IR 05000254/1998011
| ML20236L389 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 07/02/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20236L387 | List: |
| References | |
| 50-254-98-11, 50-265-98-11, NUDOCS 9807100336 | |
| Download: ML20236L389 (60) | |
Text
. - . _ _ - . - _ _ . . _ - - _ _ _ _ _ _ - _ _ - _ - _ - _
l
' '
,-r U.S. NUCLEAR REGULATORY COMMISSION REGION lll
'
Docket Nos: 50-254; 50-265 l License Nos: DPR-29; DPR-30
. Report No: 50-254/98004(DRP); 50-265/98004(DRP)
Licensee: Commonwealth Edison Company l
!.
Facility:
'
Quad Cities Nuclear Power Station, Units 1 and 2 Location: 22710 206th Avenue North Cordova, IL 61242 Dates: May 4 through 22,1998
,
inspectors: Patricia Lougheed, Reactor Engineer, Rlli Team Leader Patrick Madden, Senior Fire Protection Engineer, Office of i
Nuclea'r Reactor Regulation (NRR), Technical Team Leader Doris Chyu, Reactor Engineer, Rlli
_
Phillip Qualls, Fire Protection Engineer, NRR Kenneth Sullivan, Electrical Engineer, Brookhaven National Laboratory (BNL)
Richard Deem, Reactor Systems Engineer, BNL Approved by: Ronald N. Gardner, Chief Engineering Specialists Branch 2
.
'
9807100336 990702 I PDR ADOCK 05000254 G PM 3
_ - _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - - _ __ - - _ _ - ._ - _ - - _
.
,,.
EXECUTIVE SUMMARY Quad Cities Nuc' ear Generating Station Units 1 and 2 Inspection Report 50-245/265 98-011 On September 26,1997, Commonwealth Edison (Comed) determined that the post-fire safe shutdown procedures developed for the Quad Cities Nue! ear Power Station were inconsistent with the safe shutdown analysis (SSA). This discrepancy led to the licensee shutting down both units. To confirm the actions to be taken by the licensee to resolve Appendix R issues at Quad l
l . Cities, NRC issued a confirmatory action letter (CAL) to Comed on January 16,1998. As i l described in the CAL, the licensee committed to take several actions prior to restarting the '
plant, including: Revision and Validation of the Safe Shutdown Analvsis: The SSA was to be revised,
! reviewed, vahdated and approved to assure that a fire in any plant area would not prevent the performance of necessary post-fire safe shutdown functions, and that these required functions would remain free of fire damage; Development of Safe Shutdown Procedures: Safe shutdown procedures were to be i revised, reviewed, validated and approved to implement the revised SSA. Operators
'
and other required personnel were to be trained in the use of the procedures; and Identification and Resolution of Anoendix R Discrepancies: The licensee was to identify any 10 CFR Part 50, Appendix R discrepancies that could affect the ability of the plant to be safely shut down in the event of a fire. Discrepancies were either to be resolved or
! appropriate compensatory measures were to be identified and implemented with a plan and schedule for achieving compliance provided to NRC.
. On April 29,1998, the licensee formally docketed its response to the CAL and concluded that l all conditions necessary to restart the plant had been met. During the week of May 4 - 8,1998, l NRC conducted a special startup inspection to review the licensee's revised SSA and l . procedures. This inspection was focused on ensuring that the conditions of the CAL were me In order to focus the inspection effort on areas of the plant having a potentially greater fire-risk significance, the inspection team performed a qualitative screening evaluation of fire areas described in the licensee's safe shutdo'wn report and supporting documents. As a result of this i review, the inspection team concluded that the initial phase of the inspection should
- concentrate on the adequacy of the post-fire safe shutdown capability provided for two fire areas in the turbine building (TB-Il and TB-Ill), and one fire area in the service building (SB-l).
However, after three days onsite, the inspection team leaders and Region lil management had identified sufficient weaknesses to conclude that the conditions of the CAL were not entirely satisfied. Specifically, the analysis methodology and post-fire safe shutdown capability were found to not satisfy the technical requirements of 10 CFR Part 50, Appendix R, Sections Ill. and Ill G.3. Specific weaknesses included: (1) inadequate evaluation of, and level of protection provided for,125Vdc control power to 4 kV Switchgear; (2) Inadequate and non-conservative assumptions regarding the number of spurious equipment operations that could occur during a
>
-- _ - _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - - _ _ - _ _ _ . _ _ . - _ _ _ _ _ . _ _ _ . -_ _ _ _ - _ - _ _ _ _ . - _ _ - _ - _ _ _
.
