following assumptions are applied when developing the Wolf Creek strategy for shutting down and maintaining hot standby using procedure OFN RP-017. 2.2.1 Only fire-induced failures are postulated to occur and all equipment is in normal operating state at the time of the fire. 2.2.2 Response Not Obtained (RNO) actions are included as operator aids and exceeds the procedural guidance required by regulation. It is not expected that the RNO actions will be necessary unless the primary action is affected by the fire. 2.2.3 Before transfer of control is achieved by the alternative and dedicated shutdown system only a single spurious actuation is assumed to occur, except in the case of two redundant valves in a high/low pressure interface line. All potential spurious actuations are mitigated or prevented using procedure OFN RP-017 but timing is based on one spurious actuation occurring prior to transfer of control to the alternative and dedicated shutdown system, or two spurious actuations in the case of high/low pressure interface lines. 2.2.4 The Wolf Creek Fire Protection licensing basis, as described in USAR, Section 9.5.1, requires that a loss of off-site power be assumed in conjunction with a control room fire. However, a loss of offsite power may not be the most conservative assumption for every fire scenario. Therefore, the thermal hydraulic calculations were performed assuming off-site power is available and off-site power is not available to determine the most conservative outcome. The results of the thermal hydraulic calculation are presented in evaluation SA-08-006. 2.2.5 Automatic functions capable of mitigating spurious actuations are assumed to be defeated by damage to cables located in the area associated with the automatic function. 2.2.6 The reactor is tripped prior to evacuation of the control room. This is the only action assumed to work prior to evacuation. Tripping the reactor is considered to be t = 0 seconds for the purpose of timing subsequent steps.

2.2.7 Transfer of control to the alternative or dedicated shutdown system is assumed to occur when all isolation and transfer switches have been manipulated per procedure OFN RP-017. These switches are either located at the Auxiliary Shutdown Panel or at the local equipment. 3.0 Methodology The methodology for completing this document is described in this section.

Each section and step within OFN RP-017 was reviewed and a technical basis for the section or step was documented.

Section 1.0 describes the purpose of E-1F9915. Section 2.0 identifies the scope. Section 4.0 lists the references used to compile E-1F9915.

Section 5.0 provides background information on OFN RP-017.

Design Basis Document for Procedure OFN RP-017 Page 4 of 102 E-1F9915, Rev. 9 Section 6.0 is a summary of each PFSSD function and the major equipment associated with the function. In addition, Section 6.0 summarizes the timing requirement to ensure the function is satisfied per the times justified in Section 7.0.

Section 7.0 provides a technical review of each section in OFN RP-017. First, the front-end sections are discussed and a technical basis provided. These front-end sections include the Purpose, Symptoms or Entry Conditions, and References and Commitments.

Next, each Action/Expected Response and Response Not Obtained step within OFN RP-017 is tabulated in Table 7.1. The columns and the information provided in each column are described below.

Step Number - The step number identified in OFN RP-017.

Step Description - The Step wording taken verbatim from the procedure.

PFSSD Function - This column describes the PFSSD function that is satisfied by performing the Step. Functions are as follows: R - Reactivity Control; M - Reactor Coolant Makeup and Inventory Control; D - Decay Heat Removal; P - Process Monitoring; S - Support. If the step does not satisfy a specific function, then N/A is placed in the column.

Basis - This column provides useful information about the step and why it is included in the procedure.

Required Time to Complete - This column describes the maximum time that the operator has to complete the step to ensure the function supported by the step is satisfied. Completion of a step after the time indicated does not necessarily mean unrecoverable conditions would be reached but it would be beyond that which has been analyzed. Further analysis would be needed to determine the impact of not meeting a time limit identified in this document.

Timing Basis - This column describes the basis for the maximum allowed operator response time given in the previous column. The basis is derived from a number of calculations and evaluations as described in the column.

Control Room Fire Impact - This column describes whether a fire in the control room could cause the component to spuriously operate after the Step and any identified pre-requisite Steps are complete. If yes, then further discussion is provided for why it is acceptable.

Prerequisite Steps - This column identifies the Step(s) that are required to be completed prior to completing the Step. Prerequisites are steps that must be completed before the current step to prevent potential damage to equipment or prevent spurious operation of the equipment after the step is completed and the Operator moves on. A step that restores power to a component is not considered a prerequisite. These pre-requisites are listed to provide reasonable assurance that future procedure chan ges will not improperly re-order the steps. 4.0 References 4.1 Wolf Creek Documents 4.1.1 Procedure OFN RP-017, Control Room Evacuation 4.1.2 Wolf Creek Operating License NPF-42 4.1.3 Wolf Creek Safety Evaluation Report including Supplements 1 through 5 4.1.4 Wolf Creek Technical Requirements Manual (TRM), Revision 55 4.1.5 SNUPPS Letter SLNRC 84-0109 - Fire Protection Review Design Basis Document for Procedure OFN RP-017 Page 5 of 102 E-1F9915, Rev. 9 4.1.6 Memo from NRC to KG&E dated August 31, 1984 - Minutes of August 22, 1984 Meeting with Kansas Gas and Electric and Union Electric Company 4.1.7 Calculation XX-E-013, Rev. 4 - Post-Fire Safe Shutdown Analysis 4.1.8 Safety Analysis Evaluation SA-08-006, Rev. 3 - Retran-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire 4.1.9 Calculation Change Notice AN-02-10-000 EDG Room Temperature at Various Outside Air Temperatures for the NRC Triennial Fire Protection Inspection 4.1.10 Calculation EF-10, Rev. 2 - ESW System Flow Requirements 4.1.11 Drawing M-018-00155, Rev. 2 - Operation of Diesel Engine without Cooling Water 4.1.12 Drawing J-14001, Rev. 10 - Control Room Equipment Arrangement 4.1.13 Drawing E-13EF06A, Rev. 5 - Schematic Diagram ESW to Ultimate Heat Sink Isolation Valves 4.1.14 Drawing E-025-00007, Sheet 185, Rev. W15 - EFHV0038 Design Configuration Document 4.1.15 Document E-10NK, Rev. 6 - Class 1E 125 VDC System Description 4.1.16 Specification M-018, Rev. 14 - Standby Diesel Generator 4.1.17 PIR 2005-3314/CR2007-003037 - Issues involving NRC Information Notice 92-18 4.1.18 CR 00012368 - Timing Basis for Re-Establishing Room Cooling 4.1.19 CR 00016481 - Guidance for Control Room Re-Entry After Fire 4.1.20 CR 00019239 - Time to Close Valve BNHV8812A 4.1.21 CR 00019242 - Train B Emergency Diesel Generator Potential Failure to Start Design Basis Document for Procedure OFN RP-017 Page 6 of 102 E-1F9915, Rev. 9 4.1.22 CR 00020612 - Amphenol Connectors for MSIVs cannot be Removed by Hand 4.1.23 CR 00023410 - Issues with the Train B Emergency Diesel Generator Voltage Regulator 4.1.24 CR 00030350 - Post-Fire Safe Shutdown Concern with Train B Diesel Generator Field Flashing 4.1.25 CR 00030376 - Revise E-1F9915 to Document Time to Establish Diesel Engine Cooling 4.1.26 CR 2008-004708 - Determine Time to Establish Diesel Engine Cooling 4.1.27 CR 00041746 - Spurious Operation of Valve EFHV0060 4.1.28 Calculation KJ-M-017, Rev. 1 - Emergency Diesel Standby Generator (KKJ01B) Runtime Without ESW Flow 4.1.29 CR 00041746 - Potential for EFHV0060 to Open Due to Control Room Fire 4.1.30 CR 00044460 - Add OFN RP-017 Component Evaluation to E-1F9915 4.1.31 CR 00046634-02 Add MSO Evaluation to E-1F9915 4.1.32 CR 00046642 - RCP Seal Return Valves 4.1.33 CR 00046702 - Auxiliary Shutdown Panel Controls for B Motor Driven Auxiliary Feedwater Pump 4.1.34 CR 00046707 - Review Reactor Trip Switch Circuits for Alternative Shutdown 4.1.35 CR 00072102 - Operator Time Sensitive Action in OFN RP-017 Not Met 4.2 Nuclear Regulatory Commission Documents 4.2.1 10 CFR 50.48 - Fire Protection 4.2.2 10 CFR 50, Appendix R - Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979 4.2.3 NRC Generic Letter 86 Implementation of Fire Protection Requirements 4.2.4 NRC Information Notice 2005 Fire Protection Findings on Loss of Seal Cooling to Westinghouse Reactor Coolant Pumps 4.2.5 Regulatory Guide 1.189, Rev. 2 - Fire Protection for Nuclear Power Plants 4.3 Other Documents 4.3.1 Westinghouse WCAP-16396-NP, Westinghouse Owners Group Reactor Coolant Pump Seal Performance for Appendix R Assessments. 4.3.2 Westinghouse Technical Bulletin TB-04-22, Rev. 1, Reactor Coolant Pump Seal Performance - Appendix R Compliance and Loss of All Seal Cooling. 4.3.3 NEI 00-01, Rev. 2 - Guidance for Post-Fire Safe Shutdown Circuit Analysis 4.3.4 Westinghouse Letter LTR-RAM-I-10-053 dated October 15, 2010.

Subject:

White Paper Westinghouse Reactor Coolant Pump Seal Behavior For Fire Scenarios, Revision 2. 4.3.5 Westinghouse WCAP-17541-P, Revision 0 - Implementation Guide for the Westinghouse Reactor Coolant Pump SHIELD Passive Thermal Shutdown Seal, dated March 2012. 5.0 Background Design Basis Document for Procedure OFN RP-017 Page 7 of 102 E-1F9915, Rev. 9 The Control Room evacuation and plant shutdown procedure is documented in OFN RP-017 (power operation to hot standby) and OFN RP-017A (hot standby to cold shutdown). The original basis for procedure OFN RP-017 is SLNRC 84-0109, which documents a phased approach to shutting down the plant and maintaining it in a safe hot standby condition if control room evacuation is required following a fire. This phased approach was approved by the NRC in Supplement 5 of the Wolf Creek Safety Evaluation Report.

Although SLNRC 84-0109 formed the original licensing basis for hot shutdown from outside the control room at SNUPPS facilities, its basis is not clearly defined nor understoo

d. Some of t he step sequences and actions are questionable by today's operational and regulatory standards. Over the years, changes have been made to OFN RP-017, which were not in literal compliance with the letter. The changes were subsequently determined to not have an adverse impact on the health and safety of the public. However, because of the confusing nature of the letter, it was decided that a design basis document that clearly describes the basis for OFN RP-017 is needed.

License Amendment 214 approved superseding letter SLNRC 84-0109 with document E-1F9915 as the basis for alternative shutdown in the event of a fire in the control room. Therefore, letter SLNRC 84-0109 is considered historical and is no longer part of the approved fire protection program. 6.0 Summary of Timing Basis This Section includes a summary of the major equipment credited in OFN RP-017 for satisfying each PFSSD function (Reactivity Control, Reactor Coolant Makeup and Inventory Control, Decay Heat Removal, Process Monitoring and Support). In addition, operator response timing, to ensure the function is satisfied prior to reaching unrecoverable conditions, is discussed. 6.1 Reactivity Control Reactivity control is achieved by tripping the reactor prior to leaving the control room. Tripping the reactor is considered to be t = 0 seconds for the OFN RP-017 timeline. (Assumption 2.2.6)

The main steam isolation valves (MSIVs) and steam generator (SG) blowdown valves are isolated to prevent return to criticality due to uncontrolled cooldown. The MSIVs are assumed to remain open until action is taken outside the control room within 3 minutes to close them. Prior to evacuating the control room, operators attempt to close the MSIVs using the all-close hand switches, but this action is assumed to fail. In these cases, the steam dumps are assumed to operate properly to control temperature to 557°F, then the steam dumps are isolated within 7 minutes by de-energizing power to the valves, at which time the ARVs are used for temperature control. All components located downstream of the MSIVs are assumed to be unaffected by the fire.

Plant cooldown is controlled using SGs B and D atmospheric relief valves (ARVs) while SGs A and C ARVs are closed. Based on Calculation SA-08-006, a single SG ARV can remain open for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> with no adverse impact on safe shutdown. Otherwise, all SG ARVs are assumed to function normally at time 0, controlling pressure less than 1184.7 psia. Steam generators B & D ARVs are assumed to close at 7 minutes then control as necessary at 561 degrees F after the operator takes manual control of the B & D ARVs from the auxiliary shutdown panel (ASP). Steam generators A & C AR Vs are assumed to close at 7 minutes, then stay closed a fter the operator at the ASP closes them per procedure.

The MSIVs are assumed to remain open until operator action outside the control room closes them, despite operation of the control room all-close hand switches prior to evacuation. In all scenarios the MSIVs are assumed closed in 3 minutes when power is removed from MSFIS cabinet SA075A in Step C2. The MSIV bypass valves are failed closed by pulling the contro l power fuse block in Step B12. This will fail power to the Train A solenoid valve and fail the bypass valves closed. The bypass lines are 2 inches in diameter. A failed open bypass line is bounded by a single failed open steam generator ARV, which has an 8 inch line on the discharge side of the ARV. Calculation SA-08-006 shows that a single ARV can Design Basis Document for Procedure OFN RP-017 Page 8 of 102 E-1F9915, Rev. 9 remain open for at least 60 minutes with no adverse consequence. Therefore, the time allowed to isolate a failed open MSIV bypass line is 60 minutes. The main turbine trips in response to a reactor trip through an interlock from the reactor trip breakers that is unaffected by a fire in the control room. Therefore, steam loss through the turbine is prevented. The Train B Chemical and Volume Control System (CVCS) is used to provide borated water to the RCS to maintain negative reactivity conditions. This is accomplished using the Train B centrifugal charging pump (CCP) taking suction from the borated refueling water storage tank (RWST) and injecting to the RCS through the boron injection tank (BIT). Calculation SA-08-006 assumes the Train B CVCS is lined up and injecting through the BIT within 28 minutes. 6.2 Reactor Coolant Makeup/Inventory Control Reactor coolant makeup and inventory control is achieved by first isolating all potential RCS leakage and inventory reduction paths including pressurizer power operated relief valves (PORVs), normal letdown, excess letdown, reactor vessel head vents, reactor coolant pump seals, MSIVs, steam generator blowdown, steam generator ARVs, and residual heat removal (RHR) suction from the RCS. Leakage through the RHR system is not credible since the RHR pump suction valves are normally closed and de-energized. The reactor coolant pumps (RCPs) are stopped to prevent loss of inventory through the RCP seals.

Based on Calculation SA-08-006, pressurizer PORVs are assumed isolated within 3 minutes and normal letdown is assumed isolated within 7 minutes. Charging flow to the reactor coolant pump seals is assumed to be isolated within 10 minutes. The reactor coolant pumps are assumed to be stopped within 7 minutes. Steam generator ARVs and MSIVs are isolated as discussed in Section 6.1.

Letdown flow is assumed to be isolated within 7 minutes. In all scenarios where letdown is unaffected, initial flow is 120 gpm until isolated. The 120 gpm flow rate is based on normal letdown of 75 gpm plus an additional 45 gpm that could be flowing for Chemistry concerns (this rarely occurs). In the scenarios where letdown valves fail open, letdown flow goes to 195 gpm for 7 minutes, which is the maximum letdown flow. The automatic letdown isolation signal on low pressurizer water level (17%) is assumed to fail. Pressurizer heater backup group B is cycled to maintain pressurizer pressure within 2000 to 2300 psig. In the loss of off-site power scenarios, Calculation SA-08-006 assumes pressurizer heaters fail to operate at time zero. At 11.5 minutes, back up group B is controlled at the ASP.

In the non loss of off-site power scenarios, all three heater groups operate normally but power to backup group B is lost by procedure within 7 minutes. Power is restored within 11.5 minutes and control on backup group B is available from the ASP. Calculation SA-08-006 assumes the pressurizer and auxiliary pressurizer spray valves operate normally except in those scenarios where the pressurizer spray is assumed to fail. In those scenarios, the pressurizer spray valves are assumed to open at time zero and pressurizer spray stops at 7 minutes when the RCPs are stopped. Auxiliary spray is assumed to operate at time zero and stops in 7 minutes when PK5117 is opened in Step D1. The Train B CVCS is used for makeup and inventory control by taking suction from the RWST and injecting through the BIT. Calculation SA-08-006 assumes the Train B CVCS is lined up and injecting through the boron injection tank (BIT) within 28 minutes. Pressurizer overfill can occur if a spurious Safety Injection Signal (SIS) causes both CCPs to start and inject into the RCS through the BIT flowpath prior to establishing control of the BIT injection valves and normal charging flowpath. Calculation SA-08-006 shows that if one CCP is stopped within 10 minutes following a spurious SIS, pressurizer overfill will not occur. OFN RP-017 stops the Train B CCP within 10 minutes by opening breaker NB00201. The Train A CCP could continue to operate past the 10 minute time, but based on SA-08-006 this will not cause the pressurizer to overfill. At 28 minutes charging flow is controlled by isolating all injection paths and throttling the BIT outlet valve. Therefore, there is reasonable assurance that pressurizer overfill will not occur.

Design Basis Document for Procedure OFN RP-017 Page 9 of 102 E-1F9915, Rev. 9 Valve EGHV0102 is normally closed and controls CCW flow to the RHR heat exchanger. If valve EGHV0102 spuriously opens sufficient flow may not be available to the PFSSD loads (CCP oil cooler and seal water heat exchanger). Per drawings M-11EG01 and M-11EG02 the total CCW flow with valve EGHV0102 open is approximately 14,000 gpm. Each CCW pump is rated at 11,025 gpm at 195 feet of head. Per drawing M-082-029, the discharge head at 14,000 gpm is 155 feet and the required net positive suction head (NPSH) is 31 feet. Minimum available NPSH for normal shutdown occurs at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> per Calculation M-EG-05 and is equal to 37.5 feet. Therefore, with 14,000 gpm flowing, sufficient NPSH is available and there is reasonable assurance that the Train B CCP oil cooler and seal water heat exchanger will receive sufficient flow. However, as a precaution, EGHV0102 is closed in OFN RP-017 to prevent flow diversion during long term hot standby. This action should be completed within 28 minutes and prior to starting the B Train CCP to support CCP functionality.

A potential concern with inventory control is that a control room fire could cause the number 1 seal return valves (BBHV8141A, B, C and D) to close, which could cause excessive RCS leakage. OFN RP-017 isolates RCP seal cooling, contributing to this event. OFN RP-017 also trips the RCPs, which minimizes the impact of this event.

A white paper prepared by Westinghouse and distributed as letter number LTR-RAM-I-10-053 (Reference 4.3.4) summarizes RCP seal behavior for fire scenarios. This white paper is a compilation of several WCAPs and Technical Bulletins on the subject.

Table 1 in the letter is a scenario matrix that identifies the number 1 and number 2 RCP seal behavior and resultant leakage given RCPs running or not running and seal cooling available or not available. For the scenario postulated here (Number 1 seal return line isolated, RCPs not running and no seal cooling), the resultant leakage is 21 gpm per seal or 84 gpm total. This leakage is well within the makeup capability of the charging pump, which has a design flow rate of 150 gpm at 2800 psi and a runout flow of 550 gpm at 606 psi. Therefore, this condition does not pose a concern for PFSSD at Wolf Creek.

Wolf Creek has replaced the number one seal insert with the Westinghouse SHIELD Passive Thermal Shutdown Seal (SDS) on all four reactor coolant pumps (RCPs). The SDS is designed to restrict reactor coolant system (RCS) leakage for plant events that result in a loss of all seal cooling (Reference 4.3.5). No credit is taken in the Wolf Creek post-fire safe shutdown analyses for the reduced leakage rates from the new seal following a loss of all seal cooling. The Wolf Creek analyses use the leakage rates from the previous seal design, which are conservative compared to the new seal design. 6.3 Decay Heat Removal Hot standby decay heat removal is achieved using Train B motor driven auxiliary feedwater pump (MDAFP), taking suction from the condensate storage tank (CST), to supply feedwater to steam generator D and the turbine driven auxiliary feedwater pump (TDAFP), taking suction from the condensate storage tank (CST), to supply feedwater to steam generator B.

Calculation SA-08-006 assumes the Train B MDAFP is lined up and supplying steam generator D within 15 minutes and the TDAFP is lined up and supplying steam generator B within 35 minutes. Steam generators B and D atmospheric relief valves are used to control reactor coolant system (RCS) temperature. When the Train B MDAFP is started in 15 minutes, valve ALV0032 may still be open. Therefore, approximately 250 gpm will flow from the B MDAFP to the A SG due to failed open valve ALHV0007 until valve ALV0032 is manually closed in Step E6 in 35 minutes. Therefore, the B MDAFP could be injecting into the A SG for 20 minutes. SA-08-006, Rev. 3 (Scenario 1A) shows that the A SG reaches 100% WR indication in about 1800 seconds (30 minutes), which occurs prior to closing valve ALV0032. This has no adverse impact since the A SG is not used as a heat sink in OFN RP-017 and steam for the TDAFP turbine is not supplied by the A SG. The MSIVs are closed in 3 minutes, which is prior to the A SG reaching 100% WR, so water will not enter the TDAFP turbine. Steam generators A and C atmospheric relief valves are isolated. See Section 6.1 for discussion about steam generator ARVs.

The reactor is tripped at t = 0s when operators actuate the reactor trip push buttons prior to evacuating the control room. The reactor trip causes a low Tavg signal within 5 seconds and initiates a feedwater Design Basis Document for Procedure OFN RP-017 Page 10 of 102 E-1F9915, Rev. 9 isolation signal, which stops main feedwater flow and prevents steam generator overfill from main feedwater.

To prevent steam generator overf ill in cases where the fire causes a spurious aux iliary feedwater actuation signal (AFAS), the Train A MDAFP is stopped by operator action within 15 minutes. The TDAFP is taken to minimum output within 15 minutes and remains there until valves in the AFW discharge line are closed, which takes 35 minutes. At that point, the TDAFP is started to supply SG B.

Main steam isolation valves are required to be closed for decay heat removal to control cooldown. See Section 6.1 for discussion about MSIVs.

Calculation SA-08-006 assumes the steam generator blowdown valves remain closed in all scenarios. The calculation focused on steam generator overfill as a bounding wo rse-case scenar io because an overfilled steam generator could affect operation of the turbine driven auxiliary feedwater pump, which is required to be functional in the event of a control room fire. Open blowdown valves help the SG overfill cases, which would cause the results to be non-conservative. Therefore, modeling of spurious open SG blowdown was not performed in the current revision of SA-08-006. Failed open blowdown valves are modeled in Calculation WCNOC-CP-002 where it was determined that the blowdown valves can fail open for at least 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (the modeled duration) with no adverse impact on PFSSD. Cold shutdown decay heat removal is not included in OFN RP-017. 6.4 Process Monitoring Process monitoring ensures RCS variables are within specified limits. The ASP contains all the required process monitoring instruments to verify reactivity conditions, pressurizer level, pressurizer pressure, RCS temperature and steam generator level. Source range indicator SENI0061X indicates reactivity level. Pressurizer level is verified using BBLI0460B. Pressurizer pressure is verified using reactor vessel pressure instrument BBPI0406X. RCS temperature is verified using RCS loop 2 cold leg temperature indicator BBTI0423X and loop 4 hot leg temperature indicator BBTI0443A. Steam generator level is verified using steam generators B and D narrow range level indicators AELI0502A and AELI0504A, respectively. These process monitors are unaffected by a fire in the control room.

6.5 Support The post fire safe shutdown support function provides the necessary cooling, ventilation and electrical power required by the reactivity control, reactor makeup, decay heat removal and process monitoring functions. The support function supports all the other post fire safe shutdown functions and includes component cooling water (CCW), essential service water (ESW), room cooling and ventilation, control room isolation and electrical power distribution.

Component cooling water is required for OFN RP-017 to supply cooling to the Train B charging pump oil cooler and the seal water heat exchanger. Both of these components support centrifugal charging pump (CCP) operability. Therefore, CCW is required to be operable prior to the need for charging. Based on Calculation SA-08-006, charging needs to be lined up and injecting within 28 minutes.

Essential service water is required to provide cooling to the CCW heat exchanger, emergency diesel engine coolers and various room coolers. In addition, ESW is a backup source of auxiliary feedwater. One potential concern with ESW is that in extreme cold weather the ESW trash racks and intake screens could freeze, preventing proper flow of ESW to essential equipment. Warming lines have been installed to prevent freezing, and are placed in service during winter lineup per SYS EF-205. Procedure SYS EF-205 requires the warming lines to be placed in service when lake temperature is 40F. OFN RP-017 does not have any actions to operate the warming lines or verify operation of the lines. This is acceptable because the warming line valves are manually operated and are not subject to spurious operation. If the fire occurs in these extreme cold temperatures, winter lineup of the warming lines would have already taken place prior to the fire. Therefore, no operator actions would be required as a part of OFN RP-017 to line up or verify lineup of the warming lines.

Design Basis Document for Procedure OFN RP-017 Page 11 of 102 E-1F9915, Rev. 9 Emergency diesel engine cooling is required to maintain the engine jacket water temperature below the trip setpoint of 195°F. The engine is started in Step C7 when the offsite power feeder breakers are opened, which provides an automatic start signal to the engine. Step C9.d closes the Train B emergency diesel generator (EDG) output breaker and step C10 starts the ESW pump. The combined generator loading of the non-shed loads and the ESW pump is 3,615.9 kW per calculation KJ-M-017, which is 58.3% of the EDG rating of 6,201 kW. Check valve EFV0471 will prevent flow diversion to the service water system, so as soon as the ESW pump is started in Step C10, EDG cooling will be provided.

Table 1 in Calculation KJ-M-017 identifies the allowable time to establish EDG cooling given various values of unloaded times from 1 minute to 5 minutes in 30 second increments. The table shows that, as the time to complete steps C7 through C9.d increases, the time to complete Step C10 decreases. For example, if step C9.d is completed in 2.5 minutes after step C7, operators have 3.49 minutes to complete Step C10 and start the ESW pump. However, if the operator takes 3.5 minutes to complete Step C9.d after Step C7 is completed, then they only have 3.17 minutes to complete Step C10 and start the ESW pump. Table 1 from Calculation KJ-M-017 follows.

Time Unloaded (Minutes) Allowable Time Loaded (Minutes) 1 3.96 1.5 3.80 2 3.65 2.5 3.49 3 3.33 3.5 3.17 4 3.01 4.5 2.85 5 2.69 Room coolers and ventilation fans are used to maintain a suitable environment for the equipment within the room to ensure long term operation of the equipment. Room coolers credited in the event of a control room fire are as follows:

1. Train B Class 1E Electrical Equipment Room A/C Unit (SGK05B) 2. Train B Electrical Penetration Room Cooler (SGL15B) 3. Train B Component Cooling Water Pump Room Cooler (SGL11B)

4. Train B Auxiliary Feedwate r Pump Room Cooler (SGF02B) 5. Train B Centrifugal Charging Pump Room Cooler (SGL12B) 6. Train B Containment Coolers (SGN01B and SGN01D)

7. Train B ESW Pump Room Supply Fan (CGD01B) and Dampers (GDTZ11A and GDTZ11C)

Procedure SYS GK-200 provides instructions to compensate for loss of a Class 1E Electrical Equipment A/C Unit (SGK05A or SGK05B) and temporarily maintain the operability of equipment in the Class 1E Electrical Component Rooms on the 2000' and 2016' elevations of the Control Building. The procedure requires that within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> several doors on the 2000 and 2016 elevation of the Control Building are open and fans are placed in service on the 2000 elevation. Fans on the 2016 elevation must be put in service within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. These times are based on Calculation GK-06-W in order to maintain both trains functional. OFN RP-017 does not attempt to maintain Train A functional. The doors between rooms will be maintained closed to provide maximum cooling to the Train B equipment. Since Calculation GK-06-W shows 60 minutes is acceptable to initiate compensatory measures for loss of one train of Class 1E electrical equipment room cooling, there is reasonable assurance that restoration of SGK05B in 60 minutes in the event of a control room fire will maintain the Train B electrical equipment functional.

The timing basis for establishing electrical penetration room cooling is documented in CR 012638. Based on the evaluation in this CR, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is reasonable for the maximum time to restore cooling to the electrical penetration rooms. This time is based on the Wolf Creek Technical Requirements Manual (TRM), TR Design Basis Document for Procedure OFN RP-017 Page 12 of 102 E-1F9915, Rev. 9 3.7.22-1 which states that operators have 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to restore room temperatures to within allowable limits given in Table TR 3.7.22-1. (Note that the TRM revision in effect when the CR was evaluated (Revision 35) required equipment to be declared inoperable if temperatures were not restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The current revision of the TRM (55) does not require equipment to be declared inoperable). For conservatism, 1-hour is used as the timing basis in E-1F9915. The allowable temperature limit for the electrical penetration rooms is 101 degrees F per Table TR 3.7.22-1. Based on operator timing, the electrical penetration room cooler is started within 13 minutes. Therefore, the time to restore electrical penetration room cooling is well within the 1-hour limit established in E-1F9915.

The pump room coolers (SGL11B, SGF02B and SGL12B) automatically start when the pump starts. Procedure OFN RP-017 lines up power and ESW flow to the pump room coolers prior to starting the pumps. Therefore, pump room cooling will be provided as soon as each pump starts.

The containment coolers maintain containment temperature within acceptable limits but are not directly required for safe shutdown after a fire in the control room. There are no post-fire safe shutdown components in containment t hat will adversely impact the ability to achieve safe shutdown if the coolers are not started. Therefore, the timing for this step is not critical and, therefore, no time limit has been established.

The timing basis for establishing ESW pump room ventilation is documented in CR 012638. Based on the evaluation in CR 012638, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> should be used as the maximum time to restore cooling to the ESW pump room. This time is based on the Wolf Creek Technical Requirements Manual (TRM), TR 3.7.22-1 which states that operators have 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to restore room temperatures to within allowable limits given in Table TR 3.7.22-1. (Note that the TRM revision in effect when the CR was evaluated (Revision 35) required equipment to be declared inoperable if temperatures were not restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The current revision of the TRM (55) does not require equipment to be declared inoperable). For conservatism, 1-hour is used as the timing basis in E-1F9915. The allowable temperature limit for the ESW pump rooms is 119 degrees F per Table TR 3.7.22-1. Based on operator timing, the ESW pump room supply fan is started approximately 12 to 15 minutes after the ESW pump is started. DCP 13800 moved the Train B ESW pump room temperature controls from the control room (RP053B) to the Train B ESF switchgear room (RP147B). This ensures proper temperature control within the room by allowing the supply and recirculation dampers to modulate based on room temperature. A control room fire will not affect the operation of these dampers. 7.0 Section-by-Section Review 7.1 OFN RP-017, Section 1.0 - Purpose 7.1.1 OFN RP-017, Section 1.1 1.1 To provide operator actions for evacuating the Control Room due to fire, establishing plant control from the Auxiliary S hutdown Panel (ASP), and reac tor shutdown to Hot Standby conditions.

Basis - 10 CFR 50, Appendix R, Section III.L.3 requires procedures to be in effect to implement the alternative and dedicated shutdown capability for any fire area utilizing the provisions in Appendix R,Section III.G.3. Wolf Creek took no exception to this requirement in the Appendix R comparison documented in the USAR, Table 9.5E. Letter SLNRC 84-0109 (August 23, 1984), Section 2.0 Response Plan Summary states, in part, "Procedures will be developed to implement this plan at Callaway and Wolf Creek." The Wolf Creek SER, Supplement 5, Page 9-12 states, in part, "(1) The applicant will revise the procedures for a fire in the control room in accordance with the SNUPPS letter of August 23, 1984 -". Subsequently, License Amendment 214 approved superseding letter SLNRC 84-0109 with document E-1F9915 as the basis for alternative shutdown in the event of a fire in the control room. Therefore, Wolf Creek is committed to maintain in effect procedure OFN RP-017 to achieve hot standby conditions. Cold shutdown is achieved from outside the control room using OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Page 13 of 102 E-1F9915, Rev. 9 7.1.2 OFN RP-017, Section 1.2 1.2 This procedure should only be used when the Control Room is uninhabitable and damage to controls or Control Room equipment has occurred or is imminent.

Basis - This statement emphasizes that control room evacuation should only take place when control from the control room is lost or will be lost. Shutting down from outside the control room is not desired and evacuation should only be done when the plant cannot be controlled from inside the control room. 7.1.3 OFN RP-017, Section 1.3 1.3 Since the Control Room is uninhabitable, this procedure includes actions to:

Prevent subsequent fire/physical damage to Control Room circuits from adversely affecting systems needed to maintain Hot Standby

Transfer critical Train B controls to the ASP Maintain the plant in Hot Standby from the ASP Basis - This step identifies the objectives for OFN RP-017. It clearly states that the procedure is only intended to maintain hot standby from outside the control room using Train B components. Cold shutdown is achieved using procedure OFN RP-017A. 7.2 OFN RP-017, Section 2.0 - Symptoms or Entry Conditions Section 2.0 provides conditions in which operators may deem entering OFN RP-017 to be necessary. These entry conditions are not licensing commitments but rather guidance for operators to use when determining the need to enter OFN RP-017. The decision is a judgment call made by operating staff with the final decision made by the Shift Manager. Step 1 in the procedure provides additional conditions to be considered prior to evacuating the control room. There are no NRC criteria for establishing the point at which operators evacuate the control room. Therefore, there is no licensing basis for when control room evacuation takes place. 7.3 OFN RP-017, Section 3.0 - References and Commitments 7.3.1 OFN RP-017, Section 3.1 - References a. Nuclear Safety Engineering Surveillance Report No. 1991-005 Basis - This surveillance report, designated SSR 91-005, was performed by Wolf Creek Nuclear Safety department and was issued on 4/26/1991. The purpose of the surveillance was to determine the adequacy of 10CFR50.59 screenings on Operations procedures. OFN 00-017, Control Room Evacuation, Revision 13 was chosen for review. The review concluded that the 50.59 screenings were appropriate but made 12 recommendations for improvement of the procedure. Most of the recommendations were incorporated into revision 14 of OFN 00-017 and some were not with justification. The changes made to OFN 00-017 as a result of this surveillance that are still in effect today in OFN RP-017 are listed below:

1. NK4101 is no longer opened to remove control power from Train A bus NB01 breakers. The observer stated that by opening the switch, the Train A AFW pump would not be able to be controlled from the ASP. Operations removed the step due to there being no requirement to open the switch. Train A equipment is not required for OFN RP-017.

However, it may be practical to open NK4101 to support Step C16 (Stopping the Train A Containment Spray Pump).

Design Basis Document for Procedure OFN RP-017 Page 14 of 102 E-1F9915, Rev. 9 2. Fuse #46 in panel RP209 is pulled to fail close the MSIV bypass valves. The observer noted that opening the breaker would remove power from other equipment and felt that this is not a good idea. He also noted that Callaway pulls fuses to close the MSIV bypass valves. Step B12 pulls fuse #46 in RP209. 3. NK4411 is used to isolate steam generator blowdown. This differs from SLNRC 84-0109, which says to use the switches in the Radwaste Control Room. Use of NK4411 will achieve the desired result faster than sending an operator to the Radwaste Control Room. See Step C28. 4. As a result of recommendation 12, an attachment was added to give operators instruction to protect Train A equipment after all other critical steps are completed. Attachment F provides guidance based on this recommendation.

b. USAR 7.4.6, Safe Shutdown From Outside The Control Room Basis - USAR Section 7.4.6 describes the capability of Wolf Creek to shutdown from outside the control room using the Auxiliary Shutdown Panel (ASP), switchgear and motor control centers. The mitigating actions for a fire in the control room use Train B ASP and equipment. Train B was selected because instrumentation and controls for the turbine driven auxiliary feedwater pump are located on the Train B ASP.

c. USAR Appendix 9.5B, Fire Hazards Analyses Basis - The Fire Hazards Analysis is now located in document E-1F9905, which is incorporated into the USAR, Appendix 9.5B by reference.

d. PIR 1997-2819, EDG Master Transfer Switch In Auto With Fire In The Control Room Basis - PIR 1997-2819 identified a concern where OFN RP-017 did not previously require placing master transfer Switch KJHS0109 in Local/Manual position. The initiator stated that if the switch were left in Auto position, a control room fire could affect the circuits and shut down the diesel generator. After review of the circuits, OFN RP-017 was revised to require operators to place KJHS0109 in Local/Manual. Step C.8.a proceduralizes this action. Also see PIR 2006-000860 discussion below.

e. PIR 1997-2453, Enter OFN RP-013 At 2 mR/hr Submersion Dose Rate Basis - PIR 1997-2453 identified a concern where OFN RP-017 previously required evacuation of the control room if radiation reached certain levels. As a result, OFN RP-017 was revised to allow Health Physics and Shift Supervisor discretion on whether to evacuate. PIR 1997-3376 was also written to evaluate the need to evacuate the control room at all for radiation levels. OFN RP-017 was revised to remove the specific radiation levels and allow the Shift Supervisor to enter OFN RP-013 at his discretion.

f. OP 1988-0190, Replacing BG HV-8105 with local valves within the NCP room Basis - This is an inter-office correspondence that requested a procedure change to OFN 00-017 (now OFN RP-017) to reduce the time to complete certain actions. The procedure required an operator to first open BGFCV0121 locally in the positive displacement pump (PDP) room (now the normal charging pump (NCP) room) on the 1974 elevation then the same operator had to ascend to the north pipe penetration room on the 2000 elevation to locally close BGHV8105. The memo requested that instead of closing BGHV8105, valves BG8402B and BGV0017 be manually closed or verified closed. These valves are located in the NCP room along with BGFCV0121. The change was made as requested and OFN RP-017 uses BG8402B and BGV0017.

Design Basis Document for Procedure OFN RP-017 Page 15 of 102 E-1F9915, Rev. 9 g. PIR 1999-109, Removing control power prior to rotating ESF bus #2 isolate switch Basis - This PIR identified 3 issues where OFN RP-017, Revision 11 was not consistent with the original response strategy for control room fires documented in SLNRC 84-0109 (Superseded by E-1F9915). These issues are discussed below:

Issue 1 - Note 10 in SLNRC 84-0109 states that FCHV0312 and ABHV0005 will not be opened until it is verified that ALHV0036 is open. There are two loop steam supply valves to the turbine driven auxiliary feedwater pump (TDAFP) (ABHV0005 (loop 2) and ABHV0006 (loop 3)). SLNRC 84-0109 only credited ABHV0005 to provide a steam supply to the TDAFP. OFN RP-017, Rev. 11 Step A9 required the operator at the ASP to open steam supply valve ABHV0006 using ABHIS0006B prior to verifying that suction valve ALHV0036 is open. However, OFN RP-017, Rev. 11 Steps A6 and A8 had the same operator at the ASP close the turbine tr ip and throttle valve (FCHV0312) using FCHIS0312B and the turbine governor valve (FCHV0313) using FCHS0313 and FCHIK0313. Step A7 requir ed the operator at the ASP to isolate ABHV0005 using ABHIS0005B. The requirement in SLNRC 84-0109 has been met in that FCHV0312 and ABHV0005 are maintained closed until ALHV0036 is opened. However, ABHV0006 was added to the procedure at some later time. Since FCHV0312 is maintained closed, the TDAFP will not operate even with ABHV0006 open.

Issue 2 - This issue involves performing steps in the procedure in a different sequence than what was approved in SLNRC 84-0109. Note 2 in SLNRC 84-0109 states that DC power should be tripped after Action 9 [assure MCC and load center breakers are closed] in room 3302 so that breakers can be electrically tripped by hand to the desired position. OFN RP-017, Rev 11 had operators' open the control power breakers to the NB02 bus and then rotate switch NBHS0014 to the isolate position. By opening the control power breaker before rotating NBHS0014, relay 195 will not energize and the control room will not be isolated.

Revision 18 of OFN RP-017 deleted NBHS0014 from the procedure. The hand switch would not have completely isolated the control room from the control circuit on the affected components. Also, a control room fire could have opened the control power fuse due to a hot short, thereby isolating control power prior to operation of the hand switch.

The current revision of OFN RP-017 requires operators to remove control power from the NB02 bus and not use NBHS0014. Isolating control power will prevent spurious operation of any of the breakers associated with NB02. The possibility still exists for the NB02 breakers to close prior to isolating control power. Therefore, to ensure the NB02 bus loads are shed, each pump breaker, except for the ESW pump, is verified open prior to opening the NB02 feeder breakers to simulate a LOSP and start EDG-B. Verifying each of these breakers is open also ensures the diesel will not fail to start due to overload.

On the basis of the above discussion, the concern raised in Issue 2 of this PIR is no longer valid. The use of NBHS0014 would never have fully isolated the control room and, therefore, its use was never required. Isolation of control power to NB02 ensures spurious operation of the breakers will not occur. All revisions of OFN RP-017 (OFN 00-017) required isolation of control power to NB02 in Phase A. The intent of SLNRC 84-0109 is met since isolation of control power effectively prevents spurious operation due to cable failures in the control room.

Issue 3 - The third issue involves the clos ure of the MSIVs using a portable air supply versus an electrical source, as delineated in SLNRC 84-0109. The MSIVs are closed prior to leaving the control room using ABHS0079 or ABHS0080. However, their closure cannot Design Basis Document for Procedure OFN RP-017 Page 16 of 102 E-1F9915, Rev. 9 be guaranteed due to possible fire damage. Therefore, OFN RP-017 has steps to close the valves if they failed to close in response to the fast close signal.

SLNRC 84-0109, Note 6 states that the MSIVs will be closed with a portable 125 VDC source. Wires to the valves will then be cut to leave the valves in the closed position. Prior to revision 27, OFN RP-017 used a portable air source to close the MSIVs. This change was made in MA 93-0181 with insufficient documentation for the change. The PIR evaluation provides adequate justification for the change and RCMS 1985-118 documents the change in commitment. Since the use of air versus power to close the MSIVs is a more reliable and safe method, it met the intent of SLNRC 84-0109 and was therefore acceptable.

The MSIVs were replaced in refuel outage 16 (DCPs 09952 and 11608) with solenoid actuated system medium operated valves. These valves do not require an accumulator or external air supply so the portable air source and associated air hoses and fittings are not required. The new MSIVs are held open by six normally energized solenoid valves, three associated with Train A and three associated with Train B. Either train of solenoid valves can operate the associated valve, independent of the opposite train solenoids which provides for diversity and electrical independence. De-energizing either train of solenoids will cause the MSIVs to close. Step C2 has an operator open switch NK5119 to de-energize SA075A and fail the MSIVs closed. Furthermore, Amphenol connectors, 3 per MSIV per train, have been provided near each MSIV to provide a way for operators to disconnect power to the solenoids and close the MSIVs. These methods for closing the MSIVs are utilized in the current version of OFN RP-017.

h. PIR 1999-107, Concerns with meeting required time frame Basis - This PIR was written to document whether changes made in revision 12 of OFN RP-017 meet the commitments made in SLNRC 84-0109. The PIR concluded that commitments were met and no changes were required.

i. PIR 1999-3648 Procedure not matching plant labels Basis - This PIR addressed labeling inconsistencies between OFN RP-017 and the plant labels. The procedure was revised to match plant labeling.

j. PIR 2002-1956, Failure to properly track and implement actions specified within Regulatory Correspondence SLNRC 84-0109 as referenced in USAR Appendix 9.5B.

