IR 05000280/2003008

IR 05000280-03-008 & 05000281-03-008, on 04/21/03 Through 01/07/04, for Virginia Electric & Power Company, Surry, VA; Significance Determination of Unresolved Items from Triennial Fire Protection Inspection

ML041830225
Person / Time
Site:	Surry
Issue date:	02/02/2004
From:	Casto C Division of Reactor Safety II
To:	Christian D Virginia Electric & Power Co (VEPCO)
References
FOIA/PA-2004-0277 IR-03-008
Download: ML041830225 (26)

Text

ary 2, 2004

SUBJECT:

SURRY POWER STATION - NRC INSPECTION REPORT 05000280/2003008 AND 05000281/2003008; PRELIMINARY WHITE FINDING

Dear Mr. Christian:

On January 7, 2004, the U.S. Nuclear Regulatory Commission (NRC) completed an open item inspection for your Surry Power Station, Units 1 and 2. The enclosed inspection report documents the inspection findings, which were discussed on February 2, 2004, with Mr. R. Blount and other members of your staff.

This inspection was an in-office examination of three unresolved items (URIs) which were identified in NRC Inspection Report 05000280/2003007 and 05000281/2003007 (ADAMS Accession Number ML030930560) forwarded to you on March 31, 2003. The three URIs were:

URI 05000280/2003007-001, Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1; URI 05000280/2003007-002, Fire Response Procedures 1-FCA-3.00 And 1-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1; and URI 05000280,281/2003007-003, Alternate Shutdown Panel Ventilation System Not Independent From Impacts Of A Main Control Room Fire. These issues were unresolved pending a safety significance determination.

Based on the results of this inspection, the inspectors identified that the Surry fire response procedures were not effective in ensuring a safe shutdown of Unit 1 during a severe fire in Emergency Switchgear and Relay Room (ESGR) Number (No.) 1 (URI 05000280/2003007-001). Specifically, these procedures may not preclude an extended loss of reactor coolant pump seal injection flow and may initiate a reactor coolant pump seal loss of coolant accident which could result in pressurizer level failing to be maintained within the indicating range as required by 10 CFR 50, Appendix R. This inspection finding was assessed using the applicable DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED

VEPCO 2 ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION significance determination process (SDP) and preliminarily determined to be White (i.e., an issue with low to moderate increased importance to safety, which may require additional NRC inspections.) This issue was also determined to be an apparent violation of NRC requirements.

In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions - May 1, 2000" (Enforcement Policy), NUREG-1600, this apparent violation is being considered for escalated enforcement action because it is associated with a White finding.

Additionally, because relative equipment and cable locations in Unit 2s ESGR No. 2 are similar to those in Unit 1s ESGR No. 1, the fire ignition frequencies for both areas are similar, and the procedures used to respond to a severe fire are similar, the inspectors determined that the safe shutdown of Unit 2 during a severe fire in ESGR No. 2 may be similarly impacted. This issue is documented in this report as a new finding on Unit 2 (URI 05000281/2003008-001) that has potential safety significance greater than very low significance. This finding did not present an immediate safety concern. To date, no SDP of this new finding on Unit 2 has been completed by the NRC staff. Accordingly, you are requested to provide any information as to why the outcome of the SDP for ESGR No. 1 should not be applied to Unit 2s ESGR No. 2.

Before the NRC makes a final decision on these matters, we are providing you an opportunity to request a regulatory conference where you would be able to provide your perspectives on the significance of the findings, the bases for your position, and whether you agree with the apparent violation. If you choose to request a regulatory conference, we encourage you to submit your evaluation and any differences with the NRCs evaluation at least one week prior to the conference in an effort to make the conference more efficient and effective. Should you request a conference, the NRC requests that you provide information in your written evaluation and at the conference on the design and performance of the reactor coolant pump breakdown bushings, and their effect on limiting reactor coolant system leakage in the event of a seal failure. If a regulatory conference is held, it will be open for public observation. The NRC will also issue a press release to announce the regulatory conference.

In addition, the report documents two NRC-identified findings of very low safety significance (Green). These findings which resulted from URI 05000280/2003007-002 and URI 05000280, 281/2003007-003 were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these two findings as non-cited violations (NCVs)

consistent with Section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Surry Power Station.

Please contact Mr. Charles R. Ogle at (404) 562-4605 within seven days of the date of this letter to notify the NRC of your intentions regarding the regulatory conference for the preliminary White finding. If we have not heard from you within 10 days, we will continue with DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED

VEPCO 3 ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION our significance determination and associated enforcement processes on this finding, and you will be advised by separate correspondence of the results of our deliberations on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for the inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the referenced inspection report may change as a result of further NRC review.