.
!
fire; and (3) deficiencies in operating procedures developed M implement the post-fire safe l shutdown capability. Because of these deficiencies, the inspection team was unable to l
! conclude that the SSA was adequately validated.
l The inspection findings for the first week of the inspection were presented to licensee l
'
! management during a May 8,1998, exit meeting. During this meeting the licensee contended that it had validated the SSA against the acceptance criteria and that it was in full compliance with Appendix R; however, the licensee proposed some additional corrective actions to address the inspection findings. These inspection findings and licensee actions were discussed further during a management meeting held in the NRC Region 111 office on May 13,1998. During this meeting, the licensee committed to specifically review fire area TB-Il against the SSA t acceptance criteria and document the results of this review in an auditable form. On that basis, the NRC decided to continue the inspection. Fire Area TB-Il was selected because a postulated fire in this area could result in damage to redundant trains of shutdown equipment requiring operators of both units to evacuate the main control room and implement a dual unit !
alternative shutdown methodolog On May 18,1998, the inspection team returned to the site and reviewed the results of the i licensee's reassessment of the TB-ll fire area. The inspection team identified a number of deficiencies which appeared to confirm the team's earlier assessment that the licensee had not l identified all areas where it was not in compliance with 10 CFR Part 50, Appendix R. When the l team identified these deficiencies to the licensee, the licensee committed to implement compensatory measures and maintain them until an adequate resolution to the technical issues could be attained.
i
!
Although the technical weaknesses associated with the post-fire safe shutdown methodology showed that the licensee had not strictly met all the conditions specified in the CAL, the inspection team concluded that the licensee's SSA and post-fire safe shutdown operating procedures did provide a minimally acceptable interim methodology which, when augmented l
with the compensatory measures, provided sufficient confidence to permit the restart of both units. The inspection team considered such compensatory measures to be acceptable only as short-term corrective actions with an objective of the licensee achieving full compliance with Appendix R to 10 CFR Part 50.
I Summarv Of Findings l
. The licensee's alternative shutdown capability had a number of significant weaknesse These included:
.
loss of the 120 Vac power that caused loss of control room indication, forcing the operators to abandon the control room;
. loss of the 125 Vdc power that caused loss of breaker coordination and forced a j dual unit station blackout; j -
potential for secondary fires that could hamper the ability of the operators to perform the safe shutdown in a timely fashion;
. not adequately determining the worst case spurious signa! or operation; and
l . ._
_ _- - _ - __ - _
l ,
,
.
crediting automatic actions to ensure main steam isolation valve closur (Section E1.3)
.
The licensee's analysis of associated circuits did not appear to be sufficiently comprehensive to satisfy 10 CFR Part 50, Appendix R, Sections Ill.G and Ill.L. Of concern was the assumption that only one spurious operation would occur as a result of a fire in any area, regardless of the number, type, or location of affected cables and l
circuits. This assumption affected the time available for operator actions in that multiple automatic depressurization system valves had cabling in the same fire zon (Section E1.4)
.
Fire area TB-Il did not appear to have adequate fire detection and suppression i
equipment to ensure compliance with Appendix R, Section Ill.G.3. (Section E2.5)
.
The licensee initially took inappropriate credit in the abnormal response procedures and the closure letter to NRC's confirmatory action letter in regard to use of non-shift operating personnel in order to maintain hot shutdown. Upon being brought to the .
licensee's attention, the licensee was able to demonstrate that hot shutdown could be
. maintained using only on-shift personnel. (Section E3.2)
-
The safe shutdown analysis did not adequately consider the hazard to operators, implementing post-fire alternative safe shutdown measures, caused by smoke from the fire. (Section E3.2)
I
. Given the number of time critical operator actions required, the lack of consideration of !