Basis - This PIR identifies concerns with OFN RP-017, Rev. 16 not meeting commitments in SLNRC 84-0109. The evaluation shows a step-by-step comparison of OFN RP-017, Rev. 16 with SLNRC 84-0109 and provides justification for any deviations. The PIR evaluation found that the deviations would not have prevented the safe shutdown of the plant. The deviations were historical with no documented evaluation in some cases. In many cases, the deviations were a result of alternative methods to produce the desired result. The alternative methods were determined to be faster and/or safer than that specified by SLNRC 84-0109. Note that the contents of USAR Appendix 9.5B are now contained in E-1F9905.

k. PIR 2003-3479, Revisions to procedures need fire protection review Basis - This PIR identified problems associated with emergency lighting for equipment required to implement OFN RP-017. Changes have been made to the procedure over the years with no consideration given to emergency lighting requirements. As components were added or deleted from the procedure, consideration was not always given to emergency lighting requirements. As a result of the PIR, a number of emergency lighting Design Basis Document for Procedure OFN RP-017 Page 17 of 102 E-1F9915, Rev. 9 changes were made to ensure each OFN RP-017 action has sufficient lighting in accordance with Wolf Creek commitments.

l. Westinghouse Tech Bulletin TB-04-22, Reactor Coolant Pump Seal Performance - App R Compliance and Loss of All Seal Cooling and WCAP 10541, Reactor Coolant Pump Seal Performance Following A Loss of All AC Power, NRC IN 2005-14, FP Findings on Loss of Seal Cooling to Westinghouse RCPs.

Basis - These documents describe industry positions on reactor coolant pump seal cooling. Because of the uncertainty of where the NRC may go in the future with RCP seal cooling issues, Wolf Creek decided to deviate from SLNRC 84-0109 and not restore seal cooling in response to a control room fire. Rather, Wolf Creek will use a natural circulation cooldown and provide RCS makeup and boration through the Boron Injection Tank (BIT) flow path, rather than the seal injection flow path. Revision 22 of OFN RP-017 made this change. The use of natural circulation to cooldown will not adversely impact the ability to achieve and maintain safe shutdown.

m/n. PIR 2005-3314 (later converted to PIR 2007-003037 in PILOT), Failure to Address NRC Information Notice 92-18.

Basis - This PIR was written to address URI 2005008-06, which was given to Wolf Creek during the Fall, 2005, NRC Triennial Fire Protection Inspection. Wolf Creek has responded to this issue by modifying the control circuit on 36 motor operated valves so a hot short from a fire in the control room will not bypas s the valve protective features and prevent operation of the valve.

NRC IN 92-18 identified a concern where a control room fire could cause the spurious operation of motor operated valves due to hot shorts that bypass the valve protective features. The hot short, if sustained, could cause valve damage in a manner that prevents the valve from being manually operated to its desired position. Therefore, the ability to achieve safe shutdown after a control room fire could be compromised.

Wolf Creek initially responded to the IN by crediting the modifications that were done prior to startup in which the NRC required the installation of a number of isolation switches. However, these modifications did not address the concerns raised in IN 92-18. In April 1999 the NRC conducted an inspection at Callaway and questioned their response to IN 92-18, which was the same response given by Wolf Creek. As a result, Wolf Creek initiated PIR 1999-1245 to take another look at the issue. The PIR was closed in March 2001 with no actions taken due to the ongoing industry discussions with the NRC on the issue of hot shorts, as well as a moratorium placed on circuit inspections by the NRC. The PIR closure statement said that a new PIR will be generated when the industry initiative to address the issue is completed.

The NEI and EPRI conducted testing in 2001 to gain a better understanding of the issue of hot shorts causing spurious actuations. The testing found that under certain fire conditions, spurious actuations could occur due to hot shorts. In January 2005 the NRC resumed inspections of fire-induced safe shutdown circuits. However, the IN 92-18 issue remained unresolved at Wolf Creek and, until PIR 2005-3314 was written, a new PIR was not written as stated in PIR 1999-1245.

o. PIR 2007-003003, Potential Loss of Field Flashing on Train B Emergency Diesel Generator Basis - This PIR (originally PIR 2005-3333) was written to identify a condition where field flashing could be lost on the Train B EDG due to a fire in the control room. Since Train B is the protected train in the event of a control room fire, this could have an adverse impact on the ability to achieve safe shutdown. Change Package 12097 was prepared and Design Basis Document for Procedure OFN RP-017 Page 18 of 102 E-1F9915, Rev. 9 implemented to modify the control circuit and add control room isolation switch (KJHS0110) and redundant fuses on the circuit to ensure the availability of field flashing.

p. PIR 2006-000860, Potential Loss of Train B Emergency Diesel Generator during Control Room Fire Basis - This PIR was written after it was discovered that a control room fire could cause a hot short in the EDG shutdown circuit that could stop the EDG during the event. Since Train B is the protected train in the event of a control room fire, this could have an adverse impact on the ability to achieve safe shutdown.

The control room portion of the circuit was only partially isolated by hand switch KJHS0109, which left it vulnerable to a control room fire. Change Package 12097 was prepared and implemented to modify the circuit to provide full isolation from the control room.

q. PIR 1998-3012, VCT Outlet Valve Did Not Have Redundant Control Power Fusing. LER 98-004-00, Verifying BG LCV 112C Closed

Basis - This PIR identifies a concern where OFN RP-017 directed operators to close BGLCV0112C using local hand switch BGHS0112C. However, because the control power circuitry does not contain redundant fusing, control power could be lost, resulting in failure of the valve to close.

Prior to revision 27, OFN RP-017 had operators try the hand switch then open the breaker once sufficient time has passed for the valve to close. Another operator then followed up and verified the valve was closed and manually closed it if it was not closed.

DCP 12131 was implemented to add a redundant fuse to the circuit so that operation of BGHS0112C will close the valve. Therefore, the actions to open the breaker and manually close the valve have been removed from OFN RP-017.

r. E-1F9915, Design Basis Document for OFN RP-017, Control Room Evacuation

This document describes the basis for OFN RP-017.

s. Engineering Disposition, PFSSD Issue With Voltage Regulator (CR 00023410)

Basis - This CR identifies a concern where a fire in the control room could have affected the Train B EDG voltage regulator and could have energized the unit parallel relay, placing the EDG in droop mode of operation. The control circuitry was found to not have sufficient isolation capability to ensure the Train B EDG will be available in the event of a control room fire. A temporary modification (TMO 10-004-NE) was implemented and OFN RP-017 was revised to address the issue. The temporary modification was changed to a permanent modification in DCP 13095.

The modification installed jumper in panel NE0106 to bypass the control room circuitry for the null meter and the Auto/Manual voltage regulator selector switch. This ensures a control room fire will not damage the voltage regulator.

The procedure change added Step C8 to remove the break glass cover from the emergency start pushbutton (KJ HS-101D) to energize the ESA and ESB relays to de-energize the UPR relay. This action will also energize relay 90 VEP which disables the control room auto/manual raise/lower voltage control switches and ensures a control room fire will not cause a hot short that sends a raise or lower signal to the voltage regulator.

t. Calculation SA-08-006, Rev. 3, Retran 3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire.

Design Basis Document for Procedure OFN RP-017 Page 19 of 102 E-1F9915, Rev. 9 Basis - This calculation demonstrates the thermal-hydraulic performance of the plant during a postulated control room fire that causes spurious operation of equipment. The results of the calculation are used to determine the maximum allowed time to mitigate a spurious operation. These times are utilized throughout Table 7.1.

u. DCP 13898, EFHV060 Isolation Switch

Basis -This DCP modified the control circuit for valve EFHV0060 to address NRC Information Notice 92-18 and add an ISO/CLOSE switch to provide operators the ability to close the valve and prevent flow imbalance in the Train B ESW system.

v. DCP 13513, EDG Train B Field Flashing Issue

Basis -This DCP added several redundant fuses and isolation switch contacts in the Train B EDG control circuit to ensure operation of the EDG following a control room fire. The DCP also modified the NB0211 control circuit to ensure a fire in the control room will not spuriously close the output breaker out of synch or when the EDG is not operating.

w. DCP 13800, Train B EDG and ESW Ventilation Issues due to Fire in the Control Room

Basis -This DCP modified the control circuit for the Train B EDG and Train B ESW ventilation controls to ensure proper operation of these systems following a control room fire. 7.3.2 OFN RP-017, Section 3.2 - Commitments a. Letter SLNRC 84-0109 superseded by E-1F9915 as the licensing basis document for OFN RP-017 , Fire Protection Review RCMS #1985-118 [Entire Procedure]

Basis - SLNRC 84-0109 provides the original licensing basis for response to a control room fire and shutdown from outside the control room. The letter assigned 6 phases to the time critical actions within the letter. Procedure OFN RP-017 no longer uses phases. The timing is now based on thermal hydraulic calculations, which provide more realistic time response criteria to the potential spurious operations that could occur in the event of a fire in the control room. Therefore, all mention of phases has been removed from the procedure. The new timing requirements are described in Table 7.1.

License Amendment 214 approved E-1F9915 as licensing basis document for alternative shutdown following a control room fire in lieu of letter SLNRC 84-0109.

b. SLNRC 84-0109 change to commitment RCMS #1988-201 Basis - See 3.1.f above.

c. PIR 2005-3209, and LER 2005-006, Unanalyzed Condition Related To Loss Of RCP Seal Cooling During A Postulated Appendix R Fire Event. (Removes steps from procedure for RCP seal restoration)

Basis - An Apparent Violation (AV) issued by the NRC during the 2005 Triennial Fire Protection Inspection identified a concern where Revision 21 of OFN RP-017 may not have been able to restore seal cooling prior to seal damage occurring. The current procedure does not restore seal cooling in response to a control room fire. Rather, the RCPs are stopped, the seal injection flow path is isolated, RCP thermal barrier is isolated from the CCW system, RCS makeup and boration is accomplished through the BIT flow path and Design Basis Document for Procedure OFN RP-017 Page 20 of 102 E-1F9915, Rev. 9 natural circulation cooldown is used. The thermal hydraulic calculations show that stable hot standby conditions are achieved using OFN RP-017. 7.4 Step-by-Step Review Table 7.1 provides a detailed evaluation for each Step in OFN RP-017 per the Methodology in Section 3.0.

Design Basis Document for Procedure OFN RP-017 Page 21 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps NOTE The fire brigade is dedicated to fighting

the control room fire.

They are not

responsible for

performing any of the

operator actions

described in this procedure.

N/A Wolf Creek USAR, Appendix 9.5E, Response to Section III.L states, in part: "...Adequate Operations shift staffing is provided to achieve and maintain post-fire safe shutdown..." 10CFR50, Appendix R, Section III.L.4 states, in part, "...The number of operating shift personnel, exclusive of fire brigade members, required to operate such equipment and systems shall be on site at all times. The Wolf Creek Technical Requirements Manual (TRM), TR 5.2.1.b states in part: "A site Fire Brigade of at least 5 members shall be onsite at all times ...

The Fire Brigade shall not include the Shift Manager (SM), and the two other members of the minimum shift

crew necessary for safe shutdown of the Unit and any personnel required for other essential function during

an emergency." Note that four operators, besides the SM, are required to complete OFN RP-017. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 22 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 1 Check Control Room Evacuation Due To Fire

- REQUIRED

• Annunciators and status panels - NOT

READABLE FROM "AT THE CONTROLS"

• Spurious equipment actuations -

OBSERVED

• Loss of Control Room controls -

IMMINENT N/A The decision to evacuate is made by the Shift Manager based on environmental conditions and/or the ability to control the plant from the control room (CR). There is no regulatory basis for when the CR should be evacuated. The Wolf Creek SER, Supplement 5, page 9-10 states in part: "The new procedures assume that evacuation of the control room takes place when the fire starts..."

It is not realistic to assume the control room operators will evacuate as soon as a fire starts. Only the control room staff can make the decision to evacuate based on conditions. Therefore, OFN RP-017 provides guidelines that the Shift Manager can use for deciding

when to evacuate. N/A N/A N/A N/A 2 Trip The Reactor SB HS-1 SB HS-42 R Generic letter 86-10, response to question 3.8.4 states, in part: "...Note that the only manual action in the control room prior to evacuation usually given credit for is the reactor trip. For any additional control

room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such actions would have to be provided..." In a memo from the NRC to KG&E dated August 31, 1984, which documents the minutes of an August 22, 1984 meeting with KG&E and UEC, the NRC provided clarifications of staff positions discussed during the meeting. One of those positions is as follows:

Credit can be taken only for a manual scram before leaving the control room.

0 The reactor is assumed tripped at

t=0. No N/A Design Basis Document for Procedure OFN RP-017 Page 23 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps Based on this staff position, the NRC acknowledged that the reactor will trip when the switches are depressed prior to evacuating the control room.

Hand switches SB HS-1 and SB HS-42 are located on separate panels. SB HS-1 is located on RL003 while

SB HS-42 is located on RL006. There is a 2 foot air gap between the panels as well as metal outer covers that will restrict the spread of fire between panels.

Automatic smoke detection is present in each panel, which will provide early warning of a fire. In addition, the control room is constantly attended. A fire in one panel is unlikely to spread to the other due to the physical separation present. Drawing E-13SB12A shows a schematic diagram of the reactor trip switch wiring. Each switch has two

normally open contacts per train. Two out of four contact closures on one out of two trains actuates the reactor trip function at panel SB102A or SB102B, located outside the control room. Two contacts on each switch are on separation group 1 and two contacts are on separation group 4. Physical

separation between each group is maintained in accordance with IEEE 384 to ensure a fire that affects

one group will not affect the other. The positioning of the reactor trip switches on separate panels and the arrangement of the switch

contacts and wiring provides reasonable assurance that one of the switches will successfully trip the reactor.

Design Basis Document for Procedure OFN RP-017 Page 24 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 3 Close MSIVs AB HS-79 AND AB HS-80 R, M, D Generic letter 86-10, response to question 3.8.4 states, in part: "...Note that the only manual action in the control room prior to evacuation usually given credit for is the reactor trip. For any additional control

room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such actions would have to be provided. Additionally, assurance would have to be provided that such actions could not be negated by subsequent spurious actuation signals resulting from the postulated fire."

Hand switches AB HS-79 and AB HS-80 are located on RL006, which also has one of the two reactor trip hand switches (SB HS-42). Therefore, due to the close proximity between the reactor trip hand switch and the MSIV close hand switches, it is reasonable to conclude that actuating both hand switches is possible

prior to exiting the control room. Credit is not given for actual MSIV closure since spurious actuation could occur as a result of the control room fire. Step C2 provides instructions to close them if not already closed by opening switch

NK5119, which fails the MSIVs closed.

N/A SA-08-006 does not credit closure of the MSIVs in this step.

See Section 6.1 for discussion on the

timing basis for MSIV closure.

Yes. The MSIVs could spuriously

open or remain open after

the switches have been

actuated.

See Step C2. N/A 4 Shift Manager proceed to ASP and direct

personnel.

N/A The Shift Manager (SM) proceeds directly to the ASP to direct performance of OFN RP-017. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 25 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 4.a Announce the evacuation of the Control Room due to

fire and entry into OFN

RP-017 using Plant

Gaitronics handset N/A The Gaitronics system is the preferred method to announce the fire and call out the fire brigade. The Gaitronics control panel is located in the back panel

area of the control room on the far South wall, remote from the main control room area. A fire in the main control room area, in the absence of a loss of offsite power, will not affect the ability of the Gaitronics system to announce the fire and call out the fire brigade due to the physical separation of the control panel (QF076) and power cables. However, a loss of offsite power to NG01, NG02, PG19 and PG20 will prevent operation of the system. Therefore, an RNO is provided to ensure timely callout of the fire brigade and notification of control room evacuation. N/A N/A N/A N/A 4.a RNO IF Gaitronics is not working, THEN perform the following:

1) Announce Evacuation using the public address system. 2) IF announcement cannot be made, THEN

dispatch runners to notify OFN RP-017

personnel.

N/A This RNO provides instructions to ensure all available means are used to call out the fire brigade and

commence OFN RP-017 actions if the Gaitronics system is unavailable. N/A N/A N/A N/A 4.b Repeat announcement. N/A The Operator repeats the announcement to ensure it is heard. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 26 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 4.c Check Fire Brigade - CALLED OUT N/A The Operator ensures the fire brigade has been called out successfully and, if not, performs the RNO actions. N/A N/A N/A N/A 4.c RNO Perform the following:

1) Make the following announcement using the Public Address System "Fire Fire Fire.

Fire in Control

Room. Fire

Brigade members

assemble at

turnout lockers"

2) Repeat Public Address System

Announcement. 3) IF Fire Brigade cannot be contacted, THEN dispatch runners to alert FB members.

4) Request assistance from Coffey County Fire Department. Telephone number 911 N/A This RNO provides alternative methods to notify the fire brigade and provides instructions to ensure the off-site fire department is called out if the fire brigade is delayed or cannot be contacted. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 27 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 4.d Classify the event using EPP 06-005, EMERGENCY

CLASSIFICATION.

N/A The SMs duty at this point is to classify the event and initiate the emergency plan. N/A N/A N/A N/A 4.e Supervise performance of this procedure.

N/A After the emergency plan has been initiated, the SM supervises performance of OFN RP-017. N/A N/A N/A N/A 5 SRO proceed to ASP via CAS and direct

personnel.

N/A The Senior Reactor Operator (SRO) is responsible for performing the actions of Attachment A in OFN RP-

017. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 28 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 5.a Obtain the following equipment from Control Room emergency

locker for personnel

entering the RCA: Low-Range PIC 0

- 1000 mR High-Range PIC 0-5 R Record Dose Dosimeter (RDD) Fire Resistant Suit and Arc Flash

Shield (SRO) Leather gloves (SRO) Hard hat N/A This step ensures those exiting the CR through CAS obtain the proper radiation monitoring and safety gear.

The SRO is required to operate 480 VAC breakers on his/her way to the ASP so it will be necessary to don a fire resistant suit and leather gloves. N/A N/A N/A N/A 5.b Direct CAS personnel to: 1. Transfer control to SAS 2. Evacuate CAS N/A CAS is evacuated to prevent security personnel from being overcome by smoke. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 29 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 5.c On NG03C, place the following breakers to OFF: NG03CEF4 for AL HV-36, Supply From Cond Stor

Tk Water NG03CHF3 for EG HV-15, CCW

Return From Nuclear Aux

Components NG03CKF3 for EG HV-61, CCW CTMT ISO VLV D, S The SRO proceeds to the ASP through CAS and enters room 1512, where NG03C is located.

Therefore it is feasible for the SRO to perform these actions before proceeding to the ASP. These breakers are placed in the OFF position to ensure power is disconnected to the associated Train A valves. This will prevent the valves from spuriously operating prior to and after the valve is manually

operated in another step. If, prior to performing this step, the valve spuriously operates to the undesired position, the valve can still be manually operated. Valve damage will not occur due to circuit modifications completed per change packages 12130 (EG HV-61) and 12170 (AL HV-36 and EG HV-15) in response to NRC IN 92-18 (PIR 2007-003037). For additional information on these specific valves see Steps B7, B10 and D6.

N/A See Section 6.3 for discussion of timing basis for aligning auxiliary feedwater.

See Section 6.5 for discussion of timing basis for aligning

component cooling water. No N/A 5.d Pick up radio from emergency locker outside ASP and select

Channel 1.

N/A Operators will generally communicate via radio. Therefore, the SRO obtains a radio from the emergency locker. The radio system is unaffected by a fire in the control room. Therefore, the radio system is a reliable means of communication. Channel 1 is used because it is

the Operations channel. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 30 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 5.e Perform actions of ATTACHMENT A, SRO ACTIONS N/A The SRO is responsible for performing the actions of Attachment A in OFN RP-017. N/A N/A N/A N/A 6 On-Shift Personnel Perform Designated Actions: N/A N/A N/A N/A N/A N/A 6.a Operator performing Turbine Building actions, proceed to

PA01/PA02 and

perform actions of ATTACHMENT B, TURBINE BUILDING ACTIONS N/A N/A N/A N/A N/A N/A 6.b Reactor Operator, proceed to NK

switchgear rooms and

perform actions of ATTACHMENT C, REACTOR OPERATOR ACTIONS N/A N/A N/A N/A N/A N/A 6.c Operator performing Aux Building actions, proceed to emergency locker 2026' level and

perform actions of ATTACHMENT D, AUXILIARY BUILDING ACTIONS N/A N/A N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 31 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 6.d Offsite Communicator, proceed to TSC N/A The Wolf Creek emergency plan requires an offsite communicator. N/A N/A N/A N/A 6.e ENS Communicator, proceed to TSC and establish and maintain

continuous communications with

the NRC via the ENS

Emergency Telecommunications System (ETS)

telephone.

N/A The Wolf Creek emergency plan requires ENS Communicator to establish and maintain continuous communications with the NRC N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 32 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 6.f Operator closing BN HV-8812A, RWST TO

RHR PUMP A SUCTION ISOLATION

VALVE proceed to ESF

Switchgear Room B

and perform actions of ATTACHMENT E, BN HV-8812A AND AUX FEEDWATER VALVE CLOSURE. R, M, D Calculation SA-08-006 identified that steam generator overfill could occur if the auxiliary feedwater (AFW) pumps are not secured and certain AFW valves are not closed in a timely manner. Furthermore, CR 00019239 identified an issue involving the time to close valve BN HV-8812A to mitigate RWST draindown. The valve requires approximately 600 turns of the handwheel to close. Operations Standing Order #1 limits the handwheel speed to 60 revolutions per minute. Therefore, the minimum time to close is 10 minutes, but due to the location of the handwheel and potential fatigue of the operator, it will likely take longer. Therefore, it was decided to add an extra

operator to this procedure to perform these actions.

See Attachment E actions for further discussion.

N/A N/A N/A N/A 1 Place Following Switches In ISOLATE:

RP HIS-1 CTRL ROOM ISO SWITCH -

ISOLATE RP HIS-2 CTRL ROOM ISO SWITCH -

ISOLATE RP HIS-3 CTRL R, M, D, P, S These hand switches are used to isolate certain components from the control room. The switches, when placed in ISO. CTRL. ROOM position, energize lockout relays (LORs) and change the position on a number of contacts located in the control circuit for these components. This ensures a fire in the control room will not affect the isolated components after the hand switch is actuated. The LORs are powered from DC batteries (NK). The batteries are sized to supply power to all emergency

loads for 200 minutes following loss of ac power per N/A This step establishes control

of the isolated

components from

the auxiliary

shutdown panel (ASP). The timing basis depends on when the isolated

components are

required to be

operable, which is No N/A Design Basis Document for Procedure OFN RP-017 Page 33 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps ROOM ISO SWITCH -

ISOLATE E-10NK. Loss of offsite power will not affect the LORs. RP HIS-1 performs the following functions:

Isolates valve FC HV-312 (TDAFP Trip and Throttle Valve) from the control room. Isolates main steam to TDAFP supply valves AB HV-5 and AB HV-6 from the control room. Isolates AB PV-2 indication from the control room. AB PV-2 position indication at the ASP is

independent of the control room. RP HIS-1 isolation is not required. ARV position indication is not credited for PFSSD. ARV position is

determined by controlling the ARV using the controller at the ASP and monitoring RCS temperature. Isolates FC FV-313 (TDAFP Speed Governing Valve) position indication from the control room.

RP HIS-2 performs the following functions:

Isolates BG HV-8152 (Letdown Isolation Valve) from the control room. Isolates the trip portion of NB0208 handswitch PG HIS-21. However, NB0208 could trip and the control power fuses could blow before RP HIS-2

is operated. This would prevent operation of pressurizer backup heater group B from the ASP.

If this occurs, operators will need to manually close NB0208 to energize PG22. NB0208 is closed in Step C11. Isolates valves AL HV-30, AL HV-33 and AL HV-discussed in the steps that follow.

Therefore, there is no timing basis for this step.

Design Basis Document for Procedure OFN RP-017 Page 34 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 34 from the control room and adds a redundant fuse in the circuit. Isolates AB PV-4 indication from the control room. AB PV-4 position indication at the ASP is

independent of the control room. RP HIS-2 isolation is not required. ARV position indication is not credited for PFSSD. ARV position is

determined by controlling the ARV using the controller at the ASP and monitoring RCS temperature. Isolates MDAFP B from the control room and adds redundant fuses in the circuit. However, this method of controlling the Train B motor driven auxiliary feedwater pump is not credited in OFN RP-017. Rather, the B MDAFP is started

by closing breaker NB0205 in Step C15.

RP HIS-3 performs the following functions:

Isolates PG2201 control circuit from the control room. PG2201 supplies power to pressurizer heater backup group B. Isolation of the PG2201 control circuit using RP HIS-3 allows operation of the heater group using BB HIS-52B at RP118B.

The heaters are used in Step A.7 RNO to

maintain pressurizer pressure. Isolation of the

heaters prevents spurious operation and ensures availability when needed. PG2201 is powered from NB0208 which is closed in Step C11.

Design Basis Document for Procedure OFN RP-017 Page 35 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A2 Close S/G A And C ARVs:

a. AB HS-1 SG A STEAM DUMP CTRL XFR - LOCAL

b. AB HS-3 SG C STEAM DUMP CTRL XFR - LOCAL

c. AB PIC-1B SG A STEAM DUMP TO

ATMS CTRL- CLOSED

d. AB PIC-3B SG C STEAM DUMP TO

ATMS CTRL- CLOSED R, M, D The control circuit for these valves is not isolated from the control room by operation of AB HS-1 and AB HS-

3. Therefore, AB PV-1 and AB PV-3 could remain

open. Steps D20 and D21 direct operators to isolate air and nitrogen to the valves then bleed air from the regulator to fail the valves closed. If this method fails, operators are directed to close AB-V018 and AB-V029. Isolating air and nitrogen provides a faster method of closing the valves. Control power to AB PIC-1B originates from NN0116, which is powered from the NK011 batteries.

Therefore, power will be available to perform this action. Control power to AB PIC-3B originates from NN0303 which is powered from the NK013 batteries.

Therefore, power will be available to perform this action. 7 SA-08-006 assumes this step will be completed within 7 minutes if a

single failure occurs

that does not involve an ARV

circuit. Therefore, it

is assumed that

ARVs 1 and 3 will

be closed in 7 minutes in this step

and that the control

room fire will not

impact the ability to

close the ARVs

from the ASP. SA-08-006 also shows

that a single failed

open ARV can go

unmitigated for at

least 1-hour. See

Section 6.1 for discussion of timing

basis for controlling

the steam generator ARVs.

Yes. A control room fire

could prevent closure or

cause the

re-opening

of ABPV1 and ABPV3. N/A Design Basis Document for Procedure OFN RP-017 Page 36 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A3 Check RCS Cold Leg Temperatures:

STABLE AT OR TRENDING TO 561 F BB TI-423X D The steam generator ARVs, if unaffected by a fire, control temperature to 561 F. Temperature instrument BB TI-423X is used to monitor cold leg temperature on loop 2. The circuits for this

temperature indicator are independent of the control room. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 37 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A3 RNO Perform the following:

a. IF temperature greater than 561 °F, THEN dump steam

using S/G B and

S/G D ARV's:

1) AB HS-2 SG B STEAM DUMP CTRL XFR -

LOCAL

2) AB HS-4 SG D STEAM DUMP CTRL XFR -

LOCAL

3) AB PIC-2B - THROTTLED

OPEN

4) AB PIC-4B - THROTTLED

OPEN

b. IF temperature less than 561 °F AND

temperature

decreasing, THEN

stop dumping

steam. D ARVs AB PV-2 and AB PV-4 are isolated from the control room by placing AB HS-2 and AB HS-4 in

LOCAL position. Auxiliary feedwater is assured to steam generators B and D using the Train B MDAFP and the TDAFP. The Train B MDAFP is started in Step C15. The TDAFP is started in Step A14. Control power for AB PIC-2B originates from NN0203 which is powered from NK02. Therefore, power will remain available from the NK012 batteries.

Redundant power is available from NG02A which is energized in Step C12. Control power for AB PIC-3B originates from NN0404 which is powered from NK04. Therefore, power will remain available from the NK014 batteries.

Redundant power is available from NG02A which is energized in Step C12.

7 SA-08-006 assumes atmospheric steam

dump control on

steam generators B

and D is established at the

ASP within 7

minutes. See

Section 6.1 for discussion about

steam generator

ARVs. No N/A Design Basis Document for Procedure OFN RP-017 Page 38 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A4 Ensure CST to MD AFP B Is OPEN

AL HIS-34B -

OPEN D The control circuit for this valve is isolated from the control room by operating RP HIS-2 in Step A1. The control circuit has been modified to address NRC IN 92-18 (PIR 2005-3314). MDAFP B is lined up to supply feedwater to steam generator D. Step C14 restores power to AL HV-34 MCC cubicle NG04CNF1. The valve may not open until Step C14 is completed.

15 minutes to start the pump and inject into steam generator D See Section 6.3 for timing basis for establishing auxiliary feedwater

using Train B

MDAFP. No A1 A5 Verify AFW Valve Lineup For MD AFP

B:

a. SG D AUX FW XFR CTRL VLV o AL HS LOCAL

b. SG D MD AFP AFW REG VLV CTRL

o AL HK-5B -

OPEN D Operation of AL HS-5 to the LOCAL position allows control of valve ALHV0005 from the ASP. Power to valve AL HV-5 is from NG04CCF2. The valve is normally full open and can be throttled to control flow into the steam generator. Loss of power will fail the valve as is and will prevent control of the

valve from the ASP until power is restored to NG04C. Power is restored in step C14. This will have no adverse impact since the Train B MDAFP is not started until Step C15.

15 minutes to start the pump and inject into steam generator D See Section 6.3 for timing basis for establishing auxiliary feedwater

using Train B

MDAFP. No N/A A6 Notify Reactor Operator That Motor Driven AFW Pump B

Valve Lineup Steps A4 Through A5 Are Complete D The Reactor Operator, in Step C15, ensures Steps A4 and A5 are complete before starting the Train B motor driven auxiliary feedwater pump. Valve lineups in Steps A4 and A5 establish a suction source from the CST and a discharge path to SG D and need to be complete before Step C15 is complete.

15 minutes to start the pump and inject into steam generator D See Section 6.3 for timing basis for establishing auxiliary feedwater

using Train B

MDAFP. N/A N/A Design Basis Document for Procedure OFN RP-017 Page 39 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A7 Maintain Stable Plant Conditions:

a. PZR pressure -

BETWEEN 2000 PSIG

AND 2300 PSIG

BB PI-406X

b. PZR level -

BETWEEN 25% AND 70%

BB LI-460B

c. S/G Wide Range Levels BETWEEN 60%

AND 62%

AE LI-502A AE LI-504A

d. RCS cold leg

temperatures -

BETWEEN 551°F AND

561°F

BB TI-423X R, M, D, P Hot standby is maintained using procedure OFN RP-017 by ensuring parameters are within the ranges listed. Diagnostic instrumentation is available as described below. a. The only pressurizer pressure indicator at the ASP is on the Train A side (BB PI-455B), which is not protected from a control room fire. RCS pressure indicator BB PI-406X is located on the Train B ASP and is unaffected by a control room fire. Therefore, BB PI-406X is used in this step to verify RCS

pressure. b. Pressurizer level is indicated by BB LI-460B on the Train B ASP and is unaffected by a control room fire. c. OFN RP-017 uses steam generators B and D for shutdown from outside the control room. Wide range level indicators AE LI-502A (SG B) and AE LI-504A (SG D) are located on the Train B ASP and are unaffected by a control room fire. d. RCS cold leg temperature is monitored at the Train B ASP using temperature indicator BB TI-423X (Loop 2 cold leg). This TI is unaffected by a fire in the

control room. N/A N/A No N/A

Design Basis Document for Procedure OFN RP-017 Page 40 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A7 RNO a. Cycle PZR HTRS B/U GP B as necessary

to restore PZR

pressure BB HIS-52B

b. WHEN BIT is

aligned, THEN direct Operator performing Turbine Building actions to control level locally:

Throttle BIT outlet valve o EM HV-8801B (2000' AUX BLDG

NORTH PIPE

PEN ROOM) R, M a. If pressurizer pressure is below 2000 psig, the backup group B pressurizer heaters are cycled to restore pressure. Step C11 restores power to the heaters and will need to be complete before this step can be completed. b. 10 CFR 50, Appendix R requires pressurizer level to remain on-scale. To maintain pressurizer level on scale, an operator needs to throttle the BIT outlet valve to control flow. The valve is throttled in Step

B13. a. 11.5 b. 28 a. Per SA-08-006, pressurizer heater

backup group B is

assumed to be

controlled within 11.5 minutes.

b. SA-08-006 shows that the most

challenging

scenario for pressurizer level is

a single steam

generator ARV opening coincident

with an immediate

automatic AFAS(T) and a loss of offsite power. Pressurizer level does not drop

off scale low as

long as the CCP is

started and BIT injection is lined up

in 28 minutes. See Sections 6.1 and 6.2 for discussion

about charging.

No a. N/A b. D4 Design Basis Document for Procedure OFN RP-017 Page 41 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A8 Ensure ESW To TD AFW Pump Isolation Valve Is -

CLOSED o AL HIS-33B CLOSED D As stated earlier, AL HV-33 is isolated from the control room using RP HIS-2. Step C14 energizes valve cubicle NG04CCF4, so the valve may not close until Step C14 is completed. A failed open valve will not impact PFSSD. The preferred source of auxiliary feedwater is the CST.

However, ESW is the safety-related source. This action is for commercial concerns to ensure raw untreated ESW water does not enter the SGs.

N/A This action is not time critical. As

stated in the Basis, if the valve opens PFSSD is still

assured. No A1 A9 Contact Operator Performing Attachment B To Verify AL HV-36 Open

AL HV OPEN D The SRO ensures a suction supply from the CST is available before starting the TDAFP. Step B7 opens the valve after ensuring control power is de-energized in Step 5.c.

35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No N/A Design Basis Document for Procedure OFN RP-017 Page 42 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A9 RNO Perform the following:

a. Close AFW Pump Turbine Mechanical Trip/Throttle Valve.

FC HIS-312B

b. Close Loop 2 and

Loop 3 Steam to AFP Turb.

AB HIS-5B AB HIS-6B

c. WHEN CST Supply To TD AFW Pump is open, THEN perform

Steps A10 through

A16.

d. Observe note prior

to Step A17 and continue with step A17.

D If AL HV-36 is not open, this RNO directs the operator to ensure the steam supply to the TDAFP is isolated

to protect the TDAFP.

Valves AB HV-5, AB HV-6 and FC HIS-312B are isolated from the control room in Step A1.

N/A If the TDAFP is running with no suction source, damage to the

pump could occur.

If the pump has no suction this RNO

needs to be

completed before

damage occurs. No A1 Design Basis Document for Procedure OFN RP-017 Page 43 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A10 Place TD AFP Governor Control to

local:

FC HS-313 - LOCAL Adjust FC HIS-313B to Minimum Output D FC HS-313 transfers control of the TDAFP speed governing valve to the ASP. After the switch is manipulated, controller FC HIS-313B can be used to

control the TDAFP. Control power originates from NN0203, which is powered from NK02. Theref ore, power will remain available from the NK012 batteries. Redundant power is available from NG02A, which is energized in Step

C12. 35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No N/A A11 Verify AFW Valve Lineup For TD AFP:

a. SG B AUX FW XFR CTRL VLV LOCAL

AL HS LOCAL

b. SG B TD AFP AFW

REG VLV CTRL OPEN

AL HK-10B -

OPEN D AL HS-10 transfers control of AL HV-10 to the ASP, where AL HK-10B can be used to control valve position. This valve controls TDAFP flow to SG B, which is one of the credited AFW flowpaths. Control power originates from NN0404 which is powered from NK04. Theref ore, power will remain available from the NK014 batteries. Redundant power is available from NG02A which is energized in Step

C12. 35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No N/A A12 Ensure Loop B Steam Isolation To AFP Turbine Is - OPEN

AB HIS-5B -

OPEN D Valve AB HV-5 is opened to ensure adequate steam supply to the TDAFP. RP HIS-1 isolates the valve

from the control room and inserts a redundant fuse in

the circuit. Therefore, the hand switch can be relied on to function.

35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No A1 Design Basis Document for Procedure OFN RP-017 Page 44 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A13 Ensure Loop C Steam Isolation To AFP Turbine Is - CLOSED

AB HIS-6B -

CLOSED D Valve AB HV-6 is closed because steam generator C is not credited for a control room fire. Continued steaming of this steam generator with no feedwater flow could result in the steam generator going dry.

Valve AB HV-5 is opened in Step A12 to provide the required steam flow to the Turbine Driven Auxiliary Feedwater Pump. RP HIS-1 isolates the valve from the control room and inserts a redundant fuse in the circuit. The alternate power supply to the valve does not run through the control room. Therefore, the hand switch can be relied on to function. N/A N/A No A1 A14 Ensure AFP Turbine Mechanical Trip/Throttle Valve Open FC HIS-312B -

OPEN D Valve is isolated from the control room and redundant fuses are added using RP HIS-1 in Step A1.

35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No A1, A9 A15 Contact Operator Performing Attachment E, BN HV-8812A AND AUX FEEDWATER VALVE CLOSURE To Ensure AFW Valves Are closed. D Auxiliary feedwater valves AL-V032, AL-V056, AL-V061 and AL-V071 are closed to prevent overfilling

the steam generators. This step has the operator verify the valves are closed before starting the

TDAFP. 35 Calculation SA 006 shows that the

steam generators could overfill if the

valves are not

closed within 35 minutes. No N/A Design Basis Document for Procedure OFN RP-017 Page 45 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A15 RNO Perform the following:

a. WHEN AFW Valves are closed, THEN perform A16

b. Observe notes prior to step A17 and continue with step A17 D If the AFW valves are not closed, The RNO directs the operator to not continue to Step A16 until the valves are closed.

35 Calculation SA 006 shows that the

steam generators could overfill if the

valves are not

closed within 35 minutes. No N/A A16 Establish Turbine Driven AFW Pump Control:

a. Adjust AFP TURB

SPEED GOV CTRL Output to 2900 to 3100

RPM FC HIS-313B

b. Adjust AFW pump

speed, as necessary, to establish desired AFW

flow D The TDAFP is credited for supplying AFW to SG B. FC HIS-313B is used to control TDAFP speed from the ASP. Step A10 transfers control of FC FV-313 to the ASP. Step E4 closes TDAFP to SGs A, C and D valves AL-V056, AL-V071 and AL-V061, respectively, to prevent overfill of these steam generators.

35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No A1, A9, A10, E4 Design Basis Document for Procedure OFN RP-017 Page 46 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A17 Align Alternate AFW Pump Water Source:

a. Check CST below minimum level:

• CST level on ASP -

LESS THAN 14%

AP LI-4B OR

• Local CST level -

LESS THAN 6' 5"

b. Open ESW To MD

AFW Pump B Isolation Valve AL HIS-30B -

OPEN

c. Open ESW To TD

AFP AL HIS-33B D This step aligns the ESW system to the AFW pumps in the event the CST reaches low level. RP HIS-2 isolates both AL HV-30 and AL HV-33 from the control room and adds redundant fuses to the control circuit for each valve.

Step C14 needs to be complete to restore power to AL HV-30 and AL HV-33 MCC cubicles.

N/A The CST contains sufficient inventory for PFSSD. This step is entered only

when the CST reaches low level.

There is no timing basis associated with this step.

Yes. CST level indicator

AP LI-4B is not isolated from the control room.

Local level

instrument

may need to be used. A1 Design Basis Document for Procedure OFN RP-017 Page 47 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A17 RNO a. Perform the following: 1) WHEN CST level decreases to less than minimum level, THEN do Steps A17.b and A17.c.

2) Observe notes prior

to Step A18 and continue with Step A18.

D The RNO is entered when the CST is above minimum level. This is a continuous action step which means the operator at the ASP will continue to monitor CST level and initiate swapover to ESW when required.

Per TS 3.7.6, the CST is required to contain 281,000 gallons of water, which is sufficient to provide water to the steam generators for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at hot standby followed by plant cooldown to RHR entry conditions.

Therefore, it is not expected that ESW will be needed until several hours into the event. N/A N/A No N/A A18 Direct Available Operators To Perform Actions Of ATTACHMENT F, ACTIONS TO PROTECT TRAIN A

EQUIPMENT N/A This step is used whenever extra operators are available to minimize damage to Train A equipment.

Attachment F is not required by regulation, so its steps

are not evaluated in this DBD. N/A N/A N/A N/A A19 Check plant cooldown - NOT

DESIRED N/A The purpose of OFN RP-017 is to maintain hot standby conditions until the fire is under control and operations can be resumed from the control room. If the event duration does not allow the plant to be maintained in hot standby, then OFN RP-017A is entered, per the RNO. N/A N/A N/A N/A A19 RNO Go to OFN RP-017A, HOT STANDBY TO COLD SHUTDOWN FROM OUTSIDE THE CONTROL ROOM N/A If necessary, OFN RP-017A is entered to bring the plant to safe cold shutdown. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 48 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A20 Check Fire Has Been Extinguished.

N/A NRC Draft Regulatory Guide DG-1214 dated April 2009, which is a proposed revision to RG 1.189, Section 5.5.2 has guidance for re-entering and re-establishing control from the Control Room. Steps A20 through A24 were added to OFN RP-017 to identify this guidance. CR 00016481 identified the need to add guidance for re-entry into the Control Room. N/A N/A N/A N/A A20 RNO Do NOT continue until fire is extinguished.

N/A Continuation in the procedure is not allowed until the fire is extinguished. N/A N/A N/A N/A A21 Check Control Room Habitable N/A See Step A20 Basis N/A N/A N/A N/A A21 RNO Do NOT continue until Control Room is habitable.

