IR 05000254/1988021
| ML20207L163 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 10/05/1988 |
| From: | Darrin Butler, Hodor R, Holmes J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20207L145 | List: |
| References | |
| 50-254-88-21, 50-265-88-21, NUDOCS 8810170214 | |
| Download: ML20207L163 (21) | |
Text
a
',
.
,
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Reports No. 50-254/88021(DRS); 50-265/88021(DRS)
Docket Nos. 50-254; 50-255 Licenses No. DPR-29; DPR-30 Ltcensee: Commonwealth Edison Company Post Office.. Box 767 Chicago, IL 60690 Facility Name: Quad Cities Nuclear Power Station, Units 1 and 2 Inspection At: Quad Cities Site, Ccrdova, Illinois Inspection Conducted:
February 22-26, June 27-28 and September 1,1988 Inspectors:
6 In 10/5/8 8 Date
/dl5 /66
-
D. Butler Date R
od (BNL)
to/S/OS Date Mk
K "5ullivan (BNL)
1o/5/88 Date E bb Approved By:
R. Gardner, Chief
/0/sf%E Plant System Section Date Inspection Summary Inspection on February 22-26, June 27-28. and September 1, 1988 (Reports No. 50-254/88021(DRS): No. 50-265/88021(ORS))
Areas Inspected:
Special, announced inspection conducted to assess plant compliance with 10 CFR Part 50, Appendix R, and to review implementation of certain fire protection program requirements.
The inspection was performed in accordance with NRC Manual Chapter Procedures 30703, 64100, and 64704.
Results: Of the areas inspected, one apparent violation was identified in the crea of compliance with 10 CFR 50, Apper. dix R.
Weaknesses in the licensee's compliance to /ppendix R were evidenced by the licensee's apparent failure to adequately establish, implement, and maintain safe shutdown procedures as discussed in Paragraph 2.e.
Strengths were noted in the application of salient fire protection features as described in the licensee's safe shutdown report, 8s10170214 881007 DR ADOCK 0500
b
_ _ _ _ _ _ -
..:.-
DETAILS
__
.
_
_
. _.
1.
Persons Contacted Commonwealth Edison Company (Ceco)
- N. Kalivianakis, General Manager, Boiling Water Reactor
- R. Bax, Station Manager
'D. Bucknell, Technical Staff
- D. Doliber, Tech Staff Engineer Fire Protection
- J. Dierbeck, Tech Staff Assistant Supervisor
'#N. Digrindakis, Regulatory Assurance Engineer
- T, Hausheer, Production Services, Fire Protection
- I. Johnson, Nuclear License Administrator
- M. Kooi, Regulatory Assurance Supervisor
- D. Kunzmann, Station Quality Assurance
'G. Mavropoulos Engineering Department, Boiling Water Reactor
- J. Mcdonald, Engineering Department, Boiling Water Reactor
- T. Pettit, Station Fire Marshal
- W. Pierce, Production Services, Special Projects
- J. Reed. Tech Staff Mechanical Group Leader
,
- R. Robert, Engineering Department, Boiling Water Reactor
'R. Robey, Services Superintendent
'A. Scott, Quality Assurance Engineer
- G. Tietz, Assistant Superintendent Operations Sargent and Lundy (S&L)
- B. Barth, Mechanical Project Enginee.
- R. Brown, Electrical Engineer
- F. Fischer, Electrical Engineer
- G. Jurkin, Mechanical Engineer
- J. Kelly, Mechanical Engineer
- C. Launt, Senior Project Engineer
'D. Schroder, Electrical Analyst Professional Loss Control (PLC)
- M. Howrer, Vice President
- J. Jablowski, Senior Fire Protectic,n Engineer U.S. Nuclear Regulatory Commission (NRC)
'A. Morronglello, Resident Inspector
- Denotes persons attending the exit meeting of February 26, 1988.
' Denotes persons attending the exit meeting of June 28, 1988.
- Denotes those participating in the telecon meeting on September 1, 1988.
_ _ _ _ _ _ _.
-
.
.
-
- ---..
-
- -. - -
-
.
.
!
2.
Assessmelt of Appendix R Compliance
._
__
_ _ _
.
On a sample basis, the inspectors examined meatures that the licensee implemented to assure safo shutdown capability cnd compliance with
'
The inspection consisted of an assessment i
of the licensee's implementation of applicable Appendix R requirements i
for physical plant conditions, required operator actions, systems and i
components, operator training, supplemental procedures, and methodology i
employed to mitigate resultant adverse equipment operability due to plant
!
exposure to fires, The results of the inspectors' review were as follows:
i
'
a.
Systems Required for Safe Shutdown The Appendix R goals required to achieve post-fire safe shutdown are:
!
Reactivity control capable of achieving and maintaining cold
!
shutdowr. reactivity conditions (reactor coolant temperature l
less than or equal to 200*F).
j Reactor coolant makeup capable of maintaining water level I
above the top of the core at all times during shutdown operation.
Reactor pressure control and decay heat removal, d
Process monitoring capable of providing direct readings to tarform and control the above functions.
'
Supporting functions capable of providing process cooling,
lubrication, etc., necessary to permit operation of the j
equipment used for safe shutdown functions.
In accomplishing the above goals, the equipment and systems used to achieve and maintain hot shutdown conditions should be free of fire damage and capable of maintaining such conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, using offsite power or onsite emergency power.
The equipment and systems used to achieve and maintain cold shutdown conditions should be either free of fire damage or the damage to these systems should be limited such that repairs can be made and cold shutdown conditions achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, using offsite power or onsite emergency power.