In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter, portions of its enclosure and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)

component of NRCs document system (ADAMS). However, the NRC is continuing to review the appropriate classification of the Summary of Phase 2 SDP Risk Analysis and Phase 3 SDP analysis (Attachments 2 and 3) within our records management program, considering changes in our practices following the events of September 11, 2001. Using our interim guidance, the attached analyses have been marked as Proprietary Information or Sensitive Information in accordance with Section 2.790(d) of Title 10 of the Code of Federal Regulations. Please control the document accordingly (i.e., treat the document as if you had determined that it contained trade secrets and commercial or financial information that you considered privileged or confidential). We will inform you if the classification of these documents change as a result of our ongoing assessments. ADAMS is accessible from the NRC web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

If you have any questions regarding this letter, please contact me at 404-562-4600.

Sincerely,

/RA/

Charles A. Casto, Director Division of Reactor Safety Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37

Enclosure:

Inspection Report 05000280,281/2003008 w/Attachments: 1. Supplemental Information 2. Summary of Phase 2 SDP Risk Analysis 3. Phase 3 SDP Analysis

REGION II==

Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37 Report Nos.: 05000280/2003008 and 05000281/2003008 Licensee: Virginia Electric and Power Company (VEPCO)

Facility: Surry Power Station Location: 5850 Hog Island Road Surry, VA 23883 Dates: April 21, 2003 - January 7, 2004 Inspectors: C. Payne, Senior Reactor Inspector (Lead Inspector)

W. Rogers, Senior Reactor Analyst Approved by: C. Casto, Director Division of Reactor Safety DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION SUMMARY OF FINDINGS IR 05000280/2003-008, 05000281/2003-008; 04/21/2003 -01/7/2004; Surry Power Station, Units 1 and 2; Significance Determination of Unresolved Items from Triennial Fire Protection Inspection.

This in-office review was conducted by a regional inspector and a senior reactor analyst. One preliminary White finding with an apparent violation, one unresolved item with potential safety significance greater than Green and two Green non-cited violations (NCVs) were identified.

The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609 Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

A. NRC-Identified and Self-Revealing Findings Cornerstone: Initiating Events and Mitigating Systems

• Preliminary White. An apparent violation of 10 CFR 50, Appendix R, Sections III.L.2.b and III.L.3 was identified, in that, for a severe fire in the Emergency Switchgear and Relay Room Number 1 (Fire Area 3), the licensees fire response procedures were not effective in assuring a safe shutdown of the Unit 1 reactor. The licensee has revised the affected fire response procedures and is evaluating the need for additional corrective action.

This finding is greater than minor because it was associated with protection against one of the external factors attribute. It affected the objective of the Initiating Events cornerstone to limit the likelihood events that challenge critical safety functions as well as affected the objective of the Mitigating Systems cornerstone to ensure the availability, reliability and capability of systems that respond to initiating events. This degraded condition increased plant risk because, if a severe fire occurred in Fire Area 3, these procedures may not preclude an extended loss of reactor coolant pump seal injection flow and may initiate a reactor coolant pump seal loss of coolant accident which could result in pressurizer level failing to be maintained within the indicating range as required.

(Section 4OA5.01)

• TBD. The inspectors identified a violation having potential safety significance greater than very low significance because the licensees safe shutdown strategy and related fire response procedures may be inadequate to ensure a safe shutdown of the Unit 2 reactor for a severe fire in Emergency Switchgear and Relay Room (ESGR) Number (No.) 2. This finding is similar to one for ESGR DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION No. 1. The licensee has revised the affected fire response procedures and is evaluating the need for additional corrective action.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it is associated with the ability to achieve a safe shutdown of the Unit 2 reactor following a fire in ESGR No. 2 and affects the Initiating Events and Mitigating Systems cornerstone objectives. The finding has potential safety significance greater than very low, safety significance because RCP seal package failure could cause a seal loss-of-coolant accident and failure of the specified alternative shutdown strategy. (Section 1R05)

• Green. A Green non-cited violation of 10 CFR 50, Appendix R, Sections III.L.2.b and III.L.3, was identified, in that, for a severe fire in the Unit 1 Cable Vault and Tunnel (Fire Area 1), the licensees alternative shutdown capability may not ensure that the reactor coolant makeup function would be capable of maintaining the reactor coolant level within the level indication of the pressurizer. The licensee has entered this finding into its corrective action program.

This finding is greater than minor because it was associated with protection against one of the external factors attribute. It affected the objective of the Initiating Events cornerstone to limit the likelihood events that challenge critical safety functions as well as affected the objective of the Mitigating Systems cornerstone to ensure the availability, reliability and capability of systems that respond to initiating events. This finding was determined to be of very low safety significance because the likelihood of a severe fire in the service building cable vault (SBCV) or the cable tunnel that could cause a loss of all three Unit 1 charging pumps is very low and a 3-hour rated fire door would prevent a severe fire in the remaining sections of Fire Area 1 from spreading through the cable tunnel to the SBCV. (Section 4OA5.02)

• Green. A Green non-cited violation was identified for failure to comply with 10 CFR 50, Appendix R, Sections III.G.3.a and III.L.3. Specifically, the shared ventilation system between the main control room (MCR) and the Unit 1 and Unit 2 emergency switchgear and relay rooms (ESGRs), did not have adequate separation, isolation, or barriers to preclude smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. The alternative shutdown capability for an MCR fire is located in each units ESGR, respectively.