N/A Habitability must be established prior to allowing unprotected operators back into the control room. N/A N/A N/A N/A A22 Assess Control Room Damage. N/A See Step A20 Basis N/A N/A N/A N/A A23 Perform Corrective Actions To Restore Necessary Safety, Control And Information Systems To Functional. N/A See Step A20 Basis N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 49 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps A24 Contact TSC To Develop Procedures To Transfer Control From

Aux Shutdown Panel To The Main Control

Room And To Restore

From Any Local Actions

Taken Based On

Review Of Actions

Taken In The Procedures Performed. N/A See Step A20 Basis N/A N/A N/A N/A A25 Contact Chemistry To Perform SYS CI-009, CHEMICAL ADDITION TO THE CONDENSATE STORAGE TANK N/A This step was added in Revision 44 of OFN RP-017 per CR 75758-01-03. This step is not required for

PFSSD. N/A N/A N/A N/A A26 Proceed As Directed By Station

Management. N/A N/A N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 50 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B1 Locally Trip RCPs PA0107 for RCP A

- TRIPPED PA0108 for RCP B - TRIPPED PA0205 for RCP C - TRIPPED PA0204 for RCP D - TRIPPED M The RCPs are tripped to prevent damage to the seals upon loss of all seal cooling. Natural circulation is used to circulate coolant and to cooldown.

The breakers are tripped by rotating the local hand

switch to the STOP position. For this to work, control power needs to be available to each of the breaker control circuits. Control power is removed in Steps B4 and B5 after this step is completed.

A fire in the control room could cause a loss of control power and prevent opening the breakers with the local

hand switch. The fire would have to be located in either panel RL021, SB030A or SB033A for this to occur. 7 Based on SA 006, the RCPs are

assumed to be

tripped within 7 minutes. Yes. The breakers could spuriously

close until

Steps B4 and B5 are complete.

N/A B2 Proceed To 2033 Turbine And Obtain A Copy Of This Procedure.

N/A After the RCPs are tripped, the operator proceeds to the emergency equipment locker and obtains a copy of OFN RP-017. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 51 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B3 Perform the following:

a. Obtain the following from emergency locker:

Radio Flashlight

b. Obtain pocket ion

chambers and an RDD from the emergency

locker for personnel

entering the RCA

Low-Range PIC 0-1000 mR High-Range PIC 0-5 R RDD

c. Select Channel 1 on

radio N/A A radio is required to ensure communication with the SRO at the ASP. Channel 1 is used by Operations for communication. A flashlight will supplement fixed Appendix R emergency lighting in the event of a loss of off-site power.

Dosimetry is required for personnel entering the RCA. N/A N/A N/A N/A B4 On PK41 OPEN disconnect for DC control power to

PA01 PK4103 - OFF M Isolating DC control power to PA01 ensures cable damage will not cause the spurious closure of PA0107

or PA0108, causing the RCPs to start. Isolating control power before step B1 is complete will prevent opening the breakers using the local hand switch.

Therefore, Step B4 shall be performed after Step B1.

N/A See Section 6.2 discussion about stopping the RCPs. No N/A Design Basis Document for Procedure OFN RP-017 Page 52 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B5 On PK62 Open disconnect for DC control power to

PA02 PK6204 - OFF M Isolating DC control power to PA02 ensures cable damage will not cause the spurious closure of PA0204

or PA0205, causing the RCPs to start. Isolating control power before step B1 is complete will prevent opening the breakers using the local hand switch.

Therefore, Step B5 shall be performed after Step B1.

N/A See Section 6.2 discussion about stopping the RCPs. No N/A B6 Ensure RCP Breakers Are Tripped:

PA0107 for RCP A - TRIPPED PA0108 for RCP B - TRIPPED PA0205 for RCP C - TRIPPED PA0206 for RCP D - TRIPPED M This step ensures the RCP breakers remain tripped after control power has been removed.

N/A See Section 6.2 discussion about stopping the RCPs. No N/A B7 Check AL HV-36 CST to Turbine Driven AFP Suction Isolation

Valve Open:

a. Verify with SRO at ASP that Step 5.c is complete.

b. Ensure AL HV

OPEN D Valve AL HV-36 is required to be open to ensure suction to the TDAFP from the CST. DCP 12170 modified the control circuit to ensure a control room fire will not damage the valve and prevent manual

opening. 35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No 5.c Design Basis Document for Procedure OFN RP-017 Page 53 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B7 RNO a. Do not continue until step 5.c is complete.

D The operator completing step B7 RNO will not manually open AL HV-36 until it is verified that the

breaker is off. With the breaker on, a spurious signal can close the valve after it has been opened.

35 minutes to start the pump and inject into steam generator B See Section 6.3 for timing basis for the

TDAFP. No 5.c B8 Descend To 1974' Elevation Via Ladders In AFW Valve Room And Enter The RCA.

N/A This step provides the operator with the most efficient path to get to the Auxiliary Building. Dosimetry for entering the RCA is obtained in Step B3. N/A N/A N/A N/A B9 In NCP Room, Close CCP To Regen Hx

Valves

a. Close Charging Header HCV-182 Inlet Isolation Valve

BG-8402B -

CLOSED

b. Close Charging Header BG HCV-182 Bypass Valve

BG-V017 -

CLOSED M This step is required to prevent uncontrolled charging.

Closing the valves ensures charging to the RCS through the Regen Hx is isolated.

14 See Section 6.2 for timing basis for

isolating normal

charging. No N/A Design Basis Document for Procedure OFN RP-017 Page 54 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B10 In North Mechanical Pent Room, close CCW FROM RCS OUTER CTMT ISO VLVs to Isolate CCW From RCP Thermal

Barriers

a. Verify with SRO that Step 5.c is complete.

b. Ensure EG HV

CLOSED

c. Verify with Aux Bldg

that Att D, Step D10 is complete.

d. Ensure EG HV-133 -

CLOSED S These valves are closed to prevent a steam bubble from migrating to the CCW piping when the CCW pumps are started. The valves are also closed to

prevent cold CCW from being injected to the RCP thermal barrier when the CCW pump is started, which could cause damage to the RCP seals. The CCW pumps are not started until these valves are closed.

As long as the valves are closed before starting the CCW pumps, then there is no possibility of water hammer or seal damage.

a. Step 5.c opens the breaker associated with EG HV-61. After the breaker is open, control power is lost and the valve cannot spuriously actuate. If the breaker is confirmed open and the valve is closed, then it is in the desired position and will remain there throughout the event. If the valve is verified closed prior to ensuring Step 5.c is complete and the operator moves on to the next step, the valve could spuriously operate. Also see the discussion for Step 5.c.

c. Step D10 opens the breaker associated with EG HV-133. After the breaker is open, control power is lost and the valve cannot spuriously actuate. If the breaker is confirmed open and the valve is closed, then it is in the desired position and will remain there throughout the event. If the valve is verified closed prior to ensuring Step D10 is complete and the operator moves on, the valve could spuriously operate. Also see the discussion for Step D10.

Prior to the need for supported systems. See Section 6.5 for discussion about

support systems.

No b. 5.c d. D10 Design Basis Document for Procedure OFN RP-017 Page 55 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B10 RNO a. Do not continue until Step 5.c is complete.

c. Do not continue until

Att D, Step D10 is

complete. S The RNO ensures the operator does not continue until power is disconnected. N/A N/A No

b. 5.c d. D10 B11 In Aux Bldg Filter Alley, Locally Close Valves To Isolate RCP

Seals:

a. Seal Water Injection Filters Inlet Isolations.

BG-V101 BG-V105

b. Inform Reactor Operator that Steps

B10 and B11 are complete.

M Manual valves BG-V101 and BG-V105 isolate the seal injection lines and ensure spurious valve actuation will not restore seal injection. These valves are required to be closed before charging is restored to prevent RCP seal damage and loss of RCS inventory. The PFSSD strategy for a control room fire is to not restore seal cooling in order to prevent a seal LOCA if seal

cooling is not restored promptly. Only one of these valves is open at a time but both are included because either one could be open at the time of the fire.

28 minutes to start the charging pump and inject to the RCS. See Section 6.2 for timing basis for

charging. No N/A B12 At RP209 Across From North Mechanical Penetration Room Fail MSIV Bypass

Valves Closed. Fuse #46 - OFF

R, M, D The action to pull this fuse was part of the original licensing basis strategy for control room fire. The

strategy was approved by the NRC in Supplement 5 of the SER. Pulling the fuse removes control power from the MSIV bypass valve circuit and fails the valves closed. See Section 7.3.1 for more information.

60 See Section 6.1 for discussion about

MSIV bypass valves. No N/A Design Basis Document for Procedure OFN RP-017 Page 56 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps B13 Verify BIT Isolation Valves open:

a. Verify with person

performing Aux Bldg actions that Attachment D, Steps D4 through

D5 are complete.

b. In the North Piping

Penetration Room, locally Close "A" BIT

OUTLET VALVE.

EM HV-8801A CLOSED

c. In the North Piping

Penetration Room locally throttle open BIT outlet isolation valve.

EM HV-8801B THROTTLED

OPEN

d. Notify the SRO that BIT is lined up for injection.

e. Throttle EM HV-8801B as directed by M Step D4 opens the breaker for valve EM HV-8801B, ensuring the valve will not change position after it has

been throttled.

Step D5 opens the breaker for valve EM HV-8801A, ensuring the valve will not spuriously open after it has been closed.

Valve EM HV-8801B is throttled manually to prevent overfilling the pressurizer. If the valve were to fully

open with no letdown, the pressurizer would go solid and water would be lost to the PRT and eventually the

floor of the reactor building. Therefore, the valve is manually throttled to control pressurizer level. The valve control circuit has been modified by DCP 12130 to address NRC IN 92-18

Valve EM HV-8801A is closed to prevent overfilling the pressurizer. DCP 13614 modified the valve control circuit to address NRC IN 92-18. Closing

valve EM HV-8801A or ensuring it is closed will

prevent the pressurizer from going water solid.

28 minutes to start the charging pump and control charging flow. See Section 6.2 for timing basis for

charging. No D4, D5

Design Basis Document for Procedure OFN RP-017 Page 57 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps the SRO to control PZR level. B13 RNO a. Do not continue until D4 through D5 are complete.

M The RNO ensures the operator does not continue until power is disconnected to both valves.

28 minutes to start the charging pump and control charging flow. See Section 6.2 for timing basis for

charging. No D4 B14 Contact SRO At ASP For Further Direction

N/A N/A N/A N/A N/A N/A C1 Evacuate Control Room:

a. Exit Control Room

using north door

b. Ensure Control Room outer doors - AT

LEAST ONE CLOSED:

• Normal outer door

OR

• Missile door

c. Proceed to NK

switchgear rooms.

N/A The operator exits through the north door and retrieves his/her hard hat and proceeds to the NK

switchgear room.

Ensuring one of the control room doors is closed

prevents the fire from spreading beyond the control room. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 58 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C2 Turn Off The Following NK Disconnects:

NK5108 PORV BB PCV-455A Control

Power - OFF NK5109 MCB CONTROL PANELS RL021

AND RL022 (Reactor Head Vent

Valves) - OFF NK5119 MSFIS Cab SA075A - OFF NK4401 BUS NB02 BRKR CONTROL POWER - OFF NK4413 MCB CONTROL PANELS RL019 AND RL020 - OFF NK4414 MCB CONTROL PANELS RL021

AND RL022 (Reactor Head Vent

Valves) - OFF M, D One pressurizer PORV is assumed to fail open. Both PORVs are failed closed by opening NK5108 and

NK4421 to prevent loss of RCS inventory.

NK5109 and NK4414 supply power to portions of RL021/RL022. Panel RL021/RL022 supplies power to a number of loads including the reactor head solenoid vent valves. Placing these switches in the OFF position will fail the solenoid valves closed, thereby preventing loss of inventory through the reactor head vents. Loss of power to the remaining loads supplied by these breakers will have no adverse impact on safe shutdown. Switches NK4414 and NK5109 are also opened to de-energize other potential Separation Group 1 and 4 125VDC power sources that could cause the pressurizer PORVs to open in the event of

multiple proper polarity hot shorts within RL021/RL022.

NK5119 supplies power to Train A MSFIS cabinet SA075A. Isolation of power to SA075A will close the main steam and main feedwater isolation valves. The action is required to ensure the MSIVs can be closed in 3 minutes. The action is not required to close the main feedwater isolation valves. The reactor is tripped at t = 0s when operators actuate the reactor

trip push buttons prior to evacuating the control room.

The reactor trip causes a low Tavg signal within 5 seconds and initiates a feedwater isolation signal, which stops main feedwater flow and prevents steam

generator overfill from main feedwater (reference 3 Based on SA 006, the pressurizer

PORVs need to be

closed within 3 minutes following reactor trip. This

assumes a single

PORV opens and

no other spurious

actuations.

Therefore, NK5108, NK5109, NK4414

and NK4421 need

to be opened within 3 minutes.

SA-08-006 requires

the MSIVs to be

closed within 3 minutes.

The time required

to open the remaining switches in this step is

greater than 3 minutes so opening

them within 3 minutes will ensure

PFSSD.

No N/A Design Basis Document for Procedure OFN RP-017 Page 59 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps NK4416 S.S. PROTECTION

SYSTEM OUT 2

CABINET SB032D (Steam Dumps) -

OFF NK4421 BB PCV-456A PORV (PORV Control Power) -

OFF License Amendment 214).

Control power for NB02 needs to be isolated before

the NB02 breakers are manipulated in Step C6.

Therefore, it makes sense to open the breaker in this

step.

NK4413 supplies power to the following PFSSD components: 1) Train B diesel generator room

exhaust damper actuator GM HZ-19; 2) Solenoid actuators for radwaste building CCW supply/return header supply valves EG HV-70A and EG HV-70B; and, 3) Train B CCW temperature control valve EG

TV-30. Loss of power to GM HZ-19 will fail the damper open, which is the desired position. Loss of power to EG HV-70A/B will fail the valves closed, which will not affect PFSSD. Loss of power to EG TV-30 will fail the valve closed, allowing maximum cooling in the CCW system which will not adversely impact PFSSD. Loss of power to other components supplied by NK4413 will not adversely impact PFSSD.

NK4416 supplies power to the steam dumps. Placing NK4416 in OFF isolates the steam dumps and prevents uncontrolled cooldown and return to criticality if the MSIVs fail to close.

C3 Proceed to NB02 Switchgear Room And Obtain A Copy Of This Procedure.

N/A Prior to performing remaining steps, the Operator proceeds to the emergency locker and obtains a copy of OFN RP-017. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 60 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C4 Perform the following:

a. Obtain the following from the emergency locker:

Radio Flashlight

b. Select Channel 1 on

radio. N/A A radio is required to ensure communication with the SRO at the ASP and other operators. Channel 1 is used by Operations for communication. A flashlight

supplements fixed battery powered emergency lights. N/A N/A N/A N/A C5 Check B EDG - SECURED S This step is included for the possibility that a CR fire has caused a loss of off-site power and the EDG has automatically started.

N/A No timing basis for this step. The EDG is assumed not to

start based on Assumption Section 2.2.5, consistent

with Generic Letter

86-10, response to question 3.8.4. Yes, EDG may spurious-ly start after step.

EDG start without ESW cooling is an MSO contrary to Assump-tion 2.2.3 N/A Design Basis Document for Procedure OFN RP-017 Page 61 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C5 RNO Perform the Following:

a. Check ESW Pump B Breaker -

CLOSED NB0215 -CLOSED

b. IF NB0215, ESW PMP DPEF01B is

NOT closed, THEN

perform the following:

1) Place KJ HS-109 in LOC/MAN

2) Secure B EDG by momentarily

depressing

KJ HS-108B S This step ensures required ESW cooling is in place for automatic EDG start on loss of offsite power. This step is added based on NEI 00-01 Appendix D

guidance to prevent damage to EDG due to lack of cooling. Note that spurious start of EDG in combination with loss of ESW Cooling represents two spurious actuations as a result of a CR fire.

Assumption 2.2.3 clarifies only a single spurious actuation is assumed before transfer of control is achieved by the alternate and dedicated shutdown system. N/A N/A No N/A C6 Ensure Train B Pump Breakers - OPEN

NB0207 - OPEN NB0206 - OPEN NB0205 - OPEN NB0204 - OPEN NB0203 - OPEN NB0202 - OPEN NB0201 - OPEN S This step sheds large loads from the NB02 bus and is required prior to starting the Train B diesel generator

in Step C7.

Step C2 isolates control power to the NB02 bus and ensures the breakers do not spuriously close.

NB0201 (Train B CCP) needs to be opened within 10 minutes to prevent overfilling the pressurizer.

10 The timing for this step is based on

the need for the

supported PFSSD

equipment.

Based on SA 006, the Train B

CCP needs to be stopped within 10

minutes to prevent

pressurizer overfill

following a spurious

SIS. No C2 Design Basis Document for Procedure OFN RP-017 Page 62 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C7 Ensure Feeder Breakers To NB02 -

OPEN NB0209 - OPEN NB0212 - OPEN S This action isolates off site power to the NB02 bus and causes the diesel generator to automatically start on bus under voltage. The emergency generator is

started to energize PFSSD equipment needed throughout this procedure.

Step C2 isolates control power to the NB02 bus and ensures the breakers do not spuriously close.

Step C6 needs to be completed to prevent overloading the diesel generator.

Prior to the need for diesel generator The timing for this step is based on

the need for the

supported PFSSD

equipment. The most limiting time is

restoring

pressurizer backup

group B heaters in

Step A7 RNO. No C2, C6

Design Basis Document for Procedure OFN RP-017 Page 63 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C8 Ensure ESA And ESB Relays - Energized

a. Remove the break glass cover from

the EMERGENCY

START pushbutton, to

energize the ESA and ESB relays.

KJ HS-101D -

BREAK GLASS COVER REMOVED S This step energizes relays ESA and ESB on the Train B diesel generator engine control circuit (E-13KJ03A).

The Wolf Creek licensing basis for control room fires assumes only a single spurious actuation occurs as a result of the fire. Therefore, it can be assumed that one of the two relays will energize. Also, DCP 13513 added control room isolation contacts and redundant fuses for the ESB circuit, which ensures the ESB relay will be energized following completion of Step C9.b.

With at least one relay (ESB) energized, the unit

parallel relay (UPR) will be de-energized (E-13NE13). Therefore, the diesel generator will not be in droop mode and will function properly as PFSSD loads are

added.

Also, with one relay (ESB) energized, relay 90 VEP will be energized which will switch the electronic voltage adjuster to a pre-determined setpoint and ignores signals from the control room auto/manual

raise/lower switches. This ensures a fire in the control room will not affect the output voltage of the EDG

during the event.

Prior to the need for diesel generator The timing for this step is based on

the need for the

supported PFSSD

equipment. The most limiting time is

restoring

pressurizer backup

group B heaters in

Step A7 RNO. No C2, C6 C9 Align EDG B To Bus

a. Ensure Master Transfer Switch is in

LOC/MAN KJ HS-109 -

LOC/MAN b. At panel KJ122, S The caution before this step alerts operators that KJ HS-109 must be placed in LOC/MAN before placing KJ HS-110 in ISO position. This will prevent blowing some of the redundant fuses.

After loads are shed from the NB02 bus, and the NB02 feeder breakers are opened, the Train B diesel generator will automatically start and load to the bus when NB0211 is closed. Placing KJ HS-109 in Prior to the need for diesel generator See Section 6.5 for timing basis

associated with

EDG cooling.

Yes. A control room fire could prevent an automatic start of the Train N/A Design Basis Document for Procedure OFN RP-017 Page 64 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps place CR Fire Iso Switch in isolate.

KJ HS-110 - ISO

c. Check Diesel -

STARTED d. Ensure EDG Output Breaker - CLOSED

NB0211 - CLOSED e. Check NB02 voltage on breaker NB0201 normal 3.95 - 4.32 kv.

LOC/MAN allows for local voltage regulation and also isolates portions of the control circuit from the control room. Local voltage regulation is not credited for PFSSD and is disabled by actuation of the emergency start switch in Step C8.

DCP 12097 was implemented to add another KJ HS-109 contact to the control room stop circuit to ensure a control room fire will not shut the EDG down during

the event. In addition, DCP 12097 added KJ HS-110 and redundant fuses to ensure power is available to the field flashing circuit. DCP 13513 added more redundant fuses and isolation contacts to the EDG control circuit after CR 30350 identified an issue

where fuses located in NE106 could blow, preventing field flashing. Additional reviews performed during preparation of DCP 13513 found that a number of other control room circuits were not isolated. As a result, several more isolation contacts and fuses were

added.

Closing the EDG output breaker after the EDG is started energizes the NB02 bus. Step C9.e ensures the proper voltage is present on the bus.

B EDG. The RNO provides a method to start the engine if it does not auto start. C9 RNO b. Perform the following:

1) Obtain handle from

emergency locker

2) Place handle on either Air Start Valve:

S This RNO provides another method for starting the Train B diesel engine if it does not automatically start.

Step C8 uses the emergency start switch which will start the EDG after KJ HS-109 and KJ HS-110 are placed in the proper position in Step C9. Based on the modifications performed per DCP 13513, there is reasonable assurance that Step C9 will start the diesel engine and energize the NB02 bus and it is not likely Prior to the need for diesel generator The timing for this step is based on

the need for the

supported PFSSD

equipment. No N/A Design Basis Document for Procedure OFN RP-017 Page 65 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps

• Northeast end between cylinders and turbocharger

OR

• Southwest end between cylinders

and generator

3) Pull handle down until diesel starts

that this RNO will be required.

C10 Ensure ESW Pump B Breaker - CLOSED NB0215 - CLOSED S The ESW system supplies cooling water to the emergency diesel engine cooler, the component

cooling water heat exchanger and various room coolers. The ESW system is also a backup source of auxiliary feedwater.

NB0215 is normally open. Breaker control power is isolated in Step C2. If the breaker did not close in response to the load sequencer signal, Operators can close the breaker by pushing the manual close push

button. Prior to the need for supported components This step starts the ESW pump. Check

valve EFV0471

prevents flow

diversion to service

water. See Section

6.5 for timing basis

associated with

EDG cooling. No C2 Design Basis Document for Procedure OFN RP-017 Page 66 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C10 RNO Perform Attachment G to charge the closing

springs and manually close NB0215.

S Attachment G is included to provide instructions to operators to charge the closing springs if the breaker does not close. See the discussion regarding Attachment G basis at the end of this table.

N/A This step starts the ESW pump. Check

valve EFV0471

prevents flow

diversion to service

water. See Section

6.5 for timing basis

associated with

EDG cooling.

N/A N/A Design Basis Document for Procedure OFN RP-017 Page 67 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C11 Ensure Load Center and ESW Pumphouse MCC Breakers -

CLOSED:

NB0208 - CLOSED NB0210 - CLOSED NB0213 - CLOSED NB0216 - CLOSED S The Train B 480 VAC load centers and MCC breakers are not shed from the NB02 bus. Therefore, the listed breakers could remain closed. If the breakers open as a result of a control room fire, this step ensures they are closed.

Step C2 disconnects control power from the NB02 bus and ensures the breakers do not spuriously open after they have been closed.

NB0208 powers XPG022. PG2201 is cycled in Step A7 (RNO) to operate the pressurizer heater backup

group B. See Step A7 RNO discussion for more

information.

NB0210 powers XNG04. NG0401 is closed in Step C14 to energize NG04. See Step C14 discussion for more information on NG04.

NB0213 powers XNG02. NG0201 is closed in Step C12 to energize NG02. See Step C12 discussion for more information on NG02.

NB0216 powers XNG06, which energizes Train B ESW pumphouse MCC NG006E. MCC NG006E powers a number of components required to ensure Train B ESW pump operability. The Train B ESW pump is directly powered from NB0215 and does not

require NG006E to be energized.

Prior to the need for supported components The required time to complete this step is based on the time to place

the supported systems in service.

See Steps A7 RNO, C12, C14 and C17. No C2 Design Basis Document for Procedure OFN RP-017 Page 68 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C11 RNO Perform Attachment G to charge the closing

springs and manually close the breakers.

S Attachment G is included to provide instructions to operators to charge the closing springs if the breaker does not close. See discussion regarding Attachment G basis at the end of this table. N/A N/A N/A N/A C12 Isolate NG0201 Trip Circuit On NG0201 AND Close Breaker:

a. Position NORMAL

ISOLATE switch to ISOLATE NG HIS ISOLATE

b. On NG02, ensure

Load Center NG02

Main Breaker -

CLOSED NG0201 - CLOSED S This step is performed to ensure power is available to PFSSD components supplied by NG02. Power is provided to NG02 by NB0213. NB0213 is verified closed in Step C11. NG02 supplies power to a number of PFSSD components, but only a few are needed for OFN RP-017. These include:

EF HV-32 EF HV-34 EF HV-46 EF HV-50 SGK05B DSGL12B NN12, NN14 and NN16 BN HV-8812B BG LCV-112C EF HV-26 EF HV-38 BG HV-8111 BN LCV-112E DSGN01B DSGL15B Placing NG HIS-15 in isolate position will isolate the

trip circuit and prevent a spurious breaker trip after the breaker has been closed. The hand switch needs to be operated first before manually closing the breaker to ensure a trip does not occur.

Prior to the need for supported systems The required time to complete this step is based on the time to place

the supported systems in service.

See Steps C13, C18, C19, C20, C21, C22, C24, D9,

D12, D13, D14, D15, D22. No N/A Design Basis Document for Procedure OFN RP-017 Page 69 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps EF HV-32, EF HV-34, EF HV-46 and EF HV-50 are opened in Steps D12 through D14 to provide a flow path to/from ESW to the Train B containment coolers.

SGK05B is required to provide cooling to Class 1E electrical equipment rooms. The unit is started in Step D22 after all required lineups are made.

DSGL12B is the Train B CCP room cooler fan motor.

The pump room cooler provides a suitable ambient air temperature for the CCP motor. The cooler starts

automatically when the pump motor starts. Failure of

the room cooler to start does not prevent operation of the pump. The CCP is started in Step C24. ESW is lined up in Step C18.

Inverters NN12, NN14 and NN16 are required to energize NN02 and NN04 to provide long-term power to panels RP147A and RP147B. 125 VDC battery sets NK012 and NK014 provide the short-term power needs for these panels. The batteries are sized to supply power to all emergency loads for 200 minutes following loss of AC power per E-10NK, at which time the alternate power source will need to be lined up.

BN HV-8812B is closed in Step C19 using BN HS-8812B. Step C12 is performed prior to C19, so power will be available when the operator performs Step

C19.

Design Basis Document for Procedure OFN RP-017 Page 70 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps BG LCV-112C needs to be closed prior to starting Train B CCP to ensure hydrogen is not introduced into the CCP suction. The valve is closed in Step C21 using BG HS-112C. Train B CCP is started in Step

C24.

EF HV-26 is closed in Step C13 using ISO/CLOSE switch EF HS-26A.

EF HV-38 needs to be open to ensure a full flow return path from ESW to the UHS. EF HV-38 is fully opened in Step C18 by placing EF HS-38A in ISO/OPEN position. Power needs to be restored prior to the need for this valve to be fully open.

BG HV-8111 is required to be open to prevent Train B CCP damage during low flow conditions. BG HV-

8111 is opened in Step C22 by placing BG HS-8111A in ISO/OPEN position.

BN LCV-112E is required to be open to provide a suction source from the RWST to the Train B CCP.

BN LCV-112E is open in Step C20 by placing BN HS-112E in ISO/OPEN position.

DSGN01B needs to be energized for containment cooling. The coolers are started in Step D15.

DSGL15B is the Train B electrical penetration room cooler and is started in Step D9.

Design Basis Document for Procedure OFN RP-017 Page 71 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C13 At NG02AHF2, Position NORMAL ISO/CLOSE For ESW B/Service Water Cross- Connect Valve To ISO/CLOSE

EF HS-26A -

ISO/CLOSE S Check valve EFV0471 was added to the service water cross connect piping in DCP 14750. Valve EF HV-26 is no longer required to be closed to prevent flow diversion. The action to close EF HV-26 will remain in the procedure as a precaution. Step C12 restores power to the MCC cubicle for this valve.

DCP 12170 modified the control circuit for EF HV-26 to address NRC IN 92-18 concerns. N/A N/A No N/A C14 Isolate NG0401 Trip Circuit On NG0401 AND Close Breaker:

a. Position NORMAL

ISOLATE switch to ISOLATE NG HIS ISOLATE

b. On NG04, ensure

Load Center NG04

Main Breaker -

CLOSED NG0401 - CLOSED S This step is performed to ensure power is available to PFSSD components supplied by NG04. NG04 supplies power to a number of PFSSD components, but only a few are required to be energized for OFN RP-017. These include:

AL HV-5 AL HV-30 AL HV-33 AL HV-34 DSGF2B EM HV-8803B DSGL11B EF HV-52 EF HV-60 EG HV-16 EG HV-54 DSGN01D DPJE01B Placing NG HIS-16 in isolate position will isolate the

trip circuit and prevent a spurious breaker trip after the breaker has been closed. The hand switch needs to Prior to the need for supported systems The required time to complete this step is based on the time to place

the supported systems in service.

See Steps A4, A5, A17, C15, C23, C29, D4 and D15. No N/A Design Basis Document for Procedure OFN RP-017 Page 72 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps be operated first before manually closing the breaker to ensure a trip does not occur.

AL HV-5 needs to be opened to supply auxiliary feedwater to steam generator D. The valve is opened in Step A5 by placing AL HS-5 in LOCAL and AL HK-5B in OPEN. Power needs to be restored before the

valve will operate.

AL HV-30 needs to be opened to supply suction to the Train B MDAFP when the CST reaches low level.

This is not a time critical step since the CST has sufficient volume for PFSSD. See Step A15 discussion.

AL HV-33 needs to be opened to supply suction to the TDAFP when the CST reaches low level. This is not a time critical step since the CST has sufficient volume for PFSSD. See Step A15 discussion.

AL HV-34 needs to be opened to ensure a suction supply from the CST to the Train B MDAFP. The valve is opened in Step A4 by placing AL HIS-34B in

OPEN position. Step C14 needs to be completed before the valve will open.

DSGF2B is the Train B MDAFP room cooler. The room cooler provides a suitable ambient air temperature for the equipment in the room. The

cooler starts automatically when the pump starts as long as power is available to the cooler motor. Power is established in Step C14. See Section 6.5 for Design Basis Document for Procedure OFN RP-017 Page 73 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps discussion about room cooling.

EM HV-8803B is opened in Step D4. Step C14 needs to be performed prior to the need for charging.

DSGL11B is the Train B CCW pump room cooler.

The room cooler provides a suitable ambient air temperature for the equipment in the room. The

cooler starts automatically when either Train B CCW pump starts as long as power is available to the cooler motor. The CCW pumps are started in Step C23.

EF HV-52 is opened in Step D4 by placing EF HS-52 in ISO/OPEN position. EF HV-52 needs to be open prior to the need for CCW. The CCW system is needed for CCP oil cooling and provides cooling water

to the seal water heat exchanger. The Train B CCP is

started in Step C24.

EG HV-16 and EG HV-54 are opened in Step D4 by placing EG HS-16A and EG HS-54 in ISO/OPEN position. EG HV-16 and EG HS-54 need to be open to ensure CCW to the seal water heat exchanger prior to starting the Train B CCP. The seal water heat

exchanger provides cooling for CCP recirc flow and is needed to ensure operability of the CCP. The Train B

CCP is started in Step C24.

DSGN01D needs to be energized for containment cooling. The coolers are started in Step D15.

Design Basis Document for Procedure OFN RP-017 Page 74 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps DPJE01B needs to be energized to ensure Train B fuel oil transfer pump operability. The transfer pump is started in Step C29.

C15 Start Motor Driven AFW Pump B.

a. Verify SRO

performing Attachment A has completed steps

A4 through A5.

b. Start Motor Driven

AFW pump B

NB0205 - CLOSED

c. Notify SRO that

Motor Driven AFW

Pump B is running D a. Step A4 is required to be completed to ensure an adequate suction source to the AFW pump prior to starting the pump. Step A5 is required to be performed to ensure AFW flow from Train B MDAFP to steam generator D. If Step A5 is not complete before performing this step, there is no adverse impact since water will recirculate back to the CST.

b. The MDAFP B is started by pushing the manual close push button at NB0205. Although control power is isolated, the springs are charged and ready to

operate.

Step C2 isolates control power to the NB02 bus and

prevents a fire in the control room from spuriously opening NB0205 after it has been closed.

15 SA-08-006 shows that PFSSD is

assured if AFW is

established to

steam generator D within 15 minutes.

See Section 6.3 for discussion about

AFW. No C2, A4 C15 RNO a. DO NOT CONTINUE until steps

A4 through A5 are complete.

b. Perform Attachment G to charge the closing

springs and manually

close NB0205 D a. This RNO ensures the operator does not continue until AFW Pump B valve alignment is complete in

Steps A4 and A5.

b. If the breaker re-opens after it has been closed or the springs are not charged, manual charging will be required to get the breaker to close. Attachment G provides the method to manually charge the springs.

See discussion regarding Attachment G basis at the end of this table.

15 SA-08-006 shows that PFSSD is

assured if AFW is

established to

steam generator D within 15 minutes.

See Section 6.3 for discussion about

AFW. No C2, A4

Design Basis Document for Procedure OFN RP-017 Page 75 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C16 Ensure Containment Spray Pump A is stopped:

a. Remove CLOSE control power fuse (UC)

NB0102/UC FUSE - OFF

b. Stop Containment

Spray Pump A

NB0102 - OPEN M This step ensures the Train A containment spray pump is not running and depleting the RWST

inventory. The Train B containment spray pump is isolated in Step C6.

Pulling the fuse isolates control power from the circuit to prevent a control room fire from closing the breaker.

This action was approved by the NRC based on its inclusion in SLNRC-84-0109 (See Phase E action 18 and Note 20 in SLNRC 84-0109) 67 It is assumed that the Train A

containment spray

pump is operating

and valve

ENHV0006 is open

to cause containment spray.

E-1F9910 (see Fire Area C-22) shows

that with 1

containment spray

pump operating and

flowing water to the

header, operators

have 67 minutes to

stop the pump before the RWST level falls below

that required for

safe shutdown. No N/A Design Basis Document for Procedure OFN RP-017 Page 76 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C17 East Of NG02A, Align ESW Pump Room Ventilation:

a. Position NORMAL

ISO/RUN switch for

ESW Pump Room

Supply Fan to ISO/RUN GD HS ISO/RUN S ESW pump room ventilation maintains the ESW pump room temperature within required limits. Based on the Wolf Creek TRM, Table TR 3.7.22-1 the maximum allowable sustained temperature in the room is 119 F.

Step C10 starts the ESW pump. Step C11 energizes

the Train B ESW pump room MCC.

GD HS-11 starts the supply fan, isolates the control room circuits and inserts a redundant fuse.

DCP 13800 re-located the control cards for the Train B ESW pump room supply and recirculation dampers

from the control room panel RP053B to panel RP147B

in the Train B ESF switchgear room. The controls and wiring for the dampers are completely independent of the control room and will automatically operate to control room temperature. Hand switch GD HS-11A was removed because the hand switch was used to fail the supply damper full open. This is not desired because in extreme cold temperatures pipes within the pump room could freeze. The new configuration

allows the supply and recirculation dampers to

operate as necessary to control room temperature within the required set points.

Prior to room reaching undesirable temperature The timing basis depends on the time for the room to

heat up to a point

where the ESW

pump will not

operate. See

Section 6.5 for discussion about

room cooling. No N/A C18 At NG02AHF3, position NORMAL ISO/OPEN Switch For ESW To UHS Isolation

Valve To ISO/OPEN.

EF HS-38A -

ISO/OPEN S Return flow from the ESW system to the UHS is required for diesel generator cooling, class 1E electrical equipment room cooling, auxiliary feedwater pump room cooler, centrifugal charging pump room cooler, electrical penetration room cooler, containment air coolers, component cooling water heat exchanger and component cooling water pump room cooler. EF HS-38A isolates the control room, adds a redundant Prior to the need for full flow in the ESW system The timing basis depends on the limiting time to establish full flow in the ESW system.

The valve needs to

be fully open prior to establishing No N/A Design Basis Document for Procedure OFN RP-017 Page 77 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps fuse in the circuit and fully opens valve EF HV-38. Valve EF HV-38 is maintained partially open (66%)

during normal operation and fully opens on SIS or LOSP. A fire in the control room could cause a short that bypasses the control room handswitch and signals the valve to close. However, based on

drawing E-13EF06A and E-025-00007, Sheet 185, the valve will not fully close because limit switch contact ZS/16 prevents the valve from closing past the 66%

setpoint.

The ESW loads that are necessary shortly after the diesel generator is started in Step C9 are diesel generator cooling, class 1E electrical equipment room

cooling, auxiliary feedwater pump room cooler and electrical penetration room cooler. Based on calculation EF-10, the flow rates for each of these

components are: diesel generator cooling (1,200 gpm), class 1E electrical equipment room cooling (66 gpm), auxiliary feedwater pump room cooler (128

gpm) and electrical penetration room cooler (100 gpm). The total flow to these loads is 1,494 gpm. As stated above, valve EF HV-38 will be approximately 66% open which is more than adequate to flow 1,494 gpm through this 30 inch valve. Therefore, Step C18 does not have to be performed to establish ESW flow to these loads.

Step C18 will need to be completed before the remaining loads are needed to ensure full flow in the ESW system is available.

CCW heat exchanger and

containment air

cooler flow, since

the total flow to these systems is

11,350 gpm per calculation EF-10.

See Section 6.5 for discussion about

CCW and containment cooling.

Design Basis Document for Procedure OFN RP-017 Page 78 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C19 At NG02AFF4, Position NORMAL

ISO/CLOSE Switch For RWST To RHR Pump B ISO Valve To ISO/CLOSE.

BN HS-8812B -

ISO/CLOSE R, M This action prevents or mitigates a loss of RWST inventory to the containment sump. The hand switch isolates the control room, inserts a redundant fuse in the control circuit and closes the valve. Step C12 restores power to the MCC cubicle for this valve.

28 Calculation XX-E-013 shows there is

28 minutes available before the RWST drains to a

level below that

required for cold

shutdown. No N/A C20 On NG02AHR3, Open RWST To CCP B

Suction Valve:

BN HS-112E - ISO/OPEN R, M This step aligns the RWST to the Train B CCP. DCP 12175 added a control room isolation switch and redundant fuse at NG02AHR3 for this valve. This ensures valve BN HV-112E will open (if closed) and

remain open throughout the event when BN HS-112E is placed in the ISO/OPEN position and power is

restored in Step C12.

Prior to the need for charging See Sections 6.1 and 6.2 for discussion about

charging. No N/A C21 At NG02AFR2, Close VCT OUTLET ISO

Valve. BG HS-112C - ISO/CLOSE R, M This valve is isolated before starting the charging pump to prevent hydrogen gas intrusion into the pump. DCP 12131 added a redundant fuse in the control circuit to ensure control power is available when the hand switch is placed in ISO/CLOSE. This ensures the valve will close in response to hand switch actuation after NG02 is energized in Step C12.

Prior to the need for charging See Sections 6.1 and 6.2 for discussion about

charging. No N/A C22 At NG02AHR1, open BG HV-8111 Charging Pump Mini Flow Isolation Valve.

BG HS-8111A -

ISO/OPEN M This valve is required to be open to protect the Train B CCP from overheating during low flow conditions.

DCP 12175 added a control room isolation switch and redundant fuse at NG02AHR1 for this valve. This ensures valve BG HV-8111 will open (if closed) and remain open throughout the event when BG HS-8111A is placed in the ISO/OPEN position and power is restored in Step C12.

Prior to the need for charging See Sections 6.1 and 6.2 for discussion about

charging. No N/A Design Basis Document for Procedure OFN RP-017 Page 79 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C23 On NB02, Start One CCW Pump.

a. Ensure Turbine Building Att B, Step B10 is complete

b. NB0206 - CLOSED S The CCW system is required to provide cooling to the Train B CCP oil cooler and the seal water heat exchanger. Both of these components support operation of the Train B CCP.

Step B10 closes the CCW outlet valves from the thermal barrier. This protects the CCW piping against water hammer and prevents inventory loss through the RCP seals. See Step B10 basis.

Step C2 isolates control power to NB02 and ensures NB0206 does not spuriously open after it has been closed.

Step C14 establishes power to the CCW pump room

cooler and Step C18 completes lineup of ESW.

Therefore, room cooling will be available prior to

starting the pump.

Prior to the need for supported components See Section 6.5 for discussion about CCW. No B10, C2 C23 RNO a. Perform the following:

1) WHEN Att B, Step B10 is complete, THEN perform Step C23.b.

2) Do not continue until

Step C23.b is complete.

b. Perform the following:

S a. The RNO ensures the operator does not continue until the prerequisite steps are complete.

b.1 The RNO has the operator start CCW pump D if the B pump did not start. This RNO is included as an enhancement since the control room fire will not prevent an operator from manually closing NB0206.

b.2 This RNO provides instructions for manually charging the springs and closing the breaker if it failed to close or did not remain closed. See discussion regarding Attachment G basis at the end of this table.

Prior to the need for supported components See Section 6.5 for discussion about CCW. No B10, C2

Design Basis Document for Procedure OFN RP-017 Page 80 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 1) IF NB0206 can NOT be closed, THEN close NB0207 to start CCW pump D.

2) IF no CCW pump can be started, THEN perform Attachment G to charge the closing

springs and manually close breakers as necessary to establish

one CCW pump

running.

Design Basis Document for Procedure OFN RP-017 Page 81 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C24 Start CCP B:

a. Check RCP seal injection isolated and CCW service loop aligned Ensure Turbine Building Att. B, Step B11, RCP seal isolation is complete AND Ensure Auxiliary Building steps D4

through D10, CCW

service loop

alignment are complete

b. NB0201 - CLOSED M Seal cooling is no longer restored in OFN RP-017 due to the uncertainty in the time before seal failure can

occur. Therefore, prior to starting the CCP, operators verify seal injection is isolated. Seal injection is isolated in Step B11.

The CCP oil cooler and seal water heat exchanger require CCW. Therefore, the CCW system needs to

be aligned prior to starting the CCP. Step C23 starts the CCW pumps. Steps D4 through D12 align the CCW service loop to ensure adequate CCW flow to the CCP components. Step B13 closes CCW to RHR

heat exchanger valve EG HV-102 if it spuriously

opened.

Other required alignments are made by this operator prior to performing Step C24. These alignments are made in steps C12, C20, C21 and C22. After all alignments are made, the CCP breaker is closed to

start the pump.

28 SA-08-006 shows the CCP needs to

be started within 28

minutes. See Sections 6.1 and 6.2 for discussion

about charging.

No B11, C20,

C21, C22, C23, D4, D5 Design Basis Document for Procedure OFN RP-017 Page 82 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C24 RNO a. Perform the following:

1) WHEN RCP seal injection is

isolated AND CCW alignment is

complete, THEN perform Step

C24.b.