During the post-fire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal AC power, and the fission product integrity shall not bt affected; i.e., there shall be no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary.
.
.-.
.
--
.
.-_-
_
!
.
,
.
.
..
.
.
,
f
(1) Reactivity Control
The control rods are inserted from the control room by utilizing
>
l the manual scram buttons on Main Control Panel 901-5.
If this
action cannot be completed before evacuating the control room,
,
the reactor can also be scrammed by venting the scram air header after closing the scram air header filter inlet valves.
l (2) Reactor Coolant Inventory Control f
I
,
j The Reactor Core Isolation Cooling (RCIC) system or the dedicated i
Safe Shutdown Makeup Pump (SSMP) system are relied upon as i
alternate systems to provide reactor water makeup.
The RCIC
!
pump is turbine driven and is located below the level of the
"
Condensate Storage Tank (CST) and the minimum water level of
the suppression pool to assure a positive suction head. The
}
SSMP is driven by an electric motor. Normal suction supply
.
'
for either pump is from the CST.
The backup supply for the SSMP i
!
is the fire water system supply which has the capacity to satisfy
'
both the maximum fire demand and simultaneous operations of the
,
SSMP.
The backup water supply for RCIC is the suppression pool
'
when the CST level drops to 10,000 gallons.
Inventory depletion
)
in the event that a fire induced spurious valve action occurs l
'
was considered by the licensee. An analysis by General Electric i
j (GE) (EAS77-0787, dated July 1987) postulates a relief valve i
stuck open for ten minutes with RCIC and SSMP assumed unavailable.
,
'
The analysis concluded that the core could remain uncovered for l
35 minutes at which time if the RCIC system became available the
)
reactor water level would begin to recover.
[
l
,
j (3) Reactor pressure Control and Decay Heat Removal l
t (
i Initial pressure control and decay heat removal is supplied l
by the electromatic relief valves.
If required, mechanical
!
operation of the target rock relief valves is available for i
i pressure control. Additional decay heat is removed by the j
i discharge of exhaust steam to the suppression pool from the j
RCIC system or contir.ued discharge of steam from the high
)4 pressure system turbines and relief valves to the suppression pool results in heatup of the suppression pool water.
In order to maintain the suppression pool below 170*F as stated in the Quad Cities FSAR, one train of Residual Heat Removal (RHR)
,
equipment in the suppression pool cooling mode is required j
to be in operation within three hours after scram.
'
(4) Process Monitoring I
In order to support post-fire safe shutdown, the following i
instrumentation is available in the main control room and
'
locally on several reactor building instrument racks.
I
4 I
_
O
'
J
.
.
.
I
'
Reactor vessel level
Reactor vessel pressure
Suppression pool temperature *
Suppression pool level
Condensate storage tank level
- 0nly availaole in the control room.
For alternate shutdown the suppression pool temperature must be determined locally J
at the torus using a surface pyrometer.
Diagnostic instrunentation is also available as follows.
- RCIC System - The RCIC system flow is normally monitored in the control room on flow indicating controller FIC-1340-1.
The operator can monitor locally the flow on a mechanical flow indicator (FI-1360-30) in the RCIC room.
The RCIC system discharge pressure is normally monitored in the control room on pressure indicator PI-1340-7.
The operator
'
can monitor pump discharge pressure locally on mechanical
,
indicator PI-1360-5.
)
SSMP System - The SSMP suction, discharge pressure, and flow are normally monitored in the control room on pressure indicators PI-1/2-2940-01 and PI-1/2-2940-05 and flow l
indicating controller FIC-1/2-2940-07, respectively.
Mechanical pressure indicators and flow indicating controllers are also provided locally in the pump room (PI-1/2-2941-01, PI-1/2-2941-08, and FIC-1/2-2041 06).
I A local pressure indicator is available on the discharge of each of the two diesel-driven fire main water pumps, which are used to maintain pressure in the fire main, which also supplies the safe shutdown makeup room cooler.
- RHR System - RHR and RHR service water (RHRSW) pressure is normally monitored in the control room on PI-1040-2A and PI-1040-3A, respectively.
RHR flov is normally monitored in the control room on flow recorder FI-1040-7 and flow indicator FI-1040-11A.
RHRSW/RHR differential pressure and RHR flow can be monitored by an analog trip system indicator in the cable spreading room.
The RHR pump discharge pressure can be monitored on local j
mechanical indicators PI-1001-71A, PI-1001-718, PI-1001-71C, or PI-1001-710.
RHR service water pump discharge pressure can be monitored on local mechanical indicators PI-1001-71A, PI-1001-71B, PI-1001-71C or PI-1001-710.
- Level Indicator for Tanks - CST level is normally monitored in the control room on level indicators LII/2-3340-3 and LII/2-3340-4.
The operator can locally monitor the level from mechanical indicators LII/2-3341-77A and LII/2-3341-77B located on the ground floor of the turbine building.
.
.
.
.
,
,
Diesel fuel level in the day tanks can be monitored locally in the day tank rooms.
The diesel generator fuel transfer pump automatically starts on low day tank level.
(5) Support Systems Support systems required for post-fire safe shutdown are:
4160V AC
480V DC
125V DC
Communication system
'
Fire water
Emergency lighting (6) Cold Shutoown The reactor is depressurized by locally operating the
,
individual n.ain steam relief valves.
At approximately
!
50 psig, the RCIC system is shutdown and suppression pool cooling is secured.
The RHR system is then realigned
,
l in the shutdown cooling mode (SDC).
b.
Alternative Safe Shutdown The control room is evacuated and the plant remotel, shutdown in i
the event of a severe uncontrolled plant fire detec;ed in any of the following areas:
Control room i
Auxiliary electric equipment room i
Cable spreading room
Computer room In the absence of a centralized alternate shutdown panel, Quad Cities relies on local control stations.