l environmental conditions, and other weaknesses in the licensee's safe shutdown analysis, the safe shutdown procedures were marginal. The licensee's commitment to ,
add an additional on-shift operator alleviated the immediate concern until long term d improvements could be made to reduce the number of post-fire required operator actions. (Section E4.1) }
- There was insufficient documentation to show that the safe shutdown analysis was reviewed against its acceptance criteria or the requirements of Appendix R. Resolutions ;
l to recommendations and comments made by various reviewers were sometimes narrow in scope or did not address the comments. The compliance matrix, produced in 3 response to NRC comments, did not thoroughly identify orjustify areas where full j compliance with Appendix R was not achieved. The comment process was not entirely ;
auditable, due to comments being verbally discussed without written justification as to how they were resolved. (Sections E7.1 and E7.2)
i
. The licensee's commitment to implement and maintain compensatory measures ]
reduced the likelihood of a fire that would require the implementation of the interim safe ;
shutdown analysis shutdown methodologies. (Section E1.5) l l
. Based on the licensee's commitment to add an additional bypass radio channel and to j study the need for additional channels, the communication system minimally supported !
both the dual unit shutdown and fire brigade operations. (Section E2.4) !
!
4 ;
!
i
!
~
- - _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ - _ _ - _ _ - _ _ _ _ _ _ _ _ _ - - _ _ _ _ . _ . _ _ _ _ _ _ _ _ __ _ ___ _ _ _ _____
i
.
.
l
.
The allowed outage times established for the post-fire safe shutdown systems, as !
! mo63ed by the licensee's May 13 commitments, should ensure that the non-unit specific post-fire safe shutdown equipment functions will be maintained operable under j all unit shutdown and operating combinations. (Section E3.4)
.
The licensee adequately defined the systems needed to achieve and maintain post-fire safe shutdown conditions. (Section E1.1)
.
The licensee had sufficient manual fire suppression equipment available and staged in ,
the risk sensitive areas of the plant. The plant equipment being used for post-fire safe l shutdown was in good material condition. (Sections E2.1 & E2.2)
r
.
The temporary 8-hour emergency lighting units provided adequate lighting coverage to l- perform the required safe shutdown activities until the permanent emergency lighting
units could be installed. (Section E2.4)
.
The Quad Cities abnormal response procedures were acceptable, although several l minor problems with procedural completeness were identified. (Section E3.1)
l
l i
i t
l
- __- ..
-- - -
.
.
i Report Details l Engineering l E1 Conduct of Engineering The licensee identified that the Quad Cities Nuclear Power Station, Units 1 and 2, turbine buildings (TB), reactor buildings (RB), and service buildings (SB) contained redundant trains of equipment and cables which lacked the fire protection features necessary to satisfy 10 CFR Part 50, Appendix R, Section Ill.G.2. As a result, the licensee's post-fire safe shutdown methodology relied on an alternative shutdown capability which required the main control room to be evacuated and the plant shut down remotely (per the requirements of Section Ill.G.3 and Ill.L) for ten reiatively large fire areas, which essentially comprised the entire power block of both unit Three fire areas, that represented a significant portion of the plant risk due to fire, were initially selected by the inspection team from the licensee's safe shutdown analysis (SSA) for review. The fire areas selected were TB-lli (TB, Unit 1 side), TB-Il (TB, common area), and SB-l (control room complex). The latter two were selected because they required concurrent shutdown of both units from outside the main control roo During the first week of onsite inspection, the primary emphasis was placed on reviewing TB-lll, with a secondary emphasis on SB-l. When the team retumed for the second onsite week, the focus was totally directed towards fire area TB-f E Systems Reouired to Achieve and Maintain Post-Fire Safe Shutdown Caoability Insp3ction Scope The inspection team reviewed the licensee's post-fire safe shutdown methods to determine if the systems defined for use to achieve and maintain safe shutdown conditions satisfied the requirements of 10 CFR Part 50, Appendix R, Section Il Observations and Findings Section Ill.L requires that the systems used to achieve post-fire safe shutdown be capable of:
Achieving and maintaining cold shutdown reactivity conditions (K, < 0.99 and reactor temperature less than or equal to 200* F);
- Maintaining water level above the top of active fuel;
Providing direct readings to perform and control the above functions;
Providing process cooling, lubrication, and other support functions necessary to permit operation of the equipment used to achieve safe shutdown;
Maintaining reactor system process variables within those predicted for loss of normal AC power; and
Maintaining fission product integrit .. . _ .