2) Do Not continue until Step C24.b is complete.

b. Perform Attachment G to charge the closing

springs and manually

close NB0201 M a. The RNO ensures the operator does not continue until the prerequisite steps are complete.

b. The RNO provides instructions for manually charging the springs and closing the breaker, if it failed to close or did not remain closed. See discussion regarding Attachment G basis at the end of this table.

28 SA-08-006 shows the CCP needs to

be started within 28

minutes. See Sections 6.1 and 6.2 for discussion

about charging. No N/A C25 Inform SRO That CCW and CCP Pumps Have Been Started N/A This step ensures the SRO is informed that the pumps are operating.

N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 83 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C26 Right Of NG04D, Align Diesel

Generator Building Ventilation:

Position DG VENT SUPPLY FAN B

ISOLATION

SWITCH to ISO/RUN o GM HS-11B - ISO/RUN S This step ensures adequate Train B diesel generator room ventilation. The diesel generator room exhaust damper is failed open in Step C2 to ensure adequate diesel engine combustion air. The supply fan and outside air intake damper are not required for combustion air but are required for room cooling.

GM HS-11B is an ISO/RUN switch that operates the Train B diesel generator room supply fan CGM01B.

The switch isolates the control room, adds a redundant fuse in the circuit and starts the fan. The fan is powered from NG04DBF6 which is energized in

Step C14.

DCP 13800 re-located the control cards for the Train B EDG room supply and recirculation dampers from

the control room panel RP053B to panel RP147B in the Train B ESF switchgear room. The controls and wiring for the dampers are completely independent of

the control room and will operate to control room temperature. The action to open NG04DEF111 is no longer required to fail the supply damper open. This is not desired because in extreme cold temperatures pipes within the pump room could freeze. The new configuration allows the supply (GM TZ-11A) and recirculation (GM TZ-11B) dampers to operate as necessary to control room temperature within the

required set points.

155 Calculation change notice AN-02-010-

000-02 documents an analysis of the

diesel generator room temperatures without supply fan

operation. The calculation was

performed using 3 different outside air temperatures (97, 100 and 105 F) and

assumed the

starting room temperature equals

the outside room

temperature (very

conservative). The calculation shows

that even at a

starting room temperature of 105

F, it takes 155

minutes to reach the diesel generator

design temperature

of 122 F.

No N/A Design Basis Document for Procedure OFN RP-017 Page 84 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C27 Isolate Possible RCS Leakage Paths:

a. On NK41, open

NK4119, MCB

CONTROL PANELS RL001 AND RL002 to close Excess Letdown

Heat Exchanger Valves

NK4119 - OFF

b. On NK44, open

NK4407, MCB

CONTROL PANELS RL001 AND RL002 to close Excess Letdown

Heat Exchanger Valves.

NK4407 - OFF

M NK4119 and NK4407 supply power to portions of RL001/RL002. Panel RL001/RL002 supplies power to a number of loads, including the excess letdown heat exchanger valves. Loss of power to these valves will fail them closed, preventing inventory loss through this

path.

Loss of power to the remaining loads supplied by

these breakers in RL001/RL002 will have no adverse impact. 37 For the excess letdown flow path to

open, it would take

spurious operation

of at least 3 valves.

Flow would be

limited to the

volume that can

flow through the 1"

excess letdown

pipe. The pressurizer level is typically held at 55 to 60%. After a trip, the volume will

shrink due to RCS

cooldown to 561F.

Based on SA 006, initial

shrinkage is typically to 30%

NR. Per WCRE-03, 30% equates to 4,373 gallons. The

volume of water

below the lowest level transmitter is

637 gallons.

Therefore, the inventory that can

be lost before going

off scale low is No N/A Design Basis Document for Procedure OFN RP-017 Page 85 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps 3,736 gallons.

Assuming a

maximum of 100

gpm lost through the excess letdown

flow path, there is at least 37 minutes available to mitigate

a failed open excess letdown flow

path. C28 On NK44, Open NK4411, MCB CONTROL PANELS

RL023 AND RL024 For S/G Blowdown Isolation Valves.

NK4411 - OFF R, M, D NK4411 supplies power to Separation Group 4 125 vdc loads in RL023/RL024. These loads include blowdown valves BM HV-1 thru BM HV-4.

Disconnecting power to these valves will fail them closed, which is the desired position.

Loss of power to the remaining loads supplied by this

breaker will have no adverse impact.

Also see discussion in Section 7.3.1.a.

60 Calculation WCNOC-CP-002

shows the blowdown valves

can remain open for

over 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. No N/A Design Basis Document for Procedure OFN RP-017 Page 86 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps C29 Start EDG Fuel Oil Xfer Pump:

a. At NG04DDF3, place Emergency FO

Transfer Pump Isolation Switch in Isolate.

JE HS-21C - ISO

b. At panel KJ-122, start Emergency Fuel Oil Transfer Pump.

JE HS-21B - RUN S Change package 12176 added hand switch JE HS-21C to isolate the pump control circuit from the Control Room. In addition, operation of the switch will insert a new fuse in the circuit in case the main fuse

opened as a result of the fire. This ensures the transfer pump will start when JE HS-21B is placed in

the RUN position. NG04 is energized in Step C14.

60 The diesel engine can run for at least 60 minutes using the fuel in the day

tank, given the

reduced loading

imposed on the

engine during PFSSD. Therefore, this action should

be completed within 60 minutes. No N/A C30 Contact SRO at ASP For Further Direction N/A N/A N/A N/A N/A N/A D1 In Rod Drive M/G Room Isolate Normal Letdown PK5117, RC

& SUPPORT SYS.

CONTROL PNL.

RL001 & RL002.

PK5117 - OFF M The PFSSD strategy is to use BG LCV-459 and BG LCV-460 to isolate normal letdown. In order to isolate BG LCV-459 and BG LCV-460, PK5117 is placed in the OFF position to disrupt power to these valves and fail them closed. This will also disrupt power to auxiliary pressurizer spray valve BGHV8145 and fail the valve closed. This action will also disrupt power to a number of other separation group 5 125 vdc loads in RL001/RL002, but this will have no adverse impact on

PFSSD. 7 SA-08-006 assumes the letdown isolation valves are closed

within 7 minutes

and the auxiliary spray valve is

closed within 7 minutes. No N/A Design Basis Document for Procedure OFN RP-017 Page 87 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D2 Proceed to Emergency Locker

2026' Level And Obtain A Copy Of This Procedure.

N/A Procedure is required to complete remaining Attachment D steps. N/A N/A N/A N/A D3 Perform The Following:

a. Obtain the following from emergency locker:

Radio Flashlight Circular soft jawed pliers

b. Select Channel 1 on

radio

N/A A radio is required to ensure communication with the SRO at the ASP and other operators. Channel 1 is used by Operations for communication. A flashlight

supplements fixed battery powered emergency lights.

The soft-jawed pliers are required to disconnect the Amphenol connectors for the main steam isolation valves. N/A N/A N/A N/A D4 On NG04C, Perform the Following:

At NG04CHF2, place EF HS-60 to ISO/CLOSE Turn off NG04CHF3, EGHV102 CCW

SUPPLY TO RHR

HEAT EXCHANGER Bkr M, S EF HS-60 is placed in ISO/CLOSE to close EF HV-60 and prevent flow imbalance in the Train B ESW system. This valve is required to be closed since manual valve EF V-090 is throttled to provide the correct cooling flow from Train B ESW through the Train B CCW heat exchanger. With EF HV-60 open, the flow balance will be affected, possibly drawing ESW from other essential components. The valve will close when power is restored to NG04 in Step C14.

Placing the switch in ISO/CLOSE before power is

restored will have no adverse impact.

Prior to the need for charging and supported equipment See Sections 6.1 and 6.2 for timing basis for charging.

See Section 6.5 for

timing basis for

CCW and ESW. No N/A Design Basis Document for Procedure OFN RP-017 Page 88 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps At NG04CJF3, place EG HS-16A to ISO/OPEN At NG04CKF1, place EG HS-54 to ISO/OPEN At NG04CKF2, place EM HS-

8803B to ISO/OPEN Turn off NG04CKF3,

EMHV8801B BIT DISCHARGE ISOLATION VALVE

Bkr At NG04CNF3, place EF HS-52 to

ISO/OPEN NG04CHF3 is placed in OFF position to prevent spurious opening of EGHV102 and to allow an operator to close the valve if it did spuriously open.

The valve needs to be closed to ensure sufficient CCW flow to the CCP oil cooler and seal water heat exchanger to support Train B CCP functionality. This action needs to be completed before Step D7.

EG HS-16A is placed in ISO/OPEN to open EG HV-16 and provide a return flow path from the service loop to the Train B CCW pump suction. The valve is required to be open to ensure CCW flow to the seal water heat

exchanger, which is requir ed to ensure Train B CCP operability. The valve will open when power is restored to NG04 in Step C14. Placing the switch in

ISO/OPEN before power is restored will have no adverse impact.

EG HS-54 is placed in ISO/OPEN to open EG HV-54 and provide a supply flow path from the Train B CCW pump to the service loop. The valve is required to be open to ensure CCW flow to the seal water heat

exchanger, which is requir ed to ensure Train B CCP operability. The valve will not actually open until power is restored to NG04 in Step C14. Placing the

switch in ISO/OPEN before power is restored will have no adverse impact.

EM HS-8803B is placed in ISO/OPEN to ensure Train B CCP flow to the RCS through the BIT. This is the only boration and inventory control flow path credited.

The valve will not actually open until power is restored Design Basis Document for Procedure OFN RP-017 Page 89 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps to NG04 in Step C14. Placing the switch in ISO/OPEN before power is restored will have no adverse impact.

NG04CKF3 is placed in OFF to prevent spurious operation of EM HV-8801B. DCP 12130 modified the control circuit for EM HV-8801B to address NRC IN

92-18 concerns. Step B13 throttles EM HV-8801B.

EF HS-52 is placed in ISO/OPEN to ensure a flow

path from Train B ESW to the Train B CCW heat exchanger. The Train B CCW heat exchanger is required for CCP B oil cooler and the seal water heat

exchanger, which are both required for CCP operability. The valve will not actually open until power is restored to NG04 in Step C14. Placing the

switch in ISO/OPEN before power is restored will have no adverse impact.

D5 On NG01B, Isolate Power To EM HV-8801A, BIT Outlet

Valve NG01BER2 - OFF M Valve EM HV-8801A is closed in Step B13 to prevent overfilling the pressurizer. Step D5 needs to be completed prior to Step B13 to prevent the valve from re-opening. This step was added as a compensatory

measure per CR 00045442, which identified the potential to overfill the pressurizer if this valve were to spuriously open as a result of a safety injection signal.

The step is no longer considered a compensatory measure, but rather a permanent part of the procedure. Valve EM HV-8801A was modified in DCP 13614 to address NRC IN 92-18. Closing valve EM HV-8801A or ensuring it is closed will prevent the pressurizer from going water solid.

28 minutes to control charging flow Based on SA-08-006, operators have

28 minutes to

control charging

flow through the BIT. Train B CCP

is stopped in 10 minutes, reducing

the flow to the RCS

following a spurious

SIS. No N/A Design Basis Document for Procedure OFN RP-017 Page 90 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D6 Locally Ensure CCW Return From Nuclear

Auxiliary

Components to Train A CCW Is Closed:

a) Verify with SRO at ASP, that Step 5.c is complete. b) Ensure EG HV-15 (2026' AUX BLDG, ABOUT 30' SOUTH OF CCW HX "A", BY WEST WALL) is closed.

S EG HV-15 is closed to ensure flow is not diverted to the Train A CCW surge tank. The CCW lineup in OFN RP-017 maintains water flow from CCW to the excess letdown heat exchanger. Therefore, Train B return flow could potentially flow into the Train A CCW piping

if EG HV-15 is open.

Step 5.c opens the MCC breaker for EG HV-15 and needs to be completed before Step D6.

Prior to the need for supported equipment See Section 6.5 for timing basis for CCW. No 5.c D6 RNO a. DO NOT CONTINUE until Step 5.c is complete.

S The RNO ensures the operator does not continue until the prerequisite step is complete.

Prior to the need for supported equipment See Section 6.5 for timing basis for CCW. No 5.c D7 In the 2026' Aux Bldg Hallway (outside the MG Set Room), locally

close CCW SUPPLY TO RHR HX B.

EG HV-102 CLOSED Step D4 opens the breaker for EG HV-102, ensuring the valve will not change position after it has been closed. Valve EG HV-102 needs to be closed to ensure sufficient CCW flow to the CCP oil cooler and seal water heat exchanger to support Train B CCP functionality. This action needs to be completed before the Train B CCP is started.

28 minutes to start the charging pump and control charging flow. See Section 6.2 for timing basis for

charging. No D4 Design Basis Document for Procedure OFN RP-017 Page 91 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D8 In South Electrical Penetration Room, Place Boron Inj Upstream Test Line NORM ISO/CLOSE Switch To ISO/CLOSE.

EM HS-8843 - ISO/CLOSED M This step ensures one of the two SIS test lines is isolated to prevent flow diversion through the test line.

Step D16 isolates the second line. Both valves are normally closed and fail closed on loss of power.

Switch EM HS-8843 will isolate power to the valve and fail it closed.

The SIS test lines discharge into a common 3/4 inch line. Flow would then pass two normally closed 3/4

inch air operated valves before returning to the RWST or the RHUT. For the failure to occur, there would have to be 3 spurious actuations, which is extremely unlikely and is not postulated for a control room fire.

71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br /> With the SIS flow path open, it would take a considerable

amount of time to

reduce RWST volume to below

that needed for safe

shutdown. Per XX-

E-013, 214,260 gallons can be lost from the RWST.

Assuming 50 gpm

lost through the 3/4" SIS test line, it

would take 71

hours to reduce

RWST volume to a

level below that required for safe

shutdown. No N/A Design Basis Document for Procedure OFN RP-017 Page 92 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D9 On NG02B, Start Electrical Penetration Room Cooler:

a. At NG02BAF2, place Norm/Iso-

Run switch to ISO-RUN o GL HS ISO-RUN

b. At NG02BAF2, depress start

pushbutton S Based on the Wolf Creek TRM, Table TR 3.7.22-1, the allowable temperature in the Train B electrical penetration room is 101 F.

Switch GL HS-35, when placed in ISO/RUN position, will isolate the control room circuit and insert a redundant fuse. However, the unit will not start until the start push button is depressed, which will energize the 42 coil, close the seal in contact and start the unit.

Therefore, both GL HS-35 and the push button need

to be actuated to start the cooler. Step C14 establishes power to the cooler.

Prior to room reaching unacceptable temperature The timing of this step is based on

the time for the

room to reach

temperatures

beyond operability

limits of the

equipment. See

Section 6.5 for discussion on room cooling. No N/A D10 On NG02B, Isolate Power To EG HV-133, THERMAL BARRIER CCW RETURN HV-61 BYPASS ISO VLV.

NG02BHF1 - OFF S Step B10 verifies EG HV-133 is closed after this step is complete. This valve is closed for the same reason that EG HV-61 is closed. See the discussion for Step

5.c. Prior to the need for supported systems See Section 6.5 for discussion about CCW. No N/A D11 Inform the Reactor Operator that CCW

Alignment is Completed S This step provides confirmation to the RO that CCW alignment has been completed.

Step C23.a requires the RO to confirm Step B10 is complete. Step B10 cannot be completed until Steps 5.c and D10 are complete. When Steps 5.c, D10 and B10 are complete, the RO can start the CCW pump in

Step C23.b.

28 See Step C23 for timing basis for CCW. N/A N/A Design Basis Document for Procedure OFN RP-017 Page 93 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D12 On NG02BHF3, Open ESW TO CTMT Isolation Valve:

EF HS ISO/OPEN S DCP 11086 added a control room isolation switch and redundant fusing at MCC cubicle NG02BHF3 for valve EF HV-34. This ensures the valve will open (if closed) and remain open throughout the event when EF HS-34 is placed in the ISO/OPEN position and power is restored to NG02B. This valve is required to be open to ensure ESW flow to the Train B containment coolers.

Step C12 establishes power to load center NG02, which supplies power to cubicle NG02BHF3. If Step

D12 is performed prior to Step C12, there will be no adverse impact.

N/A See Section 6.5 for discussion about

containment cooling. No N/A D13 On NG02BHR2, Open ESW FROM CTMT Isolation Valve:

EF HS ISO/OPEN S DCP 11086 added a control room isolation switch and redundant fusing at MCC cubicle NG02BHR2 for valve EF HV-46. This ensures the valve will open (if

closed) and remain open throughout the event when EF HS-46 is placed in the ISO/OPEN position and power is restored to NG02B. This valve is required to be open to ensure ESW flow from the Train B containment coolers.

Step C12 establishes power to load center NG02, which supplies power to cubicle NG02BHR2. If Step

D13 is performed prior to Step C12, there will be no adverse impact.

N/A See Section 6.5 for discussion about

containment cooling. No N/A Design Basis Document for Procedure OFN RP-017 Page 94 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D14 On NG02B, open ESW To/From CTMT Air Cooler Valves.

a. At NG02BDR1 open EF HV-32 ESW B To CTMT Air Coolers

EF HS ISO/OPEN

b. At NG02BDR2 open EF HV-50 ESW B From CTMT Air Coolers

EF HS ISO/OPEN S DCP 12131 added control room isolation switches and redundant fuses at MCC cubicles NG02BDR1 (EF HV-32) and NG02BDR2 (EF HV-50) for these valves.

This ensures valves EF HV-32 and EF HV-50 will

open (if closed) and remain open throughout the event when EF HS-32 and EF HS-50 are placed in the ISO/OPEN position and power is restored to NG02B.

These valves are required to be open to ensure ESW flow to/from the Train B containment coolers.

Step C12 establishes power to load center NG02, which supplies power to cubicles NG02BDR1 and NG02BDR2. If Step D14 is performed prior to Step

C12, there will be no adverse impact.

N/A See Section 6.5 for discussion about

containment cooling. No N/A D15 Start Containment Cooler Fans B and D:

a. At NG02TAF1, start CTMT Cooler Fan B

GN HS-9A - ISO/RUN

b. At NG04TAF1, start CTMT Cooler Fan D

GN HS-17A - ISO/RUN S DCP 12177 installed a redundant fuse in the control circuit for each fan so that, in the event of a fire in the control room, the fans will start when GN HS-9A and GN HS-17A are placed in ISO/RUN position and power is restored to NG02T and NG04T.

Step C12 establishes power to load center NG02, which supplies power to NG02TAF1. If Step D15 is performed prior to Step C12, there will be no adverse impact.

Step C14 establishes power to load center NG04, which supplies power to NG04TAF1. If Step D15 is performed prior to Step C14, there will be no adverse

impact. N/A See Section 6.5 for discussion about

containment cooling. No N/A Design Basis Document for Procedure OFN RP-017 Page 95 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D16 In North Electrical Penetration Room, Place Boron Inj Downstream Test Line NORM ISO/CLOSE Switch to ISO/CLOSE.

EM HS-8882 - ISO/CLOSED M This step ensures one of the two SIS test lines is isolated to prevent flow diversion through the test line.

Step D8 isolates the second line. Both valves are normally closed and fail closed on loss of power.

Switch EM HS-8882 will isolate power to the valve and fail it closed.

The SIS test lines discharge into a common 3/4 inch line. Flow would then pass two normally closed 3/4

inch air operated valves before returning to the RWST or the RHUT. For the failure to occur, there would have to be 3 spurious actuations, which is extremely unlikely and is not postulated for a control room fire. 71 hours8.217593e-4 days <br />0.0197 hours <br />1.173942e-4 weeks <br />2.70155e-5 months <br /> See D8 discussion. No N/A D17 Ensure MSIVs Are Closed By Unplugging All

Amphenol Connectors At The Listed Terminal

Boxes: AB HV A Train TB14540 AB HV A Train TB14533 AB HV A Train TB14538 AB HV A Train TB14535 R, M, D This step is a precaution to ensure the MSIVs remain closed for the duration of the event. Step C2 de-energizes the MSIVs by opening NK5119, which fails them closed. There is reasonable assurance that the MSIVs will not re-open because it would take multiple proper polarity hot shorts to re-energize the MSIV solenoids. In the unlikely event the MSIVs fail open during the event, this could cause a rapid cooldown and return to criticality. To prevent this unlikely event from occurring, the Amphenol connectors are

unplugged.

N/A This step can be completed when all

other steps are

complete. See

Section 6.1 for

additional

discussion

regarding MSIVs. No N/A Design Basis Document for Procedure OFN RP-017 Page 96 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D18 Notify SRO at the Aux Shutdown Panel, Status of MSIVs N/A This step ensures the SRO knows the Amphenol connectors have been pulled. The new MSIVs have no external position indication so the operator at the ASP will have to rely on available instrumentation to

determine position.

60 See D17 discussion.

N/A N/A D19 Request SRO At ASP To Ensure S/G A And C ARVs - CLOSED AB PV CLOSED AB PV CLOSED R, M, D AB PV-1 and AB PV-3 are closed by the SRO at the ASP. AB PV-2 and AB PV-4 are isolated from the

control room and controlled from the ASP.

60 See Section 6.1 for discussion about

steam generator

ARVs. No N/A D20 Isolate air and N2 to AB PV-3, SG C

ATMOSPHERIC RELIEF VLV:

a. KAV1445 -

CLOSED

b. KAV1366 -

CLOSED

c. Vent both regulators

d. Verify AB PV-3 closed R, M, D This step isolates air and nitrogen and bleeds air from the regulator to prevent the valve from opening.

60 See Section 6.1 for discussion about

steam generator

ARVs. No N/A D20 RNO d. Close AB-V029, SG C ATMOSPHERIC

RELIEF VLV ISO R, M, D If AB PV-3 cannot be closed, then manual valve AB-V029 can be closed to isolate steam generator C

ARV. 60 See Section 6.1 for discussion about

steam generator

ARVs. No N/A Design Basis Document for Procedure OFN RP-017 Page 97 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D21 Isolate air and N2 to AB PV-1, SG A

ATMOSPHERIC RELIEF VALVE

a. KAV1435 -

CLOSED

b. KAV1364 -

CLOSED

c. Vent both regulators

d. Verify AB PV-1

closed R, M, D This step isolates air and nitrogen and bleeds air from the regulator to prevent the valve from opening.

60 See Section 6.1 for discussion about

steam generator

ARVs. No N/A D21 RNO d. Close AB-V018, SG A ATMOSPHERIC

RELIEF VLV ISO R, M, D If AB PV-1 cannot be closed, then manual valve AB-V018 can be closed to isolate steam generator A

ARV. 60 See Section 6.1 for discussion about

steam generator

ARVs. No N/A Design Basis Document for Procedure OFN RP-017 Page 98 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps D22 In SGK04B Room, Start Class 1E Electrical Equipment A/C Unit:

Position SGK05B NORMAL ISO/RUN Switch To ISO/RUN o GK HS-103 -

ISO/RUN S This step ensures room cooling to the Class 1E switchgear rooms. The cooler needs to be started before the rooms reach a temperature beyond operating limits for the equipment. Based on the TRM, Table 3.7.22-1, the maximum allowable temperature in the rooms supplied by SGK05B is 101 F. In order for the unit to operate, there needs to be power to NG02A and ESW flow to the cooler. Power is restored in Step C12. ESW lineup is completed by step C13. Steps C12 and C13 should be completed

well before Step D22.

60 Technical Requirement 3.7.23 states that with one

Class 1E A/C Unit

inoperable, establish

compensatory

measures within 2

hours. For the

purposes of OFN RP-017, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> will

be used as the

timing requirement

to restore cooling.

See Section 6.5 for

additional discussion about

room cooling.

No C10, C13 D23 Proceed As Directed By SRO at ASP.

N/A Attachment D is complete and the SRO will direct the operator at this point. N/A N/A N/A N/A E1 Proceed to NB02 Switchgear Room And Obtain The Following:

• Copy of this procedure

• Flashlight N/A Procedure is required to complete remaining Attachment E steps. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 99 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps E2 Ensure Motor Driven AFW Pump A Is Stopped:

a. Remove CLOSE control power fuse (UC)

NB0105/FUSE - OFF

b. Stop Motor Driven

AFW Pump A

NB0105 - OPEN D The Train A MDAFP breaker is opened to stop the pump and prevent uncontrolled AFW flow to steam generators B and C which could result in overfilling the

steam generators. Although A Train equipment is not credited, spurious actuation of A Train equipment needs to be mitigated if it could lead to unwanted consequences. In this case, overfilling of the steam generators is not desired and is, therefore, being prevented in OFN RP-017.

15 SA-08-006 shows that if the pump is stopped within 15 minutes and other

actions in the

procedure are taken, overfilling of

steam generators B

and C will not occur. No N/A E3 Place BN HV-8812A, RWST TO RHR PUMP A SUCTION

ISOLATION VALVE Breaker To Off

NG01ACR2 - OFF M This Step ensures BN HV-8812A is de-energized and will not spuriously operate after it has been manually closed in the next step.

28 Calculation XX-E-013 shows there is

28 minutes available before the RWST drains to a

level below that

required for cold

shutdown. No N/A Design Basis Document for Procedure OFN RP-017 Page 100 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps E4 In RHR Pump Room A, Close RWST To RHR Pump A Isolation Valve.

BN HV-8812A -

CLOSED M Valve BN HV-8812A is normally open and is manually closed in OFN RP-017 to prevent the RWST from

draining to the containment sump in the event EJ HV-8811A spuriously opens. Valve BN HV-8812A is a Train A valve so power may not be available, which is why manual operation is required. Step E2 isolates

power to the control circuit to prevent spurious operation after the valve is closed. DCP 12173 modified the control circuit to ensure a control room fire will not damage the valve and prevent manual closure. 28 Based on XX-E-013, operators have

28 minutes to close

the valve and

prevent the RWST

from draining to the containment sump. No E2 E5 Inform The SRO That BN HV-8812A Is

Closed M This step notifies the SRO and the ASP that BN HV-8812A is closed. N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 101 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps E6 Ascend Ladders To 2000 Elevation Aux Feedwater Pump Room

Area And Close The Following Valves:

o TD AFWP DISCHARGE TO SG A HV-8 INLET

ISO.

o AL-V056 -

CLOSED o TD AFWP DISCHARGE TO SG D HV-6 INLET

ISO.

o AL-V061 -

CLOSED o MD AFWP DISCHARGE TO SG A HV-7 INLET

ISO.

o AL-V032 -

CLOSED o TD AFWP DISCHARGE TO SG C HV-12 INLET

ISO.

o AL-V071 -

CLOSED D This step isolates possible AFW flow diversion paths to prevent overfilling the steam generators when operating the TDAFP and the B MDAFP.

35 See Section 6.3 for timing basis. No N/A Design Basis Document for Procedure OFN RP-017 Page 102 of 102 E-1F9915, Rev. 9 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP IN OFN RP-017 STEP DESCRIPTION PFSSD Function (Note 1) BASIS Req'd Time To Complete (min) TIMING BASIS CR Fire Impact? (Note 2) Prereq Steps E7 Notify RP that a non-RCA area was entered

into from the RCA.

N/A This step notifies RP that the operator entered the auxiliary feedwater area from the RCA and the area

may be contaminated. N/A N/A N/A N/A E8 Inform The SRO That the Aux Feedwater

Valves Are Closed, Go

Back Down The Ladder

And Proceed To ASP N/A This step notifies the SRO that the Aux Feedwater valves are closed. N/A N/A N/A N/A Att F Actions to Protect Train A Equipment N/A This attachment was added based on Reference 3.1.a. See discussion under Reference 3.1.a and

Step A16. N/A N/A N/A N/A Att G Manual Charging of Siemens Circuit

Breakers N/A This attachment is included to provide instructions to operators on how to manually charge the Siemens circuit breakers. This attachment is used for some

RNO actions throughout the procedure. The springs are charged for one cycle of operation so entering the attachment will not normally be necessary. N/A N/A N/A N/A Table Notes:

1. PFSSD Functions are as follows: R - Reactivity Control; M - Reactor Coolant Makeup and Inventory Control; D - Decay Heat Removal; P - Process Monitoring; S - Support; N/A - Not Applicable

2. The column labeled "CR Fire Impact?" identifies if a fire in the control room could potentially cause the component to mis-position after the step has been completed. Yes means the component can mis-position and No means the component cannot mis-position. N/A means the question is not applicable to the step.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 1 of 30 Appendix 1 OFN RP-017 Credited Component Evaluation

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 2 of 30 Table A1 documents whether the components credited for hot standby following a control room fire are properly protected against hot shorts, open circuits or shorts to ground that could occur due to a fire in the control room. Also, the evaluation documents whether adequate isolation capability is provided to ensure the credited components remain functional and unaffected by the fire after control room isolation is completed.

This evaluation was performed to satisfy an NRC commitment made in Licensee Event Report 2010-003-00. This evaluation was orig inally performed as a corrective action for CR 00023410-02-01 and is being added to E-1F9915 per CR 00044460-02-01 to ensure the infor mation is maintained in a controlled document. The evaluation has been updated since the original evaluation in CR 00023410-02-01 to reflect the current configuration in OFN RP-017.

Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation ABHS0079 and ABHS0080 The main steam isolation valves (MSIVs) are closed in OFN RP-017 to prevent rapid cooldown and return to criticality. Operators, upon exiting the control room, actuate All Close hand switches ABHS0079 and ABHS0080 to close the MSIVs. The Wolf Creek fire protection licensing basis does not allow us to credit this action. Therefore, later steps have operators remove power from the MSIV solenoids to fail them closed. The circuit is shown on drawings E-13AB26, E-13AB27, E-13AB28 and E-13AB29.

Power is removed from the A Train solenoids by placing NK5119 in the OFF position. This isolates separation group 1 power from MSFIS cabinet SA075A and fails the MSIVs closed.

Power is also removed from the A Train solenoids by removing the Amphenol connectors at the associated terminal box. This is done as a precaution to prevent the unlikely spurious re-opening of the MSIVs due to the control room fire. Loss of power to either train of solenoids will fail the MSIVs closed. A Train was chosen for convenience.

Based on the above discussion, the MSIVs are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 3 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation ABHV0005 Valve ABHV0005 controls steam to the turbine driven auxiliary feedwater pump (TDAFP) from Steam Generator B and opens upon loss of 125 VDC power to the solenoid valve. Redundant control power originates from NK4201 through relay panel RP334 (Dwg E-13RP14) which does not run in the control room. Placing ABHIS0005B in the open position drops power to the solenoid and opens the valve.

Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP3 (Dwgs E-13RP11 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Hand switch ABHIS0005B is placed in the open position at the ASP to open the valve and allow a steam supply to the TDAFP. The control circuit is isolated from the control room when RPHIS0001 is placed in the isolate position. Drawing E-13AB01A shows the control circuit. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ABHV0005 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch ABHIS0005B will function. Therefore, ABHV0005 is protected.

ABHV0006 Valve ABHV0006 controls steam to the turbine driven auxiliary feedwater pump (TDAFP) from Steam Generator C and opens upon loss of 125 VDC power to the solenoid valve. Hand switch ABHIS0006B is placed in the closed position at the ASP to close the valve and prevent steaming steam generator C, which is not being provided with feedwater flow in procedure OFN RP-017. Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP2 (Dwgs E-13RP11 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Drawing E-13AB01 shows the control circuit. The valve opens upon loss of 125 VDC power to the solenoid valve and closes when the solenoid valve is energized. Redundant control power originates from NK4201 through relay panel RP334 (Dwg E-13RP14), which does not run in the control room. Placing RPHIS0001 in the ISOLATE position maintains power to the ABHV0006 control circuit and allows operators to maintain the valve in the closed position from the ASP. A fire in the control room will not affe ct operation of the valve after RPHIS0001 is placed in the isolate position. In the unlikely event valve ABHV0006 opens, PFSSD is assured because steam flow to the TDAFP remains available.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch ABHIS0006B will function. Therefore, valve ABHV0006 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 4 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation ABHV0012, ABHV0015, ABHV0018 and ABHV0021 MSIV Bypass valves ABHV0012, ABHV0015, ABHV0018 and ABHV0021 are failed closed in OFN RP-017 by removing 125 VDC control power from the control circuit. Control power is removed by pulling fuse #46 in panel RP209. This de-energizes auxiliary relay 94XAB05 and subsequently de-energizes solenoid valves associated with the MSIV bypass valves and causes them to close. The valve circuit is shown on drawing E-13AB23A. Panel RP209 wiring for fuse block 46 is shown on drawing E-093-00048. Based on drawing E-093-00048 fuse block 46 does supply power to auxiliary relay 94 XAB05. Therefore, removal of fuse block 46 will cause the MSIV bypass valves to close. The MSIV bypass valves are not considered high/low pressure interfaces so consideration of multiple proper polarity hot shorts is not required. The negative side of the circuit shown on drawing E-13AB23A does not run in the control room. Therefore, after the fuse is pulled there is no possibility that the bypass valves can spuriously open as a result of a fire in the control room.

Based on the above discussion, the MSIV bypass valves are adequately protected in the event of a control room fire. ABPV0001 and ABPV0003 Steam generator ARVs ABPV0001 and ABPV0003 are closed in OFN RP-017 by isolating air and nitrogen to the valves and venting air from the regulators. The ARVs are not isolated from the control room. The Train A ASP has hand switches (ABHS0001 and ABHS0003) that transfer control of ABPV0001 and ABPV0003 to the ASP but the circuits run in the control room. Drawings J-110-00216 and J-110-00220 show the loop diagram for these circuits.

For PFSSD, only two steam generators are needed to maintain hot standby. The control room fire strategy uses steam generator B and D ARVs (ABPV0 002 and ABPV0004) for temperature control and closes steam generators A and C ARVs (ABPV0001 and ABPV0003) to prevent uncontrolled cooldown.

Loss of air and nitrogen to the ARVs will fa il the valves closed. A fire in the control room will not cause the valves to open in the absence of air and nitrogen. Therefore, ARVs ABPV0001 and ABPV0003 are protected.

ABPV0002 and ABPV0004 Steam generator ARVs ABPV0002 and ABPV0004 are controlled in OFN RP-017 at the ASP to control RCS temperature. Hand switches ABHS0002 and ABHS0004 at the ASP are placed in the LOCAL position to transfer control from the control room to the controller at the Train B ASP. The LOOP diagrams for ABPV0002 are shown on drawings J-110-00218, J-110-00219 and J-110-00933. The LOOP diagrams for ABPV0004 are shown on drawings J-110-00222, J-110-00223 and J-110-00934.

Based on a review of these drawings and discussion with the Instrumentation and Control group, ABHS0002 and ABHS0004 will transfer control to the ASP and the control room circuit is isolated after these switches are placed in local position. Therefore, ABPV0002 and ABPV0004 are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 5 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation AELI0502A This level indicator is used to verify steam generator B level. Drawings E-13AE08 and M-761-02303 show the circuit arrangement. Level transmitter AELT0502 sends a signal to SB148A in the Train B ESF switchgear room. From SB148A the signal is split and sent to the main control room indicator AELI0502 and ASP indicator AELI0502A. A fire in the control room that affects AELI0502 and associated cable will not affect AELI0502A because the signal converter will isolate any effects from a short occurring in the control room. Therefore, AELI0502A is protected.

AELI0504A This level indicator is used to verify steam generator D level. Drawings E-13AE08 and M-761-02310 show the circuit arrangement. Level transmitter AELT0504 sends a signal to SB148B in the Train B ESF switchgear room. From SB148B the signal is split and sent to the main control room indicator AELI0504 and ASP indicator AELI0504A. A fire in the control room that affects AELI0504 and associated cable will not affect AELI0504A because the signal converter will isolate any effects from a short oc curring in the control room. Therefore, AELI0504A is protected.

ALHV0005 Valve ALHV0005 is controlled at the ASP by placing hand switch ALHS0005 in the local position and controlling the valve using ALHK0005B. The AL HV-5 circuit is shown on drawings J-110-00349, J-110-00871 and J-110-00939. Technical data sheets for the Foxboro 200 system are provided in vendor manual J-110-00388. These drawings and data sheets were reviewed to determine the circuit configuration and operation of the local hand switch and local valve controller.

When the local hand switch (ALHS0005) is placed in the LOCAL position, relay coils on a relay logic card are energized and the contacts change state. The change of state selects the output fr om the controller at the ASP and de-selects the control room controller. A fire in the control room could affect the control room controller but any spurious signal would not affect the valve controller. This is because spurious signals or hot shorts originating in the control room are isolated in RP147B by either contact output isolators or isolated current to voltage converters. Based on vendor manual J-110-00388, these devices will prevent spurious signals or hot shorts originating in the control room from affecting the ability to control ALHV0005 from the ASP.

The physical makeup of the relay contacts allows only one possible state for each set of contacts. Therefore, the contact pair cannot be both open or both closed. One contact will be open and the other will be closed. Since the test procedure provides positive confirmation that the controller at the ASP does work, th is provides reasonable assurance that the controller in the control room is completely isolated from the circuit when the local hand switch is placed in the LOCAL position. Based on the above discussion, there is reasonable assurance that AL HV-5 is isolated from the control room by demonstration that the controller at the ASP operates the valve. Therefore, ALHV0005 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 6 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation ALHV0010 Valve ALHV0010 is controlled at the ASP by placing hand switch ALHS0010 in the local position and controlling the valve using ALHK0010B. The AL HV-10 circuit is shown on drawings J-110-00354, J-110-00940 and J-110-00941. Technical data sheets for the Foxboro 200 system are provided in vendor manual J-110-00388. These drawings and data sheets were reviewed to determine the circuit configuration and operation of the local hand switch and local valve controller.

When the local hand switch (ALHS0010) is placed in the LOCAL position, relay coils on a relay logic card are energized and the contacts change state. The change of state selects the output fr om the controller at the ASP and de-selects the control room controller. A fire in the control room could affect the control room controller but any spurious signal would not affect the valve controller. This is because spurious signals or hot shorts originating in the control room are isolated in RP147B by either contact output isolators or isolated current to voltage converters. Based on vendor manual J-110-00388, these devices will prevent spurious signals or hot shorts originating in the control room from affecting the ability to control ALHV0010 from the ASP.

The physical makeup of the relay contacts allows only one possible state for each set of contacts. Therefore, the contact pair cannot be both open or both closed. One contact will be open and the other will be closed. Test procedure STS RP-004 provides positive confirmation that the controller at the ASP does work, so this provides reasonable assurance that the controller in the control room is completely isolated from the circuit when the local hand switch is placed in the LOCAL position.

Based on the above discussion, there is reasonable assurance that ALHV0010 is isolated from the control room. Therefore, ALHV0010 is protected.

ALHV0030 Valve ALHV0030 is opened when necessary using ALHIS0030B to supply the Train B MDAFP with ESW. Upon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP5 (Dwgs E-13RP12 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Drawing E-13AL04B shows the control circuit for this valve. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0030 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0030B will function. Therefore, valve ALHV0030 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 7 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation ALHV0033 OFN RP-017 places ALHIS0033B in the close position to ensure valve ALHV0033 is closed. Step A17 opens the valve when it is necessary to swap to ESW to supply the TDAFW pump. U pon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP6 (Dwgs E-13RP12 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit is shown on drawing E-13AL04B. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0033 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0033B will function. Therefore, ALHV0033 is protected.

ALHV0034 OFN RP-017 places ALHIS0034B in the open position to open valve ALHV0034. The ALHV0034 circuit is isolated from the control room when RPHIS0002 is placed in the isolate position. Upon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP5 (Dwgs E-13RP12 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit is shown on drawing E-13AL02B. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0034 after the isolation switch is operated. The valve may not readily open when ALHIS0034B is placed in the open position because power is not restored to the MCC until Step C13. This is acceptable because AFW is not needed until 15 minutes into the event. Step C13 is completed prior to 15 minutes.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0034B will function. Therefore, ALHV0034 is protected.

ALHV0036 Valve ALHV0036 is manually operated in OFN RP-017 because this valve is powered from Train A MCC cubicle NG03CEF4. Power is disconnected from the valve by opening Train A MCC cubicle breaker NG03CEF4. Train A components are not protected against faults occurring as a result of a control room fire. The control circuit for valve ALHV0036 is shown on drawing E-13AL02C. Change package 12170 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures a control room fire will not damage the valve and prevent it from being opened manually. Therefore, ALHV0036 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 8 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation APLI0004B Condensate Storage Tank (CST) Level Indicator APLI0004B is used by operators in OFN RP-017 to verify level in the CST. When level drops to 14%, the procedure directs operators to swap to the ESW source. OFN RP-017 also directs operators to use the local indicator. Level indicator APLI0004B circuit is shown on drawing J-110-00098. Based on a review of this drawing, the level indicator is not isolated from the effects of a control room fire and could provide erroneous readings. The Note above the Step in OFN RP-017 where APLI0004B is used states that level indicator APLI0004B could be affected by the fire. Therefore, Operators will be aware that they should not rely on this level indicator. Isolation of this level indicator is not required because level in the CST is not a concern initially since sufficient volume exists to supply the steam generators for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. At that time, sufficient personnel will be available to locally monitor CST level.

Therefore, the configuration is acceptable.

BBLI0460B This level indicator is used to verify pressurizer level. Drawings E-13BB16 and M-761-02304 show the circuit arrangement. Level transmitter BBLT0460 sends a signal to SB148A in the Train B ESF switchgear room. From SB148A the signal is split and sent to the main control room indicator BBLI0460A and ASP indicator BBLI0460B. A fire in the control room that affects BBLI0460A and associated cable will not affect BBLI0460B because the signal converter will isolate any effects from a short occurring in the control room. Therefore, BBLI0460B is protected.

BBPI0406X This pressure indicator is used to verify RCS pressu re is being maintained between 2000 and 2300 psig. The circuit arrangement is shown on drawings E-13BB16 and M-761-02311. Pressure transmitter BBPT0406 sends a signal to SB148B in the Train B ESF switchgear room. From SB148B the signal is split and sent to the main control room indicator BBPI0406 and ASP indicator BBPI0406X. A fire in the control room that affects BBPI0406 and associated cable will not affect BBTPI0406X because the signal converter will isolate any effects from a short occurring in the control room. Therefore, BBPI0406X is protected.

BBTI0423X This temperature indicator is used to verify RCS Loop 2 cold leg temperature. Drawings E-13BB15 and M-761-02301 show the circuit arrangement. Loop 2 cold leg temperature element BBTE0423B sends a signal to Cabinet 2A which is SB148A located in the Train B ESF switchgear room (Fire Area C-10). From SB148A the signal is split and sent to the main control room indicator BBTI0423B and ASP indicator BBTI0423X. A fire in the control room that affects BBTI0423B and associated cable will not affect BBTI0423X because the signal converter will isolate any effects from a short occurring in the control room. Therefore, BBTI0423X is protected.