Both units are shutdown for any fire requiring evacuation of a control room.
Control and diagnostic instrumentation fer the high pressu.e systems (RCIC and
SSMP) are provided locally in the pump rooms.
Reactor water level
,
and pressure can be monitored locally on several reactor building i
instrument racks.
Suppression pool level is available on a local level indicator, however, suppression pool temperature must be determined at the torus using a surface pyrometer. Mechanical indicators are available on the ground floor of the turbine building for CST level.
,-
.
i l'
!
-
.
.
.
.
.
.
The Unit 1-Nuclear Station Operator (U1-NS0) and the Unit 2-Nuclear Station Operator (U2-NS0) establish safe shutdown command posts in their respective reactor buildings.
The U1-NSO is stationed on the second floor of the Unit 1 Reactor Building at instrument racks 2201-5 and 6, while the U2-NSO is stationed on the second floor of the Unit 2 Reactor Building at instrument rack 2202-5 and 6.
Tests of the hand held radio used in the "talk around" mode during post fire safe shutdown demonstrated that the communications between the command posts and other plant areas involved with safe shutdown functions could be maintained. This is especially important for Quad Cities due to the many required manual operations and the number of operators (ten) required to shutdown both units, c.
. Procedure for Alternate Safe Shutdown The licensee has developed procedures for alternate shutdown in the event of oisabling fires in the Control Room, Auxiliary Electric Equipment Room, the Cable Spreading Room and the Computer Room.
Procedure QARP 800-1, Revision 1, dated May 1987 was developed in the event of a fire affecting Unit 1, and QARP 1500-1 was written for a Unit 2 fire.
For either case, the non-affected unit is also shutdown. Although both procedures were reviewed, the inspectors focused on QARP 800-1.
To implement this procedure a total of ten licensee personnel are required as follows:
Shift Engineer (SE) and Station Control Room Engineer (SCRE) -
will report to the second floor of the Units 1 and 2 Reactor Buildings to coordinate Units I and 2 safe shutdown activities.
- Shift Foreman (SF) will report to the Unit 2 diesel generator room to start up and monitor Diesel Generator 2.
- U1-NSO will report to the second floor of the Unit 1 Reactor Building to monitor instrument racks 2201-5 and 2201-6 and establish a safe shutdown command post.
- U2-NSO will report to the second floor of the Unit 2 Reactor Building to monitor Instrument Racks 2202-5 and 2202-6 and establish a safe shutdown command post.
- Center Desk Nuclear Station Operator (CO-NS0) will report to the 4kV Buses 13 and 14 area of the Unit 1 turbine building to perform immediate powe; supply operations.
Upon completion of these actions, he will assist with other local manual operations where and when required.
- Equipment Operator (EO) stil report to the 4kV buses 23 and 24 area of the Unit 2 Turbine Building to perform immediate power supply operations.
Upon completion of these actions, he will
...
- - - - - _ _-._
_- -
- - -. - - -.
_ _. - -
_.
_ _-
-
.
!
'
i
'
.
.
p..
'
assist with other local manual operations where and when
!
required.
I
Unit Operator (UO) will report to the Unit 1 Diesel Generator room to start up and monitor Diesel Generator 1.
Unit 1 Equipment Attendant (EA1) will report to the Unit 1
!
J
l RCIC system room located in the northwest corner on the j
basement elevation of the Reactor Building to start up and
-
j monitor the RCIC system.
'
s
)
Unit 2 Equipment Attendant (EA2) will report to the SSMP room I
located on the ground floor elevation of the Turbine Building
j to start up and monitor the SSMP system.
I I
The procedure review indicated that it contained the steps necessary
{
i to achieve stable hot shutdown and cold shutdown, however, the i
j inspectors identified a number of discrepancies as described below, f
e
-
!
(1) Step No. 28 - Did not contain sufficient detail for the operator
!
j to obtain suppression pool temperature using a surface pyrometer.
The licensee concurred and agreed to modify the procedure to j
'
i include the number of measurements and their location on the j
l torus.
!
{
(2) Step No. 13b - Change wording from "RCIC Condenser Condensate
{
,
Pump" to "RCIC Condenser Vacuum Pump."
j
!
)
(3) Steps No. 16 through 32 (hot shutdown) - Were not pre-assigned i
j to specific operators, but were to be designated by the SE at j
j the time of the event. During the early stages of hot shutdown, l
the SE has the responsibility of coordinating the activities of
[
the operators in the affected unit, in addition to maintaining
}
communication with the unaffected unit.
Pre-assigning the F
,
l operators in the procedure would facilitate the task of the I
NSO. This was substantiated during the walkdown when the SE experienced difficulty in deciding which operator to select.
l The licensee agreed to review and modify the procedure.
In
!
addition, the licensee agreed to update and incorporate time lines into the Safe Shutdown Analysis.
}
'
,
!
The above three discrepancies are considered an Open Item j
(254/88021-01(DR$); 265/88021-01(DRS)) pending review of the licensee's revised Safe Shutdown Procedures and Safe a
j Shutdown Analysis.
,
r l
(4) Based on deficiencies identified during the review of the
common bus concern (refer to Paragraph 2.e. of this report),
'
}
additional load shedding manual actions to the procedure may l
j be required.
The effect of additional actions on the time l
lines required for safe shutdown will be reexamined when
'
j the procedures have been modified.
,
!
!
,
i
!
i
-. _.
_ _ -
-.. _ -
-
_ - - - -.