-- - _ _ _ - _ - _ _ _ _ - _ _ - _ _ _ _ - - - _ _ - _ _ _
.
i Reactivity Control Function l The inspectors determined that this function was accomplished for both units by the l
'~
hydraulic insertion of control rods resulting from a manual reactor scram initiated by the
. operators arming and depressing the manual scram push-buttons for the reactor protection system, located in the main control room. Each unit's reactor could also be manually scrammed from outside of the control room by manually tripping the power to eith( motor-generator se Reactor Pressure and Coolant System inventorv Control -
The licensee's SSA used two methods to provide make up inventory to the reactor, depending on the fire area involved, either the safe shutdown makeup pump (SSMP) or the reactor core isolation cooling (RCIC) system. Both the SSMP and RCIC normally I
took suction from the contaminated condensate storage tank (CCST). If the CCST
>
Inventory was depleted, RCIC suction would be realigned to the suppression pool, while the SSMP would be manually realigned to take suction from the main fire water heade i l- During cooldown, a minimum of one safety relief valve (SRV) was required to operate to ( reduce reactor pressure. Instrument air would be required to operate the valve. After l
'
manual actions were taken to isolate and restore the 125 Vdc power necessary to
. operats the valves, up to four additional electromagnetic relief valves would be available to rapidly reduce reactor pressure. The SSA assumed only two electromagnetic relief -
g valves were available for post-fire safe shutdown.
t Reactor Over-Pressure Protection Funcf00 l- This function was accomplished through the SRV system. Opening the SRVs reduced
! reactor pressure by venting steam directly to the suppression pool. At Quad Cities, j there were 13 SRV's on each unit. All of the SRVs would be available to provide i over-pressure protectio Decav Heat Removal Function l
, The SSA assumed that, during RCIC/ SSMP operation, decay heat was removed from
! - the reactor through the SRVs, using the suppression pool as a heat sink. The
! suppression pool was cooled using the residual heat removal (RHR) suppression pool L cooling mode (hot shutdown) or the RHR shutdown cooling mode of operation (cold shutdown). Both modes required operation of the RHR service water (RHRSW) system to transfer the decay heat from the suppression pool to the ultimate heat sin l Plant Monitorina and Instrumentation Function j in Information Notice (IN) 84-09 " Lessons Learned from NRC Inspections of Fire Protection Safe Shutdown Systems," the NRC identified the minimum instrumentation considered necessary to achieve safe shutdown for boiling water reactors, such as Quad Cities. These were: reactor vessel water level and pressure, suppression pool
- _ - _ __- _--
-- - . - - - - . - _ - - - _ _
.
- \
l I
.
.
l l level and temperature, level Indication for all tanks used, as well as any diagnostic Instrumentation for shutdown systems required for operability. In the event of fire in
,
TB-Il or SB-1, the 120 Vac distribution system could not be assured to be available, due
!
to the possibility of fire damage. Therefore, the licensee's SSA assumed that all instrumentation readings were monitored locally, for both unit Safe Shutdown Sunoort Functions Support functions either removed heat or supplied power to the process systems l performing the shutdown functions of reactivity control, reactor coolant makeup, reactor
! depressurization and heat removal. For example, the RHRSW system removed heat from the suppression pool during the suppression pool cooling mode and removed heat from the reactor loop through the RHR heat exchanger during the shutdown cooling I mode. The diesel generator cooling water pumps provided water for equipment cooling I through the appropriate room coolers for the RHR and RCIC systems. Fire water provided the cooling water for the SSMP room cooler. Electrical power was supplied by the station blackout (SBO) diesel generators to the various components through the AC i and DC distribution systems. Quad Cities had two battery powered DC systems,125 and 250 Vdc. The 250 Vdc system provided power for the RCIC auxiliaries and the 125 Vdc system provided power for breaker control during post fire safe shutdow Further discussion of support systems vulnerabilities is provided in Section E Co,iciusions l The team concluded that the licensee adequately defined the systems needed to achieve and maintain post-fire safe shutdown conditions.
t E1.2 Seoaration of Safe Shutdown Functions As described above, the licensee developed an altemative shutdown capability for all of the fire areas evaluated. Therefore, the adequacy of separation provided for redundant trains of shutdown functions for compliance with Section Ill.G.2 was not specifically
,
reviewed. Section E1.4 evaluates, on a limited basis, the adequacy of separation and protection provided for components and equipment whose fire-induced spurious l operation could adversely affect the post-fire safe shutdown capability E1.3 Alternative Post-Fire Safe Shutdown l- Insoection Scone
.