BG8402B Valve BG8402B is a manual valve. A control room fire will not affect operation of the valve. Therefore, BG8402B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 9 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation BGHV8111 Valve BGHV8111 is opened in OFN RP-017 to ensure adequate minimum flow through the Train B charging pump. This prevents heatup and damage to the pump. Hand switch BGHS8111A, located at MCC cubicle NG02AHR1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13BG11C. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHR1. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve BGHV8111 is protected.

BGLCV0112C Valve BGLCV0112C is closed in OFN RP-017 to isolate the VCT from the charging header. Hand switch BGHS0112C is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13BG12A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AFR2. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve BGLCV0112C is protected.

BGV0017 Valve BGV0017 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV0017 is protected.

BGV0101 Valve BGV0101 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV0101 is protected.

BGV0105 Valve BGV0105 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV0105 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 10 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation BNHV8812A Valve BNHV8812A is manually closed in OFN RP-017 to prevent draindown of the RWST to the containment sump. This valve is powered from Train A MCC cubicle NG01ACR2. The operator removes power from the valve by opening NG01ACR2 before manually closing the valve. The control circuit is shown on drawing E-13BN03. The circuit is not isolated from the control room. Removal of power will prevent spurious operation of the valve in the event of a control room fire. DCP 12173 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually closed when needed. Therefore, valve BNHV8812A is protected.

BNHV8812B Valve BNHV8812B is closed in OFN RP-017 to prevent flow diversion from the RWST to the containment sump. Hand switch BNHS8812B is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13BN03A. The circuit was modified in DCP 12173 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AFF4. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve BNHV8812B is protected.

BNLCV0112E Valve BNLCV0112E is opened in OFN RP-017 to establish a suction source from the RWST to the Train B CCP. Hand switch BNHS0112E, located at MCC cubicle NG02AHR3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13BN01A. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHR3. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve BNLCV0112E is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 11 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0026 Valve EFHV0026 is closed in OFN RP-017 to prevent flow diversion from ESW to the service water piping. Hand switch EFHS0026A is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13EF02A. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AHF2. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve EFHV0026 is protected.

EFHV0032 Valve EFHV0032 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0032, located at MCC cubicle NG02BDR1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF07A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BDR1. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0032 is protected.

EFHV0034 Valve EFHV0034 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0034, located at MCC cubicle NG02BHF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF09A. The circuit was modified in DCP 11086 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BHF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0034 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 12 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0038 Valve EFHV0038 is opened in OFN RP-017 to establish Train B ESW flow to the UHS. Hand switch EFHS0038A, located at MCC cubicle NG02AHF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF06A. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHF3. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve EFHV0038 is protected.

EFHV0046 Valve EFHV0046 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0046, located at MCC cubicle NG02BHR2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF09A. The circuit was modified in DCP 11086 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BHR2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0046 is protected.

EFHV0050 Valve EFHV0050 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0050, located at MCC cubicle NG02BDR2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF08A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BDR2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0050 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 13 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0052 Valve EFHV0052 is opened in OFN RP-017 to establish Train B ESW flow to the Train B CCW heat exchanger. Hand switch EFHS0052, located at MCC cubicle NG04CNF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF05A. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CNF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0052 is protected.

EFHV0060 Valve EFHV0060 is closed in OFN RP-017 to prevent a flow imbalance in the essential service water (ESW) system. Hand switch EFHS0060 is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13EF04A. The circuit was modified in DCP 13898 to address NRC IN 92-18 concerns and to add the isolation switch and redundant fuse after condition report 00041746 identified the potential flow balance concern. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG04CHF2. A different step restores power to the MCC so that when the switch is actuated and/or power is restored, the valve will close.

Based on the above discussion, valve EFHV0060 is protected.

EGHV0015 Valve EGHV0015 is manually closed in OFN RP-017 to prevent flow diversion from Train B CCW to Train A CCW. Breaker NG03CHF3 is opened in an earlier step to remove power from the circuit. The circuit is shown on drawing E-13EG05C. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually closed when necessary.

A fire in the control room could damage the control circuit for the valve but the damage will not cause the valve to spuriously operate after the breaker is opened. Therefore, valve EGHV0015 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 14 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EGHV0016 Valve EGHV0016 is opened in OFN RP-017 to establish Train B CCW flow from the service loop. Hand switch EGHS0016A, located at MCC cubicle NG04CJF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EG05A. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CJF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EGHV0016 is protected.

EGHV0054 Valve EGHV0054 is opened in OFN RP-017 to establish Train B CCW flow to the service loop. Hand switch EGHS0054, located at MCC cubicle NG04CKF1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EG05D. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CKF1. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EGHV0054 is protected.

EGHV0061 Valve EGHV0061 is manually closed in OFN RP-017 because this valve is powered from Train A MCC cubicle NG03CKF3. Train A components are not protected against faults occurring as a result of a control room fire. An operator removes 480 VAC power from the valve by opening NG03CKF3 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-13EG09A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures this does not occur so the valve can be manually operated when needed. Therefore, valve EGHV0061 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 15 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EGHV0133 Valve EGHV0133 is manually closed in OFN RP-017. This valve is powered from Train B MCC cubicle NG02BHF1. An operator removes 480 VAC power from the valve by opening NG02BHF1 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-13EG18A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures this does not occur so the valve can be manually operated when needed. Therefore, valve EGHV0133 is protected.

EMHV8801A / NG01BER2 Valve EMHV8801A is closed in OFN RP-017 to prevent overfill of the pressurizer. This valve is powered from Train A MCC cubicle NG01BER2. An operator removes 480 VAC power from the valve by opening NG01BER2 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-13EM02C. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. Change package 13614 modified the valve control circuit to address NRC IN 92-18 to ensure the valve can be manually closed. The pressurizer overfill concern was identified in CR 00045442.

EMHV8801B / NG04CKF3 Valve EMHV8801B is throttled in OFN RP-017 to control charging injection flow. This valve is powered from Train B MCC cubicle NG04CKF3. An operator removes 480 VAC power from the valve by opening NG04CKF3 before another operator manually throttles the valve in another step. The control circuit is shown on drawing E-13EM02A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually throttled when needed. Therefore, valve EMHV8801B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 16 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation EMHV8803B Valve EMHV8803B is opened in OFN RP-017 to establish Train B CCP flow to the boron injection tank (BIT). Hand switch EMHS8803B, located at MCC cubicle NG04CKF2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EM02B. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CKF2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EMHV8803B is protected.

EMHV8843 Valve EMHV8843 is closed in OFN RP-017 to prevent flow diversion from charging through the SIS test line which discharges to the RWST or the RHUT. Hand switch EMHS8843 is used to close the valve but does not completely isolate the control room. The circuit is shown on drawing E-13EM04A.

The valve is a solenoid operated valve that requires 125 VDC to open. Actuation of hand switch EMHS8843 to the ISO/CLOSE position will open contacts on the positive side of the circuit and de-energize the solenoid. The negative side of the circuit is not isolated. Based on a review of the drawing, a positive hot short in the control room affecting this circuit will not cause the valve to open because the isolation contacts on the hand switch will be open, preventing the re-energization of the solenoid.

Based on the above discussion, valve EMHV8843 is protected.

EMHV8882 Valve EMHV8882 is closed in OFN RP-017 to prevent flow diversion from charging through the SIS test line which discharges to the RWST or the RHUT. Hand switch EMHS8882 is used to close the valve but does not completely isolate the control room. The circuit is shown on drawing E-13EM05A.

The valve is a solenoid operated valve that requires 125 VDC to open. Actuation of hand switch EMHS8882 to the ISO/CLOSE position will open a contact on the positive side of the circuit and de-energize the solenoid. The negative side of the circuit is not isolated. Based on a review of the drawing, a positive hot short in the control room affecting this circuit will not cause the valve to open because the isolation contacts on the hand switch will be open, preventing the re-energization of the solenoid.

Based on the above discussion, valve EMHV8882 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 17 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation FCHV0312 Valve FCHV0312 is opened using FCHIS0312B at the ASP. This allows steam to flow to the turbine driven auxiliary feedwater pump. Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP1 (Dwgs E-13RP11 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit for FCHV0312 is shown on drawing E-13FC23. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve FCHV0312 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch FCHIS0312B will function. Therefore, valve FCHV0312 is protected.

FCHV0313 DCP 12958 replaced the analog governor control system for valve FCHV0313 with a Westinghouse Ovation digital control system. The control circuit is shown on drawing E-13FC24.

Hand switch FCHS0313 is placed in LOCAL position at the ASP to transfer speed control to the ASP. A hot short that occurs on this circuit prior to placing the switch in LOCAL will be cleared by the surge protection device (FCIB0313) so that the remaining portions of the control circuit are unaffected.

A fire in the control room could affect the circuit for the turbine speed indicator and speed setpoint indicator (FCSI0313A). These circuits are isolated from the control room by signal isolators located in panel FC219 (See drawing M-021A-00019, Sheet 3).

Based on the above discussion, there is reasonable assurance that valve FCHV0313 can be controlled at the ASP when FCHS0313 is placed in LOCAL position. Therefore, valve FCHV0313 is protected.

GDHS0011 Hand switch GDHS0011 isolates the Train B ESW pump room supply fan from the control room, inserts a redundant fuse on the secondary side of the control power transformer, and starts the fan. The circuit is shown on drawing E-K3GD01A. Based on a review of the schematic, the hand switch will isolate all portions of the control room and start the fan. Therefore, the fan will operate during the event.

Exhaust damper GDTZ0011C opens when supply fan CGD01B starts. The exhaust damper circuit is shown on drawing E-K3GD03. When hand switch GDHS0011 is placed in the ISO/RUN position, auxiliary relay 3XGD2 is energized, which closes a contact and energizes the contactor relay 42 and starts the fan. Relay 42, when energized, opens a contact in the exhaust damper circuit, which de-energizes the exhaust damper and fails it in the full open position. None of the circuits associated with the exhaust damper are run in the control room. Therefore, the control room fire will no t affect the exhaust damper.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 18 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation During normal operation, the outside air intake damper and recirculation damper operate as necessary to maintain the ESW pump room within design limits. In the winter months, most of the air flow is recirculated with minimal outside air makeup. In the summer months, most of the air flow is exhausted with minimal or no recirculation.

DCP 13800 moved the controls for outside air supply damper GDTZ0011A and recirculation damper GDTZ0011B from the control room panel RP053B to Train B ESF switchgear room panel RP147B. The controls and circuits are completely independent of the control room, so a control room fire will not adversely impact the operation of these dampers. The circuit is shown on drawings E-K3GD04A and J-110-00569.

Supply damper GDTZ0011A and recirculation damper GDTZ0011B modulate based on Train B ESW pump room temperature input from GDTE0011. Power to RP147B is from NN0404 which is available in the event of a fire in the control room.

Based on the above discussion, the Train B ESW pump room supply fan, exhaust damper, recirculation damper and outside air supply damper are protected. GKHS0103 Class 1E electrical equipment A/C unit SGK05B is started in OFN RP-017 to provide cooling to the Train B Class 1E electrical equipment rooms. Hand switch GKHS0103 is placed in the ISO/RUN position to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the unit. The circuit is shown on drawings E-13GK13A, M-622.1A-00002 and M-622.1A-00003.

Based on a review of these drawings, hand switch GKHS0103 will isolate all portions of the control room and start the unit. After the switch is placed in the ISO/RUN position, a fire in the control room will not affect the unit. Therefore, SGK05B is protected.

GLHS0035 Train B electrical penetration room cooler SGL15B is started in OFN RP-017 to ensure adequate cooling to the equipment in the room. The circuit is shown on drawing E-13GL12A. Hand switch GLHS0035 is placed in the ISO/RUN position to isolate the control room and insert a redundant fuse in the control circuit. Then the operator depresses the start pushbutton on the MCC cubicle to start the unit. The unit is powered from MCC cubicle NG02BAF2.

Based on a review of the drawing, hand switch GLHS0035 will isolate all portions of the control room. The pushbutton will energize the 42 relay, close the seal-in contact and start the unit. Therefore, SGL15B is protected.

GMHS0011B Train B diesel generator room supply fan CGM01B is started in OFN RP-017 using hand switch GMHS0011B. The hand switch isolates the control room, inserts a redundant fuse on the secondary side of the control power transformer, and starts the fan. The circuit is shown on drawing E-13GM01A. Based on a review of the drawing, the hand switch will isolate all portions of the control room and start the fan. Power to the fan is from MCC cubicle

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 19 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NG04DBF6. A previous step restores power to the MCC so that when the switch is actuated, the fan will start.

Exhaust damper GMHZ0019 fails open when NK4413 is opened in an earlier step in OFN RP-017. The control circuit for GMHZ0019 is shown on drawing E-13GM04A. Hand switch GMHS0019B is no longer used in OFN RP-017 since disconnecting control power will open the damper. Therefore, exhaust damper GMHZ0019 is protected.

During normal operation, the outside air intake damper and recirculation damper operate as necessary to maintain the Train B EDG room within design limits. In the winter months, most of the air flow is recirculated with minimal outside air makeup. In the summer months, most of the air flow is exhausted with minimal or no recirculation.

DCP 13800 moved the controls for outside air supply damper GMTZ0011A and recirculation damper GMTZ0011B from the control room panel RP053B to Train B ESF switchgear room panel RP147B. The controls and circuits are completely independent of the control room, so a control room fire will not adversely impact the operation of these dampers. The circuit is shown on drawings E-13GM02 and J-110-00565.

Supply damper GMTZ0011A and recirculation damper GMTZ0011B modulate based on Train B EDG room temperature input from GMTE0011. Power to RP147B is from NN0404 which is available in the event of a fire in the control room.

Based on the above discussion, the Train B EDG room supply fan, exhaust damper, recirculation damper and outside air supply damper are protected. GNHS0009A Containment cooler SGN01B is started in OFN RP-017 to maintain the containment temperature within acceptable limits. Hand switch GNHS0009A is placed in ISO/RUN position to start the cooler from MCC NG02TAF1. The circuit is shown on drawing E-13GN02A. Based on a review of the drawing, the hand switch will isolate all portions of the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the cooler. Therefore, a fire in the contro l room will not affect the cooler after the hand switch is placed in the ISO/RUN position.

Based on the above discussion, containment cooler SGN01B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 20 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation GNHS0017A Containment cooler SGN01D is started in OFN RP-017 to maintain the containment temperature within acceptable limits. Hand switch GNHS0017A is placed in ISO/RUN position to start the cooler from MCC NG04TAF1. The circuit is shown on drawing E-13GN02A. Based on a review of the drawing, the hand switch will isolate all portions of the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the cooler. Therefore, a fire in the contro l room will not affect the cooler after the hand switch is placed in the ISO/RUN position.

Based on the above discussion, containment cooler SGN01D is protected.

JEHS0021C Pump PJE01B is the Train B emergency diesel generator fuel oil transfer pump. The pump is started in OFN RP-017 by first placing hand switch JEHS0021C in the ISOLATE position then placing hand switch JEHS0021B in the RUN position. The circuit is shown on drawing E-13JE01A.

Based on a review of the drawing, hand switch JEHS0021C will isolate all portions of the control room from the circuit and insert a redundant fuse in the secondary side of the control power transformer. Hand switch JEHS0021B will start the pump and maintain it running until the hand switch is placed in the STOP position.

Based on the above discussion, pump PJE01B is protected.

KJHS0101D Procedure OFN RP-017 has operators remove the break glass from switch KJHS0101D to actuate the switch. This step energizes relays ESA and ESB on the Train B diesel generator engine control circuit (Dwg E-13KJ03A). DCP 13513 added redundant fuse s and control room isolation contacts on the ESB circ uit so that when KJHS0110 is placed in the ISO position, the ESB circuit is energized.

With ESB energized, the unit parallel relay (UPR) will be de-energized (Dwg E-13NE13). Theref ore, the diesel generator will not be in droop mode and will function properly as PFSSD loads are added.

Also, with ESB energized, relay 90 VEP will be energized which will switch the electronic voltage adjuster to a pre-determined setpoint and the voltage adjuster will ignore signals from the control room auto/manual raise/lower switches. This ensures a fire in the control room will not affect the output voltage of the EDG during the event.

Based on the above discussion, actuation of KJHS0101D will achieve the desired outcome, which is to maintain relay ESB energized.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 21 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation KJHS0109 Hand switch KJHS0109 is placed in the LOC/MAN position to isolate portions of the Train B diesel generator start/stop circuit from the control room. The switch also transfers control of the Train B diesel generator to the local panel in the diesel generator room.

Based on drawing E-13KJ03A, KJHS0109 will isolate the control room stop porti on of the circuit. This will ensure a fire in the control room will not inadvertently cause the diesel engine to shut down. KJHS0109 also isolates the control room voltage control and inserts redundant fuses on the local voltage control circuit as shown on drawing E-13NE13. KJHS0110 Hand switch KJHS0110 is placed in the ISO position to isolate the Train B diesel generator control circuit from the control room and insert redundant fuses in portions of the circuit.

DCP 12097 added KJHS0110 and redundant fuses to ensure power is available to the field flashing circuit. DCP 13513 added redundant fuses and isolation contacts to the control circuit from KJHS0110. These additional contacts and fuses isolate the remaining control room portions of the B EDG control circuit that were not isolated by DCP 12097.

Based on a review of drawing E-13KJ03A, KJHS0110 and KJHS0109 will isolate the control room so that the B EDG will operate following a control room fire.

NB0102 Breaker NB0102 is opened to prevent operation of the Train A containment spray pump. The close control power fuse is first removed to ensure the breaker does not close as a result of the control room fire. The circuit is shown on drawing E-13EN01.

The fuses that are removed are the two 15 amp fuses that protect the close circuit. The remainder of the circuit stays energized. A hot short from a fire in the control room could re-energize the positive polarity of the close circuit. However, the negative polarity will remain de-energized because the negative side of the close circuit does not run to the control room. Therefore, a fire in the control room will not cause a hot short that closes the breaker.

Based on the above discussion, breaker NB0102 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 22 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NB0201 through NB0207, NB0209 and NB0212 OFN RP-017 opens breakers NB0201 through NB0207, NB0209 and NB0212 to shed most of the major loads from NB02. NB0209 and NB0212 are opened to fail off-site power to NB02 and cause an automatic start of the Train B emergency diesel generator. Some of the loads are added by OFN RP-017 after the Train B emergency diesel generator is started. Control power to the breakers is de-energized in a previous step. The breakers are opened by pushing the manual trip push button on the breakers. The breakers are closed when needed by pushing the manual close push button. The charging springs allow 1 cycle of operation without control power. The discussion for NK4401 / NB02 shows that the breakers are protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, the breakers are protected.

NB0208, NB0210, NB0213 and NB0216 These breakers are closed to energize various load centers and motor control centers. The discussion for NK4401 / NB02 shows that the breakers are protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, the breakers will remain closed for the duration of the event.

NB0211 NB0211 is closed to energize the NB02 bus from the Train B diesel generator. A previous step removes control power from the breaker, so spurious opening of the breaker caused by the control room fire will not occur. The control circuit for NB0211 is shown on drawing E-13NE11. The discussion for NK4401 / NB02 shows that the breaker is protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, NB0211 is protected.

NB0215 NB0215 is closed to energize the Train B ESW pump. A previous step removed control power from the breaker, so spurious opening of the breaker caused by the control room fire will not occur. The control circuit for NB0215 is shown on drawing E-K3EF01A. The discussion for NK4401 / NB02 shows that the breaker is protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, NB0215 will remain closed for the duration of the event.

NGHIS0015 / NG0201 Breaker NG0201 is verified to be closed (or manually closed if not) in OFN RP-017 to ensure power is available to required loads fed from bus NG02. All PFSSD loads that are powered from NG02 are shown on drawing E-1F9424B. Not all of these loads are required after a control room fire. The control circuit for NG0201 is shown on drawing E-13NG11B. Prior to closing (or verifying closed) NG0201, hand switch NGHIS0015 is placed in the ISOLATE position to isolate the trip portion of the NG0201 control circuit from the control room. Based on a review of drawing E-13NG11B, placing NGHIS0015 in the ISOLATE position will isolate the trip circuit and prevent NG0201 from tripping. If the breaker has tripped prior to placing NGHIS0015 in the ISOLATE position, and the close control power fuse has blown as a result of the fire, the breaker can be re-closed because the close springs will be charged. Therefore, the configuration is acceptable.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 23 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NGHIS0016 / NG0401 Breaker NG0401 is verified to be closed (or manually closed if not) in OFN RP-017 to ensure power is available to required loads fed from bus NG04. All PFSSD loads that are powered from NG02 are shown on drawing E-1F9424D. Not all of these loads are required after a control room fire. The control circuit for NG0401 is shown on drawing E-13NG11A. Prior to closing (or verifying closed) NG0201, hand switch NGHIS0016 is placed in the ISOLATE position to isolate the trip portion of the NG0201 control circuit from the control room. Based on a review of drawing E-13NG11A, placing NGHIS0016 in the ISOLATE position will isolate the trip circuit and prevent NG0401 from tripping. If the breaker has tripped prior to placing NGHIS0016 in the ISOLATE position, and the close control power fuse has blown as a result of t he fire, the breaker can be re-closed because the close springs will be charged. Therefore, the configuration is acceptable.

NK4119 and NK4407 The excess letdown isolation valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switches NK4119 and NK4407 in the OFF position. This de-energizes power to the valves and fails them closed. The circuit is shown on drawing E-13BG48. The power distribution arrangement is shown on drawing E-13RL02. The excess letdown valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required.

Based on a review of drawing E-13BG48, loss of power to the circuit will fail the valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening NK4119 and NK4407 will de-energize any potential separation group 4, 125 VDC sources in RL001/RL002. Switch PK5117 is opened in an earlier step, which removes 125 VDC from the separation group 5 source to RL001/RL002. Switch PK5211, which provides separation group 6 125 VDC power to RL001/RL002, is not opened in OFN RP-017. However, separation group 6 cables cannot come in contact with separation group 4 cables because of the physical separation requirements of IEEE 384, which are discussed in drawing E-11013 (5.8.1.B). Therefore, the excess letdown isolation valves will not spuriously open after power has been removed using NK4119 and NK4407.

Based on the above discussion, the excess letdown isolation valves are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 24 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NK4401 Disconnect switch NK4401 is placed in the OFF position to de-energize breaker control power for bus NB02. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK4401 is protected. Removing breaker control power from the NB02 bus in this manner prevents spurious operation of equipment supplied by NB02. The schematic diagram for each NB02 breaker is identified in the following table.

Breaker Schematic NB0201 E-13BG01A NB0202 E-13EM01 NB0203 E-13EN01 NB0204 E-13EJ01 NB0205 E-13AL01B NB0206 E-13EG01C NB0207 E-13EG01D NB0208 E-13PG12A NB0209 E-13NB14 NB0210 E-13NG10A NB0211 E-13NE11 NB0212 E-13NB15 NB0213 E-13NG10A NB0214 Spare NB0215 E-K3EF01A NB0216 E-K3NG10A NB0217 Spare A review of each schematic diagram shows that a single hot short from an energized source conductor in the control room will not cause the control circuit on any of the equipment to become re-energized after control power has been removed. Two simultaneous hot shorts would be needed to re-energize the control circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The equipment fed from NB02 is not considered high/low pressure interface so the potential to re-energize the control circuit is not credible. Therefore, the NB02 bus is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 25 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NK4411 The steam generator blowdown valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switch NK4411 in the OFF position. The blowdown valves are not high/low pressure interfaces so consideration of multiple spurious actuations is not required. Switch NK4411 will not spuriously actuate in the event of a control room fire. Therefore, switch NK4411 is protected. The circuit for the blowdown valves is shown on drawings E-13BM06A through E-13BM06D. The power distribution is shown on drawing E-13RL07.

When NK4411 is placed in the OFF position, the blowdown valves will fail closed. It w ould take multiple proper polarity hot shorts to re-energize the valves, which is not postulated in the case of non-high/low pressure interfaces. Therefore, opening NK4411 will effectively close the blowdown valves and maintain them closed for the duration of the event.

Based on the above discussion, the steam generator blowdown valves are protected.

NK4413 Disconnect switch NK4413 is placed in the OFF position to remove 125 VDC control power from certain components fed from control room panel RL019 and RL020. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK4413 is protected. The power distribution circuit for NK4413 is shown on drawing E-13RL05. The PFSSD equipment supplied by NK4413 includes GMHZ0019, EGHV0070A, EGHV0070B and EGTV0030. Loss of 125 VDC control power to these components will fail the components in their desired position. None of these components are high/low pressure interfaces so multiple proper polarity hot shorts do not need to be considered. The control circuit for these components is shown on drawings E-13GM04A, E-13EG08 and E-13EG16. Based on a review of these drawings it would take two proper polarity hot shorts to re-energize the control circuit for these components to fail them in an undesired position after switch NK4413 is placed in the OFF position. A single hot short will not cause the control circuit to re-energize. Therefore, these components are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 26 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NK4414 and NK5109 The reactor head vent valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switches NK4414 and NK5109 in the OFF position. This de-energizes power to the head vent valves and closes the valves. The circuit is shown on drawing E-13BB30. The power distribution arrangement is shown on drawing E-13RL06. The head vent valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required.

Based on a review of drawing E-13BB30, loss of power to the circuit will fail the valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening NK4414 and NK5109 as well as NK5108 and NK4419 in earlier steps will de-energize any potential 125 VDC sources in RL021/RL022 and make this failure mode non-credible. Switch PK6117, which provides separation group 5 125 VDC power to RL021/RL022 and switch PK5205, which provides separation group 6 125 VDC power to RL021/RL022, is not opened in OFN RP-017. However, separation group 5 and 6 cables cannot come in contact with separation group 1 and 4 cables because of the physical separation requirements of IEEE 384, which are discussed in drawing E-11013 (5.8.1.B). Therefore, the reactor head vent valves will not spuriously open after power has been removed using NK4414 and NK5109.

Based on the above discussion, the reactor head vent valves are protected.

NK4416 Disconnect switch NK4416 is placed in the OFF position to remove 125 VDC control power from SB032D. This action is taken to fail the steam dumps and cooldown valves closed. The steam dumps are not high/low pressure interfaces so multiple proper polarity hot shorts do not need to be considered. The control circuits for the steam dumps and cooldown valves are shown on schematic diagrams E-13AB08, E-13AB09, E-13AB11A, E-13AB11B, E-13AB11C, E-13AB12 and E-13AB31. Based on a review of these drawings it would take two proper polarity hot shorts to re-energize the control circuit for the steam dumps and cooldown valves to fail them in an undesired position after switch NK4416 is placed in the OFF position.

A single hot short will not cause the control circuit to re-energize. Therefore, the steam dumps and cooldown valves are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 27 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NK4421 Disconnect switch NK4421 is placed in the OFF position to de-energize pressurizer PORV BBPC V0456A and fail it closed. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK4421 is protected. De-energizing the PORV circuit in this manner prevents spurious opening of the PORV. The PORV circuit is shown on drawing E-13BB40. Based on a review of this drawing, a single hot short from an energized source conductor in the control room will not cause the PORV to open. It would take multiple simultaneous negative and positive hot shorts to re-energize the PORV circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The following paragraph discusses the combination of circuit failures necessary to cause the PORVs to open.

Based on a review of drawing E-13BB40, in order for the PORV to open, the hot shorts would have to occur in control room panel RL021. A minimum of three 'smart' hot shorts would have to occur to open a PORV. These hot shorts include one external positive hot short, one external negative hot short and a conductor-to-conductor hot short. The external 125 VDC power source would have to be from the same separation group because IEEE-384 and E-11013 (5.8.1) do not allow cables of different separation groups to touch. Setroute was reviewed for all the separation group 4 cables with a 125 VDC potential (designated by a letter K after the system designation in the cable scheme) running to panel RL021. Based on this review the only other 125 VDC source that could energize the PORV is NK4414, which is a Separation Group 4 power supply. This switch is opened in Step C2 of OFN RP-017.

Based on the above discussion, pressurizer PORV BBPCV0456A will not spuriously open after switches NK4421 and NK4414 are opened.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 28 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation NK5108 Disconnect switch NK5108 is placed in the OFF position to de-energize pressurizer PORV BBPC V0455A and fail it closed. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK5108 is protected. De-energizing the PORV circuit in this manner prevents spurious opening of the PORV. The PORV circuit is shown on drawing E-13BB40. Based on a review of this drawing, a single hot short from an energized source conductor in the control room will not cause the PORV to open. It would take multiple simultaneous negative and positive hot shorts to re-energize the PORV circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The pressurizer PORVs are not considered high/low pressure interfaces per License Amendment 193. The following paragraph discusses the combination of circuit failures necessary to cause the PORVs to open.

Based on a review of drawing E-13BB40, in order for the PORV to open, the hot shorts would have to occur in control room panel RL021. A minimum of three 'smart' hot shorts would have to occur to open a PORV. These hot shorts include one external positive hot short, one external negative hot short and a conductor-to-conductor hot short. The external 125 VDC power source would have to be from the same separation group because IEEE-384 and E-11013 (5.8.1) do not allow cables of different separation groups to touch. Setroute was reviewed for all the separation group 1 cables with a 125 VDC potential (designated by a letter K after the system designation in the cable scheme) running to panel RL021. Based on this review the only other 125 VDC source that could energize the PORV is NK5109, which is a Separation Group 1 power supply. This switch is opened in Step C2 of OFN RP-017.

Based on the above discussion, pressurizer PORV BBPCV0455A will not spuriously open after switches NK5108 and NK5109 are opened.

NK5119 Disconnect switch NK5119 supplies power to main steam and feedwater isolation cabinet SA075A. Opening this disconnect switch removes power from the Train A solenoids on the Main Steam Isolation Valves and Main Feedwater Isolation Valves. This will fail the valves in the closed position, whic h is the desired position for PFSSD.

Opening NK5119 is not required to fail the MFIVs to the closed position. Feedwater isolation is automatic upon initiation of reactor trip (reference License Amendment 214).

PA0107, PA0108, PA0204 and PA0205 These breakers are manually tripped to stop the RCPs. The control circuit is not isolated from the control room, nor is it required to be isolated. Per OFN RP-017, operators first trip the breaker, remove control power, then verify that the breaker is still tripped. Control power is removed by opening disconnect switches PK4103 and PK6204. Removal of control power ensures control room fire damage will not inadvertently re-start the pump. Verification ensures the pump did not re-start prior to control power being removed. The circuit for all four RCPs is shown on drawing E-13BB01. The procedure adequately addresses tripping the RCP breakers and includes necessary steps to ensure the pumps do not re-start. Therefore, the configuration is acceptable.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 29 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation PK4103 Disconnect switch PK4103 is placed in the OFF position to remove control power from PA01. For a control room fire, this is required to remove control power fr om breakers PA0107 and PA0108 for RCPs PBB01A and PBB01B, respectively, to ensure the RCPs do not re-start after they have been stopped. Other breakers on PA01 are not required for PFSSD following a control room fire. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, PK4103 is protected.

The control circuit for PA0107 and PA0108 is shown on drawing E-13BB01. Based on a review of this drawing it would take two proper polarity hot shorts to re-energize the control circuit for these breakers to start the pumps after switch PK4103 is placed in the OFF positi on. A single hot short will not cause the control circuit to re-energize. The RCPs are not considered high low pressure interfaces so consideration of two proper polarity hot shorts is not required. Therefore, there is reasonable assurance that the RCPs will not spuriously start after they have been stopped.

Based on the above discussion, removal of control power from PA01 in this manner will prevent spurious operation of RCPs PBB01A and PBB01B. Therefore, the configuration is acceptable.

PK5117 Disconnect switch PK5117 is opened in OFN RP-017 to fail normal letdown valves BGLCV0459 and BGLCV0460 closed and fail auxiliary pressurizer spray valve BGHV8145 closed. The letdown valve circuit is shown on drawing E-13BG10. The auxiliary spray circuit is shown on drawing E-13BG19. The power distribution arrangement for PK5117 is shown on drawing E-13RL02. The letdown isolation valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required. The spray valve is not considered a high/low pressure interface so multiple proper polarity hot shorts do not need to be considered.

Letdown Valves

Based on a review of drawing E-13BG10, loss of power to the circuit will fail the letdown valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening PK5117 as well as NK4119 and NK4407 in another step will de-energize these potential 125 VDC sources in RL001/RL002. The separation group 6 source of 125 VDC power remains available from switch PK5211. Based on E-11013 (5.8.3) separation groups 5 and 6 cables could be bundled together within the control room cabinets. Therefore, a source of 125 VDC power is available in RL001/RL002 to re-energize and open the valves.

When PK5117 is opened, the two series letdown isolation valves (BGLCV0459 and BGLCV0460) fail closed and all three parallel letdown orifice isolation valves (BGHV8149A, BGHV8149B and BGHV8149C) fail closed. To re-establish a letdown flow path, three valves would need to re-open (both letdown isolation valves and one letdown orifice isolation valve). This would require six independent proper polarity hot shorts (3 negative and 3 positive)

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1F9915, Rev. 9 Page 30 of 30 Table A1 OFN RP-017 Credited Component Evaluation Component Evaluation which is not credible.

Based on the above discussion, there is reasonable assurance that the letdown isolation valves will not re-open after PK5117 is placed in the OFF position.

Auxiliary Pressurizer Spray Valve Based on a review of drawing E-13BG19, loss of power to the circuit will fail the spray valve closed. In order for the valve to re-open, it would two independent proper polarity hot shorts which is not postulated for non-high/low pressure interfaces.

Based on the above discussion, there is reasonable assurance that the auxiliary pressurizer spray valve will not re-open after PK5117 is placed in the OFF position. PK6204 Disconnect switch PK6204 is placed in the OFF position to remove control power from PA02. For a control room fire, this is required to remove control power fr om breakers PA0204 and PA0205 for RCPs PBB01D and PBB01C, respectively, to ensure the RCPs do not re-start after they have been stopped. Other breakers on PA02 are not required for PFSSD following a control room fire. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, PK6204 is protected.

The control circuit for PA0204 and PA0205 is shown on drawing E-13BB01. Based on a review of this drawing it would take two proper polarity hot shorts to re-energize the control circuit for these breakers to start the pumps after switch PK6204 is placed in the OFF positi on. A single hot short will not cause the control circuit to re-energize. The RCPs are not considered high low pressure interfaces so consideration of two proper polarity hot shorts is not required. Therefore, there is reasonable assurance that the RCPs will not spuriously start after they have been stopped.

Based on the above discussion, removal of control power from PA02 in this manner will prevent spurious operation of RCPs PBB01C and PBB01D. Therefore, the configuration is acceptable.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 1 of 37 Appendix 2 Control Room Fire Consequence E valuation for Motor Operated Valves Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 2 of 37 Table A2 documents an evaluation of the impact on post-fire safe shutdown if a fire occurs in the control room and affects motor operated valve circuits. The evaluation was originally performed per a corrective action for CR 041746-02-02. The evaluation has been added to E-1F9915 to ensure the information is maintained in a controlled document.

Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BGHIS8109 RL001 M-12BG03 (E-6) BGHV8109 Normal Charging Pmp Recirc Valve could open or remain closed. The NCP is not used for PFSSD. If loss of flow occurs in the charging header and this valve fails closed, the NCP could be damaged. This will have no adverse impact on PFSSD since the Train B CCP is available in the event of a control room fire.

BGHIS0112C RL001 M-12BG03 (E-7) BGLCV0112C VCT Outlet Valve Valve can fail closed or remain open Valve is closed in OFN RP-017 by placing BGHS0112C in the ISO/CLOSE position. Valve has been modified to address NRC IN 92-18. If the valve fails closed before lining up the RWST, the operating charging pump will lose suction and will be damaged. If RCP seal cooling flowpath remains available, then the pumps would have 12 gpm on the suction side, which is not sufficient to protect the running pump. If the seal flowpath is affected, which is possible for a fire in this cabinet, there will be no flow in the system. Prior to restoring power to the valve and operating ISO/CLOSE switch BGHS0112C there is a possibility of H2 intrusion into the charging pump suction. Since the NCP is the normally operating pump and is not credited for PFSSD, damage to it will not adversely affect PFSSD. A SIS would provide a permissive for the valve to close but the valve would not close until the RWST to charging valve is open. Therefore, a SIS would not cause a loss of suction to the pump.

BGHIS0112B RL001 M-12BG03 (F-7) BGLCV0112B VCT Outlet Valve Valve could close or remain open. Valve is not relied upon for PFSSD following a control room fire. Valve BGLCV0112C is credited in OFN RP-017. See discussion for BGHIS0112C for PFSSD impact if the valve spuriously closes.

BGHIS8112 RL001 M-12BG01 (E-3) BGHV8112 Seal Water Ret Cont Iso Valve Valve could close or remain open. See discussion for BGHIS8100.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 3 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BGHIS8100 RL001 M-12BG01 (E-2) BGHV8100 Seal Water Ret Cont Iso Valve Valve could close or remain open. If the valve closes, seal leakoff flow would be directed to the reactor coolant drain tank rather than the seal water heat exchanger. There is no adverse impact on PFSSD if this occurs. RCP seal damage will not occur because OFN RP-017 stops the RCPs and isolates seal injection.

BGHIS8104 RL001 M-12BG05 (B-4) BGHV8104 Immediate Borate to CCP Suction Valve could open or remain closed. The valve can fail in any position with no impact on PFSSD. If the valve fails open with the boric acid transfer pumps running, boron will be added to the RCS, causing a reduction in reactivity. If the valve fails closed, it is in the correct PFSSD position.

BGHIS8110 RL001 M-12BG03 (E-3) BGHV8110 CCP A Recirc Valve could close or remain open. If the A CCP is running at the time of the fire and this valve closes with little or no flow in the system, the pump could be damaged. The NCP is normally operating, so this is not a concern under normal operating conditions. The B CCP is credited for a control room fire so damage to the A CCP due to a control room fire will not adversely impact PFSSD.

BNHIS0112D RL001 M-12BN01 (B-5) BNLCV0112D RWST to CCP Valve could open or remain closed. If the valve opens, there is no adverse impact on PFSSD since it would provide a suction source to the charging pump header. If the valve remains closed, CCP suction would be available from the VCT unless the VCT outlet valves close. OFN RP-017 lines the RWST up to the charging header by opening BNLCV0112E before starting the B CCP. Therefore, failure of this valve to open will not affect PFSSD in the event of a control room fire.

BNHIS0112E RL001 M-12BN01 (F-3) BNLCV0112E RWST to CCP Valve could open or remain closed. If the valve opens, there is no adverse impact on PFSSD since it would provide a suction source to the charging pump header. If the valve remains closed, CCP suction would be available from the VCT unless the VCT outlet valves close. OFN RP-017 lines up the RWST up to the charging header before starting the B CCP. The valve is opened by placing BNHS0112E in the ISO/OPEN position.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 4 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BGHIS8111 RL001 M-12BG03 (E-4) BGHV8111 CCP B Recirc Valve could close, causing a loss of CCP B mini flow. If the B CCP is running at the time of the fire and this valve closes with little or no flow in the system, the pump could be damaged. The NCP is normally operating, so this is not a concern under normal operating conditions. Procedure OFN RP-017 opens this valve by placing BGHS8111A in the ISO/OPEN position.

BGHIS8106 RL001 M-12BG03 (E-3) BGHV8106 CCP to Regen Hx Iso Valve could open or close If this valve closes, it is in the desired PFSSD position. If it remains open, charging flow would continue until manual valve BG8402B is closed.

BGHIS8105 RL001 M-12BG03 (E-3) BGHV8105 CCP to Regen Hx Iso Valve could open or close If this valve closes, it is in the desired PFSSD position. If it remains open, charging flow would continue until manual valve BG8402B is closed.

BGHS8110 RL001 M-12BG03 (E-3) BGHV8110 CCP A Recirc Iso Reset Could cause a spurious reset or prevent a reset. Switch is used to reset a safety injection signal. Based on a review of drawing E-13BG11B, fire damage to the switch will not cause the valve to open or close. Furthermore, the valve is not credited for PFSSD following a control room fire so the position of the valve will not affect PFSSD.

BGHS8111 RL001 M-12BG03 (E-5) BGHV8111 CCP B Recirc Iso Reset Could cause a spurious reset or prevent a reset. Switch is used to reset a safety injection signal. Based on a review of drawing E-13BG11C, fire damage to the switch will not cause the valve to open or close. Therefore, there is no adverse impact on PFSSD. Procedure OFN RP-017 opens this valve by placing BGHS8111A in the ISO/OPEN position. Damage to the switch and associated cables will not prevent BGHS8111A from performing this function.

BGHIS8357A RL001 M-12BG03 (C-4) BGHV8357A CCP A to RCP SealsValve could open or remain closed. None. Seal injection is isolated by closing BGV0101 and BGV0105 in procedure OFN RP-017. With the valve open or closed, there is no adverse impact on PFSSD. BGHIS8357B RL001 M-12BG03 (B-4) BGHV8357B CCP B to RCP SealsValve could open or remain closed. None. Seal injection is isolated by closing BGV0101 and BGV0105 in procedure OFN RP-017. With the valve open or closed, there is no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 5 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BBHIS8157A RL001 M-12BB02 (E-1) BBHV8157A Excess Letdown to PRT Could allow excess letdown flow to the PRT if 2 other valves to the excess letdown heat exchanger also open. Could potentially lose ~50 gpm to the PRT if one excess letdown heat exchanger inlet flowpath (2 valves) also open. The excess letdown heat exchanger inlet valves are also controlled from RL001, so this condition could occur but it would require multiple spurious operations. Wolf Creek is not required to consider multiple spurious operations in the event of a control room fire. Furthermore, excess letdown is isolated in OFN RP-017 by opening breakers NK4119 and NK4407 to fail the excess letdown valves closed. Based on E-1F9915, operators have 37 minutes to mitigate a failed open excess letdown flowpath assuming 100 gpm loss. OFN RP-017A opens BBHV8157A to re-establish a letdown flowpath for cold shutdown. Valve BBHV8157A has been modified to address IN 92-18 concerns and is therefore available.