_
_._. -
__
_ - - - -
.... - -
_
_
o
-
o
.
'
'
i
'
A walkdown of Procedure QARP 800-1, was conducted on February 25,.
)
1988.
Four inspectors accompanied the operators as they performed
.
.
_ i
!
the simulated shutdown.
Initial conditions specified were*
i
f j
Units at 100*4 power.
Walkdown Unit 1 shutdown only.
i
I
Manual start of emergency diesel generators.
l The walkdown was terminated at Step 29 of the procedure before
!
,
!
commencing cooldown.
!
l
!
The following concerns were identified by the inspectors:
>
I
Breaker compartment numbers for Steps 16b and 16e were reversed.
Operator was not provide.< with a key for opening 208V MCC 18-1A-1
breaker cabinet.
- One of the operators failed to acknowleua receipt of radio
!
instructions from the shift engineer.
'
There was some confusion and uncertainty in selecting operators I
i
{
to perform steps that were not pre-assigned in the procedure.
i
L j
In subsequent discussions, the licensee committed to make the
!
i necessary changes.
The previously idenuf ted concerns are
[
j considered an Open Item (254/88021-02(ORS); 265/88021-02(ORS))
l j
pending review and acceptance of the licensee's corrective
actions.
!
'
l
)
During a separate walkdown by the inspectors of the RCIC pump room I
to check the feasibility of manual valve actions, three valves would
require the operato to climb on pipes and operate the handwheel in t
i an awkward positiun. The licensee agreed to provide a more suitable
means to perform these manual actions.
This is considered an Open
!
Item (254/88021-03(DRS); 265/88021-03(DRS)) pending review and acceptance of the licensee's actions, j
It was also observed during the audit that a fuse puller in the
!
i diesel room was missing and that two replacement fuses were taped j
to the handle that may have been required to replace fuses F22
'
.
and F24.
The licensee agreed to provide a more secure and suitable i
means for storing the puller and fuse.
!
?
In response to questions regarding periodic surveillance of tools l
and equipment stored in the safe shutdown locker, the licensee l
indicated that safe shutdown equipment was in the process of being
,
added to the plant surveillance procedures.
This is considered an i
i Open Item (254/88021-04(DRS); 265/88021-04(DRS)) pending review of q
j licensee actions, j
l
I i
!
_
.
,
.
.
.
d.
Operator Training on Safe Shutdown Procedures
__
In addittor, to observing the operator's performance during the walkdown of procedure QARP 300-1, operator training personnel
were interviewed concerning operator training on Appendix R post-fire safe shutdown procedures and equipment. Training records for operating shift personnel were also reviewed.
The areas reviewed were found to be satisfactory.
e.
protection for Associated Circuits
.
'
The following associated circuits were evaluated:
l Commen Bus Concern
'
The common bus associated circuit concern is found in circuits, either safety-related or non safety-related, where there is a
,
l common power source with shutdown equipment and the power j
source is not electrically protected from the circuit of I
concern.
- l Spurious Signals The spurio,.
i 1gnals concern is made up of two items:
The false motor, control and instrument readings such
-
i as those which occurred at the 1975 Browns Ferry fire.
These could be caused by fire initiated grounds, shorts,
'
or open circuits.
-
Spurious operation of safety-related or non safety-related
-
,
components that would adversely af fect safe shutdown capability (e.g., RHR/RCS isolation valves).
,
Common Enclosure
'
]
The common enclosure associated circuit concern is found
!
i when redundant circuits are routed together in a raceway or i
enclosure and they are not provided with adequate electrf al j
isolation protection, or fire can destroy both circuits cue t
j to inadequate fire protection methods.
l t
i The inspection results were as follows:
I (1) Common Bus Concern
.
)
The common bus concern consists of two items:
'
Circuit coordination
High impedance faults i
,
?
-
!
f
i t
!
i
-.
-
. _
_
_. _- -. - _. _
- -
-
..-.. ___
_
-.
-
-
.
t
-
- .
.
.
i The Quad Cities safe shutdown analysis verified equipment
required to achieve safe shutdown to be free of fire
!
induced faults when the operation of the equipment is
,
required to achieve post-fire safe shutdown conditions.
!
Non-essential loads, which share common power sources with i
'
l equipment required to achieve safe shutdown, have not been
!
ircluded within the scope of the analysis and the licersee
!
'
j does not take credit for coordinated electrical protection l
of safe shutdown power sources at any level. To prevent
,
}
fire iriduced faults on non-essential loads propagating into
!
!
the possible loss of power sources relied on to achieve safe I
shutdown, the licensee has prepared written procedures which l
j direct operator actions to shed the non-essential loads from i
required power sources.
This methodology was reviewed and accepted in a safety Evaluation forwarded in a letter dated
'
l December 1, 1987 from T. Ross, NRC to D. Butterfield, CECO.
I i
On a sampling basis, a review of the licensee's procedural j
'
methodology of compliance with Appendix R was performed to l
verify its technical accuracy and completeness. To accomplish
j this task, the licensee's safe shutdown procedures for a fire l
j in a randomly selected fire area were compared to information l
contained in the analysis and associated electrical distribution
!
i system drawings.
Specifically, Safe Shutdown Procedure, 04, QARP 500-1, Revision 2, dated December 11, 1987, was selected j
for review, this procedure would be utilized in the event of l
,
i fire within the Units IB and 1C RHR Service Water Pump Room
)
(Fire Area 11.1.1B). Contrary to the analysis, the review i
identified that the procedure specified the removal of only J
j those non-essential loads protected by electrically operated
,
j circuit breakers. Shedding of non-essential leads protected
'
by manually operated circuit breakers had not been included.