- To assess the attemative shutdown methodology developed by the licensee, the
! '
inspection team performed a comprehensive evaluation of fire area TB-ll.' This area l was selected because redundant trains of equipment required to achieve and maintain safe shutdown conditions in both units were susceptible to fire damage. As a result, a
. fire in this area was postulated by the licensee to force operators of both units to l abandon the main control room and accomplish post-fire shutdown activities at local
!' control stations throughout the plan !
'
_
-__--_ _ _ - _ _ .
. .
Additionally, a sample of required safe shutdown equipment was selected for detailed evaluation. The objectvt of this evaluation was to ensure that the equipment design, layout, and post-fire safe . shutdown analytical approach satisfied the Appendix R reactor performance criteria for safe shutdown from outside the control roo This review was done to evaluate the thoroughness of the licensee's efforts following the May 8 exit meeting and the May 1?. management meeting where the licensee committed to perform a revalidation of its SSA against its defined acceptance criteri j l Observations and Findinas l Potential for Extended SBO Condition As described in Section E1.4 below, the 125 Vdc control power distribution system was l not shown to be free of fire damage in fire areas TB-ll or TB-Ill. When 125 Vdc power i was not avai'able at the 4160 Vac switchgear, the automatic fault current interrupting capabiiity of circuit breakers associated with the affected switchgear would not operat Specific switchgear that would be affected included: switchgear buses 11,12,13,13-1, 14,14-1,- 22,24, and 24-1. In addition,4 kV power cables associated with these switchgear, with the exception of switengear 22, were also vulnerable to damage as a result of a fire in TB-Il or TB-lll. The licensee, in performing its SSA did not demonstrate that these power cables were not routed in close proximity with 125 Vdc control cables nor did it confirm that the cables did not share a common, unprotected, cable tray. This i resulted in the licensee having to assume that a fire in TB-Il or TB-lli damaged both the )
4160 Vac power cables and the 125 Vdc control cables of switchgear required for post-fire safe shutdown. The SSA credited the operation of protective devices located uostream of the required 4 kV power sources, and implementation of manual operator actions, as necessary, to clear faults and restore powe The SSA noted that switchgear 14 and 24 were supplied from the normal (off-site) ;
source of power and would be used to power the altemative shutdown capability l provided for TB-ll and TB-Ill, as long as off-site power remained available. Since circuit breaker coordination would not exist when 125 Vdc power was lost, and power cables of both buses were vulnerable to damage as a result of fire, the licensee relied on ground fault protection provided for the unit auxiliary transformers (UAT) and reserve auxiliary transformers (RAT) to trip the upstream 345 kV circuit breakers located in the switchyard. As a result, fiie-induced faults on load cables of the affected switchgear would create a SBO condition in battl units for an extended period of time. Tc restore
! power, operators would have to manually align the electrical distribution system to the desired configuration and isolate, start, and load the SBO diesel generators. The
. inspection team's review of the licensee's time line analysis for the TB-Il fire area determined that the SBO could last between 40 to 60 minutes. The inspectors were concemed that this scenario did not meet the requirements of Section Ill.L.7 in that the safe shutdown equipment was not known to be isolated from fire-induced faults. This is considered part of an unresolved item (50-254/265/98011-01a(DRS)), pending licensee justification of why this configuration was acceptable.
l 9 L
l L .
p.
i
! .
l The RAT and UAT ground fault protection credited in the licensee's SSA as a means of
!
protecting switchgear 14 required completion of modifications (installation of a l three-hour raceway fire barrier) necessary to protect RAT and UAT current transformer
- cables, which were vulnerable to fire damage in TB-Il Potential for a Fire-induced Loss of 125 Vdc Control Power to Create Conditions That Could Adverselv Affect the Ability to Extinaulsh Fire and Achieve Safe Shutdown t ConditiQn j
!