BBHIS8157B RL001 M-12BB02 (D-1) BBHV8157B Excess Letdown to PRT Could allow excess letdown flow to the PRT if 2 other valves to the excess letdown heat exchanger also open. Could potentially lose ~50 gpm to the PRT if one excess letdown heat exchanger inlet flowpath (2 valves) also opens. The excess letdown heat exchanger inlet valves are also controlled from RL001, so this condition could occur but it would require multiple spurious operations. Wolf Creek is not required to consider multiple spurious operations in the event of a control room fire. Furthermore, excess letdown is isolated in OFN RP-017 by opening breakers NK4119 and NK4407 to fail the excess letdown valves closed. Based on E-1F9915, operators have 37 minutes to mitigate a failed open excess letdown flowpath assuming 100 gpm loss. OFN RP-017A opens BBHV8157B to re-establish a letdown flowpath for cold shutdown. Valve BBHV8157B has been modified to address IN 92-18 concerns and is therefore available.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 6 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire AEHIS0016 RL005 M-12AE01 (E-5)

AEHV0016 SG Feed Pump A FW Disch Valve Could cause the valve to close or remain open. The main feedwater pumps are not used for PFSSD. If the valve closes, PFSSD is achieved using auxiliary feedwater. If the valve stays open, backflow through the pump is prevented by check valve AEV0023. Steam generator overfill is prevented by automatic feedwater isolation upon initiation of reactor trip (reference License Amendment 214). Therefore, damage to this switch will not adversely impact PFSSD.

AEHIS0015 RL005 M-12AE01 (C-5)

AEHV0015 SG Feed Pump B FW Disch Valve Could cause the valve to close or remain open. The main feedwater pumps are not used for PFSSD. If the valve closes, PFSSD is achieved using auxiliary feedwater. If the valve stays open, backflow through the pump is prevented by check valve AEV0022. Steam generator overfill is prevented by automatic feedwater isolation upon initiation of reactor trip (reference License Amendment 214). Therefore, damage to this switch will not adversely impact PFSSD.

ALHIS0036A RL005 M-12AL01 (B-4)

ALHV0036 CST to TDAFP Suction Valve could spuriously close. This valve is required to be open in OFN RP-017 to provide a suction source from the CST to the TDAFP. The valve is verified open in Step B7 and opened if it is not. This is a Train A valve so it is not isolated from the control room. Rather, the power is de-energized in Step 5.c to prevent spurious operation. If the valve spuriously closes before opening the breaker, an operator can locally open the valve. The valve was modified in DCP 12170 to address IN 92-18. Therefore, damage to this switch will not adversely impact PFSSD.

ALHIS0032A RL005 M-12AL01 (D-3)

ALHV0032 ESW A to TDAFP Suction Valve could spuriously open or remain closed. This valve is normally closed and is not used in OFN RP-017. Train A ESW is not used in OFN RP-017. The valve can fail in any position with no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 7 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire ALHIS0035A RL005 M-12AL01 (D-3)

ALHV0035 CST to MDAFP A Valve could spuriously close. Valve is normally open to provide a suction source from the CST to the Train A MDAFP. The Train A MDAFP is not used in OFN RP-017 and therefore this valve can fail closed with no adverse impact on PFSSD.

ALHIS0031A RL005 M-12AL01 (E-3)

ALHV0031 ESW to MDAFP A Valve could spuriously open or remain closed. Valve is normally closed and opens on LSP signal to provide a suction source from Train A ESW to the Train A MDAFP. The Train A MDAFP is not used in OFN RP-017. This valve can fail in any position with no adverse impact on PFSSD.

ALHIS0033A RL005 M-12AL01 (C-3)

ALHV0033 ESW to TDAFP Valve could spuriously open or remain closed. This valve is opened in OFN RP-017 when aligning the alternate AFW source. The valve is isolated from the control room using RP HIS-2 in Step A-1. If the valve fails open it is possible that ESW would enter the TDAFP suction, which would allow raw water to enter the steam generators. This will not adversely affect PFSSD. If the valve fails closed, it can be lined up to the TDAFP after it is isolated in Step A1. The valve was modified to address IN 92-18 in DCP 12170. In either case, there is no adverse impact on PFSSD.

ALHIS0034A RL005 M-12AL01 (H-4)

ALHV0034 CST to MDAFP B Valve could spuriously close. Valve is required to be open to provide the primary source of AFW from the CST to the Train B MDAFP. The valve is isolated from the control room in Step A1 using RP HIS-2 and opened using AL HIS-34B at the ASP. The valve was modified in DCP 12170 to address IN 92-18. Therefore, spurious operation of the valve will not adversely impact PFSSD.

ALHIS0030A RL005 M-12AL01 (G-3)

ALHV0030 ESW to MDAFP B Valve could spuriously open or remain closed. This valve is opened in OFN RP-017 when aligning the alternate AFW source. The valve is isolated from the control room using RP HIS-2 in Step A-1. If the valve fails open it is possible that ESW would enter the MDAFP B suction, which would allow raw water to enter the steam generators. This will not adversely affect PFSSD. If the valve fails closed, it can be lined up to the B MDAFP after it is isolated in Step A1. In either case, there is no adverse impact on PFSSD. The valve was modified in DCP 12170 to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 8 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire FCHIS0312A RL005 M-12FC02 (G-3) FCHV0312 TDAFP Trip and Throttle Valve Could prevent operation of the valve. This valve is required in OFN RP-017 to provide steam to the TDAFP. The valve is isolated from the control room in Step A1 and opened in Step A14. If the valve goes full open, steam would flow only if either valve ABHV0005 or ABHV0006 and valve FCFV0313 also open. Valve FCFV0313 is normally open with the controller in manual and set to 3850 RPM. Therefore, with the proper valve lineup there could be steam release through the TDAFP. Excessive steam flow would likely result in FCHV0312 tripping on high speed. The valve was not modified to address NRC IN 92-18 because control relays in the circuit prevent the concern identified in NRC IN 92-18.

ALHK0007A RL006 M-12AL01 (F-8)

ALHV0007SG A MD Aux FW B Control Valve Could prevent flow

control from MDAFP B to SG A.

Damage to this switch could cause a loss of auxiliary feedwater flow control from the Train B MDAFP to SG A. The Train B MDAFP is used in OFN RP-017 to supply SG D only. SG A is not credited in OFN RP-017 since the dump valve is on Train A. If this valve were to open while running the Train B MDAFP, auxiliary feedwater would flow to SG A but with possibly no steam dump capability the SG would overfill. Manual valve ALV0032 is closed in OFN RP-017 to prevent overfilling SG A.

ALHK0009A RL006 M-12AL01 (E-8)

ALHV0009SG B MD Aux FW A Control Valve Could prevent flow

control from MDAFP A to SG B.

Damage to this switch could cause a loss of auxiliary feedwater flow control from the Train A MDAFP to SG B. The Train A MDAFP is not used in OFN RP-017. The pump is secured in OFN RP-017 to prevent overfilling SGs B and C.

ALHK0011A RL006 M-12AL01 (C-8)

ALHV0011 SG C MD Aux FW A Control Valve Could prevent flow control from MDAFP A to SG C. Damage to this switch could cause a loss of auxiliary feedwater flow control from the Train A MDAFP to SG C. The Train A MDAFP is not used in OFN RP-017. The pump is secured in OFN RP-017 to prevent overfilling SGs B and C.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 9 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire ALHK0005A RL006 M-12AL01 (H-8)

ALHV0005 SG D MD Aux FW B Control Valve Could prevent flow control from MDAFP B to SG D. Damage to this switch could cause a loss of auxiliary feedwater flow control from the Train B MDAFP to SG D. This valve is credited in OFN RP-017 to ensure a flow path from MDAFP B to SG D. The valve is controlled in Step A5. Prior to Step A5 the valve could either fail open, fail closed or fail somewhere in-between. There is no adverse impact on PFSSD prior to controlling the valve. The design of the valve would not allow it to be damaged per IN 92-18 so the valve was not modified to address this concern. This is because the valve is a positionable MOV using hand controller ALHK0005A. Fire damage to the controller or circuits will not bypass the torque and limit switches at the valve. Therefore, the valve cannot be damaged in a manner described in IN 92-18.

0HS-WL025A RL013 M-0024, Sh. 2 (H-6) 0WL0014 Low Level Iso Vlv Ctrl Sw Could prevent operation of the valve. The makeup water system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

0HS-WL026A RL013 M-0024, Sh. 2 (H-5) 0WL0015 Dewater Iso Vlv Ctrl Sw Could prevent operation of the valve. The makeup water system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

0HS-WL028A RL013 M-0024, Sh. 2 (H-3) 0WL0017 Dewater Disch Vlv Ctrl Sw Could prevent operation of the valve. The makeup water system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

0HS-WL027A RL013 M-0024, Sh. 2 (D-6) 0WL0016 Blowdown Iso Vlv Ctrl Sw Could prevent operation of the valve. The makeup water system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

0HS-WL029AA, 0HS-WL029AB RL013 M-0024, Sh. 2 (F-

3) 0WL0018 Blowdown Disch Vlv Ctrl Sw Could prevent operation of the valve. The makeup water system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 10 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BNHIS0003 RL017 M-12BN01 (C-3) BNHV0003 RWST to Containment Spray Pump B Could close or remain open. If the valve remains in its normally open position with no other spurious actuations, there would be no adverse impact on PFSSD. However, if the CS B pump starts and the containment spray isolation valve opens then Train B containment spray would occur and RWST inventory will be depleted until containment spray is stopped. The flow in the containment spray system with one pump operating is approximately 3,000 gpm. Based on calculation XX-E-013, Appendix 1, a maximum of 214,260 gallons of water can be lost from the RWST to maintain sufficient volume to achieve cold shutdown. Therefore, operators have approximately 71 minutes to stop the containment spray pump. The Train B pump is stopped in OFN RP-017 prior to 71 minutes. Therefore, the pump will be stopped within the required time period to prevent unacceptable RWST draindown.

ENHIS0007 RL017 M-12EN01 (B-7) ENHV0007 Containment Recirc Sump to Containment Spray Pump B Could spuriously open. This valve is not credited for PFSSD. If it spuriously opens or remains closed there is no adverse impact on PFSSD. Check valve ENV0008 will prevent the RWST from draining to the containment sump if the valve opens. ENHIS0016 RL017 M-12EN01 (D-4) ENHV0016 Spray Additive Tank Isolation Valve Could open or remain closed. This valve is not credited for PFSSD. If it spuriously opens or remains closed there is no adverse impact on PFSSD. ENHIS0012 RL017 M-12EN01 (C-4) ENHV0012 Containment Spray Isolation Valve Could spuriously open. If this valve opens with no other spurious actuations, there would be no adverse impact on PFSSD. However, if the CS B pump starts then containment spray would occur, taking suction from the RWST. 71 minutes are available to mitigate this condition before the RWST reaches a level below that required for cold shutdown. Operators stop the CS B pump in OFN RP-017 prior to 71 minutes. Therefore, the pump would be stopped within the required time period to prevent unacceptable RWST draindown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 11 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BNHIS8806B RL017 M-12BN01 (E-3) BNHV8806B RWST to SI Pumps Suction Could close or remain open. If this valve remains in its normally open position, then there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1565 psi. The SI pumps are not credited for PFSSD so if the valve closes, there would be no adverse impact.

EMHIS8923B RL017 M-12EM01 (D-7) EMHV8923B SI Pump B Suction Isolation Valve Could close or remain open. If this valve remains in its normally open position, then there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1565 psi. If the valve spuriously closes, there is no adverse impact since the Train B SI pump is not credited for PFSSD.

EMHIS8924 RL017 M-12EM01 (G-8) EMHV8924 CVCS to SI pump Suction Could close or remain open. This normally open valve, along with normally closed parallel valves EMHV8807A and EMHV8807B provide an alternate SI pump suction path from the CVCS suction header. The SI system is not used for PFSSD. This valve can fail in any position with no adverse impact on PFSSD.

EMHIS8807B RL017 M-12EM01 (F-7) EMHV8807B CVCS to SI pump Suction Could open or remain closed. If this normally closed valve opens with the SI pumps off, there is no adverse impact on PFSSD. If the pumps start there will be no flow in the system and RWST inventory will be maintained.

BNHIS8813 RL017 M-12BN01 (C-7) BNHV8813 SI Return to RWST Could close or remain open. This normally open valve provides a return flowpath from the SI pumps to the RWST. If the valve closes with SI pumps running, damage could occur to the pumps if there is no flow in the system. The SI pumps are not credited for PFSSD so there would be no adverse impact.

BNHIS8813A RL017 M-12BN01 (C-7) BNHV8813 Valve BNHV8813 Power Lockout Could close or remain open. This switch is a power lockout for valve BNHV8813 and is normally in the ISO position, which maintains the valve in the open position. There is no adverse impact on PFSSD if this switch is affected.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 12 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EJHIS8804B RL017 M-12EJ01 (B-4) EJHV8804B RHR HX B to SI Pump B Could open or remain closed. The valve is required to remain closed for PFSSD when operating Train B RHR for cold shutdown. If the valve opens prior to reaching RHR entry conditions there would be no adverse impact on PFSSD. Valve was modified to address IN 92-18 and is closed in OFN RP-017A to support cold shutdown.

EMHIS8814B RL017 M-12EM01 (B-5) EMHV8814B SI Pump B Return to RWST Could close or remain open. This normally open valve provides a return flowpath from the Train B SI pump to the RWST. If the valve closes with Train B SI pump running, damage could occur to the pump if there is no flow in the system. The Train B SI pump is not credited for PFSSD so there would be no adverse impact.

EMHIS8821B RL017 M-12EM01 (D-4) EMHV8821B SI Pump B to RCS Cold Leg Injection Could close or remain open. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802B RL017 M-12EM01 (D-4) EMHV8802B SI Pump B Discharge Valve Could open or remain closed. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802BA RL017 M-12EM01 (D-4) EMHV8802B Valve EMHV8802B Power Lockout Could open or remain closed. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8835 RL017 M-12EM01 (C-4) EMHV8835 SI Cold Leg Injection Valve Could close or remain open. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8835A RL017 M-12EM01 (C-4) EMHV8835 Valve EMHV8835 Power Lockout Could close or remain open. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8821A RL017 M-12EM01 (E-4) EMHV8821A SI Pump A to RCS Cold Leg Injection Could close or remain open. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 13 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EMHIS8802A RL017 M-12EM01 (F-4) EMHV8802A SI Pump A Discharge Valve Could open or remain closed. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802AA RL017 M-12EM01 (F-4) EMHV8802A Valve EMHV8802A Power Lockout Could open or remain closed. The position of this valve (open or closed) has no adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8923A RL017 M-12EM01 (F-7) EMHV8923A SI Pump A Suction Isolation Valve Could close or remain open. If this valve remains in its normally open position with no other spurious actuations, then there would be no adverse impact on PFSSD. If the valve spuriously closes, there is no adverse impact since the Train A SI pump is not credited for PFSSD.

EMHIS8814A RL017 M-12EM01 (B-6) EMHV8814A SI Pump A Return to RWST Could close or remain open. This normally open valve provides a return flowpath from the Train A SI pump to the RWST. If the valve closes with Train A SI pump running, damage could occur to the pump if there is no flow in the system. The Train A SI pump is not credited for PFSSD so there would be no adverse impact.

ENHIS0006 RL017 M-12EN01 (H-4) ENHV0006 Train A Containment Spray Isolation Valve Could spuriously open. If this valve opens with no other spurious actuations, there would be no adverse impact on PFSSD. However, if the A CS pump starts then containment spray would occur, taking suction from the RWST. 71 minutes are available to mitigate this condition before the RWST reaches a level below that required for cold shutdown. The CS A pump is stopped in OFN RP-017 prior to 71 minutes. Therefore, the pump will be stopped within the required 71 minutes.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 14 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BNHIS0004 RL017 M-12BN01 (B-3) BNHV0004 RWST to Containment Spray Pump A Could close or remain open. If the valve remains in its normally open position with no other spurious actuations, there would be no adverse impact on PFSSD. However, if the A CS pump starts and the containment spray isolation valve opens, Train A containment spray would occur and RWST inventory will be depleted until containment spray is stopped. The flow in the containment spray system with one pump operating is approximately 3,000 gpm. Based on calculation XX-E-013, Appendix 1, a maximum of 214,260 gallons of water can be lost from the RWST to maintain sufficient volume to achieve cold shutdown. Therefore, operators have approximately 71 minutes to stop the containment spray pump. The A CS pump is stopped in OFN RP-017 prior to 71 minutes. Therefore, RWST inventory will be maintained.

ENHIS0015 RL017 M-12EN01 (D-6) ENHV0015 Spray Additive Tank Isolation Valve Could open or remain closed. This valve is not credited for PFSSD. If it spuriously opens or remains closed there is no adverse impact on PFSSD. ENHIS0001 RL017 M-12EN01 (G-7) ENHV0001 Containment Recirc Sump to Containment Spray Pump A Could spuriously open. This valve is not credited for PFSSD. If it spuriously opens or remains closed there is no adverse impact on PFSSD. Check valve ENV0002 will prevent the RWST from draining to the containment sump if the valve opens. BBHIS8702A RL017 M-12BB01 (F-4) BBPV8702A RCS Hot Leg to RHR Pump A None This valve is normally deenergized and is maintained closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A. EJHIS8701A RL017 M-12EJ01 (G-8) EJHV8701A RCS Hot Leg to RHR Pump A None This valve is normally deenergized and is maintained closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 15 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BNHIS8812A RL017 M-12BN01 (B-3) BNHV8812A RWST to RHR Pump A Suction Valve could close or remain open. If the valve closes there is no adverse impact on PFSSD. If the valve remains open and valve EJHV8811A opens, then the RWST would drain to the containment sump. OFN RP-017 closes BNHV8812A to prevent draindown via this path. BNHV8812A has been modified to address IN 92-18 per DCP 12173. Calculation XX-E-013, Appendix 1 has determined there is 28 minutes to mitigate RWST draindown to the sump if one RWST to sump flowpath fails open. This condition will be mitigated before the RWST drops below minimum level needed for cold shutdown.

EJHIS8811A RL017 M-12EJ01 (F-7) EJHV8811A Ctmt Recirc Sump to RHR A Suction Valve could spuriously open. Damage to this switch could cause the valve to open. In addition, valve BNHV8812A may not automatically close as designed, causing the RWST to drain to the sump. This condition is mitigated in OFN RP-017 by manually closing BNHV8812A within the required time period of 28 minutes. The valve was modified to address NRC IN 92-18.

EJHIS0610 RL017 M-12EJ01 (H-6) EJFCV0610 RHR Pump A Miniflow Valve Valve could close. Damage to this switch has no adverse impact on PFSSD since the Train A RHR system is not credited for a control room fire. The position of this valve (open or closed) will have no adverse impact on hot standby.

EJHIS8804A RL017 M-12EJ01 (H-4) EJHV8804A RHR A to CVCS Iso Valve Valve could open or remain closed. Valve is required to remain closed when operating Train A RHR to prevent flow diversion to the charging header. The position of this valve (open or closed) will have no adverse impact on hot standby. The Train A RHR system is not credited for a control room fire so spurious operation of this valve will have no adverse impact on PFSSD. EJHIS8716A RL017 M-12EJ01 (E-3) EJHV8716A RHR Pump A Hot Leg Recirc Valve could close or remain open. Damage to this switch could cause the valve to close or prevent it from closing. The Train A RHR system is not credited for PFSSD following a control room fire so damage to this switch will have no adverse impact on the ability to achieve cold shutdown. The position of this valve (open or closed) will have no adverse impact on hot standby. OFN RP-017A closes EJHV8840 to prevent hot leg recirculation when lining up RHR for cold shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 16 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EJHIS8809A RL017 M-12EJ01 (G-3) EJHV8809A RHR A to Cold Leg Injection Loops 1 and 2. Valve could close or remain open. The Train A RHR system is not credited for a fire in the control room. The position of this valve (open or closed) will have no adverse impact on safe shutdown.

EJHIS8809AA RL017 M-12EJ01 (G-3) EJHV8809A Valve EJHV8809A power lockout. Valve could close or remain open. The Train A RHR system is not credited for a fire in the control room. The position of this valve (open or closed) will have no adverse impact on safe shutdown.

EMHIS8807A RL017 M-12EM01 (G-7) EMHV8807A CVCS to SI pump Suction Valve could open or remain closed. If this normally closed valve opens with no other spurious actuations, there is no adverse impact on PFSSD. If the pumps start there will be no flow in the system and RWST inventory will be maintained.

EJHIS8809B RL017 M-12EJ01 (C-3) EJHV8809B RHR B to Cold Leg Inj Loops 3 and 4 Valve could close or remain open. This valve is credited for a fire in the control room when lining up Train B RHR in OFN RP-017A for cold shutdown. Spurious operation of the valve during hot standby will not impact PFSSD. The valve was modified to address IN 92-18.

EJHIS8809BA RL017 M-12EJ01 (C-3) EJHV8809B RHR B to Cold Leg Inj Loops 3 and 4 Valve could close or remain open. This valve is credited for a fire in the control room when lining up Train B RHR in OFN RP-017A for cold shutdown. Spurious operation of the valve during hot standby will not impact PFSSD. The valve was modified to address IN 92-18.

EJHIS8840 RL017 M-12EJ01 (E-3) EJHV8840 RHR Hot Leg Recirc Valve Valve could open or remain closed. This valve is closed in OFN RP-017A to prevent hot leg recirculation. The position of this valve (open or closed) will have no adverse impact on hot standby. The valve was modified to address IN 92-18.

EJHIS8840A RL017 M-12EJ01 (E-3) EJHV8840 RHR Hot Leg Recirc Valve Valve could open or remain closed. This valve is closed in OFN RP-014 to prevent hot leg recirculation. The position of this valve (open or closed) will have no adverse impact on hot standby. The valve was modified to address IN 92-18.

EJHIS8716B RL017 M-12EJ01 (C-3) EJHV8716B RHR Pump B Hot Leg Recirc Valve could close or remain open. Damage to this switch could cause the valve to close or prevent it from closing. The position of this valve (open or closed) will have no adverse impact on hot standby. OFN RP-017A closes EJHV8840 to prevent hot leg recirculation when lining up RHR for cold shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 17 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EJHIS0611 RL017 M-12EJ01 (B-6) EJFCV0611 RHR B Miniflow Valve Valve could close. If the valve closes there will be no adverse impact unless the Train B RHR pump starts in which case the pump would have no recirc flow. The pump is stopped (or prevented from starting) in OFN RP-017. Valve EJFCV0611 is lined up in OFN RP-017A when placing RHR in service. The valve was modified to address IN 92-18. EJHIS8701B RL017 M-12EJ01 (C-8) EJHV8701B RCS Hot Leg to RHR Pump B None This valve is normally deenergized and is maintained closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A. BBHIS8702B RL017 M-12BB01 (H-5) BBPV8702B RCS Hot Leg to RHR Pump B None This valve is normally deenergized and is maintained closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A. BNHIS8812B RL017 M-12BN01 (D-3) BNHV8812B RWST to RHR B Suction Valve could close or remain open. If the valve closes there is no adverse impact on PFSSD. If the valve remains open and valve EJHV8811B opens, then the RWST would drain to the containment sump. OFN RP-017 closes BNHV8812B using BNHS8812B. Calculation XX-E-013, Appendix 1 has determined there is 28 minutes to mitigate RWST draindown to the sump if one RWST to sump flowpath fails open. This condition will be mitigated before the RWST drops below minimum level needed for cold shutdown. The valve has been modified to address NRC IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 18 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EJHIS8811B RL017 M-12EJ01 (D-7) EJHV8811B Ctmt Recirc Sump to RHR B Suction Valve could spuriously open. Valve EJHV8811B is required to be closed for hot standby (OFN RP-017) and cold shutdown (OFN RP-017A). Damage to this switch could cause the valve to open. In addition, valve BNHV8812B may not automatically close as designed, causing the RWST to drain to the sump. This condition is mitigated in OFN RP-017 using switch BNHS8812B. Procedure OFN RP-017A provides guidance to locally close this valve prior to lining up RHR for shutdown cooling. The valve has been modified to address NRC IN 92-18.

BNHIS8806A RL017 M-12BN01 (B-5) BNHV8806A RWST to SI Pumps Suction Could close or remain open. If this valve remains in its normally open position, then there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1565 psi. The SI pumps are not credited for PFSSD so if the valve closes, there would be no adverse impact.

EGHIS0101 RL017 M-12EG02 (G-4) EGHV0101 CCW to RHR HX A Valve could open or close If the valve opens, there is no adverse impact. If the valve closes, CCW flow to the Train A RHR heat exchanger would be prevented. The Train A RHR system is not credited for safe shutdown following a fire in the control room. The valve can fail in any position with no adverse impact on PFSSD.

EGHIS0102 RL017 M-12EG02 (C-4) EGHV0102 CCW to RHR HX B Valve could open or close If the valve opens, there is no adverse impact. If the valve closes, CCW flow to the Train B RHR heat exchanger would be prevented. The Train B RHR system is credited for safe shutdown following a fire in the control room. The system is lined up in OFN RP-017A. The valve has been modified to address NRC IN 92-18. BNHIS8812AA RL017 M-12BN01 (B-3) BNHV8812A RWST to RHR Pump A Suction Valve could close or remain open. See discussion for BNHIS8812A. BNHIS8812BA RL017 M-12BN01 (D-3) BNHV8812B RWST to RHR B Suction Valve could close or remain open. See discussion for BNHIS8812B.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 19 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EMHIS8803B RL018 M-12EM02 (B-7) EMHV8803B CCP B to BIT Valve could remain closed or open. Valve is required to be open in OFN RP-017. The valve is manually opened in OFN RP-017 Step B12. If the valve spuriously opens, it is in the desired position and PFSSD is unaffected. The valve has been modified to address NRC IN 92-18.

EMHIS8803A RL018 M-12EM02 (C-7) EMHV8803A CCP A to BIT Valve could remain closed or open. Valve is not used in OFN RP-017. If it spuriously opens or fails in the closed position there is no impact on PFSSD. EPHIS8808B RL018 M-12EP01 (F-5) EPHV8808B Accum Tank B Outlet Iso Valve Could cause the valve to close or remain open. The position of this valve (open or closed) has no impact on PFSSD. The valve is used to control lineup of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD. During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808A RL018 M-12EP01 (G-5) EPHV8808A Accum Tank A Outlet Iso Valve Could cause the valve to close or remain open. The position of this valve (open or closed) has no impact on PFSSD. The valve is used to control lineup of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD. During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808C RL018 M-12EP01 (D-5) EPHV8808C Accum Tank C Outlet Iso Valve Could cause the valve to close or remain open. The position of this valve (open or closed) has no impact on PFSSD. The valve is used to control lineup of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD. During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808D RL018 M-12EP01 (B-5) EPHV8808D Accum Tank D Outlet Iso Valve Could cause the valve to close or remain open. The position of this valve (open or closed) has no impact on PFSSD. The valve is used to control lineup of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD. During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 20 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EMHIS8801B RL018 M-12EM02 (D-4) EMHV8801B BIT Discharge Iso Valve Could cause the valve to open or remain closed This valve is required to be open in OFN RP-017 to provide a charging path to the RCS. Step B18 opens the valve locally manually. If the valve opens as a result of the fire, it is in the desired PFSSD position. The valve has been modified to address NRC IN 92-18.

EMHIS8801A RL018 M-12EM02 (E-4) EMHV8801A BIT Discharge Iso Valve Could cause the valve to open or remain closed This valve is not used in OFN RP-017. If the valve opens as a result of the fire, then a flow path from charging to the RCS will be established as required. If the valve fails to open, valve EMHV8801B is opened in Step B18. Therefore, spurious operation of the valve will not affect PFSSD.

KCHIS0253B RL018 M-12KC02 (B-6) KCHV0253 Fire Protection Header Outer Ctmt Iso Valve Could prevent operation of the valve A fire in the control room does not require operation of the containment fire suppression system. Damage to this switch has no adverse impact on PFSSD.

EGHIS0014 RL019 M-12EG01 (C-7) EGHV0014 ESW to CCW Train B Makeup Could cause the valve to open. Valve is normally closed. If the valve opens, valve EGHV0012 will prevent ESW water from entering the CCW system. If both valves open, the CCW surge tank would fill solid, however this would not impact the ability of the CCW system to perform its intended function. If necessary, manual valve EGV0185 could be closed to isolate the makeup.

EGHIS0012 RL019 M-12EG01 (C-8) EGHV0012 ESW to CCW Train B Makeup Could cause the valve to open. Valve is normally closed. If the valve opens, valve EGHV0014 will prevent ESW water from entering the CCW system. If both valves open, the CCW surge tank would fill solid, however this would not impact the ability of the CCW system to perform its intended function. If necessary, manual valve EGV0185 could be closed to isolate the makeup.

EGHS0016 RL019 M-12EG01 (C-7) EGHV0016, EGHV0054 CCW Train B to/from Service Loop Could cause the valves to close or open. Valves are closed when operating the Train A CCW system and opened when operating the Train B CCW system. If the valves spuriously open, they are in the desired PFSSD position for OFN RP-017. If the valves are closed, OFN RP-017 opens them using switches EGHS0016A and EGHS0054. The valves were modified to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 21 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHIS0071 RL019 M-12EG03 (H-6) EGHV0071 CCW to RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0126, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, it will be manually open in OFN RP-017A. If the valve fails open, the CCW sy stem is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. Valve was modified to address IN 92-18.

EGHIS0058 RL019 M-12EG03 (H-6) EGHV0058 CCW to RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0127, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, it will be manually open in OFN RP-017A. If the valve fails open, the CCW sy stem is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. Valve was modified to address IN 92-18.

EGHIS0062 RL019 M-12EG03 (A-5) EGHV0062 CCW Return from RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and can be in any position for OFN RP-017. This valve is not required for cold shutdown. If the valve fails closed, it is in the desired PFSSD position. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017.

EGHIS0060 RL019 M-12EG03 (A-5) EGHV0060 CCW Return from RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0130, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, it will be manually open in OFN RP-017A. If the valve fails open, there is no adverse impact with CCW continuing to flow through the RCP bearing coolers, motor air coolers, excess letdown heat exchanger and RCDT heat exchanger. Valve was modified to address IN 92-18.

EGHIS0061 RL019 M-12EG03 (B-5) EGHV0061 CCW Return from RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and is required to be closed in OFN RP-017 to prevent a postulated steam bubble from forming in the CCW piping, potentially causing a water hammer. The valve is manually closed in OFN RP-017. Valve was modified to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 22 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHIS0059 RL019 M-12EG03 (B-5) EGHV0059 CCW Return from RCS Iso Valve Could cause the valve to close or remain open. Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0131, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, it will be manually open in OFN RP-017A. If the valve fails open, there is no adverse impact with CCW continuing to flow through the RCP bearing coolers, motor air coolers, excess letdown heat exchanger and RCDT heat exchanger. Valve was modified to address IN 92-18.

EFHIS0042 RL019 M-12EF02 (D-2) EFHV0042 ESW B to Service Water Could cause the valve to close or remain open. Valve is normally open and can be in any position for PFSSD. If the valve closes, ESW return to the UHS is controlled by EFHV0038 in OFN RP-017. If this valve and EFHV0040 remains open, there is no adverse impact because proper ESW flow is ensured. Therefore, spurious operation of this valve will not affect PFSSD. EFHIS0038 RL019 M-12EF02 (D-2) EFHV0038 ESW B to UHS Could cause the valve to close or remain open. Valve is normally throttled and is required to be fully open in OFN RP-017. If the valve fails open, it is in the desired PFSSD position. If it fails closed, it will be opened in OFN RP-017 using the isolation handswitch at the MCC. Valve has been modified to address IN 92-18. EFHIS0041 RL019 M-12EF02 (E-2) EFHV0041 ESW A to Service Water Could cause the valve to close or remain open. Valve is normally open and can be in any position for PFSSD. Train A ESW is not credited for PFSSD in OFN RP-017. Therefore, spurious operation of this valve will not adversely impact PFSSD.

EFHIS0060 RL019 M-12EF02 (D-3) EFHV0060 ESW B Return from CCW Hx B Could cause the valve to open or remain closed. This valve is normally closed with manual valve EFV0090 throttled to provide the proper flow for SIS or LOSP. If the valve opens, flow balance in the ESW system will be affected. If the valve closes, ESW flow through the CCW heat exchanger is ensured via normally throttled manual valve EFV0090. The valve is closed in OFN RP-017 using EFHS0060. Valve has been modified to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 23 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EFHIS0046 RL019 M-12EF02 (C-6) EFHV0046 ESW B from Ctmt Air Coolers Could cause the valve to close or remain open. Valve is required to be open in OFN RP-017 to ensure proper operation of the containment air coolers. The valve is opened in OFN RP-017 when lining up the containment coolers. Valve has been modified to address IN 92-18.

EFHIS0050 RL019 M-12EF02 (C-6) EFHV0050 ESW B from Ctmt Air Coolers Could cause the valve to close or remain open. Valve is required to be open in OFN RP-017 to ensure proper operation of the containment air coolers. The valve is opened in OFN RP-017 when lining up the containment coolers. Valve has been modified to address IN 92-18.

EFHIS0024 RL019 M-12EF01 (E-6) EFHV0024 ESW B from Service Water Cross Connect Could cause the valve to close or remain open. This flowpath is required to be isolated in OFN RP-017 to prevent flow diversion from ESW to the service water system. Valve EFHV0026, which is installed in series with this valve, is isolated in OFN RP-017. If EFHV0024 closes, then it is in the desired PFSSD position. If EFHV0024 remains open, valve EFHV0026 is closed to isolate this flowpath.

EFHIS0052 RL019 M-12EF02 (D-5) EFHV0052 ESW B to CCW Hx B Could cause the valve to close or remain open. Valve is normally open and is required to be open for OFN RP-017. If the valve spuriously closes, it is opened in OFN RP-017 using EFHS0052. Valve has been modified to address IN 92-18.

EFHIS0032 RL019 M-12EF02 (C-8) EFHV0032 ESW B to Ctmt Air Coolers Could cause the valve to close or remain open. Valve is required to be open in OFN RP-017 to ensure proper operation of the containment air coolers. The valve is opened in OFN RP-017 using EFHS0032. Valve has been modified to address IN 92-18.

EFHIS0034 RL019 M-12EF02 (C-7) EFHV0034 ESW B to Ctmt Air Coolers Could cause the valve to close or remain open. Valve is required to be open in OFN RP-017 to ensure proper operation of the containment air coolers. The valve is opened in OFN RP-017 using EFHS0034. Valve has been modified to address IN 92-18.

EFHIS0023 RL019 M-12EF01 (F-6) EFHV0023 ESW A from Service Water Cross Connect Could cause the valve to close or remain open. Train A ESW is not used in OFN RP-017. Spurious operation of this valve will not adversely impact PFSSD.

EFHIS0051 RL019 M-12EF02 (H-5) EFHV0051 ESW A to CCW Hx A Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EFHIS0031 RL019 M-12EF02 (G-8) EFHV0031 ESW A to Containment Air Coolers Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 24 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EFHIS0033 RL019 M-12EF02 (G-7) EFHV0033 ESW A to Containment Air Coolers Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EFHIS0025 RL019 M-12EF01 (F-7) EFHV0025 ESW A from Service Water Cross Connect Could cause the valve to close or remain open. Train A ESW is not used in OFN RP-017. Spurious operation of this valve will not adversely impact PFSSD.

EFHIS0040 RL019 M-12EF02 (D-2) EFHV0040 ESW B to Service Water Could cause the valve to close or remain open. Valve is normally open and can be in any position for PFSSD. If the valve closes, ESW return to the UHS is controlled by EFHV0038 in OFN RP-017. If this valve and EFHV0042 remains open, there is no adverse impact because proper ESW flow is ensured. Therefore, spurious operation of this valve will not affect PFSSD. EFHIS0059 RL019 M-12EF02 (H-3) EFHV0059 ESW A Return from CCW Hx B Could cause the valve to close or remain open. Train A ESW is not used in OFN RP-017. Spurious operation of this valve will not adversely impact PFSSD.

EFHIS0045 RL019 M-12EF02 (G-6) EFHV0045 ESW A from Containment Air Coolers Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EFHIS0026 RL019 M-12EF01 (E-7) EFHV0026 ESW B from Service Water Cross Connect Could cause the valve to close or remain open. This flowpath is required to be isolated in OFN RP-017 to prevent flow diversion from ESW to the service water system. The valve is isolated in OFN RP-017 using EFHS0026A. If it spuriously closes, it is in the desired PFSSD position. Valve has been modified to address IN 92-18.

EFHIS0049 RL019 M-12EF02 (G-6) EFHV0049 ESW A from Containment Air Coolers Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EFHIS0037 RL019 M-12EF02 (G-3) EFHV0037 ESW A to UHS Could cause the valve to close or remain open. Train A ESW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EFHIS0039 RL019 M-12EF02 (F-2) EFHV0039 ESW A to Service Water Could cause the valve to close or remain open. Valve is normally open and can be in any position for PFSSD. Train A ESW is not credited for PFSSD in OFN RP-017. Therefore, spurious operation of this valve will not adversely impact PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 25 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHS0015 RL019 M-12EG01 (D-6) EGHV0015, EGHV0053 CCW Train A to/from Service Loop Could cause the valves to close or remain open. These valves are open when operating the Train A CCW system. Valve EGHV0015 is manually closed in OFN RP-017 to prevent flow diversion from Train B CCW to Train A CCW system. Valve EGHV0015 has been modified to address IN 92-18. Valve EGHV0053 is not used in OFN RP-017 because check valve EGV0036 will prevent flow from the train B CCW system to the train A CCW system.

EGHIS0011 RL019 M-12EG01 (F-8) EGHV0011 ESW to CCW Pump A Could cause the valve to open or remain closed. Train A CCW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EGHIS0013 RL019 M-12EG01 (F-7) EGHV0013 ESW to CCW Pump A Could cause the valve to open or remain closed. Train A CCW is not credited in OFN RP-017. Spurious operation will not adversely impact PFSSD.

EGHIS0131 RL020 M-12EG03 (C-5) EGHV0131 CCW Return Ctmt Iso Valve Could prevent operation of the valve. Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0059, needs to be open for cold shutdown when using the excess letdown heat exchanger. Damage to the switch could prevent opening the valve but will not cause the valve to spuriously open since switch EGHIS0131A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0059 will be manually opened in OFN RP-017A.

EGHIS0127 RL020 M-12EG03 (G-4) EGHV0127 CCW Supply Ctmt Iso Valve Could prevent operation of the valve. Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0058, needs to be open for cold shutdown when using the excess letdown heat exchanger. Damage to the switch could prevent opening the valve but will not cause the valve to spuriously open since switch EGHIS0127A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0058 will be manually opened in OFN RP-017A.

EGHIS0131A RL020 M-12EG03 (C-5) EGHV0131 CCW Return Ctmt Iso Valve Could prevent operation of the power lockout feature and could cause spurious operation of valve. Valve is normally closed with this hand switch in the ISO position, preventing accidental opening of the valve. This valve, or valve EGHV0059, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, valve EGHV0059 will be manually opened in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 26 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHIS0133 RL020 M-12EG03 (D-5) EGHV0133 CCW Return Ctmt Iso Valve Could prevent operation of the valve. Valve is normally open and is required to be closed in OFN RP-017 to prevent a postulated steam bubble from forming in the CCW piping, potentially causing a water hammer. Damage to the switch could prevent operation of the valve but will not cause the valve to spuriously open since switch EGHIS0133A is normally in the ISO position. The valve is manually closed in OFN RP-017. Valve has been modified to address IN 92-18.

EGHIS0133A RL020 M-12EG03 (D-5) EGHV0133 CCW Return Ctmt Iso Valve Could prevent operation of the power lockout feature and could cause spurious operation of valve. Valve is normally open and is required to be closed in OFN RP-017 to prevent a postulated steam bubble from forming in the CCW piping, potentially causing a water hammer. If the valve spuriously opens it will be manually closed in OFN RP-017. Valve has been modified to address IN 92-18.

GSHIS0021 RL020 M-12GS01 (G-4) GSHV0021 Hyd Purge Outer Ctmt Iso Vlv Valve could open or remain closed. If the valve opens, there is no adverse impact on PFSSD. Valve GSHV0020 will remain closed or, if GSHV0020 also opens, the Aux Building ESF filters will prevent release of radioactivity. In either case, PFSSD is assured.

EGHIS0130 RL020 M-12EG03 (B-5) EGHV0130 CCW Return Ctmt Iso Valve Could prevent operation of the valve. Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0060, needs to be open for cold shutdown when using the excess letdown heat exchanger. Damage to the switch could prevent opening the valve but will not cause the valve to spuriously open since switch EGHIS0130A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0060 will be manually opened in OFN RP-017A.

EGHIS0126 RL020 M-12EG03 (G-5) EGHV0126 CCW Supply Ctmt Iso Valve Could prevent operation of the valve. Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0071, needs to be open for cold shutdown when using the excess letdown heat exchanger. Damage to the switch could prevent opening the valve but will not cause the valve to spuriously open since switch EGHIS0126A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0071 will be manually opened in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 27 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHIS0126A RL020 M-12EG03 (G-5) EGHV0126 CCW Supply Ctmt Iso Valve Could prevent operation of the power lockout feature and could cause spurious operation of valve. Valve is normally closed with this hand switch in the ISO position, preventing accidental opening of the valve. This valve, or valve EGHV0071, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, valve EGHV0071 will be manually opened in OFN RP-017A. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. EGHIS0130A RL020 M-12EG03 (B-5) EGHV0130 CCW Return Ctmt Iso Valve Could prevent operation of the power lockout feature and could cause spurious operation of valve. Valve is normally closed with this hand switch in the ISO position, preventing accidental opening of the valve. This valve, or valve EGHV0060, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, valve EGHV0060 will be manually opened in OFN RP-017A.

EGHIS0132 RL020 M-12EG03 (B-4) EGHV0132 CCW Return Ctmt Iso Valve Could prevent operation of the valve. Valve is normally closed and can be in any position for OFN RP-017. This valve is not required for cold shutdown. Damage to the switch could prevent opening the valve but will not cause the valve to spuriously open since switch EGHIS0132A is normally in the ISO position. If the valve fails closed there is no PFSSD impact. EGHIS0132A RL020 M-12EG03 (B-4) EGHV0132 CCW Return Ctmt Iso Valve Could prevent operation of the power lockout feature and could cause spurious operation of valve. Valve is normally closed and can be in any position for OFN RP-017. This valve is not required for cold shutdown. If the valve fails closed, it is in the desired PFSSD position. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017.