Specific examples of non-essential breakers omitted by the
'
a procedure include the folluwing manually operated breakers located on 480V Switchgear No. 18:
Circuit Breaker Funcn on l
185A Feed to Reactor Building 480V MCC 18-3 l'
184A Turbine Building 480V MCC 18-2 i
1840 120/240V AC UPS PML. 901-63 l
1850 Feed to Turbine Building and Reactor
'
Building LTG. No. 1
.
In addition, the procedural review identified that Safe Shutdown Procedure D4 addressed non-essential load shedding from safe
shutdown power sources only during the case when offsite power
'
is lost. When offsite power remains available, load shedding of equipment not required to achieve safe shutdown was not
,
included in the procedure.
<
I
!
i
1
!
i i
<
-
- - - - - - - - -
- - - - -
-- -
- - -
-- -
. - - - - - - - - - - - -
_.
_.
_ _ _.
-
. _. _.
a
,
.
-
t
.
.
Based on the licensee's lack of analysis (fo= bre&ker coordination) to verify the protection of power sources required to achieve safe shutdown, and the identified a
procedural deficiencies, it was determined that fire induced
!
faults on equipment or cabling associated with the non-essential
)
Nads -' required power sources may adversely affect the plants abilit,.o achieve safe shutdown.
'
,
'
This is contrary to Section III.L of Appendix R vhien requires that safe shutdown equipment and systems for each fire area be known to be isolated from associated non-safety circuits in the
.'
fire area so that hot shorts, open circuits, or short: to ground in the associated circuits will not prevent operation of the safe shutdown equipment.
This is considered an example of an apparent violation (254/88021-05a(ORS); 265/88021-05a(DRS)) of 10 CFR 50, Appendix R.
L In response to this concern, licensee representatives performed a reevaluation of all safe shutdown procedures presently in
!
place.
Following this reevaluation, the licensee indicated i
that these deficiencies were a generic concern for all non-safe
shutdown leads associated with 400V busos required to achieve safe shutdown.
The licensee committed to perform any necessary
procedural revisions.
In addition, as an interim compensatory measure, the licensee initiated Temporary Procedure QARP 000-3, l
"Additional Guidance for QARP's," which is to be implemented in
]
conjunction with the plant's existing procedures.
The temporary procedure was reviewea by the inspection team and no unacceptable
,
conditions were identified, d
.
During the site re-visit of June 27 and 28,1988, the licensee's
'
method of protection for the common power source asso"sted I
concern was re-examined. Based on discussions with licensee representatives, it was determined that the licensee has apparently revised its coordination protection methodology
from that described in Section 5.5 of its approved Safa
,
i Shutdown Analysis which was reviewed during the February
]
site visit.
t
,
j Subsequent to the February 1983 inspection, the licensee has
,
)
initiated a circuit coordination study which !t currently in
'
I the licensee's review process.
The licensee is presently
'
'
revising its coordinated fault protection methodology from that i
contained in its approved safe shutdown analysis.
The licensee's
)
intent is to utill:e the results of this study where applicable, i
!
i.e., demonstrate satisfactory coordination where it presently j
j exists and to rely on aM ormal operating procedures to restore
!
i power sources which may be lost as a result of fire induced
'
i faults.
The licensee was requesteo to submit any changes
}
i'
regarding the Safe Shutdow.i Analysis to NRR for review.
I i
l
I i
l l
i i
!
-
.
.
'
.
'
.
The inspection team identified the following concerns with l
the licensee's reliance on bus restoration through the use of abnormal operating procedures:
The abnormal operating procedural methodology permits the loss of a power supply relied upon to achieve safe
]
shutdown prior to requiring any operator action.
Thus, this method will not prevent the loss of an affected power source, d
Numerous manual actions are already required by the licensee's current safe shutdown methodology; implementing the abnormal operating procedures may-j place an unacceptable additional burden on operators.
The inspection team requested the licensee to include the implementation of the abnormal operating procedures in the time line analysis of required operator actions in the updated Safe Shutdown Analysis.
,
Since normally available control room indication of a
lost power sources, such as annunciator alarm circuits or valve position indication circuits, are not known to be free of fire damage, operators may be forced
to perform trouble shooting operations in order to restore an affected power source.
Such actions may (
,
i adversely impact the 30 minute maximum time of
!
j establishing reactor coolant makeup capability.
l
l In the event of a control building fire, the licensee's l
Safe Snutdown Analysis specifies the use of RCIC to (
j establish reactor coolant makeup within 30 minutes. During
>
'
the June site visit, it was identified that the RCIC inboard
'
steam supply isolation valve (1-1301-16) is located inside l
containment and derives its power from MCC 18-1A-1 which
,
is a load or 4SOV AC Switchgear 18. At the time of the i
j February inspection, the 480V AC Switchgear 18 was
!
j identified as being susceptible to loss due to common
i power source deficiencies, Thus, during the June site
!
j visit, a concern was identified that a control building
-
fire may result in the loss of 480V AC Switchgear 18 (and
,
l the subsequent loss of MCC 18-1A-1) dua to high impedance
'
j faults, concurrent with a fire initiated spurious closure i
!
of the inboard RCIC steam supply isolation valve.
At. the
'
'
time of the site re-visit, the licensee could not provide an analysis to demonstrate adequate separation of the RCIC
steam supply isolation valve control and power cabling to i
preclude the occurrence of a spurious valve closure l
coincident with a loss of 480V AC Switchgear 18. The licensee committed to provide an analysis.
The potential i
loss of 4SOV Switchgear 18 concurrent with a spurious j
closure of the RCIC inboard steam supply isolation valve i
is considered an example of en apparent violation
(254/8-8021-05b(DRS); 265/SS021-05b(ORS)) of 10 CFR 50
{
Appendix R.