Consequently, operators may not have the environmental conditions or visibility to safely man and accomplish a successful shutdown of either Unit 1 or Unit 2 from the Auxiliary Shutdown Panels. The licensee has entered this finding into its corrective action program.

This finding is greater than minor because it was associated with the protection against external factors attribute and affected the objective of the Mitigating DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events. This finding was determined to be of very low safety significance because heat from a fire, and the natural buoyancy of smoke, will cause the smoke gas layer to accumulate near the ceiling of the MCR (away from the ESGRs), the likelihood of a severe fire in the MCR is low, and the prompt response and actions of the MCR operators and the fire brigade would prevent any fires that start from becoming severe. (Section 4OA5.03)

B. Licensee-identified Violations:

None DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Report Details 1. REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems and Barrier Integrity 1R05 FIRE PROTECTION (71111.05T/SDP)

Section 4OA5.01 of this inspection report documents the resolution of unresolved item (URI)05000280/2003007-001, Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 (NRC Inspection Report 05000280, 281/2003007, dated March 31, 2003, ADAMS Accession Number ML030930560). Following completion of the significance determination process (SDP)

for this Emergency Switchgear and Relay Room (ESGR) Number (No.) 1 finding, the inspectors recognized that an evaluation of the finding for applicability to Unit 2s ESGR No. 2 would be appropriate. [ESGR No. 2 was not included in the original scope of the baseline triennial fire protection inspection. Thus, it was not evaluated as part of the ESGR No. 1 SDP analysis.]

a. Inspection Scope The inspectors conducted an in-office review of plant drawings 11448-FE-27C and 11548-FE-27A (arrangement drawings for ESGR No. 1 and ESGR No. 2, respectively)

to compare the location and design features of safe shutdown equipment and fire protection features. [The inspectors had walked down both these areas during the triennial fire protection inspection.] The inspectors also compared Fire Contingency Action (FCA) procedure 2-FCA-4.00, Limiting ESGR Number 2 Fire, Revision 14, with 1-FCA-4.00, Limiting ESGR Number 1 Fire, Revision 13, to identify any differences in operator implementation of the alternative safe shutdown strategies for Unit 1 and Unit 2. In addition, the Surry Non-Seismic Individual Plant Examination of External Events (IPEEE) was reviewed for plant fires in ESGR No. 1 and ESGR No. 2. This included a review of the applicable fire area/compartment Ignition Source Data Sheets.

b. Findings Because relative equipment and cable locations in Unit 2s ESGR No. 2 are similar to those in Unit 1s ESGR No. 1, the fire ignition frequency for both areas is similar, and the alternative safe shutdown procedures used to respond to a severe fire are similar, the inspectors determined that the finding associated with URI 05000280/2003007-001 was applicable to Unit 2. Specifically, for a severe fire in ESGR No. 2 the procedural guidance in 2-FCA-4.00, Limiting ESGR Number 2 Fire, may not prevent loss of seal injection cooling to the Unit 2 reactor coolant pump (RCP) seal packages nor be timely in restoring seal injection flow, via the charging system cross-connect line with Unit 1, to prevent damage to the RCP seal packages. Additionally, procedural guidance in 0-DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION FCA-14.00, Charging and Seal Injection Flow Paths, to restore seal injection flow following cross-connect with Unit 1 may aggravate potential damage to the seal packages and, consequently, increase the severity of leakage from the RCP seals.

Thus, safe shutdown of Unit 2 during a severe fire in ESGR No. 2 would not be ensured.

The licensee captured this issue in its corrective action program under Plant Issue (PI)

S-2003-0637 [during review of this similar issue in ESGR No. 1]. This finding has potential safety significance greater than very low significance and is a URI pending completion of the SDP.

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part. Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the Safety Evaluation Report (SER) dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.2.b states, in part, that The reactor coolant makeup function shall be capable of maintaining the reactor coolant level...within the level indication in the pressurizer in PWRs.Section III.L.3 specifies that procedures shall be in effect to implement this capability.

Contrary to the above, on February 14, 2003, the alternative shutdown capability and response procedures specified for a fire in ESGR No. 2, an Appendix R,Section III.G.3 area, were not effective and did not meet this requirement. Specifically, the licensees procedures may not preclude an extended loss of reactor coolant pump seal injection flow and may initiate a reactor coolant pump seal loss of coolant accident which could result in pressurizer level failing to be maintained within the indicating range. Pending determination of the safety significance, this finding is identified as URI 05000281/2003008-001, Fire Response Procedures 2-FCA-4.00 And 0-FCA-14.00 Not Adequate To Ensure Safe Shutdown Of Unit 2.