GSHIS0020 RL020 M-12GS01 (G-5) GSHV0020 Hyd Purge Inner Ctmt Iso Vlv Valve could open or remain closed. If the valve opens, there is no adverse impact on PFSSD. Valve GSHV0021 will remain closed or, if GSHV0021 also opens, the Aux Building ESF filters will prevent release of radioactivity. In either case, PFSSD is assured.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 28 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire EGHIS0072 RL020 M-12EG02 (H-2) EGHV0072 CCW Iso to PASS Could prevent operation of the valve. The Post-Accident Sampling System is not used for PFSSD. If the valve opens, CCW will flow to the PASS coolers only if three other valves also open. If this occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

EGHIS0074 RL020 M-12EG02 (H-1) EGHV0074 CCW Iso to PASS Could prevent operation of the valve. The Post-Accident Sampling System is not used for PFSSD. If the valve opens, CCW will flow to the PASS coolers only if three other valves also open. If this occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

EGHIS0127A RL020 M-12EG03 (G-4) EGHV0127 CCW Supply Ctmt Iso Valve Could prevent operation of the power lockout featurebut will not cause the valve to open Valve is normally closed with this hand switch in the ISO position, preventing accidental opening of the valve. This valve, or valve EGHV0058, needs to be open for cold shutdown when using the excess letdown heat exchanger. If the valve fails closed, valve EGHV0058 will be manually open in OFN RP-017A. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. EGHIS0073 RL020 M-12EG02 (H-2) EGHV0073 CCW Iso to PASS Could prevent operation of the valve. The Post-Accident Sampling System is not used for PFSSD. If the valve opens, CCW will flow to the PASS coolers only if three other valves also open. If this occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

EGHIS0075 RL020 M-12EG02 (H-1) EGHV0075 CCW Iso to PASS Could prevent operation of the valve. The Post-Accident Sampling System is not used for PFSSD. If the valve opens, CCW will flow to the PASS coolers only if three other valves also open. If this occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

BBHIS8037A RL021 M-12BB02 (D-3) BBHV8037A PRT Drain to Ctmt Norm Sump Could cause the valve to spuriously open. Spurious opening of the valve will not cause a loss of inventory in the RCS. The valve is used to drain the contents of the PRT to the sump.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 29 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BBHIS8037B RL021 M-12BB02 (D-3) BBHV8037B PRT Drain to Ctmt Norm Sump Could cause the valve to spuriously open. Spurious opening of the valve will not cause a loss of inventory in the RCS. The valve is used to drain the contents of the PRT to the sump.

BBHS8000A RL021 M-12BB02 (E-7) BBHV8000A Cold O/P Arm Sw Could prevent closing the valve. The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the valves closed. Therefore, failure of this valve to close will have no adverse impact on PFSSD.

BBHS8000B RL021 M-12BB02 (F-8) BBHV8000B Cold O/P Arm Sw Could prevent closing the valve. The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the valves closed. Therefore, failure of this valve to close will have no adverse impact on PFSSD.

BBHIS0013 RL021 M-12BB03 (C-3) BBHV0013 CCW from RCP A Could cause spurious operation of the valve. RCP thermal barrier cooling is not credited in OFN RP-017. The CCW service loop is isolated in OFN RP-017 so there will be no flow to the thermal barrier. Spurious operation of this valve will have no adverse impact.

BBHIS0014 RL021 M-12BB03 (C-3) BBHV0014 CCW from RCP B Could cause spurious operation of the valve. RCP thermal barrier cooling is not credited in OFN RP-017. The CCW service loop is isolated in OFN RP-017 so there will be no flow to the thermal barrier. Spurious operation of this valve will have no adverse impact.

BBHIS0015 RL021 M-12BB03 (C-3) BBHV0015 CCW from RCP C Could cause spurious operation of the valve. RCP thermal barrier cooling is not credited in OFN RP-017. The CCW service loop is isolated in OFN RP-017 so there will be no flow to the thermal barrier. Spurious operation of this valve will have no adverse impact.

BBHIS0016 RL021 M-12BB03 (C-3) BBHV0016 CCW from RCP D Could cause spurious operation of the valve. RCP thermal barrier cooling is not credited in OFN RP-017. The CCW service loop is isolated in OFN RP-017 so there will be no flow to the thermal barrier. Spurious operation of this valve will have no adverse impact.

BBHIS8351A RL021 M-12BB03 (D-5) BBHV8351A Seal Wtr Supply to RCP A Could cause the valve to close. Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves BGV0101 and BGV0105. Spurious closure of this valve will have no adverse impact on PFSSD.

BBHIS8351B RL021 M-12BB03 (D-5) BBHV8351B Seal Wtr Supply to RCP B Could cause the valve to close. Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves BGV0101 and BGV0105. Spurious closure of this valve will have no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 30 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BBHIS8351C RL021 M-12BB03 (D-5) BBHV8351C Seal Wtr Supply to RCP C Could cause the valve to close. Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves BGV0101 and BGV0105. Spurious closure of this valve will have no adverse impact on PFSSD.

BBHIS8351D RL021 M-12BB03 (D-5) BBHV8351D Seal Wtr Supply to RCP D Could cause the valve to close. Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves BGV0101 and BGV0105. Spurious closure of this valve will have no adverse impact on PFSSD.

BBHIS8000A RL021 M-12BB02 (E-7) BBHV8000A Cold O/P Arm Sw Could prevent closing the valve. The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the valves closed. Therefore, failure of this valve to close will have no adverse impact on PFSSD.

BBHIS8000B RL021 M-12BB02 (F-7) BBHV8000B Cold O/P Arm Sw Could prevent closing the valve. The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the valves closed. Therefore, failure of this valve to close will have no adverse impact on PFSSD.

ECHIS0011 RL021 M-12EC01 (H-5) ECHV0011 Fuel Pool Hx CCW Disch Iso A Could cause spurious operation of the valve. Valve controls CCW flow to the Fuel Pool Hx. The fuel pool cooling system is not required for PFSSD.

Spurious operation of the valve will not adversely impact safe shutdown.

ECHIS0012 RL021 M-12EC01 (E-5) ECHV0012 Fuel Pool Hx CCW Disch Iso B Could cause spurious operation of the valve. Valve controls CCW flow to the Fuel Pool Hx. The fuel pool cooling system is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

LFHIS0105 RL023 M-12LF03 (C-5) LFHV0105 Control/Aux Bldg Sump Iso Vlv Could cause the valve to close or open. The auxiliary building drainage system is not relied on for PFSSD. Spurious operation of this valve will not adversely impact PFSSD.

LFHIS0106 RL023 M-12LF03 (C-4) LFHV0106 Control/Aux Bldg Sump Iso Vlv Could cause the valve to close or open. The auxiliary building drainage system is not relied on for PFSSD. Spurious operation of this valve will not adversely impact PFSSD.

AFHIS0113 RL023 M-12AF02 (C-7)

AFLV0113C Feed Wtr Htr 4A Iso Vlv Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0106 RL023 M-12AF02 (E-7)

AFLV0106C Feed Wtr Htr 3A Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 31 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire AFHIS0144 RL023 M-12AF02 (C-5)

AFLV0144C Feed Wtr Htr 4B Iso Vlv Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0136 RL023 M-12AF02 (E-5)

AFLV0136C Feed Wtr Htr 3B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHIS0173 RL023 M-12AF02 (C-3)

AFLV0173C Feed Wtr Htr 4C Iso Vlv Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0165 RL023 M-12AF02 (E-3)

AFLV0165C Feed Wtr Htr 3C Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0007 RL023 M-12AF01 (G-8)

AFLV0007C AFLV0007D AFLV0007E Feed Wtr Htr 7A Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0012 RL023 M-12AF01 (E-7)

AFLV0012C Feed Wtr Htr 6A Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0012 RL023 M-12AF01 (E-7)

AFLV0012D MSR C Scavenging Steam to HP Htr 6A Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0012 RL023 M-12AF01 (E-7)

AFLV0012E MSR A Scavenging Steam to HP Htr 6A Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHIS0024 RL023 M-12AF01 (D-7)

AFLV0024C Feed Wtr Htr 5A Iso Vlv Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0058 RL023 M-12AF01 (F-2)

AFLV0058C Feed Wtr Htr 7B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0058 RL023 M-12AF01 (F-2)

AFLV0058D Feed Wtr Htr 7B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0058 RL023 M-12AF01 (F-2)

AFLV0058E Feed Wtr Htr 7B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 32 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire AFHS0044 RL023 M-12AF01 (E-3)

AFLV0044C Feed Wtr Htr 6B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0044 RL023 M-12AF01 (E-3)

AFLV0044D Feed Wtr Htr 6B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHS0044 RL023 M-12AF01 (E-3)

AFLV0044E Feed Wtr Htr 6B Drain Iso Vlvs Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHIS0064 RL023 M-12AF01 (D-3)

AFLV0064B Feed Wtr Htr 5B Iso Vlv Could cause the valve to close or open. The feed water heaters are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

AFHIS0210 RL023 M-12AF01 (C-3)

AFHV0210 Htr Drn Tk Start Up Drn to Cond Could cause the valve to close or open. The heater drain tank is not required for PFSSD. Spurious operation will not impact safe shutdown.

ADHIS0008 RL023 M-12AD02 (C-3)

ADHV0008 Cond Pump A Disch Iso Could prevent operation of the valve. The condensate pumps are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

ADHIS0017 RL023 M-12AD02 (C-5)

ADHV0017 Cond Pump B Disch Iso Could prevent operation of the valve. The condensate pumps are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

ADHIS0024 RL023 M-12AD02 (C-7)

ADHV0024 Cond Pump C Disch Iso Could prevent operation of the valve. The condensate pumps are not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

ADHIS0028 RL023 M-12AD02 (C-2)

ADHV0028 Cond Demin BypassCould prevent operation of the valve. The valve is not required for PFSSD. Spurious operation of the valve will not adversely impact safe shutdown.

LFHIS0095 RL023 M-12LF09 (F-2) LFFV0095 Cont Sump Iso Vlv Could cause the valve to close or open. The reactor building drainage system is not relied on for PFSSD. Spurious operation of this valve will not adversely impact PFSSD.

FCHIS0004 RL023 M-12FC03 (H-3) FCHV0004 SGFP Turb A Above Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0104 RL023 M-12FC04 (H-3) FCHV0104 SGFP Turb B Above Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 33 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire FCHIS0007 RL023 M-12FC03 (H-3) FCHV0007 SGFP Turb A Below Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0107 RL023 M-12FC04 (H-3) FCHV0107 SGFP Turb B Below Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0012 RL023 M-12FC03 (F-3) FCHV0012 SGFP Turb A Above Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0112 RL023 M-12FC04 (F-3) FCHV0112 SGFP Turb B Above Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0013 RL023 M-12FC03 (F-3) FCHV0013 SGFP Turb A Below Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0113 RL023 M-12FC04 (F-3) FCHV0113 SGFP Turb B Below Seat Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0071 RL023 M-12FC03 (A-4) FCHV0071 SGFP Turb A Startup Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

FCHIS0171 RL023 M-12FC04 (A-4) FCHV0171 SGFP Turb B Startup Drain Could cause the valve to close or open. The SGFP is not required for PFSSD. Damage to the switch will have no adverse impact on PFSSD.

ADHIS0113 RL023 M-12AD01 (F-4)

ADHV0113A, ADHV0113B, ADHV0113C, ADHV0113D Vacuum Breaker Valves Could cause the valve to close or open. The condenser vacuum breaker valves are not required for PFSSD. Spurious operation will not adversely impact PFSSD.

KAHIS0030 RL024 M-12KA01 (C-1) KAHV0030 Inst Air Supply to H2 Ctrl System Could cause the valve to close or remain open. The H2 control system is not credited for PFSSD. Damage to this switch will not adversely impact safe shutdown.

ACHIS0251 RL024 M-12AC02 (G-6)

ACHV0251, ACHV0252, ACHV0261, ACHV0263 2nd Stage Reheater Steam Drains Could cause the valves to close or open. The moisture separator reheater is not required for PFSSD. Spurious operation of the valves will have no adverse impact on safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 34 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire ACHIS0189 RL024 M-12AC02 (G-7)

ACHV0189A, ACHV0189B, ACHV0189C, ACHV0189D 1st Stage Reheater Steam Supply Could cause the valve to close or open. The moisture separator reheater is not required for PFSSD. Spurious operation of the valve will have no adverse impact on safe shutdown.

ABHIS0032 RL024 M-12AB03 (H-5)

A BHV0031, A BHV0032 2nd Stage Reheater Steam Supply Could cause the valve to close or open. Valve is required to be closed if the MSIVs cannot be closed to prevent uncontrolled steam release. OFN RP-017 closes the MSIVs so spurious operation of this valve will not adversely impact PFSSD.

ACHIS0131 RL024 M-12AC02 (F-2)

ACHV0118, ACHV0120, ACHV0121, ACHV0122, ACHV0123, ACHV0124, ACHV0125, ACHV0126, ACHV0144, ACHV0145, ACHV0152, ACHV0153, ACHV0255 Cold Reheat Line Drains Could cause the valves to close or open. The MSR drains are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ACHIS0253 RL024 M-12AC02 (F-6)

ACHV0253, ACHV0254, ACHV0262, ACHV0264 1st Stage Reheater Steam Drains Could cause the valves to close or open. The MSR drains are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ADHS0055 RL024 M-12AD02 (G-6) ADHV0055, ADHV0066 LP Htr 1A to 4A Isol Valves Could cause the valves to close or open. The low pressure heaters are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ADHS0043 RL024 M-12AD02 (G-4) ADHV0043, ADHV0054 LP Htr 1B to 4B Isol Valves Could cause the valves to close or open. The low pressure heaters are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ADHS0030 RL024 M-12AD02 (G-2) ADHV0030, ADHV0041 LP Htr 1C to 4C Isol Valves Could cause the valves to close or open. The low pressure heaters are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ADHIS0042 RL024 M-12AD02 (G-3) ADHV0042 LP Htr Bypass Valves Could cause the valve to close or open. The low pressure heaters are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 35 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire AEHIS0017 RL024 M-12AE01 (E-5)

A EHV0017, A EHV0034 HP Htr 5B, 6B and 7B Isol Vlvs Could cause the valves to close or open. The heaters are not required for PFSSD. Spurious operation of the valves will have no adverse impact on safe shutdown.

AEHIS0018 RL024 M-12AE01 (E-4)

A EHV0018, A EHV0033 HP Htr 5A, 6A and 7A Isol Vlvs Could cause the valves to close or open. The heaters are not required for PFSSD. Spurious operation of the valves will have no adverse impact on safe shutdown.

AEHIS0038 RL024 M-12AE01 (G-4)

AEHV0038 HP Htrs Bypass Valves Could cause the valve to close or open. The heaters are not required for PFSSD. Spurious operation of the valves will have no adverse impact on safe shutdown.

EAHIS0005 RL024 M-12EA02 (G-3) EAHV0005 Serv Wt r Return to CW System Could cause the valve to close or open. The service water system is not credited for PFSSD. The ESW system is the credited service water supply. Spurious operation of this valve will not adversely impact safe shutdown.

EAHIS0006 RL024 M-12EA02 (H-3) EAHV0006 Serv Wt r Return to CW System Could cause the valve to close or open. The service water system is not credited for PFSSD. The ESW system is the credited service water supply. Spurious operation of this valve will not adversely impact safe shutdown.

ACHIS0119 RL024 M-12AC02 (F-2)

ACHV0119, ACHV0127, ACHV0129, ACHV0148, ACHV0149, ACHV0150, ACHV0151, ACHV0225 MSR Shell Drain Jog Control Could cause the valves to close or open. The MSR drains are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ACHIS0072 RL024 M-12AC01 (C-6)

ACHV0071, ACHV0072 Startup Drain Valve Could cause the valves to close or open. The startup drains are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ACHS0181A RL024 M-12AC02 (H-7)

A CPV0181A, A CPV0181B, A CPV0181C, A CPV0181D Reheater Steam High Load Valves Could cause the valves to close or open. The MSR's are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 36 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire ACHIS0134 RL024 M-12AC01 (H-7)

ACHV0130, ACHV0134, ACHV0135, ACHV0136, ACHV0137, ACHV0256, ACHV0260, ACHV0261, ACHV0263 Main Stop and Control Vlv Startup Drains Could cause the valves to close or open. The drains are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

ACHS0181B RL024 M-12AC02 (H-7)

ACPV0181A Main Steam Supply to 2nd Stage Reheater Could cause the valve to close or open. The MSR's are not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

CAHIS0001 RL026 M-12CA01 (G-8) CAHV0001 Main Steam Seal Feed Valve Valve could fail open or closed. The main steam seal system is not required for PFSSD. Steam flow is isolated when the MSIVs are closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

CAHIS0002 RL026 M-12CA01 (G-8) CAHV0002 Main Steam Seal Feed Valve Valve could fail open or closed. The main steam seal system is not required for PFSSD. Steam flow is isolated when the MSIVs are closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

CAHIS0004 RL026 M-12CA01 (H-8) CAHV0004 Aux Steam Seal Feed Valve Valve could fail open or closed. The auxiliary steam seal system is not required for PFSSD. Steam flow through this line originates from the auxiliary boiler, not the main steam system. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

CAHIS0003 RL026 M-12CA01 (G-7) CAHV0003 Steam Seal Man Unloading Vlv Valve could fail open or closed. The steam seal system is not required for PFSSD. Steam flow is isolated when the MSIVs are closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

ABHIS0046 RL026 M-12AB03 (B-8)

A BHV0046 Main Stm Hdr to Stm Seal System Valve could fail open or closed. The main steam seal system is not required for PFSSD. Steam flow is isolated when the MSIVs are closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

FBHS0082 RL027 M-12FB01 (F-7) FBHV0080, FBHV0081 Htr's 6A and 6B Mn Stm Alignment Could prevent operation of the valves. The auxiliary steam system is not required for PFSSD. Damage to the switch will not adversely impact safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 9 Page 37 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument Instrument Location P&ID Drawing Associated MOV(s) DescriptionConsequence if Damaged Impact on PFSSD in the Event of a Control Room Fire BMHS0100 RL027 M-12BM01 (G-2) BMHV0100, BMHV0101 Htr's 5A and 5B Bldwn Stm Alignment Could cause the valves to open or close. Valves are not used for PFSSD. Damage to the switch will have no adverse impact on PFSSD. Steam generator blowdown is isolated in OFN RP-017 by opening breaker NK4411.

AEHS0103 RL027 M-12AE01 (G-2)

A EHV0102, A EHV0103 FWP PAE02 Inlet and Outlet Iso Valves Could prevent operation of the valves. The motor driven feedwater pump is not required for PFSSD. Damage to the switch will have no adverse impact on safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 1 of 58 Appendix 3 Control Room Multiple Spurious Operation (MSO) Review Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 2 of 58 This evaluation addresses multiple spurious operations in the event of a control room fire. For control room fires, it is not required to consider MSOs as an initial consequence of the fire. However, per RG 1.189, MSOs should be considered after control is transferred to the alternate shutdown capability. (See RG 1.189, Section 5.4.1)

Table A3 identifies the NEI 00-01, Rev. 3 MSO list and provides a comparison of how Wolf Creek addresses each scenario for cont rol room fires.

Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 1 Loss of all RCP Seal Cooling Spurious isolation of seal injection header flow AND Spurious isolation of CCW flow to thermal barrier heat exchanger Scenario causes loss of all RCP seal cooling and subsequent RCP seal LOCA, challenging the RCS Inventory Control Function.

BBHV8351A, BBHV8351B, BBHV8351C and/or BBHV8351D

AND BBHV0013 (BBFT0017), BBHV0014 (BBFT0018),

BBHV0015 (BBFT0019), and/or BBHV0016 (BBFT0020)

OR EGHV0058, EGHV0061, EGHV0062 (EGFT0062) or EGHV0071 OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. Therefore, this scenario is not applicable to a control room fire because the procedure actually causes the scenario.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 3 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 2 Loss of all RCP Seal Cooling Spurious opening of charging injection valve(s) causing diversion flow away from seals,

AND Spurious isolation of CCW flow to thermal barrier heat exchanger Scenario causes loss of all RCP seal cooling and subsequent RCP seal LOCA, challenging the RCS Inventory Control Function. EMHV8801A or EMHV8801B AND EMHV8803A or EMHV8803B

AND BBHV0013 (BBFT0017), BBHV0014 (BBFT0018), BBHV0015 (BBFT0019),

and/or BBHV0016 (BBFT0020)

OR EGHV0058, EGHV0061, EGHV0062 (EGFT0062) or EGHV0071 OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. OFN RP-017 also lines up the B Train BIT flowpath for injection. Therefore, this scenario is not applicable to a control room fire because the procedure actually causes this scenario.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 4 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 3 Thermal Shock of RCP Seals Loss of all Seal Cooling to any RCP(s). See Scenarios 1 & 2,

AND Spurious re-initiation of seal cooling (i.e., seal injection or CCW to TBHX) Thermal shock of seals causes catastrophic RCP seal failure and subsequent RCP seal LOCA, challenging the RCS Inventory Control Function.

Same as PWROG 1 or 2 AND EGHV0058 AND EGHV0071 or EGHV0126 AND EGHV0127 AND EGHV0062 or EGHV0132 AND EGHV0061 or EGHV0133 OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. Spurious re-initiation of seal injection is prevented by closing manual valves BGV0101 and BGV0105. Spurious re-initiation of thermal barrier cooling is prevented by de-energizing and closing valves EGHV0061 and EGHV0133. Therefore, this scenario is not applicable to a control room fire because the procedure prevents this scenario from occurring.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 5 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 4 Catastrop hic RCP Seal Failure Loss of all Seal Cooling to any RCP(s). See Scenarios 1 & 2,

AND Fire prevents tripping, or spuriously starts, RCP(s) Scenario causes catastrophic RCP seal failure and subsequent RCP seal LOCA, challenging the RCS Inventory Control Function.

Same as PWROG 1 or 2 AND PBB01A, PBB01B, PBB01C or PBB01D OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. Therefore, this scenario is not applicable to a control room fire because the procedure prevents spurious re-start of the RCPs.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 6 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 5 RCP Seal No. 2 Failure Loss of all Seal Cooling to any RCP(s). See Scenarios 1 & 2,

AND Spurious isolation of No. 1 seal leakoff valve(s) Isolation of the No. 1 seal leakoff line during a loss of all seal cooling event would force the No. 2 RCP seal into a high pressure mode of operation at high temperature, which is beyond the design basis of the No. 2 seal. This could cause catastrophic failure of the No. 2 seal and increase RCS leakage. Same as PWROG 1 or 2 AND BBHV8141A, BBHV8141B, BBHV8141C or BBHV8141D OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. OFN RP-017 does not ensure the No. 1 seal leakoff valves remain open. These valves are normally open and fail open.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, with the No. 1 seal return line spuriously closed the maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 6 Letdown Fails to Isolate and Inventory Lost to CVCS Spurious opening of (or failure to close) letdown isolation valve(s), AND Spurious opening of (or failure to close) letdown orifice valve(s) Letdown Fails to Isolate and Inventory Lost to CVCS causes loss of RCS inventory, challenging the RCS Inventory Control Function. BGLCV0459 and BGLCV0460

AND BGHV0149A, BGHV0149B or BGHV0149C OFN RP-017 fails the letdown valves and letdown orifice valves closed by opening switch PK5117. Calculation SA-08-006 uses a value of 120 gpm or 195 gpm, depending on the scenario, for 7 minutes. Based on drawing E-13RL02, the two letdown valves and three letdown orifice valves are powered from PK5117. Based on drawings E-13BG10 and E-13BG35, de-energizing the control circuit will close the valves.

To spuriously re-energize the circuit and re-open the valves, it would take two proper polarity inter-cable hot shorts on at least three valves. Therefore, six proper polarity inter-cable hot shorts would have to occur, which is extremely unlikely.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 7 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control De-energizing PK5117 will de-energize all other sources of separation group 5 - 125 VDC power from RL001/RL002 that could re-energize the letdown valves. Cable 15RLK01AA is the power cable from PK5117 to distribution bus DB1 in RL001/RL002. The cable enters RL001/RL002 from the lower cable spreading room in cable tray 135C8B45. All 125 VDC cables in tray 135C8B45 are fed from PK5117, so opening PK5117 will de-energize these cables.

Separation group 1 (Train A) 125 VDC power source to RL001/RL002 from NK4119 and separation group 4 (Train B) power source from NK4407 to RL001/RL002 are de-energized in OFN RP-017. By design, these sources should never come into contact with separation group 5 circuits. However, in the unlikely event they do, the sources are eliminated in the procedure.

Separation group 6 125 VDC power source from PK5211 is not de-energized in OFN RP-017. The separation group 6 cables could come in contact with the separation group 5 cables because there are no design restrictions to keep them separated within the control panels. The cables are separated in raceway.

As stated above, it would take a minimum of six proper polarity inter-cable hot shorts to cause the two letdown isolation valves and one letdown orifice valve to spuriously open. Since the letdown valves are considered high/low pressure interfaces, consideration of two or more proper polarity hot shorts is required. However, based on testing of DC circuits documented in NUREG/CR-7100 and NUREG-2128, multiple proper polarity inter-cable hot shorts causing multiple spurious operations is not credible.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 8 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 7 Letdown Fails to Isolate and Inventory Lost to PRT Letdown fails to isolate (see Scenario 6), AND Spurious closure of downstream containment isolation valve Scenario causes letdown flow to PRT through relief valve. This letdown flow is assumed unavailable for RCS makeup.

Same as PWROG 6 AND BGHV8152, BGHV8160, or BGPCV0131 See response to PWROG 6.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 8 Excess Letdown Fails to Isolate Spurious opening of (or failure to close) multiple series excess letdown isolation valves Scenario causes loss of RCS inventory to the CVCS system, challenging the RCS Inventory Control Function. The RCS inventory (letdown) is assumed lost and unavailable for makeup. In reality, additional failures downstream of the excess letdown isolation valves would have to occur for this RCS inventory to be unavailable for makeup. BGHV8153A and BGHV8154A OR BGHV8153B and BGHV8154B AND BBHV8157A, BBHV8157B or BGHCV0123 Excess letdown is isolated in OFN RP-017 by opening switches NK4119 and NK4407. These actions de-energize all separation group 1 and 4 sources of 125 VDC power within panel RL001/RL002 and ensure the excess letdown valves do not spuriously open as a result of a control room fire.

In the unlikely event a 125 VDC source comes into contact with the control circuit for the excess letdown valves, it would take at least 4 proper polarity hot shorts to cause two series valves to open. Then it would take additional hot shorts to open valve BBHV8157A or BBHV8157B to cause excess letdown to flow to the PRT or valve BGHCV0123 to cause excess letdown to flow to the reactor coolant drain tank. Based on industry testing of DC circuits documented in NUREG/CR-7100 and NUREG-2128, this combination of smart hot shorts is not credible. Therefore, the actions taken in OFN RP-017 to close the excess letdown flowpath are acceptable.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 9 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 9 RCS Makeup Isolation Spurious isolation of seal injection flow path, AND/OR Spurious isolation of normal charging flow

path, AND/OR Spurious isolation of charging injection flow path Scenario isolates all high head RCS makeup flow paths, challenging the RCS Inventory Control Function. BGFCV0462, BGHCV0182, BGHV8105 or BGHV8106 AND BGFCV0121 or BBHV8351A, BBHV8351B, BBHV8351C and/or BBHV8351D

AND BGHV8357A or BGHV8357B OFN RP-017 isolates seal injection and normal charging by closing valves BGV0101, BGV0105 and BG8402B. Charging is lined up through the BIT by lining up the Train B charging pump and valves EMHV8803B and EMHV8801B. Valve EMHV8801B is throttled, by procedure, to achieve the correct charging flow.

Calculation SA-08-006 assumes 28 minutes to line up charging through the BIT. Due to the isolation and redundant fusing provided for the Train B equipment, this flowpath provides a reliable means of charging following a control room fire.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 10 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 10 Charging Pump Failure Initial condition is charging pump running with normal lineup taking suction from VCT. Spurious isolation of suction from VCT to running charging pump, AND Spurious isolation of (or failure to open) suction from RWST to running charging pump Scenario causes charging pump inoperability, challenging the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire.

BGLCV112B (BGLT0112) or BGLCV112C (BGLT0185)

AND BNLCV112D (BGLT0112) and BNLCV112E (BGLT0185) The normal charging pump (NCP) is normally operating. If this pump is damaged due to a spuriously closed VCT outlet valve, there is no adverse impact on PFSSD because the Train B centrifugal charging pump (CCP) is the credited charging pump for a control room fire.

If the Train B CCP is operating at the time of the fire, and one of the VCT outlet valves closes, the Train B CCP would be damaged. This scenario would only require a single spurious operation because it would only take spurious closure of one valve to cause it to happen. The RWST to charging pump suction valve does not automatically open when the VCT valve closes. The RWST valve opens on a low-low VCT level or SIS, neither of which would occur per this scenario.

Procedure OFN RP-017 lines up the RWST to the Train B CCP. Valve BNLCV0112E is opened using BNHS0112E. This switch isolates the control room and inserts a redundant fuse in the circuit, ensuring the valve opens and remains open.

This MSO scenario represents a vulnerability of low likelihood because the B CCP is not normally operated. Also, a control room fire that is severe enough to cause evacuation is not likely because the control room is constantly attended and smoke detectors are provided in the control room cabinets.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 11 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 11 Charging Pump Failure Initial condition is charging pump running and drawing suction from RWST.

Spurious isolation of two parallel RWST outlet valves. Scenario causes loss of charging pump suction, causing subsequent pump cavitation and inoperability. This challenges the RCS Inventory Control Function. BNLCV112D and BNLCV112E Procedure OFN RP-017 lines up the RWST to the Train B CCP. Valve BNLCV0112E is opened using BNHS0112E. This switch isolates the control room, inserts a redundant fuse in the circuit and opens the valve, ensuring the valve remains open for the duration of the event.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 12 Charging Pump Failure Spurious opening (or failure to close) of multiple series VCT outlet valves Scenario causes VCT drain down and hydrogen cover gas entrainment into charging pump suction, ultimately causing charging pump inoperability and challenging the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire.

Note this scenario assumes that VCT makeup has been isolated (i.e., letdown isolated).

BGLCV112B and BGLCV112C Procedure OFN RP-017 isolates valve BGLCV0112C using BGHS0112C. This switch isolates the control room, inserts a redundant fuse in the circuit and closes the valve, ensuring the valve remains closed for the duration of the event.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 12 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 13 Charging Pump Failure Letdown fails to isolate (see Scenario 6), AND Spurious isolation of CCW cooling to the letdown heat exchanger Scenario causes elevated charging pump suction temperature and subsequent pump inoperability. Charging pump inoperability challenges the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire. PWROG 6 AND BGTV0130 See scenario PWROG 6 for discussion about letdown.

The VCT is isolated as discussed in scenario PWROG 12.

Since letdown and the VCT is isolated per procedure OFN RP-017, spurious isolation of CCW cooling to the letdown heat exchanger is not a concern.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 14 Charging Pump Failure Charging pump runout when RCS is depressurized Scenario causes charging pump runout and failure.

Pump(s) must be running when RCS is at a depressurized condition. RCS depressurization could occur due to spurious opening of pressurizer PORV(s), for example. PBG05A PBG05B AND BBPCV0455A And/or BBPCV0456A Procedure OFN RP-017 lines up the Train B CCP to inject through the BIT. The BIT outlet valve is throttled by operator action to maintain inventory. Therefore, pump runout is prevented in OFN RP-017 by an operator throttling the discharge valve to control pressurizer level.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 13 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 15 RWST Drain Down via Containment Sump Spurious opening of multiple series containment sump valves Scenario causes RWST drain down to the containment sump. Since typical PFSS analyses do not credit alignment of containment sump, the RWST inventory becomes unavailable for RCS makeup, challenging the RCS Inventory Control Function. BNHV8812A and EJHV8811A OR BNHV8812B and EJHV8811B OFN RP-017 isolates BNHV8812A and BNHV8812B prior to the RWST draining to an insufficient level. Containment sump valves EJHV8811A and EJHV8811B are not operated in OFN RP-017. As long as valves BNHV8812A and BNHV8812B are closed, spurious operation of EJHV8811A and EJHV8811B will have no adverse impact on RWST inventory.

Valve BNHV8812A is de-energized and manually closed per procedure. The valve has been modified to address NRC IN 92-18, so the valve can be manually closed when needed.

Valve BNHV8812B is closed using hand switch BNHS8812B. The hand switch isolates the control room and inserts a redundant fuse in the control circuit. The valve was modified to address NRC IN 92-18. Therefore, the valve will close when hand switch BNHS8812B is actuated and the valve will not re-open because the control circuit is isolated from the control room.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 14 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 16 RWST Drain Down via Containment Spray Spurious opening of containment spray header valve(s),

AND Spurious starting of containment spray pump(s) and/or RHR pump(s). Scenario causes a pumped RWST draindown via the containment spray ring. The RWST inventory ultimately settles to the containment sump. Since typical PFSS analyses do not credit alignment of the containment sump, the RWST inventory is assumed unavailable for RCS makeup, challenging the RCS Inventory Control Function. ENHV0006 AND PEN01A OR ENHV0012 AND PEN01B Containment spray pumps PEN01A and PEN01B are stopped or prevented from starting in OFN RP-017 by opening the pump motor breakers. Control power is removed from PEN01A by removing the close control power fuse in NB0102. Control power is removed from PEN01B by opening switch NK4401, which removes control power from the entire NB02 bus. Removal of control power prevents a control room fire from closing the breakers and spuriously starting the pumps.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 17 Interfacing System LOCA Spurious opening of multiple series RHR suction valves from RCS Scenario causes interfacing system LOCA, challenging the RCS Inventory Control Function.

BBPV8702A and EJHV8701A OR BBPV8702B and EJHV8701B During normal operation, these valves are de-energized and locked in the closed position. A fire in the control room cannot open these valves because it would take multiple proper phase hot shorts to re-energize the valves. Power circuits for these valves do not run through the control room so this circuit failure cannot occur due to a fire in the control room.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 15 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 18 Multiple Pressurize r PORVs Spurious opening of multiple (two or three) Pressurizer PORVs with corresponding block valves in normal, open position Scenario causes loss of RCS inventory through the pressurizer PORVs, challenging the RCS Inventory Control Function. Scenario also causes pressurizer depressurization, challenging the RCS Pressure Control Function.

BBPCV0455A and BBHV8000A AND BBPCV0456A and BBHV8000B Spurious opening of both pressurizer PORVs would result in conditions that do not meet the performance criteria of 10 CFR 50, Appendix R, Section III.L.

Calculation SA-08-006 assumes a single PORV is open for no more than 3 minutes. Procedure OFN RP-017 closes or ensures the pressurizer PORVs do not open by removing 125 VDC control power. This is done by opening switches NK5108 for BBPCV0455A and NK4421 for BBPCV0456A. Timing has shown that these switches are opened in less than 3 minutes.

Isolation of control power ensures a single proper polarity hot short will not energize the PORVs. License Amendment 193 approved the re-classification of the PORVs and block valves as non-high/low pressure interface, which allows Wolf Creek to consider only a single proper polarity hot short when performing circuit analysis on the PORVs and associated block valves.

Calculation SA-08-006, Scenario 1 was run with two pressurizer PORVs open for 3 minutes. The results show that, although significant voiding occurs in the upper core and steam generators, there is sufficient natural circulation to maintain core inlet and outlet temperature between 560 and 570 F. Pressurizer level momentarily goes off scale high but then stabilizes at about 55% and pressurizer pressure stabilizes at about 1200 psi. The core remains covered and no fuel damage is indicated.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 16 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 19 Pressurize r PORV and Block Valve Spurious opening of Pressurizer PORV(s),

AND Spurious opening of block valve(s) after it has been closed. Scenario causes loss of RCS inventory through the pressurizer PORV(s), challenging the RCS Inventory Control Function. Scenario also causes pressurizer depressurization, challenging the RCS Pressure Control Function.

BBPCV0455A AND BBHV8000A OR BBPCV0456A AND BBHV8000B See scenario PWROG 18 for discussion about the pressurizer PORVs. Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 20 Reactor Head Vent Valves Spurious opening of multiple series reactor head vent valves Scenario causes loss of RCS inventory through open reactor head vent flowpath(s), challenging the RCS Inventory Control Function.

BBHV8001A and BBHV8002A OR BBHV8001B and BBHV8002B The reactor head vent valves are closed in OFN RP-017 by opening switches NK5109 and NK4414. This de-energizes the valves and fails them closed. In order for two valves in the same flowpath to re-open, it would take at least four proper polarity hot shorts, which is not credible based on testing of DC circuits documented in NUREG/CR-7100 and NUREG-2128 Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 17 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG 21 Excess RCS Makeup Spurious starting of additional high head charging pump(s), AND Spurious opening of additional RCS makeup flow paths (i.e., charging injection) Scenario causes increasing RCS inventory, leading to a water solid pressurizer and PORV or safety valve opening. This scenario challenges both RCS Inventory and RCS Pressure Control Functions.

PBG04, PBG05A or PBG05B AND EMHV8801A or EMHV8801B AND EMHV8803A or EMHV8803B Procedure OFN RP-017 lines up Train B CCP to inject through the BIT using valves EMHV8801B and EMHV8803B. Normal charging is isolated by procedure by closing valve BG8402B. Seal injection is isolated by closing BGV0101 and BGV0105.

The Train A CCP is not secured in OFN RP-017. The BIT flowpath is controlled in OFN RP-017, so spurious operation of the Train A CCP is not a concern because the flow is controlled.

BIT outlet valve EMHV8801A is closed in OFN RP-017 by first opening the breaker then manually closing the valve to prevent excess flow to the RCS. The valve has been modified by DCP 13614 to address NRC IN 92-18.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 22 Primary Sample System Spurious opening of RCS sample valve(s) (i.e., hot leg, PZR liquid space, PZR steam space, etc.), AND Spurious opening of inside containment isolation valve, AND Spurious opening of outside containment isolation valve, AND Spurious opening of downstream sample valve(s) Scenario causes loss of reactor coolant through the primary sample system, challenging the RCS Inventory Control Function. SJHV0003 SJHV0004 SJHV0005 SJHV0006 SJHV0012 SJHV0013 SJHV0020 SJHV0127 SJHV0128 SJHV0129 SJHV0130 SJHV0133 Procedure OFN RP-017 does not isolate the primary sample system. Normally closed manual valves downstream of the sample coolers prevents loss of inventory through this flowpath. See drawing M-12SJ01.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 18 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control Expert Panel 1 Letdown Fails to Isolate and Inventory Lost to RHT Letdown fails to isolate (see Scenario 6), AND Spurious diversion of letdown flow to recycle hold-up tank Scenario causes letdown flow to RHT through divert valve. This letdown flow is assumed unavailable for RCS makeup.

Same as PWROG 6 AND BGLCV0112A (BGLT0149) See scenario PWROG 6 for discussion of letdown.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 2 Injection Flow Diverted to RWST or RHT Scenario assumes high head injection is in operation.

BIT test line opens to divert injection flow to the RWST or RHT Scenario causes diversion of high head injection and loss of RCS makeup. EMHV8843 or EMHV8882 AND EMHV8871 AND EMHV8964 Procedure OFN RP-017 closes test line EMHV8843 using hand switch EMHS8843. The hand switch isolates the control room and inserts a redundant fuse in the circuit. The valve has been modified to address NRC IN 92-18. This ensures the valve will close when the hand switch is placed in the ISO/CLOSED position. It also ensures the valve will not spuriously open in the event of cable damage.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 3 Isolation of Charging Pump Miniflow Spurious closure of normal charging isolation valve AND Spurious closure of pump miniflow valve Scenario causes overheating and eventual failure of affected pump. BGFCV0462 and BGHV8109 OR BGFCV0121 and BGHV8110 or BGHV8111 Procedure OFN RP-017 lines up the Train B CCP and opens miniflow valve BGHV8111 using hand switch BGHS8111A. Hand switch BGHS8111A isolates the control room, inserts a redundant fuse in the control circuit and opens the valve. Valve BGHS8111 has been modified to address NRC IN 92-18. Therefore, placing BGHS8111A in ISO/OPEN will open the valve and prevent it from closing due to a control room fire.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 19 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control Expert Panel 4 Loss of Low Head SI Pump Suction Spurious RWST Low Level indication resulting in:

Closure of RWST to high head pumps AND Containment Sump Suction valves open with insufficient water level in sump Scenario causes failure of low head SI pumps when required for recirculation. 2/4 Low-Low on BNLT0930, BNLT0931, BNLT0932, and BNLT0933 Procedure OFN RP-017 lines up the RWST to the Train B CCP. Valve BNLCV0112E is opened using BNHS0112E. This switch isolates the control room, inserts a redundant fuse in the circuit and opens the valve, ensuring the valve remains open for the duration of the event.

Spurious signals on the level transmitters will not adversely affect PFSSD after a control room fire because all required valves are manually aligned. The Train B intermediate head SI pump and low head RHR pump is prevented from starting in OFN RP-017 by opening the breaker and removing control power. Therefore, these pumps are protected from damage due to a control room fire and remain available if needed.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 20 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control Expert Panel 5 Failure of ECCS Sump Alignment Spurious RWST High Level indication resulting in:

Exhaustion of RWST inventory AND Failure of automatic transfer to ECCS Sump suction source. Scenario causes damage to CCPs and/or low head SI pumps due to loss of suction source.

SIAS AND BNLT0930, BNLT0931, BNLT0932, and BNLT0933 Procedure OFN RP-017 lines up the RWST to the Train B CCP. Valve BNLCV0112E is opened using BNHS0112E. This switch isolates the control room, inserts a redundant fuse in the circuit and opens the valve, ensuring the valve remains open for the duration of the event.

Spurious signals on the level transmitters will not adversely affect PFSSD after a control room fire because all required valves are manually aligned. The Train B intermediate head SI pump and low head RHR pump is prevented from starting in OFN RP-017 by opening the breaker and removing control power. Therefore, these pumps are protected from damage due to a control room fire and remain available if needed.

Following a control room fire, all lineups are performed manually. If necessary to line up the containment sump to the RHR pump, valve EJHV8811B can be opened. This valve has been modified to address NRC IN 92-18.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 6 RCP Seal Return Diverted to PRT Spurious closure of RCP seal return line isolation valve. Scenario causes loss of RCS inventory to the PRT challenging the RCS Inventory Control function. BGHV8100 OR BGHV8112 RCP seal injection is isolated in OFN RP-017 by closing valves BGV0101 and BGV0105. Therefore, with no seal injection there will be no seal return to divert to the PRT.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 7 Loss of all RCP Seal Cooling Loss of Letdown Flow to VCT AND Failure of RWST supply to high head pumps AND Spurious isolation of Scenario causes loss of all charging pumps due to loss of suction sources, loss of RCP Thermal Barrier cooling and subsequent RCP BGLCV0459, BGLCV0460, BGHV8152, BGHV8160, BGPCV0131, or BGLCV0112A OFN RP-017 has operators stop the RCPs and isolate seal injection and thermal barrier cooling. OFN RP-017 also lines up the B Train BIT flowpath for injection. Therefore, this scenario is not applicable to a control room fire because the procedure actually causes this scenario.