,
'
13 s
1
,
a
.
>
.
.
.
(2) Spurious Signals (a) High/ Low Pressure Interfaces The licensee's analysis has identified the RHR shutdown cooling suction pump isolation valves for each unit as
the only high/ low pressure interface of concern.
This
,
interface consists of the series combination of an inboard
,
isolation valve (M01(2)-LOO 1-50) which is a 20" normally closed AC motor operated valve (MOV) powered from the
,
Division I, 480V AC Motor Control Center (MCC) 18-1B(28-28),
and an outboard isolation valve (M01(2)-1001-47) which is
'
a 20" normally closed DC MOV powered from the Division II 250V DC MCC-1B(28).
The licensee's method of control for i
this interface was found to include administrative controls I'
which require the outboard isolation valve to be locked closed in the deenergized position at MCC-1B (2B).
The licensee's analysis and method of control for the high/ low pressure interface concern was found j
to be in compliance with existing NRC guidance and j
interpretive documentation.
I
)
(b) Current Transformer Secondaries j
j The licensee has performed an analysis of the current
'
transformer open circuit secondary concern.
This analysis demonstrated that the maximum potential in
current transformer open secondary will be limited to approximately 30 volts.
This potential does not
]
present a secondary fire hazard.
l The licensee's analysis of the current transformer concern l
was found to be acceptable.
,
(c) Isolation of Fire Instigated Spurious Signals
/
>
,
l The licensee has provided isolation for fire induced
!
spurious signals by various methods including:
.
Administration Controls
'
'
Rerouting of Cables
Isolation Switches
'
]
During the inspection, all forms of isolation listed above were observed and found to be acceptable.
The licensees analysis and methods of control for the i
spurious signal associated circuit concern was found j
to be acceptable.
!
s i
I
-
- -
- -
- -
-
_
. - -
-
_ _ _ _
-
--
_ -. _ __._
_ _ _ _ _ - -.
-
I o
,
l
,-
(3) Common Enclosse
_
_
At the time of the inspection, licensee representatives
'
.,
stated that:
'
Cables for redundant safe shutdown in divisions were i
not routed within a common enclosure,
j Non safety-related cables which were routed together with cables required to achieve post fire safe shutdown were protected by an appropriate electrical isolation device.
,
,
l
Non safety-related cables which share a common enclosure
'
i with cables required to achieve post fire safe shutdown j
were never routed between divisions.
!
Physical in plant inspection did not identify any exceptions l
to the above statements.
l
,
The following non safety-related cables routed in common I
i enclosure with safety-related cables were randomly selected i
to verify that they were electrically protected:
.
!
I Electrical i
Jable No.
Function Protection
)
~
12905 Containment Spray Valve (Power)
3A Braaker
.
11148 Reactor Bldg. Exhaust Fan 1A 10A Fuse
]
(Control)
13566 Reactor Bldg. Ventilation System i
Pnl 2251-24X (Power)
20A Breaker
[
65334 RPT-ATVS (Centrol)
10A Fuse
,
12197 Rectre. Pump 1B Coupling Fluid 100A Breaker i
Pump B2 (Power)
,
No unacceptable conditions were identified during the review of
the common enclosure associated circuit concern.
i 4,
L
{
f.
Fire Protection of Safe Shutdown Capability l
In the licensee's safe shutdown raport, the licensee has identified
!
}
several safe shutdown pathways in which at least one pathway per
!
unit will be available in the event of c disabling fire in the plant. The inspectors toured both units and observed firewalls,
,
I suppression and detection systems which appeared to be well designed
'
and installed as described in the Safe Shutdown Report. No l
discrepancies were noted by the inspector.
j
,
}
[
i
)
3
1 i
!
I
.
.-_
._. -
_ _
.-
.-
_ _.
-
_
---
,
'
-
.
.
<
t g,
fmergency Lights The licensee is required to meet Section !!!.J of Appendix R which i
requires emergency lights with at leas +. an eight-hour battery power
'
suppl / for all areas needed for operation of safe shutdown equipment i
'
and in access and egress routes thereto.
l Generic Letter 8G-10 provides acceptable methods of satisfying the
Commission's regulatory requirements (i.e., Appendix R). Generic i
Letter 86-10 states "where a licensee has provided emergency lighting
I per Section III.J. Appendix R, we would expect that the licensee
verify by field testing that this lighting is adequate to perform
'
the intendud task."
j The licensee provided the inspector with the emergency lichting l
blackout walkdown test results completed on April 10, 1987. The
'
'
purpose of this test was to verify that sufficient lighting was l!
provided to show that manual shutdown actions as requ4 red by the
,
safe shutdown report could be performed, l
!
The inspector observed that for several areas needed for operation L
of safe shutdown equipment, and for access and egress routes to
!
,
'
that equipment, it appeared that sufficient emergency lighting was
!
available. At the request of the inspector, an eight-hour discharge l
test of the emergency lights was conducted.
The results of the test
'
were as follows:
,
i i
Puck No.
Location No. of Lamps l
L
U-1 Trackway
i
U-1 Diesel Generator Day
}
Tank Room
l
_ Pack No.
Location No. of Lamps
l 21A U-1 Diesel Generator Room
'f
(South)
l
218 U-1 01esel Generator Room l
}
(North)
!
228 B-7 Man Lift
)
16B U-1 Battery Charger Room
i 16K V-1 Battery Charger Room
l
j All lights were operable after eight-hours of discharge.
!