4. OTHER ACTIVITIES 4OA5 OTHER

.01 (Closed) URI 05000280/2003007-001: Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Introduction: An apparent violation (AV) was identified for failure to comply with 10 CFR 50, Appendix R, Sections III.L.2.b and III.L.3, in that, for a severe fire in the ESGR No. 1, the licensees alternative shutdown capability did not ensure that the reactor coolant makeup function would be capable of maintaining the reactor coolant level within the level indication of the pressurizer. This inspection finding was assessed using the SDP and preliminarily determined to be White (i.e., an issue with low to moderate increased importance to safety, which may require additional NRC inspections.)

Description: During the baseline triennial fire protection inspection, the inspectors identified a finding having potential safety significance greater than very low significance, involving the strategy, and related fire response procedures, for assuring a safe shutdown of the Unit 1 reactor during a severe fire in ESGR No. 1. Specifically, the procedural guidance in 1-FCA-4.00, Limiting ESGR Number 1 Fire, may not prevent loss of seal injection cooling to the Unit 1 RCP seal packages nor be timely in restoring seal injection flow, via the charging system cross-connect line with Unit 2, to prevent damage to the RCP seal packages. Additionally, procedural guidance in 0-FCA-14.00, Charging and Seal Injection Flow Paths, to restore seal injection flow following cross-connect with Unit 2 may aggravate potential damage to the seal packages and, consequently, increase the severity of leakage from the RCP seals. The licensee captured this issue in its corrective action program under PI S-2003-0637. Subsequent licensee investigation of this issue generated two additional PIs (S-2003-1490 and S-2003-5254). Pending determination of the safety significance, this finding was documented as a URI in the triennial fire protection inspection report.

Analysis: This finding affects the protection against external factors and procedure quality cornerstone attributes. It affects the objective of the Initiating Events Cornerstone to limit the likelihood of events that challenge critical safety functions because existing procedural guidance may result in RCP seal package damage and increase the likelihood of an RCP seal loss of coolant accident (LOCA). Additionally, the finding affects the Mitigating Systems Cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events [fire] because continuous RCP seal injection flow is not maintained nor, once seal injection is lost, is it restored quickly enough to preclude RCP seal damage so that pressurizer level can be maintained in the indicating range. Because the finding affects fire protection, it was assessed in accordance with the NRC Reactor Oversight Processs SDP as described in NRC Inspection Manual Chapter 0609, Appendix F (MC 0609, App. F). However, the MC 0609, App. F, Phase 1 screening criteria did not apply to the deficiencies related to Surrys safe shutdown strategy or fire response procedures. As a result, a Phase 2 risk analysis was performed. A Summary of the Phase 2 analysis is provided as Attachment 2.

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Summary of Phase 3 SDP Analysis This evaluation was performed by contractors supporting the Office of Nuclear Reactor Regulation with the assistance of senior reactor analysts from headquarters and Region II.

The Surry Phase 3 SDP Analysis is included in this inspection report as Attachment 3.

The Phase 3 analysis discusses the approach, site visit observations, assumptions, screening analysis, fire ignition frequencies, fire scenario analysis, contributors to fire risk, integrated assessment of fire-induced core damage frequency, and conclusions developed from this analysis. The report also contains four appendices documenting supplemental information used in the Phase 3 analysis (circuit analysis, fire propagation, accidental water spray on both switchgears and event tree analysis).

Five fire scenarios were developed and considered during the Phase 3 analysis.

1. A severe fire in emergency bus room 1H damaging equipment or cables in emergency bus room 1J. In this scenario, both emergency buses fail without a possibility of recovery.

2. A severe fire in emergency bus room 1J damaging equipment or cables in emergency bus room 1H. (Similar to Scenario 1 above.) In this scenario, both emergency buses fail without a possibility of recovery.

3. A relatively severe fire occurs in emergency bus room 1H. The fire brigade uses water to extinguish the fire. Water is accidentally sprayed on equipment in emergency bus room 1J. It is assumed that as a result, both emergency buses fail without a possibility of recovery.

4. A relatively severe fire occurs in emergency bus room 1J. The fire brigade uses water to extinguish the fire. Water is accidentally sprayed on equipment in emergency bus room 1H. (Similar to Scenario 3 above.) It is assumed that as a result, both emergency buses fail without a possibility of recovery.

5. A severe fire in emergency bus room 1J leads to complete loss of emergency bus 1J, loss of some of the cable above the electrical cabinets, and recoverable loss of emergency bus 1H.

Based on an analysis (Appendix B of the Phase 3 SDP Analysis), it was determined that multi-compartment fires were very unlikely. Thus, Scenarios 1 and 2 were not analyzed further for risk significance. As a result, only Scenarios 3, 4 and 5 were analyzed in detail with probabilistic modeling.

The core damage frequency (CDF) for each scenario was calculated by multiplying the scenario frequency and associated conditional core damage probability (CCDP). The table below presents the set of scenarios, their associated occurrence frequencies, CCDPs and CDFs.