l-l Appendix R, Section Ill.L.3 requires the altemative shutdown capability to be capable of accommodating post-fire conditions where offsite power is not available for 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> The emergency diesel generators (EDGs) were designed to stad and load in response l to a sensed undervoltage condition on the 4160 Vac buses. The licensee did not take 1 l credit for the EDGs during a TB-ll fire, because the EDGs were not protected from fire l L damagei However, there was nothing to prevent the EDGs from stading if a loss of l offsito power occurred during an Appendix R fire, The inspection team determined that the EDGs might continue to run for approximately i
'
40 minutes before the operators took action to manually trip the EDG output breaker Since the 125 Vdc control cables and 4160 Vac power cables were not shown to be free of fire damage, a fault could propagate such that the EDG output breaker would not trip.
, Thus the EDG would continue supplying the damaged 4160 Vac power cables located in l TB-II. This condition had the potential to e ? ate secondary fires outside the original fire l affected area, as well as impacting the ability of the fire brigade to extinguish the fire and l the ability of the operators to implement the alternative shutdown proc dures, due to the i
! effect of faulted 4160 Vac cables in unknown locations of the original fir l f
I In response to the inspection team's observations, the licensee performed a ca!culation which focused on determining the maximum fault current that might be experienced by 1 connected cables and equipment. Based on this calculation, the licensee determined -l l that the fault current would be limited by the supply capability of the EDG to a value that I was within the capacity of the switchgear and EDG output breaker. Additionally, since operator actions were credited for tripping the EDG output breaker, the licensee !
[ concluded that the postulated scenario, while possible, would have no impact on the .
'
operators' ability to achieve safe shutdown. Since the fault current calculations were not -
specifically reviewed by the inspection team, the licensee prepared a position paper, ;
describing its evaluation of this scenario on post-fire safe shutdown capability. The
,_
inspection team reviewed the position paper and determined that it was narrowly l focused on assessing the abliity of switchgear and circuit breakers to withstand the potential fault current and did not adequately consider the potential impact such a fire scenario might have on the post-fire safe shutdown capability. Specifically, the evaluation did not address: (a) the impact that faulted 4160 Vac cables in unknown
! locations of TB-ll might have on the fire brigade's abdity to extinguish the fire; (b) the potential for secondary fires, to occur in areas other than the bus duct, switchgear and cable and the impact this additional fire may have on the safe shutdown capability; (c) the effect that a corresponding degraded bus voltage condition (i.e., reduced voltage resulting from the faulted condition) would have on the operability of shutdown loads
_ _ - _ _ _ - _ - _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ . - _ _ _ _ _ _ _ _ _ - _ _ _ _
---____-__ - _-_______- - - -___- - _-_ - -
l .
! .
that might have been automatically loaded onto the faulted bus; or (d) the length of time before shutdown procedures directed operators to trip the EDG output breaker. This is
. considered part of an unresolved item regarding the licensee's compliance with Appendix R (50-254/265/98011-01b(DRS)).
. Potential for Loss of 120 Vac Instrumentation Power The vulnerebmty of the 120 Vac distribution system to loss due to fire was not evaluated by the licensee and operation of this system was not credited in the SSA. The loss of the 120 Vac distribution system would cause a loss of vital instrumentation normally available in the main concol room for both units. This loss of vital instrumentation would prevent the operators from being able to monitor the plant status from the main control room. Therefore, the SSA assumed that operators would abandon the main control room and implement an altemative shutdown strategy for turbine building fires. The inspection team considered this approach to be weak in that it increased the complexity of the operators' response to even relatively minor turbine building fires.