Based on review of the licensee's blackout walkdown test, field
]
walkdown of s(veral areas and pathways requiring emergency lighting,
'
and results of the eight-hour discharge test, no unacceptable items were identified.
!
i h.
Emergency d ght Maintenance
!
j The inspector requested the licensee's procedures that insure l
that the emergency lights will be maintained in accordance with the j
16
>
j i
-
.
_ - -
-
_ _ _
-
_ - _
- _.
.
-
.
manufacturer's instructions and be properly maintained and operable in the event that they are required.
The licensee provided the inspector with the procedure titled
"Semiannual Eight-Hour Emergency Lighting Pack Inspection,"
No. QMS 200-33 which addressed (but is not limited to) the
'
l electrolyte level and charging state of the battery.
In addition, the licensee provided the inspector with the procedure titled "Annual Eight-Hour Emergency Lighting Pack Inspection" No. QMS 200-29.
The procedure required an eight-hour discharge test, maintenance and verification that the lights are properly
airned.
!
!
No unacceptable items were identified a. 2 result of the review of i
the "Emergency Lights Semiannual and Annual Inspection" procedures, j
i.
Corgmunications l
Th6 licensee has five communication systems available for safe shutdown:
I
Pub)(c Address
Dia; Telephones (PBX)
Sourd Power Phone
Eme'gency Phone System
Por'able riadio System The licen ee ht, performed an analysis to determine the availability of each cc.vw acation system in the 6<ent of fire.
For fires which do not reqt*<e alternate shutdown the licensee may use each system as availabn For alternate Autdown communication, the licensee has designated the portable rao'o system in the "talk around" mode of operation i
as the primary rneans of communication.
In the "talk around" mode of operation the portable radio system eperates independent of the radio repeater system which may not be available during a loss of offsite power or in the event of fire within certain locations of the plant, To verify operability, the licensee has performed
"Appendix R Radio Ten" (QCNPS Special Test 1-92) and has achieved satisf actory results.
In addition, the operability of the portable radio communication system in the "talk around" mode was observed during the alternate shutdown procedure walk through with no unacceptable conditions observed by the inspection team.
j.
Cable Routing On a sample basis, the following redundant, power and control cables of equipment required to achieve safe shutdown were selected and reviewed for pruper separatien compliance.
i
.
,
.
Component Cable Function
'
RHR Pump 1-002A Power RHR Pump 1-002B Power RHR Pump 1-002C Power RHR Pump 1-0020 Power Safe Shutdown Makeup Pump Power
[
Safe Shutdown Makeup Pump Control OG 1/2 Cooling Water Pump Control RHR Room Cooler 1-5764A Control RHR Room Cooler 1-5764B Control RCIC Valve 1-1301-16 Control RCIC Valve 1-1301-17 Control
RCIC Valve 1-1301-149 Control No unacceptable conditions were identified, f
3.
Fire Protection Features
,
As part of the Appendix R compliance assessment, several fire protection features were also reviewed as listed below:
i
Fire Pumps
Carbon Dioxide System
'
Portable Extinguishers l
!
a.
Fire Pumps In the lictosce's respense to the guidelines of Appendix A to f
APCSB 9.5-1. Section E.2(c), the response indicates that the i
site has t*6 diesel driven fire pumps rated at 2000 gallons per l
minute (GPM) at 125 pounds per square inch gauge (PSIG), and that
the fire pumps take suction from the Mississippi River. The i
licensee also indicated in this document that fire cumps are L
generally installed in accordance with NPFA 20. "Standard for the Inst.11ation of Centrifugal Fire Pumps."
la the NFPA 20-1937, "Standard for the Installation of Centrifugal
Fire Pumps," it indicates that the annual flow test of th* fire
'
pump assembly shall be perfortred to determine the fire pump assembly i
ability to continue to attain satisfactory performance at shutoff.
l rated and peak loads. Also, in Section 8-2.4 titled "Instrumentation anct Control." it states "Engine shall be provided with a governor
'
capable of res ulating engine speec within a range of 10 percent between shutoff and maximum load condition of the pump."
i Fire Pu p Capacity Test The inspector requested and was provided with the diesel fire pump capacity test for 19S4, 1935 and 1937.
The licensee indicated that l
the 1996 test could not be located.
l
.
___.
_
_
_
_
_
_.
_.
l
[
I
.
i 1984 Fire Pump Capacity Test
)
'
The procedure "Diesel Fire Pump Capacity Test," QOS 4100-7,
'
Revision 6, dated September 1982 required that each diesel driven I
.
fire pump develop at least 2000 GPM at a system pressure of 123 psig
]
each operating cycle to meet technical specification. The fire pump
met technical specification requirements, but the recorded results j
did not demonstrate that the pump can attain a satisfactory j
performance at shutoff and peak loads as described in NFPA-20, 1985 Fire Pump Capaciy Test
j i
The licensee was unable to locate the station procedure documenting i
I the diesel fire pump capacity test.
The licensee, however did
}
provide the inspector with Fire Pump Test Report from their fire J
insurance carrier.
,
Pump A (South)
]
The test points recorded reflected the rated tad peak loads for the fire pump.
In addition, the rated speed (rpm) of the fire pump was
,
considered in the test.
'
PumpB(NorthJ l
I The 1985 fire pump capacity test for Pump A (South) only reflected the rated and over capacity te:t and did not address the shutoff j
test.
Pump B fire capacity test only considered rated load. Based
on the re.orded results, it was not demonstrated that the fire pumps
!
can attain satisfactory performance at shutoff and ptak loads as j
'
l described in NFPA-20.
l i
!
i 198ti Fire Pump Capacity Test
[
The licensee indicated that the 1986 diesel fire pump capacity test t
j results could not be located.