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Scenario CCDPs and CDFs Scenario Frequency CCDP CDF %

3. Water Spray on Both Buses - Room 1H 1.1E-06 3.3E-01 3.6E-07 16.0 4. Water Spray on Both Buses - Room 1J 1.9E-07 3.3E-01 6.1E-08 2.7 5. Severe switchgear fire in Room 1J 5.8E-05 3.2E-02 1.8E-06 81.3 Total 5.9E-05 2.3E-06 As the table above indicates, the total CDF for the entire set of scenarios (the non-conforming case) was calculated to be 2.3E-06 per reactor year. Due to the low base case CDF, the risk analysts concluded that the delta CDF [the difference between the base case CDF and the non-conforming case CDF] was essentially the same as the non-conforming case CDF (i.e., 2.3E-06). This result indicates the risk significance of the finding is of low to moderate importance to safety.

SDP/Enforcement Review Panel (SERP) Evaluation The total change in CDF due to the performance deficiency was found to be 2.3E-06. The key factors in the risk determination which most influenced this result were the CDF associated with a severe fire in the 1J 4160V switchgear and the lack of an automatic fire suppression system in the fire area. The color associated with this magnitude of change in CDF is White. Therefore, the SERP has preliminarily determined this issue to be a White finding.

Enforcement: 10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part. Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report (UFSAR) and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.2.b states, in part, that The reactor coolant makeup function shall be capable of maintaining the reactor coolant level . . . within the level indication in the pressurizer in PWRs.Section III.L.3 specifies that procedures shall be in effect to implement this capability.

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Contrary to the above, on February 14, 2003, the alternative shutdown capability and response procedures specified for a fire in ESGR No. 1, an Appendix R,Section III.G.3 area, were not effective and did not meet this requirement. Specifically, the licensees procedures may not preclude an extended loss of reactor coolant pump seal injection flow and may initiate a reactor coolant pump seal loss of coolant accident which could result in pressurizer level failing to be maintained within the indicating range. This apparent violation is identified as AV 05000280/2003008-002, Alternative Shutdown Capability and Response Procedures Not Adequate to Ensure Safe Shutdown of Unit 1.

.02 (Closed) URI 05000280/2003007-002: Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 Introduction: A Green non-cited violation (NCV) was identified for failure to comply with 10 CFR 50, Appendix R, Criterion III.L.2.b and III.L.3, in that, for a severe fire in the Unit 1 Cable Vault and Tunnel (CV&T), the licensees alternative shutdown capability did not ensure that the reactor coolant makeup function would be capable of maintaining the reactor coolant level within the level indication of the pressurizer.

Description: During the triennial fire protection inspection, the inspectors identified a finding having potential safety significance greater than very low significance, involving the strategy, and related fire response procedures, for assuring a safe shutdown of the Unit 1 reactor during a severe fire in Unit CV&T (Fire Area 1). Specifically, the procedural guidance in 1-FCA-3.00, Limiting Cable Vault and Cable Tunnel Fire, may not prevent loss of seal injection cooling to the Unit 1 RCP seal packages nor be timely in restoring seal injection flow, via the charging system cross-connect line with Unit 2, to prevent damage to the RCP seal packages. In addition, procedural guidance in 0-FCA-14.00, Charging and Seal Injection Flow Paths, to restore seal injection flow following cross-connect with Unit 2 may aggravate potential damage to the seal packages and, consequently, increase the severity of leakage from the RCP seals. The licensee captured this issue in their corrective action program under PI S-2003-0637. Subsequent licensee investigation of this issue generated two additional PIs (S-2003-1490 and S-2003-5254). Pending determination of the safety significance, this finding was documented as a URI in the triennial fire protection inspection report.

Analysis: This finding is greater than minor because it was associated with the protection against external factors and procedure quality cornerstone attributes. It affects the objective of the Initiating Events Cornerstone to limit the likelihood of events that challenge critical safety functions because existing procedural guidance may result in RCP seal package damage and increase the likelihood of an RCP seal LOCA. Additionally, the finding affects the Mitigating Systems Cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events [fire] because continuous RCP seal injection flow is not maintained nor, once seal injection is lost, is it restored quickly enough to preclude RCP seal damage so that pressurizer level can be maintained in the indicating range.

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION During the significance determination period, the inspectors determined that the issue was of very low safety significance (Green). Some of the factors (including assumptions used in the SDP, MC 0609, App. F) causing the issue to be of very low safety significance were:

• The Unit 1 CV&T is comprised of four interconnected rooms - the service building cable vault (SBCV), the cable tunnel, the cable penetration vault (CPV) and the motor control center (MCC) room. A normally open 3-hour rated fire door (and wall) separates the CPV and the MCC room from the cable tunnel and the SBCV. The operators and fire brigade can enter the Unit 1 CV&T through several different doors: from the outside yard to the MCC room, from the auxiliary building (15'-0" elevation) to the CPV, or from ESGR No.1 to the SBCV (two separate doors).