Based on Revision 2 of a White Paper prepared by Westinghouse dated October 15, 2012, maximum leakage

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 21 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control CCW flow to thermal barrier heat exchanger seal LOCA, challenging the RCS Inventory Control Function.

OR BGHV0149A, BGHV0149B and BGHV0149C AND BNLCV0112D and BNLCV0112E AND BBHV0013 (BBFT0017), BBHV0014 (BBFT0018), BBHV0015 (BBFT0019), and/or BBHV0016 (BBFT0020)

OR EGHV0058, EGHV0061, EGHV0062 (EGFT0062) or EGHV0071 through each seal is 21 gpm with the RCPs stopped and no seal cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which states that modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 22 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 23 Inadvertent Steam Dumping Spurious opening of multiple atmospheric steam dump valves upstream of MSIV Scenario causes RCS over-cooling.

Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

ABPV0001 (ABPT0001)

ABPV0002 (ABPT0002)

ABPV0003 (ABPT0003)

ABPV0004 (ABPT0004) OFN RP-017 controls all four atmospheric relief valves (ARVs). Two of the valves are controlled from the auxiliary shutdown panel (ASP) using hand controllers and two are failed closed locally by isolating air and nitrogen. Calculation SA-08-006 shows that a single ARV can be failed open for 60 minutes with no adverse consequences. All four ARVs are controlled or closed well within 60 minutes.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 23 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 24 Inadvertent Steam Dumping MSIV(s) spurious opening, or failure to

close, AND Spurious opening, or failure to close, of downstream steam loads (e.g., condenser steam dumps, turbine inlet valves, etc.) Scenario causes RCS over-cooling.

Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

ABHV0011, ABHV0014, ABHV0017 or ABHV0020 AND ABUV0034, ABUV0035, ABUV0036, ABUV0037, ABUV0038, ABUV0039, ABUV0040, ABUV0041, ABUV0042, ABUV0043, ABUV0044 or ABUV0045 OR ACFCV0043 and ACFCV0047 or ACFCV0044 and ACFCV0049 or ACFCV0045 and ACFCV0048 or ACFCV0046 and ACFCV0050 OFN RP-017 closes the MSIVs by removing power from cabinet SA075A. This removes 125 VDC power from the Train A solenoids for all four MSIVs and fails them closed. This action is taken within 3 minutes into the incident. Calculation SA-08-006 shows that if the MSIVs are closed in 3 minutes, PFSSD is not adversely affected.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 24 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 25 Inadvertent Steam Dumping MSIV bypass valve(s) spurious opening, or failure to close, AND Spurious opening, or failure to close, of down stream steam loads (e.g., condenser steam dumps, turbine inlet valves, etc.) Scenario causes RCS over-cooling.

Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

ABHV0012, ABHV0015, ABHV0018 or ABHV0021 AND ABUV0034, ABUV0035, ABUV0036, ABUV0037, ABUV0038, ABUV0039, ABUV0040, ABUV0041, ABUV0042, ABUV0043, ABUV0044 or ABUV0045 OR ACFCV0043 and ACFCV0047 or ACFCV0044 and ACFCV0049 or ACFCV0045 and ACFCV0048 or ACFCV0046 and ACFCV0050 See PWROG 24 for discussion about the MSIVs.

OFN RP-017 isolates the MSIV bypass valves by removing the control power fuse. Removing the control power fuse ensures the bypass valves remain closed. Calculation SA-08-006 assumes the bypass valves remain open for the duration of the event. Therefore, failure of the bypass valves to close will not prevent PFSSD.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 25 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 26 Inadvertent Steam Dumping Spurious operation of main steam header drain valve(s) Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

ABLV0007, ABLV0008, ABLV0009 ABLV0010, ABLV0050, ABLV0051, ABLV0052 or ABLV0053 See PWROG 24 for discussion about the MSIVs.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 27 Turbine Driven AFW Pump Inoperability Spurious isolation of redundant steam supply valves to turbine driven AFW pump Scenario causes turbine driven AFW pump inoperability, which challenges the Decay Heat Removal Function.

ABHV0005 and ABHV0006 Steam generator C (loop 3) supplies steam to the TDAFP through valve ABHV0006. However, steam generator C is not provided with feedwater flow in OFN RP-017. Therefore, valve ABHV0006 is closed in OFN RP-017 to prevent steam generator C from boiling dry. Hand switch RPHIS0001 is operated in an earlier step to isolate ABHV0006 from the control room and insert redundant fuses in the control circuit. This action ensures ABHIS0006B will work to control the position of ABHV0006.

Steam generator B (loop 2) supplies steam to the TDAFP through valve ABHV0005. Procedure OFN RP-017 controls the position of ABHV0005 (open or closed) from the ASP using ABHIS0005B. Hand switch RPHIS0001 is operated in an earlier step to isolate ABHV0005 from the control room and insert redundant fuses in the control circuit. This action ensures ABHIS0005B will work to control the position of ABHV0005.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 26 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 28 AFW Flow Isolation Spurious closure of multiple valves in AFW pump discharge flow path(s) Scenario isolates AFW flow to the steam generator(s), challenging the Decay Heat Removal Function. ALHV0005 (ALFT0001), ALHV0007 (ALFT0007), ALHV0009 (ALFT0009) and/or ALHV0011 (ALFT0011)

OR ALHV0006, ALHV0008, ALHV0010 and/or ALHV0012 OFN RP-017 lines up auxiliary feedwater to two steam generators. The TDAFP is lined up to supply steam generator B and the Train B MDAFP is lined up to supply steam generator D. The remaining two steam generators are not required for PFSSD. Valve ALHV0005 is opened to supply AFW from the B MDAFP to steam generator D. This va lve is controlled at the ASP by hand controller ALHK0005B. Hand switch ALHS0005 is placed in the LOCAL position to transfer control from the control room to the ASP. This also isolates the control room so that fire will not affect the operation of ALHK0005B.

Valve ALHV0010 is opened to supply AFW from the TDAFP to steam generator B. This valve is controlled at the ASP by hand controller ALHK0010B. Hand switch ALHS0010 is placed in the LOCAL position to transfer control from the control room to the ASP. This also isolates the control room so that fire will not affect the operation of ALHK0010B.

The configuration ensures valves ALHV0005 and ALHV0010 will remain available when needed.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 27 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 29 AFW Flow Isolation Spurious closure of steam supply valve(s) to turbine driven AFW pump, AND Spurious isolation of AFW pump discharge flow path(s) Scenario isolates AFW flow to the steam generator(s) and causes turbine driven AFW pump inoperability, challenging the Decay Heat Removal Function.

ABHV0005 and ABHV0006 AND ALHV0005 (ALFT0001), ALHV0007 (ALFT0007), ALHV0009 (ALFT0009) and/or ALHV0011 (ALFT0011) See PWROG 27 for discussion about the steam supply to the TDAFP. See PWROG 28 for discussion about AFW pump discharge flow paths. Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 28 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 30 AFW Flow Diversion Combination of spurious valve operations in the AFW pump discharge flowpaths to the steam generators Scenario causes AFW flow diversion to a non-credited steam generator(s), challenging the Decay Heat Removal Function. A steam generator may be "non-credited" by the SSA for a number of reasons including unavailability of instrumentation, inoperability of steam dumps on that loop, etc. ALHV0005 (ALFT0001), ALHV0007 (ALFT0007), ALHV0009 (ALFT0009) and/or ALHV0011 (ALFT0011)

OR ALHV0006, ALHV0008, ALHV0010 and/or ALHV0012 Procedure OFN RP-017 lines up the Train B motor driven auxiliary feedwater pump to steam generator D and the turbine driven auxiliary feedwater pump (TDAFP) to steam generator B. The two motor driven AFW pumps are designed to feed only two steam generators. The TDAFP is designed to feed all four steam generators.

Spurious opening of multiple discharge valves in the AFW system could cause flow diversion to non-credited steam generators. However, check valves are installed in the main feedwater line upstream of the auxiliary feedwater tap. The check valves ensure AFW flows to only the intended steam generator.

Although AFW could be diverted to a non-credited steam generator, the credited steam generator will receive adequate flow. Furthermore, OFN RP-017 has steps to close several manual valves in the AFW discharge flowpath to stop flow to non-credited steam generators to prevent overfill.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 29 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 31 AFW Pump Run Out Spurious full opening of multiple AFW flow control and/or isolation valves Scenario may cause AFW pump runout and inoperability, challenging the Decay Heat Removal Function.

Note that this scenario may occur even without spurious operations if the fail-safe position of relevant valves is full open. ALHV0005 (ALFT0001), ALHV0007 (ALFT0007), ALHV0009 (ALFT0009) and/or ALHV0011 (ALFT0011)

OR ALHV0006, ALHV0008, ALHV0010 and/or ALHV0012 Each AFW discharge flowpath has a flow orifice installed. Based on the Auxiliary Feedwater system description (M-01AL), each flow orifice is designed to limit flow to any single steam generator in the event of a main feedwater line break to ensure adequate auxiliary feedwater flow to the intact steam generator. Similarly, the flow orifices would prevent pump runout in the event of multiple failed open discharge control valves.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 32 CST Diversion to Condenser Spurious opening of valves between the Condensate Storage Tank (CST) and condenser hotwell Scenario causes inadvertent draining of CST inventory to the condenser. This CST inventory becomes unavailable as an AFW source, challenging the Decay Heat Removal Function.

Other CST draindown paths may exist. P&ID review required.

ADLV0079BA or ADLV0079BB Based on drawing M-109-00010, the CST tap for the condenser makeup is 20'-6" above the bottom of the tank and the tap for the AFW supply is 12 inches above the bottom of the tank. Therefore, if ADLV0079BA and/or ADLV0079BB were to spuriously open, there would be approximately 216,720 gallons remaining in the CST for AFW based on tank document WCRE-03. Therefore, spurious opening of these valves will not affect PFSSD. Procedure OFN RP-017 has steps to line up ESW to the auxiliary feedwater pumps if the CST level is less than 14%.

Level indication at the ASP is not protected from a control room fire but local indication is available. See Appendix 1, Table A1, APLI0004B evaluation. In the unlikely event the CST drains by other drain paths as a result of a fire in the control room, the auxiliary feedwater system will remain available. Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 30 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 33 Excess Feed Flow to Steam Generator Scenario can occur due to various combinations of spurious AFW pump starts, spurious opening (or failure to close) of valves in AFW pump discharge flowpaths, and spurious opening of MFW isolation valves with MFW pump(s) running. Scenario causes RCS over-cooling and/or steam generator overfill, both challenging the Decay Heat Removal Function. RCS over-cooling can cause RCS shrinkage and low PZR level. Steam generator overfill can affect operability of turbine-driven AFW pump. Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESFAS signal. Same as PWROG 27 and 30 Plus PAL01A, PAL01B or PAL02 OR PAE01A or PAE01B fail to trip OR PAE02 spuriously starts and AEHV0102 and AEHV0103 spuriously open AND AEFCV0510 or AEFCV0550 and AEFV0039 or AEFCV0520 or AEFCV0560 Evaluation SA-08-006, Rev. 3 investigates various scenarios that could result in steam generator overfilling. One of the assumptions used in developing some of the scenarios in SA-08-006, Rev. 2 was that the MSIVs close in response to a control room action. This assumption was determined to be wrong during the 2011 NRC Triennial Fire Protection Inspection. Therefore, all scenarios in SA-08-006 assume the MSIVs remain open until action is taken outside the control room to close them. With the MSIVs open, the main feedwater pumps continue to operate and pump water into the steam generators after the reactor is tripped from the control room. This causes the steam generators to overfill in some scenarios prior to operators closing the MSIVs and MFIVs from outside the control room.

An evaluation was performed to determine if the feedwater isolation signal (FWIS) would be affected by a control room fire. It was determined that a credible fire in the control room would not affect both trains of FWIS and that a FWIS would occur on a reactor trip with low Tavg. Since automatic functions are not allowed to be credited for control room fires, a license amendment request has been prepared to have this deviation approved. The LAR was submitted to the NRC on 11/21/2013. License Amendment 214 was approved 9/11/15 to allow credit for automatic FWIS on reactor trip with low Tavg.

Based on the results of this evaluation and the actions taken by operators, the steam generators will not overfill. Refer to Evaluation SA-08-006 for a detailed discussion of the scenarios and results.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 31 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal and AEFV0040 or AEFCV0530 or AEFCV0570 and AEFV0041 or AEFCV0540 or AEFCV0580 and AEFV0042 PWROG 34 Steam Generator Blowdown Spurious opening of, or failure to close, multiple series steam generator blowdown valves Scenario causes drain down of steam generator inventory through the blowdown system, challenging the Decay Heat Removal Function.

Scenario may screen if available AFW mass flow rate exceeds steam generator inventory mass loss rate through blowdown. BMHV0001, BMHV0002, BMHV0003 or BMHV0004 Calculation SA-08-006, Rev. 2 (previous revision) evaluated the thermal hydraulic impact of all four steam generator blowdown valves failing open and remaining open. The calculation shows that the blowdown valves can fail open for 60 minutes with no adverse consequences. Calculation SA-08-006, Rev. 3 (current revision) assumes all four blowdown valves remain closed. Calculation WCNOC-CP-002 assumes all four blowdown valves open for the modeled duration of 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> in some scenarios. There was no adverse impact on PFSSD identified with all four blowdown valves open for this duration.

OFN RP-017 removes power from the blowdown valves to fail them closed within 60 minutes. Per SA-08-006, Rev. 2 and the current revision of WCNOC-CP-002, this will not adversely impact PFSSD.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 32 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Decay Heat Removal PWROG 35 Secondary Sample System Spurious opening of steam generator sample valve(s) inside containment, AND Spurious opening of isolation valve(s) outside containment, AND Spurious opening of downstream sample valve(s) Scenario causes drain down of steam generator inventory through the sample system, challenging the Decay Heat Removal Function. N/A The sample lines are isolated by a normally closed manual isolation valve downstream of the sample coolers. Therefore, this scenario is not applicable.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 8 AFW Flow Diversion 1/2 MDAFW Pumps Fails to Start AND MFW Isolation Fails Scenario results in loss of decay heat removal capability due to flow imbalances created by attempting to feed all 4 SGs with a single MDAFW Pump. PAL01A or PAL01B AND AEFV0039, AEFV0040, AEFV0042 or AEFV0042 AND AEFCV0510 or AEFCV550, AEFCV0520 or AEFCV0560, AEFCV0530 or AEFCV0570, AEFCV0540 or AEFCV0580 The feedwater check valves were moved to a location upstream of the AFW tap in DCP 12792. Therefore, AFW flow cannot divert to another steam generator.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 33 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Pressure Control PWROG 36 RCS Pressure Decrease Spurious opening of pressurizer spray

valve(s), AND Inability to trip, or spurious operation of, RCP, AND Inoperability of PZR Heater(s) Scenario causes a RCS pressure transient, challenging the RCS Pressure Control Function. Typical PFSS analyses address this issue; PRAs often consider scenario negligible since there is no real threat of core uncovery.

PBB01A A ND BBPCV0455B

OR PBB01B AND BBPCV0455C OR PBG04, PBG05A, or

PBG05B AND BGHV8145 AND Pressurizer Heater Backup Groups A and B and Variable Group C Off Auxiliary pressurizer spray is prevented in OFN RP-017 by opening switch PK5117. This action is performed within 7 minutes after the reactor is tripped.

Normal pressurizer spray is stopped when operators trip the RCPs within 7 minutes after the reactor trip. The RCPs are stopped by locally tripping the breaker, so inability to trip is not a concern for a control room fire. Control power is removed from the RCP switchgear to prevent spurious re-start.

Backup group B heaters are protected from a control room fire and can be operated by an operator at the ASP. The remaining heater groups could be affected.

Evaluation SA-08-006 and Calculation WCNOC-CP-002 model various combinations of pressurizer heaters and pressurizer spray spurious operation/mal-operation. The results show that PFSSD is assured with any combination of spray/heater spurious operation/maloperation. Therefore, the various potential scenarios discussed in this MSO are bounded.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 34 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Pressure Control PWROG 37 RCS Pressure Increase Spurious operation of multiple PZR heaters, AND Inoperability of pressurizer spray or auxiliary spray, AND Failure to open pressurizer PORVs Scenario causes a RCS pressure transient, challenging the RCS Pressure Control Function. RCS pressure increase could cause PORV(s) and/or safety valve(s) to open.

Same as PWROG 36 Plus BBPCV0455A and/or BBPCV0456A fail to open Procedure OFN RP-017 fails the pressurizer PORVs closed and isolates auxiliary pressurizer spray. The procedure also trips the RCPs, causing a loss of pressurizer spray. Pressure is controlled by reducing temperature using two steam generator ARVs and auxiliary feedwater. Evaluation SA-08-006 shows that a pressure transient will not occur if procedure OFN RP-017 is followed.

Backup group B heaters are protected from a control room fire and can be operated by an operator at the ASP. The remaining heater groups could be affected. Calculation WCNOC-CP-002 evaluates the impact of multiple heaters spuriously operating and shows there is no adverse impact on PFSSD if this occurs. At worse, the pressurizer safeties will lift to relieve pressure.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 9 RCS Pressure Decrease Spurious operation of pressurizer pressure master controller Scenario causes an RCS pressure transient resulting in spurious SI actuation.

BBPC0455A (BBPT0455) A spurious SI actuation could occur in the event of a control room fire. Evaluation SA-08-006 models the effects of a spurious SI signal. Procedure OFN RP-017 has necessary steps to maintain RCS pressure and temperature within required limits.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 35 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Reactivity Control PWROG 38 Inadvertent Boron Dilution Unborated water supply to the RCS can occur due to combinations of the following:

-Spurious start of reactor makeup pump(s) (supplies unborated water to the VCT),

-Spurious opening of valves between reactor makeup pump(s) and VCT,

-Spurious full opening of the reactor makeup flow control valve, -Spurious closure of the boric acid flow control valve Scenario decreases RCS boron concentration, potentially causing reactivity increase, and challenging the Reactivity Control Function. BGFCV0111A and BGFCV0110B or BGFCV0111B WITH PBL01A or PBL01B OR BGFCV0110A fails closed during auto makeup The reactor makeup pumps supply unborated water to the VCT upstream of the VCT outlet valves. Procedure OFN RP-017 closes one of the two VCT outlet valves (BGLCV0112C). Therefore, unborated water will not reach the RCS per this scenario when OFN RP-017 is implemented.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 36 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Reactivity Control PWROG 39 Fire Prevents Reactor Trip Fire damage to RPS may prevent reactor trip. For example, hot shorts may prevent tripping of RPS MG sets. Scenario results in insufficient shutdown margin and potential need for emergency boration.

Note that this review may have already been performed for the disposition of Information Notice 2007-07. SB102A and SB102B AND PG01902 OR PG02002 and PA0207 Fail to Open AND Failure of Manual Rod Insertion (SFHS0002)

AND Failure of Emergency Boration (PBG04, PBG05A, PBG05B, PBG02A, PBG02B, and BGHV8104) Document E-1F9915, Table 7.1, Step 2 provides an evaluation that shows the reactor will trip when operators depress the reactor trip push buttons in the control room in the event of a fire in the control room. The presence of physical separation, smoke detection and constant attendance in the control room provides reasonable assurance that one of the reactor trip buttons will effectively trip the reactor.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 10 Malfunction of SGLCS Spurious operation of SG Water Level control resulting in overfeed of SG Scenario could cause reactor trip due to positive reactivity insertion. AEFC0510 (AELC0519), AEFC0520 (AELC0529), AEFC0530 (AELC0539), and AEFC0540 (AELC0549) For a control room fire, automatic functions are assumed to be defeated. Therefore, credit cannot be given to the steam generator level control system. See the response to scenario PWROG 33 for discussion about overfilling the steam generators.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 37 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 40 CCW Header Isolation CCW flow can be isolated via several combinations of spurious valve closures.

Pertinent valves include: -pump discharge valves, -pump crosstie valves, -CCW heat exchanger inlet valves, -CCW heat exchanger outlet valves, -CCW heat exchanger crosstie valves, -Etc. Scenarios cause failure of CCW function to provide cooling to safe shutdown loads. EGHV0053 and EGHV0054 OR EGHV0015 and EGHV0016 OFN RP-017 lines up Train B CCW by opening EGHV0016 and EGHV0054 and closing EGHV0015. All three valves were modified to address NRC IN 92-18 concerns. Valves EGHV0016 and EGHV0054 are opened using a hand switch at the MCC. Valve EGHV0015 is manually closed by local operator action.

Other valves are manually operated and are maintained in the correct position. Therefore, these valves can not spuriously operate.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 38 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 41 CCW to Redundant Loads Spurious isolation of CCW cooling to redundant loads (including lube oil coolers, RHR heat exchangers, etc.) Scenario isolates CCW cooling to redundant loads causing safe shutdown equipment inoperability of redundant Trains.

All credited CCW loads should be reviewed. Loss of CCW to redundant RHR Heat Exchangers:

EGHV0101 AND EGHV0102 For PFSSD following a control room fire, Train B CCW is required to provide cooling for the B RHR heat exchanger, B CCP oil cooler, B RHR pump seal cooler and seal water heat exchanger. Valve EGHV0102 is manually opened in OFN RP-017A to provide a flow path from the B CCW heat exchanger to the B RHR heat exchanger when entering shutdown cooling mode. The valve was modified to address NRC IN 92-18 so it will be available when needed. Valve EGHV0054 is opened in OFN RP-017 to provide B CCW flow to the seal water heat exchanger as discussed in scenario PWROG 40. The remaining flow paths have normally open manual valves that are not subject to spurious operation due to a control room fire.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 39 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 42 CCW Flow Diversion to Non-Credited Loop Flow diversion can occur via several combinations of spurious valve operations in the CCW pump discharge and CCW

loop crosstie flowpaths. Review P&IDs to identify relevant combinations. Scenario causes CCW flow to be diverted to the non-credited loop. This ultimately prevents CCW cooling of credited safe shutdown loads. Potential failure to close of non-safety loop isolation EGHV0069A, EGHV0069B, EGHV0070A and/or EGHV0070B Spurious opening of SFP HX supply ECHV0011 or ECHV0012 OFN RP-017 closes EGHV0070A and EGHV0070B by opening switch NK4413. However, as discussed in Appendix 1 of Calculation XX-E-013 closure of these valves is not required for PFSSD.

Under normal operation, the CCW system supplies approximately 4,000 gpm to the SFP heat exchanger. The RHR heat exchanger is not normally supplied with CCW during normal operation. The accident flow to the RHR heat exchanger is approximately 7,600 gpm per M-11EG01. For hot standby following a control room fire, the B RHR system is not used. The B RHR system is placed in service for shutdown cooling, at which time the SFP heat exchanger can be isolated using a manual valve. Therefore, the 4,000 gpm flow through the SFP heat exchanger will not adversely affect CCW flow to the credited PFSSD components.

In the event valve EGHV0102 spuriously opens and allows CCW flow to the RHR heat exchanger sufficient flow may not be available to the PFSSD loads (CCP oil cooler and seal water heat exchanger). Per drawings M-11EG01 and M-11EG02 the total CCW flow with valve EGHV0102 open is approximately 14,000 gpm. Each CCW pump is rated at 11,025 gpm at 195 feet of head. Per drawing M-082-029, the discharge head at 14,000 gpm is 155 feet and the required net positive suction head (NPSH) is 31 feet. Minimum available NPSH for normal shutdown occurs at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> per Calculation M-EG-05 and is equal to 37.5 feet. Therefore, with 14,000 gpm flowing, sufficient NPSH is available and there is reasonable assurance that the Train B CCP oil cooler and seal water heat exchanger will receive sufficient flow. However, as a precaution, EGHV0102 is closed in OFN RP-017 to prevent flow diversion during long term hot standby. This action is required to be completed within 28 minutes and prior to starting the B Train CCP to support CCP functionality.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 40 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 43 ESW Header Isolation ESW flow to credited loads can be isolated via several combinations of spurious valve closures.

Pertinent valves include: -pump discharge valves, -pump crosstie valves, -ESW heat exchanger inlet valves, -ESW heat exchanger outlet valves, -ESW heat exchanger crosstie valves, -Etc. Review P&IDs to identify relevant combinations. Scenario causes isolation of ESW, which can fail cooling to the CCW system and other safe shutdown components directly cooled by ESW (e.g., EDG cooling). EFHV0037, EFHV0039 and EFHV0041 OR EFHV0038, EFHV0040 and EFHV0042 The Train B ESW system is credited for a control room fire. Valve EFHV0038 is opened in OFN RP-017 by placing hand switch EFHS0038A in the ISO/OPEN position. The valve was modified to address NRC IN 92-18 concerns. Therefore, valve EFHV0038 is protected from a control room fire.

Valves EFHV0040 and EFHV0042 are service water return valves from Train B ESW. The valves close on SIS or LOSP to ensure 100% of the ESW flow returns to the UHS during accident conditions. For PFSSD these valves can fail in any position with no adverse impact because flow will be maintained through EFHV0038.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 41 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 44 ESW to Redundant Loads Spurious isolation of ESW cooling to redundant loads (including CCW heat exchangers, EDG cooling, etc.) Scenario isolates ESW cooling to redundant loads causing safe shutdown equipment inoperability of redundant Trains.

All credited ESW loads should be reviewed. Component Cooling Water:

EFHV0051 or EFHV0059 AND EFHV0052 or EFHV0060 Instrument Air:

EFHV0043 AND EFHV0044 Containment Coolers: EFHV0031, EFHV0032, EFHV0033, EFHV0034, EFHV0045, EFHV0046, EFHV0049 and/or EFHV0050 Procedure OFN RP-017 lines up Train B ESW to all required PFSSD loads. Most of the Train B motor operated valves have been modified to address NRC IN 92-18 concerns. Also, the valves are opened or closed using an isolation switch at the MCC.

Train B valves included in these modifications are:

EFHV0032 EFHV0034 EFHV0046 EFHV0050 EFHV0052 EFHV0060 Instrument air is not credited for PFSSD. Therefore, valves EFHV0043 and EFHV0044 are not included in OFN RP-017. See PWROG 45 for discussion of flow diversion if these valves fail open.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 42 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 45 ESW Flow Diversion to Non-Credited Loops/System s Flow diversion can occur via several combinations of spurious valve operations in the ESW pump discharge and loop crosstie flowpaths. Review P&IDs to identify relevant combinations. Scenario causes ESW flow to be diverted to a non-credited loop or system. This ultimately prevents ESW cooling of credited loads. SW Isolation Failure: EFHV0023 and EFHV0025 OR EFHV0024 and EFHV0026 CCW HX Supply Full Open:

EFHV0051, EFHV0052, EFHV0059 or EFHV0060 Instrument Air:

EFHV0043 AND EFHV0044 Train B ESW is credited for a control room fire. Valve EFHV0026 is isolated in OFN RP-017 by placing EFHS0026A in the ISO/CLOSE position. The hand switch isolates the control room, inserts a redundant fuse in the secondary side of the CPT and closes the valve. Also, this valve has been modified to address NRC IN 92-18. These modifications ensure the valve will close and remain closed for the duration of the event.

See PWROG 44 for discussion about EFHV0052 and EFHV0060.

Instrument air is not credited for a control room fire, so valves EFHV0043 and EFHV0044 are not included in OFN RP-017. If these valves remain in the open position, flow will be diverted to the air compressor and after cooler. Since Train A is not used for control room fire, opening of EFHV0043 will have no adverse impact on PFSSD. If valve EFHV0044 remains open, there is no adverse impact because the ESW system is designed to supply the required PFSSD loads concurrent with the air compressor and after cooler. Valve EFHV0044 does not automatically close on a SIS or LOSP, which indicates that ESW flow to the air compressor and after cooler will not affect safe shutdown.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 43 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 46 Emergency Power Additional components load onto credited diesel generator Scenario causes diesel generator overloading and inoperability. Note: Scenario very site specific. Interlocks may prevent this

from occurring. All large loads The B EDG is credited for a control room fire. Procedure OFN RP-017 identifies the steps to start the EDG in the event of a fire in the control room. The procedure first sheds all large electrical loads from the NB02 bus before starting the EDG. Then, each required load is added in sequence with sufficient time between starts to allow the EDG to come up to speed prior to adding the next load. Control power is removed from the NB02 bus to prevent inadvertent loading of the bus.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 47 Emergency Power Diesel generator overloading Scenario causes diesel generator overloading and inoperability. Note: Scenario very site specific. Interlocks may prevent this from occurring.

In addition to Scenario 46, overloading may also occur if proper load sequencing is bypassed via hot shorts, causing simultaneous loading of multiple components onto the EDG. NF039A and NF039B If a fire occurs in the NF039 cabinets and load sequencing is bypassed such that multiple components are loaded simultaneously, the EDG would continue to operate. There are no trip signals that would cause the EDG to trip if this occurs. If the EDG started in emergency mode, the output breaker would remain closed because the trip circuits are bypassed in emergency mode. Overloading would drop the output voltage of the EDG and the current to the individual loads would increase, which could trip the breakers for the individual loads. However, the EDG and output breaker would be unaffected.

OFN RP-017 opens most of the NB02 breakers and manually sequences the loads to the bus after the EDG is started. The B EDG would remain available to support PFSSD. Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 44 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions PWROG 48 Emergency Power Diesel generator spuriously starts without service water cooling. The fire causes the startup of the Emergency Diesel Generator and spurious isolation of ESW cooling (See Scenarios 42

& 44). Running the Emergency Diesel Generator with a loss of cooling water could trip and/or damage the diesel on high temperature. KKJ01A and PEF01A OR KKJ01B and PEF01B Essential Service Water (ESW) is established in OFN RP-017 within the time limits of KJ-M-017 Table 1 (included in Section 6.5 of E-1F9915) after the EDG is manually started to prevent a high temperature trip. Spurious EDG start and ESW affected by fire is an MSO before control is transferred to the auxiliary shutdown panel. Only a single spurious operation is assumed before control is transferred to the auxiliary shutdown panel.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 49 Emergency Power Non-synchronous paralleling of EDG with on-site and off-site sources through spurious breaker operations Scenario causes damage to diesel generator by closing into a live bus out-of-phase. Note: Scenario very site specific. Interlocks may prevent this from occurring. NB0109, NB0111 and NB0112

Or NB0209, NB0211 and NB0212 Breaker NB0211 is the Train B EDG output breaker. Under normal conditions, interlocks prevent this breaker from closing when NB0209 or NB0212 are closed. This prevents non-synchronous paralleling of the EDG to the grid.

Non-synchronous paralleling concern was addressed in DCP 13513. The DCP modified the NB0211 control circuit to prevent a control room fire from closing NB0211 prematurely.

Based on the above discussion, this MSO scenario has been addressed for a control room fire.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 45 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Support Functions Expert Panel 11 Loss of CCW Cooling Spurious operation of CCW Temperature Control Valve could divert flow around HX resulting in loss of cooling. Scenario could result in loss of RCP Thermal Barrier Cooling, loss of RHR cooling capability, and loss of additional equipment dependent on CCW. EGTV0029 AND EGTV0030 Procedure OFN RP-017 lines up Train B CCW to provide cooling for credited Train B components. Valve EGTV0030 is the temperature control valve for Train B CCW heat exchanger. Power to EGTV0030 is disconnected in OFN RP-017 by opening switch NK4413. This fails EGTV0030 closed and prevents CCW from bypassing the heat exchanger, which would prevent adequate cooling of credited PFSSD loads.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 12 Loss of Control Room HVAC Spurious trip of both Trains or isolation of cooling to both Trains. Scenario could result in spurious operation of various instrument loops due to overheating of instrument cabinets.

SGK04A AND SGK04B A fire in the control room would result in evacuation. Therefore, control room ventilation is not required for a control room fire. Loss of SGK04A and SGK04B would not adversely affect the ability to achieve safe shutdown from outside the control room.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 46 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 50 Generic - Loss of Pump Suction Spurious isolation of various valves in pump suction flow path Suction flow paths for all credited pumps should be reviewed for MSO scenarios causing loss of suction and pump inoperability. An example of a pump suction MSO was previously identified in which both the VCT outlets valve(s) and RWST outlet valve(s) spuriously close. Another example involves pump suction cross-connect valves. Three pumps may be supplied from a common suction header that includes several cross-connect valves. If two valves spuriously isolate, the pump drawing suction from the common header between the two isolated SI Pumps:

EMHV8923A, and EMHV8807A and EMHV8807B, or EMHV8924, or EJHV8804A AND EMHV8923B and EJHV8804B Charging Pumps: See PWROG 10 AFW Pumps:

LSP, and ALHV0030, ALHV0031, ALHV0032, and/or ALHV0033 OR LSP, and ESW Unavailable All suction flow paths to credited pumps have been analyzed and measures have been taken to protect these flow paths from spurious operation in the event of a control room fire. These measures include providing control room isolation, redundant fusing and circuit modifications to address NRC IN 92-18 where applicable.

Procedure OFN RP-017 lines up the suction flow paths to ensure adequate suction is available to all the pumps credited for PFSSD following a control room fire. One of the first steps in OFN RP-017 is to open the breakers associated with these pumps. Then, steps are taken to establish suction and discharge flow paths prior to energizing the pump motors. These steps provide reasonable assurance that the pumps will not operate without suction and discharge flow paths.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 47 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other valves can lose suction and become inoperable.

The spurious operation of idle

pumps after suction has been spuriously isolated should also be considered. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESAFAS signal.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 48 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 51 Generic -

Pump Shutoff Head Spurious isolation of pump discharge flow, AND Spurious isolation of recirculation valve(s) Scenario causes pump operation at shutoff head and subsequent inoperability. All credited pumps should be reviewed for this scenario.

Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause inoperability of additional pumps. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESAFAS signal. RHR Pumps:

Spurious SIS or Spurious start of pumps AND EJFCV0610 or EJFCV0611 All discharge flow paths from credited pumps have been analyzed and measures have been taken to protect these flow paths from spurious operation in the event of a control room fire. These measures include providing control room isolation, redundant fusing and circuit modifications to address NRC IN 92-18 where applicable.

Procedure OFN RP-017 lines up the discharge flow paths to ensure adequate flow is available from all the pumps credited for PFSSD following a control room fire. One of the first steps in OFN RP-017 is to open the breakers associated with these pumps. Then, steps are taken to establish suction and discharge flow paths prior to energizing the pump motors. These steps provide reasonable assurance that the pumps will not operate without suction and discharge flow paths.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 49 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 52 Generic -

Pump Outside Design Flow Pump damage from operation outside design flow either at shutoff head or pump run-out conditions. Scenario causes pump failure.

Operation at shutoff head can occur, for example, if pump discharge flow spuriously isolates with the recirculation valves closed. Run-out can occur, for example, if the discharge header is at reduced pressure conditions.

Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause failure of additional pumps. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal. All credited pumps. Procedure OFN RP-017 lines up each credited pump to ensure the pumps are not run dead headed or at run-out conditions. This is done by first de-energizing all credited pumps then making the required valve lineups. Once this is done, the pumps are started. In some cases, dedicated operators are staged at valves to throttle the flow as directed by the operator at the ASP. These steps prevent operation of the pumps outside of their design conditions.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 50 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 53 Generic - Flow Diversion Spurious operation of various valves causing flow diversion. All credited flow paths should be reviewed for MSO scenarios that can divert flow away from desired location. Various Procedure OFN RP-017 lines up Train B valves to prevent flow diversion. All potential flow diversion paths were reviewed to ensure appropriate actions are taken to prevent flow diversion. Valves in the paths are either manually closed or closed by use of a hand switch. All valves that are closed electrically have been modified to ensure a control room fire will not affect the ability to close the valve.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 51 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other Expert Panel 13 Generic -

Pump Discharge Flow Path Isolation Spurious isolation of various valves in pump discharge flow path Discharge flow paths for all credited pumps should be reviewed for MSO scenarios that isolate those flow

paths. One example is spurious isolation of two parallel charging injection valves. Another example involves pump discharge cross-connect valves. For example, three pumps may feed a common discharge header that includes several cross-connect valves. If two valves spuriously isolate, pump flow feeding the common header between the two isolated valves will isolate. SI Pumps:

EMHV8821A and EMHV8802A fails to open AND EMHV8821B and EMHV8802B fails to open See PWROG 51 for discussion of pump discharge flow path isolation.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 52 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 54 Loss of HVAC Spurious isolation of HVAC to credited loads Perform review to identify spurious failures that could cause isolation of HVAC to credited loads. Credited loads may include pump rooms, switchgear rooms, and rooms containing solid state control systems. Examples of spurious failures include spurious damper isolation and spurious isolation of cooling flow to chillers.

ESW: GDTZ0001A AND GDTZ0001C OR GDTZ0011A AND GDTZ0011C Diesels: GMTZ0001A AND GMHZ0009 OR GMTZ0011A AND GMHZ0019 Procedure OFN RP-017 lines up HVAC to Train B rooms containing credited PFSSD equipment. This includes Class 1E electrical equipment rooms, electrical penetration rooms, pump rooms, containment and Train B diesel generator room. Modifications have been made to ensure a control room fire will not affect the ability to provide HVAC to these rooms.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 55 Valve Inoperability Spurious motor-operated valve operation, AND Wire-to-wire short(s) bypass torque and limit switches General scenario is that fire damage to motor-operated valve circuitry causes spurious operation. If the same fire causes wire-to-wire short(s) such that the valve torque and limit switches are bypassed, then the valve motor may stall at the end of the valve All credited motor operated valves All credited motor operated valves (MOVs) used to shut down following a control room fire have been modified to address NRC IN 92-18.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 53 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other cycle. This can cause excess current in the valve motor windings as well as valve mechanical damage. This mechanical damage may be sufficient to prevent manual operation of the valve. Scenario only applies to motor-operated valves.

Note that this generic issue may have already been addressed during disposition of NRC Information Notice 92-18. This disposition should be reviewed in the context of multiple spurious operations and multiple hot shorts.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 54 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 56 Fire-Induced Spurious ESFAS Fire-induced spurious ESFAS signals (e.g., safety injection, containment isolation, etc), combined with other fire-induced failures, can adversely affect safe shutdown capability. An example of a fire-induced ESFAS signal is a fire causing open circuits on 2/3 main steam pressure instruments on one loop resulting in a spurious safety injection signal. ESFAS signals can result from open circuits, shorts to ground, and/or hot shorts. Fire-induced failure of instrument inverters may also cause spurious ESFAS signals. The plant should perform a systematic review to asses the potential for fire-induced spurious ESFAS to adversely affect safe shutdown capability. Below are some examples. 2/4 Low Pressurizer Pressure:

BBPT0455, BBPT0456, BBPT0457, and BBPT0458 Low Steamline Pressure (2/3 of any of the following):

ABPT0514, ABPT0515, ABPT0516 OR ABPT0524, ABPT0525, ABPT0526 OR ABPT0534, ABPT0535, ABPT0536 OR ABPT0544, ABPT0545, ABPT0546 Spurious ESFAS requires at least two spurious signals, which is not required to be postulated as an initial condition for control room fires. A spurious ESFAS occurring after control room isolation is achieved will not affect the ability to maintain the reactor in a safe shutdown condition because all required Train B equipment is manually aligned per OFN RP-017. Certain Train A equipment that could cause adverse effects is also secured in OFN RP-017 to prevent inadvertent operation. Therefore, a spurious ESFAS will not affect the ability to achieve and maintain safe shutdown.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 55 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other High Containment Pressure (2/3)

SIS: GNPT0934, GNPT0935, GNPT0936 High Containment Pressure (2/4)

CSAS: GNPT0934, GNPT0935, GNPT0936, GNPT0937 PWROG 56a RCS Makeup Pump Inoperability Spurious safety injection signal, AND Spurious isolation of makeup pump suction Safety injection signal starts multiple RCS makeup pumps. Fire causes makeup pump suction valves to fail closed. Scenario results in cavitation / inoperability of multiple RCS makeup pumps. RHR Pumps:

PWROG 56 AND BNHV8812A or BNHV8812B Charging Pumps:

PWROG 56 AND BGLCV0112B or See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 56 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other BGLCV0112C

AND BGLCV0112D and BGLCV0112E PWROG 56b Loss of All Seal Cooling Spurious containment isolation signal isolates CCW to the thermal barrier heat exchangers for all RCPs, AND Spurious isolation of seal injection header flow Scenario causes loss of all RCP seal cooling and subsequent RCP Seal LOCA. 2/4 Containment Pressure HI-3 from GNPT0934, GNPT0935, GNPT0936, and GNPT0937 AND BGFCV0462 and BGFCV0121

OR BBHV8351A, BBHV8351B, BBHV8351C and/or BBHV8351D See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 57 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 56c Loss of All Seal Cooling Spurious containment isolation signal isolates CCW to the thermal barrier heat exchangers for all RCPs, AND Spurious opening of charging injection valve(s) causing insufficient flow to seals Scenario causes loss of all RCP seal cooling and subsequent RCP Seal LOCA. 2/4 Containment Pressure HI-3 (CISB) from GNPT0934, GNPT0935, GNPT0936, and GNPT0937

AND EMHV8801A or EMHV8801B AND EMHV8803A or EMHV8803B See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 56d RWST Drain Down Spurious high containment pressure on multiple channels causing spurious containment spray signal Scenario causes a pumped RWST drain down via the containment spray pumps and containment spray ring. 2/4 Containment Pressure HI-3 from GNPT0934, GNPT0935, GNPT0936, and GNPT0937 See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG 56e PORV(s) Open Spurious high pressurizer pressure on multiple channels causes high pressurizer pressure signal Spurious high pressurizer pressure signal causes PORV(s) to open and challenges the RCS Inventory and Pressure Control Functions BBPT0455 AND BBPT0456 See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 9 Page 58 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion Other PWROG 56f RCS Makeup Pump Failure Spurious Recirculation Actuation Signal (RAS) causes pumps to start and align to dry containment sump Spurious Recirculation Actuation Signal (RAS) starting and aligning pumps to a dry containment sump. RHR Pumps Containment Sump Valves See PWROG 56 for discussion about spurious ESFAS.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert Panel 14 Loss of Containment Isolation Various combinations of spurious operation of valves credited for containment isolation. Scenario could cause uncontrolled release of fission products following core damage. Penetration 32:

LFFV0095 AND LFFV0096 Penetration 65:

GSHV0020 AND GSHV0021 Penetration 160:

GTHZ0011 AND GTHZ0012 Penetration 161:

GTHZ0004 AND GTHZ0005 Procedure OFN RP-017 ensures no core damage will occur following a fire in the control room. This is demonstrated in evaluation SA-08-006. Therefore, containment isolation is not required for PFSSD following a control room fire.

Based on the above discussion, this MSO scenario is adequately addressed.