'
-
[
1937 Fire Pump Capacity Test i
The diesel fire pump capacity test procedure. QMS 100-27, Revision 2, dated July 1986 was developed by the licensee to outline the test l
necessary to verify that the diesel fire pumps are operating at the l
]
proper capacity.
'
i l
The diese? fire pump capacity test checklist which is referenced and
used with Test Procedure QM5 100.27 addressed the shutoff, rated and
,
'
peak loads as described in NFPA.
The licensee agreed to update the l
]
procedure to incorporate pump speed correction adjustments to the
recorded flow and pressure using the affinity laws as described in j
the Fire Protection Handbook.
In addition, the licensee agreed to l
j record the engine speed and verify that the governor regulates engine I
]
speed within a range of 10 percent between shutoff and maximum load condition of the pump.
l i
'
i
'
q
I l
i
-
- -
-
-
-....
-
-
- -. _
.
. _
.
._
..
--____-
-
,.
.
.
Conclusion
)
!
Based upon review of the diesel fire pump capacity test from 1984 i
to 1987, the licensee 5as not yet established an adequate fire pump
test that determines the fire pump assembly ability to continue to l
attain satisfactory performance at shutoff, rated and peak leads.
i However, review of the available data from these test results do l
not indicate that the pumps would not perform satisfactorily in i
the event that the pumps would be required to operate. As discussed
-
with the licensee, the baseline field acceptance test should be made l
available or developed (the fire pump baseline curve should compare
.
l favorably with the fire pump shop test curve).
The licensee should l
review NFPA-20 (latest revision) and consider revising the diesel l
l fire pump capacity procedure to address parameters such as correction I
for rpms and vibration testing.
This is considered an Open Item l
(254/88021-06(OR$); 265/88021-06(ORS)) pending review and acceptance l
,
j of the licensee's revised Diesel Fire Pump Capacity Test Procedure.
-
,
b.
Carbon Dioxide System
[
I
'
l In Section 2.4.3.3 of the licensee's fire hazard analysis titled L
"Carbon Dioxide Supprersion Systems," the analysis 'ndicates
i
that there are total flooding Carbon Dioxide suppression systems I
provided in the Diesel Generator Rooms and associated diesel day (
i j
tank rooms.
The licensee indicates in the fire hazard analysis f
j that the guidelines established in NFPA 12 were used as general
)
guidance in system design and installation with consideration
.
]
given to sufficient design concentration and soak time.
'
i
]
The inspector requested the original acceptance test (concentration l
test) to review the test results and verify equipment (encompassed
l by the test) interlocked with the Carbon Dioxide system was, at a j
l j
mi.'imum, being tested in accordance with the licensee's Carbon Dioxide
Fire Protection Test procedure.
The licen,ee indicated to the t
inspector that the Carbon Otexide concentration test could not I
be located and, in rddition, the vendor was contacted but indicated l
that the Carbon Dioxide tests were not on file.
The licensee was
}
,
i informec that the concentration test should be conducted, documented i
]
and used as a basis to substantiate the fire hazard analysis.
This i
is censidered an Open Item (254/SB021-07(ORS); 265/88021-07(ORS)
L pending review of licensee actions.
[
j In review of the procedure. "Standby Diesel Generator Cardon Fire
Protection Test Procedure," QIS 59-1, Revision 7. December 19S6, L
the inspector informed the licensee of the following:
)
(1) In Step F.3 and Step F.5 the procedure did no; clearly l
establish what valve is required to be unlocked and i
closed.
j
>
l
!
(2) In Step E.1, it indicates that a brief flow test shall be made l
'
to verify flow from each no: le.
In Step F.8, it requires the j
licensee to verify and record on the data sheet that the-e is (
discharge from spray nozzles.
!
l
I t
- - - - -
- - - -
- - - - -
__
_ - _ -
.._ --
- _- _._
_
__
o'
.e
.
The licensee was informed that bags should be installed on the Carbon Dioxide nozzles when conducting the puff test to verify that all nozzles in that fire area are not obstru:ted.
In
'
addition, the licensee was also requested to sample the air in rooms rhere Carbon Dioxide is discharged so as not to
{
expose employees to hazardous levels of Carbon 01 oxide.
-
The licensee acknowledged the inspectors observations and agreed to revise the Carbon Dioxide surveillance procedures.
I i
This is considered an Open Item (254/88021-OS(DRS);
'
265/88021-OS(DRS)) pending review and acceptance
'
of the licensee's revised procedure (s).
!
t c.
Portable Extinguishers
!
l Portable carbon dioxide and dry chemical extinguishers are located I
I throughout all safety-related plant areas.
The licensee was informed l
l that in the event of an earthquake it appeared that some of the
!
I porttble carbon dioxide extinguishers may become dislodge,d from l
their holders and become potential missiles should the valve be i
damaged, The licensee acknowledged the inspector's concern and l
agreed to review this issue.
t
!
4.
Open items j
i Open items are matters which have been discussed with the licensee, which will be reviewed further by the inspector, and which involve some action l
on the part of the NRC or !icensee or both. Open items are discussed in l
Paragraphs 2.c, 3.a. and 3 b.
l i
5.
Exit Interview
!
The inspectors met with licensee representatives at the conclusion of the i
inspection on February 26 and June 28, 1988.
The inspectors discussed the
likely content of this report and the licensee did not indicate that any l
information discussed during the inspection could be considered proprietary i
in nature.
l In addition, on September 1, 1988, a conference call was held between Jonathon Reed and the inspectors to discuss the results of the in-office
!
review discussed in the report.
i
!
,
,
d
21
.
o