• The CV&T is protected by a total flooding, automatic carbon dioxide (CO2) suppression system. The CO2 system is divisional such that a fire in one section of the fire area will only dump CO2 in that section. The cable tunnel fire door automatically shuts upon actuation of the CO2 suppression system within the CV&T. This essentially creates two separate fire zones: 1) the MCC room and the CPV and 2) the cable tunnel and the SBCV. No findings were associated with this rated fire door.

• The alternative safe shutdown procedure for the Unit 1 CV&T (i.e., cross-connecting the Unit 1 charging system with Unit 2's) would only be implemented if all Unit 1 charging flow is lost. Control and power cables for all three Unit 1 charging pumps pass from ESGR No. 1 into the SBCV. The cables for the 1A and 1C charging pumps then pass from the SBCV directly into the auxiliary building. In contrast, the cables for the 1B charging pump first pass from the SBCV, down through the cable tunnel into the CPV, and then into the auxiliary building. Assuming the cable tunnel fire door functions correctly, only a severe fire in the SBCV and/or cable tunnel could cause a loss of all Unit 1 charging flow.

• The cable tunnel contains no ignition sources. The only ignition sources in the SBCV are three relay panels associated with the cooling water canal level system. All three panels contain only relays and cables that are energized by low voltage power.

Combined with their low fire ignition frequency, the likelihood of these relay panels causing a severe fire in the SBCV is very low.

• Implementation of the alternative safe shutdown procedures directs the performance of twenty-nine manual operator actions in the Unit 1 CV&T. All twenty-nine steps would be performed in the CPV. Assuming the cable tunnel fire door and the divisional CO2 fire suppression system function as designed, the effects of a severe fire in the SBCV would not prevent the operators from entering the CPV to perform their required actions. [To avoid the fire, the operators could enter the CPV from either the MCC room or the auxiliary building.]

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Enforcement: Because this failure to comply with 10 CFR 50, Appendix R, Sections III.L.2.b and III.L.3, is of very low safety significance and has been entered into the corrective action program (PI S-2003-0637), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000280/2003008-003, Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Ensure Safe Shutdown Of Unit 1.

.03 (Closed) URI 05000280,281/2003007-003: Alternate Shutdown Panel Ventilation System Not Independent From Impacts Of A Main Control Room Fire Introduction: A Green NCV was identified for failure to comply with 10 CFR 50, Appendix R, Sections III.G.3 and III.L.3. Specifically, the shared ventilation system between the MCR (Fire Area 5) and ESGR No. 1 and ESGR No. 2 (Fire Areas 3 and 4, respectively), did not have adequate separation, isolation, or barriers to preclude smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. The alternative shutdown capability for an MCR fire is located in each units ESGR, respectively. Consequently, operators may not have the environmental conditions or visibility to safely man and accomplish a successful shutdown of either Unit 1 or Unit 2 from the Auxiliary Shutdown Panels (ASP).

Description: During the triennial fire protection inspection, the inspectors identified a finding of having potential safety significance greater than very low significance, involving the lack of adequate separation, isolation, or barriers to preclude smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. The Surry Appendix R Report identified the MCR fire area as an alternative shutdown area. During a severe fire in the MCR, the operators would abandon the MCR and utilize the Unit 1 and Unit 2 ASPs, located in the Unit 1 and Unit 2 ESGRs respectively, to achieve a safe shutdown of the units. The ESGRs share a common ventilation system with the MCR.

Fire dampers, located in the ventilation system ducts, were designed to isolate the ESGR area to contain the Halon within the ESGRs, and to prevent smoke and toxic gases from spreading from the ESGRS to the MCR. Although an ESGR fire alarm signal or manual actuation of the Halon system (in response to an ESGR fire) would signal these dampers to close, the inspectors found that there were no smoke or fire actuation devices to signal them to shut during a fire in the MCR. Additionally these dampers do not have the capability of being manually actuated from the MCR. During a severe fire in the MCR, large amounts of heavy black smoke and toxic gases could be generated. The open dampers could permit smoke and toxic gases to spread from the MCR to the ESGR. This situation could present a habitability concern for the operators attempting to achieve shutdown at the respective units ASP.

Fire procedure 0-FCA-1.00, Limiting MCR Fire, Revision 29, does not require the operators to bring self-contained breathing apparatus (SCBA) gear to the ESGR nor are any SCBAs readily available at the ESGRs. The Surry Appendix R Report did not include an evaluation of potential maloperation of the ventilation system, its DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION components, or its effect on habitability at the ASP. As a result, the alternative shutdown capability was not physically independent of the fire area as required by Sections III.G.3 and III.L of Appendix R. The licensee initiated PI S-2003-0643 to evaluate the independence and operability of the ESGR ventilation system during an MCR fire.

Analysis: The inspectors determined that the finding was associated with the protection against external factors attribute and affected the objective of the Mitigating Systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events. Therefore, the finding is greater than minor.

During the significance determination period, the inspectors determined that the issue was of very low safety significance (Green). Some of the factors (assumptions used in the SDP, MC 0609, App. F) causing the issue to be of very low safety significance were:

• Heat from a fire and the natural buoyancy of smoke will cause the smoke gas layer to accumulate near the ceiling of the MCR. Because the ESGR is located below the MCR, smoke and toxic gases must nearly fill the MCR envelope in order to drive the smoke gas layer down through ventilation ducts to the room below.

• Due to the large volume in the MCR, more than two bench boards would need to be involved in a fire to generate sufficient smoke to fill the MCR. The likelihood of fire spreading to more than two bench boards is very low due to their low fire ignition frequency and due to their construction (self-contained cabinets).

Additionally, the MCR is a normally manned station so the MCR operators would attempt to fight the fire in its early stages.

• The fire brigade nominally responds in 10-15 minutes (based on fire drills over the last 18 months) of fire notification. At that time, an MCR door(s) would be opened to allow fire brigade access to fight the fire. This action would serve to vent smoke out of the MCR to the turbine building and reduce the likelihood of smoke migration down to the ESGRs. In addition, the fire brigade would set up portable ventilation equipment to enhance smoke removal from the area.

Enforcement: This finding was considered a failure to comply with 10 CFR 50, Appendix R, Sections III.G.3 and III.L.3, which specify that the alternative shutdown capability shall be independent of the affected fire area(s). Contrary to the above, the shared ventilation system between the MCR and the ESGRs did not have adequate separation, isolation, or barriers to preclude smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. Because this finding is of very low safety significance and has been entered into the licensees corrective action program (PI S-2003-0643),

this violation is been treated as an NCV, consistent with section VI.A of the NRC DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION Enforcement Policy: NCV 05000280,281/2003008-004, Alternate Shutdown Panel Ventilation System Not Independent From Impacts Of A Main Control Room Fire.

4OA6 Meetings, Including Exit On February 2, 2004, the inspectors presented the inspection results by telephone to Mr., and other members of your staff, who acknowledged the findings. The inspectors confirmed that proprietary information was not provided or examined during the inspection.

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Enclosure

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT Licensee personnel M. Adams, Site Engineering Manager R. Blount, Site Vice President T. Carlisle, Nuclear Engineering B. Garber, Licensing T. Gunning, Fire Protection Engineer J. Kloecker, Mechanical Engineer H. Le, Supervisor Engineering M. Smith, Systems Engineering Manager T. Sowers, Director Operations and Maintenance B. Staley, Maintenance Manager J. Swientoniewski, Operations Manager M. Thomas, Electrical NRC personnel G. McCoy, Senior Resident Inspector, Surry LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Opened 05000281/2003008-001 URI Fire Response Procedures 2-FCA-4.00 And 0-FCA-14.00 Not Adequate To Ensure Safe Shutdown Of Unit 2 (Section 1R05)05000280/2003008-002 AV Alternative Shutdown Capability and Response Procedures Not Adequate to Ensure Safe Shutdown of Unit 1 (Section 4OA5.01)

Opened and Closed 05000280/2003008-003 NCV Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Ensure Safe Shutdown Of Unit 1 (Section 4OA5.02)

DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Attachment 1

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION 05000280,281/2003008-004 NCV Alternate Shutdown Panel Ventilation System Not Independent From Impacts Of A Main Control Room Fire (Section 4OA5.03)

Closed 05000280/2003007-001 URI Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 (Section 4OA5.01)05000280/2003007-002 URI Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 (Section 4OA5.02)

05000280,281/2003007-003 URI Alternate Shutdown Panel Ventilation System Not Independent From Impacts Of A Main Control Room Fire (Section 4OA5.03)

LIST OF DOCUMENTS REVIEWED Procedures:

0-FCA-14.00, Charging and Seal Injection Flow Paths, Rev. 2 1-FCA-3.00, Limiting Cable Vault and Cable Tunnel Fire, Rev. 12 1-FCA-4.00, Limiting ESGR Number 1 Fire, Rev. 13 2-FCA-4.00, Limiting ESGR Number 2 Fire, Rev. 14 Drawings:

(Note: 11448 indicates Unit 1, 11548 indicates Unit 2)

11448-FAR-205, Equipment Location - Appendix R Auxiliary Building Plan El 13-0", sh. 2, Rev. 16 11448-FB-25A, Ventilation & Air Conditioning Service Building, sh. 1, Rev. 9 11448-FB-25B, Ventilation & Air Conditioning Service Building, sh. 2, Rev. 9 11448-FB-25C, Ventilation & Air Conditioning Service Building, sh. 1, Rev. 17 11448-FB-25D, Ventilation & Air Conditioning Service Building - El. 9-6", sh. 1, Rev. 16 11448-FB-25E, Ventilation & Air Conditioning Service Building - El. 9-6", sh. 1, Rev. 22 11448-FB-25F, Ventilation - Service Building Floor El. 42'-0" and 47'-0" Columns 21/4 to 6, sh. 1, Rev. 13 11448-FB-25G, Ventilation - Service Building Floor El. 42'-0" Columns 10 to 131/2, sh. 1, Rev.

11448-FB-25H, Ventilation - Service Building Floor El. 27'-0" Columns 21/4 to 5, Rev. 7 11448-FB-25J, Ventilation & Air Conditioning Service Building, sh. 9, Rev. 9 DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Attachment 1

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION 11448-FB-25K, Ventilation - Service Building Floor El. 27-0" Columns 10 to 14, sh. 1, Rev. 10 11448-FB-25L, Ventilation & Air Conditioning Service Building, sh. 1, Rev. 10 11448-FB-25M, Ventilation & Air Conditioning Service Building, sh. 12, Rev. 4 11448-FB-25N, Ventilation & Air Conditioning Service Building, sh. 13, Rev. 3 11448-FB-25K, Ventilation - Service Building Roof El. 60'-0" and 75'-0" Columns 21/2 to 14, Rev. 6 11448-FB-25R, Ventilation - Service Building Floor El. 27'-0" Columns F to 21/4, Rev. 4 11448-FB-25S, Ventilation - Service Building Floor El. 42'-0" Columns F to 21/4, Rev. 2 11448-FB-25T, Ventilation - Service Building Roof/Floor El. 56'-0" and 70'-0" Columns F to 21/4, Rev. 3 11448-FB-25U, Ventilation - Service Building Floor El. 27'-0" Part Plans, Sections and Detail, Rev. 2 11448-FB-25V, Ventilation - Service Building Part Plans El. 42'-0" Columns 11 to 121/2, Rev. 4 11448-FE-3FH, Wiring Diagram Control Cabinet 1-CW-PNL-1A & 1-CW-PNL-1B, sh. 1, Rev. 2 11448-FE-3FJ, Wiring Diagram Control Logic Cabinet 1-CW-PNL-2, sh. 1, Rev. 0 11448-FE-27C, Arrangement Emergency Switchgear and Relay Rooms El. 9'-6", sh. 1, Rev. 31 11448-FE-42T, Conduit Plan Emergency Swgr Rm El. 9'-6", Rev. 18 11448-FE-45A, Conduit & Cable Tray Plan Cable Tunnel & Vaults, sh. 1, Rev. 19 11448-FE-48C, Conduit Plan Auxiliary Building - El. 13'-0", sh. 1, Rev. 19 11448-FE-48F, Cable Terminations & Conduit Sleeve Loading Tables Auxiliary Building, sh. 1, Rev. 31 11448-FE-90BA, Appendix R Block Diagram Charging Pump System, sh. 1, Rev. 2 11448-FE-90BB, Appendix R Block Diagram Charging Pump System, sh. 2, Rev. 2 11448-FM-5B, Arrangement Auxiliary Building, sh. 1, Rev. 13 11548-FE-27A, Arrangement Emergency Switchgear and Relay Rooms El 9'-6", sh. 1, Rev. 25 Plant Issue Reports Reviewed:

S-2003-1490, Review FCA procedures to determine the need for additional guidance on establishment of charging flow to both units via the charging pump cross-tie.

S-2003-5254, The design data used to support Dominions methodology for maintaining pressurizer level following an Appendix R fire in the Unit 1 emergency switchgear room appears to be inadequate and non-conservative.

Other Documents:

Non-Seismic Individual Plant Examination for External Events, dated 12/15/94 DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Attachment 1

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION LIST OF ACRONYMS AFW Auxiliary Feedwater ASP Auxiliary Shutdown Panel AV Apparent Violation BTU British Thermal Units CCDP Conditional Core Damage Probability CDF Core Damage Frequency CFR Code of Federal Regulations CPV Cable Penetration Vault CV&T Cable Vault and Tunnel EIHP Early Inventory High Pressure Injection ESGR Emergency Switchgear and Relay Room FCA Fire Contingency Action IEL Initiating Event Likelihood IPEEE Individual Plant Examination of External Events LOCA Loss of Coolant Accident NCV Non-cited Violation No. Number NRC U.S. Nuclear Regulatory Commission MCC Motor Control Center MCR Main Control Room PARS Publicly Available Records System PI Plant Issue PWR Pressurized Water Reactor RCP Reactor Coolant Pump SBCV Service Building Cable Vault SCBA Self-contained Breathing Apparatus SDP Significance Determination Process SER Safety Evaluation Report SERP SDP/Enforcement Review Panel UFSAR Undated Final Safety Analysis Report URI Unresolved Item VEPCO Virginia Electric and Power Company DOCUMENT TRANSMITTED HEREWITH CONTAINS SENSITIVE UNCLASSIFIED INFORMATION WHEN SEPARATED FROM ATTACHMENTS 2 AND 3, THIS DOCUMENT IS DECONTROLLED Attachment 1

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION PROPRIETARY INFORMATION REMOVED ATTACHMENT 2

ATTACHMENTS 2 AND 3 CONTAIN PROPRIETARY INFORMATION PROPRIETARY INFORMATION REMOVED ATTACHMENT 3