,
CCST Freeze Protection For safe shutdown from outside the main control room, the licensee used the CCST to
! provide a source of water to RCIC and the SSMP for makeup to the reactor. Since the CCST was an above ground tank, it contained electrically powered heaters for freeze
,
protection. The inspection team questionev why these heaters were not included in the SSA equipment lists. The licensee produced calculation QDC-3300-M-0110 " Heat Transfer Calculation for the A&B CCSTs," Rev. O, January 25,1996, which justified why freeze protection was not required over the post-fire safe shutdown t;n e frame of 72 hrs. The inspection team found that the calculation supported not requiring the CCST heaters for 171 hours0.00198 days <br />0.0475 hours <br />2.827381e-4 weeks <br />6.50655e-5 months <br />. The team considered this acceptsbic, as it was well beyond the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> time line established for Appendix Time line Analvsis
,
The licensee was asked to provide the time line analysis that supported implementation of the post-fire safe shutdown procedures. The team was specifically concemed that the licensee was relying on only four operators to impbment the post-fire safe shutdown from outside the main control room, given the time constraints in the SSA. Initially, the
_
licensee provided two calculations, GENE-B13-01933-01, " Quad Cities 10 CFR 50 l:
'
Appendix R 3afe Shutdown RPV Level Calculation," Rev.1, March 6,1998, which established the basis for the 31-minute injection requirement, and BSA-O-97-05, " Quad Cities 10 CFR 50 Appendix R Safe Shutdown Torus Temperature and Level Calculation," Rev.1, March 6,1998, which showed that suppression pool temperature would not exceed design bases requirements when torus cooling was established within three hours.' After reviewing the documentation, the inspection team and the licensee
'
discussed the applicability of the boundary conditions, specifically how one stuck open SRV for ten minutes became the bounding transient for Appendix R fire scenario Responses to team questions indicated that the possibility of a stuck open main steam isolation valve (MSIV) or the impact of multiple SRVs opening was not analyzed.- The
l l
- _ _ -
-
.
.
licensee stated that multiple SRVs were not analyzed, since one spurious operation was used as the basis for all safe shutdown analyses. The licensee could not demonstrate how it determined that one stuck open SRV was its bounding fire-induced transient, or the technical basis for this conclusion. This is further discussed in Section E For the case of a stuck open MSIV, the team had two concerns: 1) condenser overpressure; and 2) the impact on time to reach top of active fuel, Jue to the increased steaming rate of the larger MSIV opening. Specifically, the team was concerned that a stuck open MSIV could impact the 31-minute injection tinieline established by the licensee's calculations. In subsequent dialogue 'with the licensee, the inspection team leamed that the main condenser had a 40 percent load rejection capability, which would be sufficient to prevent main condenser overpresore. The team also determined that automatic actions were being credited for timely closure of the MSIVs and proper operation of the turbine control and bypass valves by the turbine electro-hydraulic control system and that the shutdown procedures did not address the immediate confirmation that the MSIVs were close Generic Letter (GL) 86-10 " Implementation of Fire Protection Requirements,"
Question 5.3.10, provided the 'IRC's guidance regarding plant transients that should be considered in the design of an altemate shutdown system. This guidance specified that the shutdown capability should not be adversely affected by a fire which results in the loss of all automatic function (i.e. logic, signals) in conjunction with one worst case spurious signal or actuation resulting from a fire. However, at Quad Cities, credit for automatic actuations were taken in the part of time line analysis for the thermal hydraulic response of the plant. This is part of an unresolved item (URI 50-254/265-98011-01c(DRS)), pending licensee review and justification as to why crediting automatic actions to ensure closure of the MSIVs was acceptabl Heating. Ventilation and Air Conditioning Heating, ventilation and air conditioning (HVAC) to both unit's battery chargers and DC panel rooms would be lost due to a loss of offsite power. The HVAC was not loaded on the SBO diesel generators that supplied the emergency power during a post-fire safe shutdown. The team reviewed calculation QDC-5700-M-0601," Transient Temperature Analysis of the Battery Charger Rooms With Loss of Ventilation," Rev. O, March 4,1998, which provided the transient temperature analysis of the battery charger rooms with a
'oss of ventilation. This calculation showed a peak temperature of 157'F for Unit 1 and a peak temperature of 147'F for Unit 2. When doors to both rooms were opened at 30 minutes, the temperature in both rooms dropped to 136*F and remained there for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The team then reviewed calculation QDC-8300-E-0602,
" Evaluation of Safety Related Equipment in the Battery Rooms for an Appendix R Event," Rev. O, March 17,1998, which evaluated the operability of the equipment in these rooms for the stated temperature profile over the post-fire safe shutdown time period. This calculation showed that the equipment located in these areas was qualified to operate in the conditions stated. Finally, the team verified that the operator actions to open the room doors within 30 minutes were in the post-fke shutdown procedure _ _ _ _ _ _
l
.
'
t
'
[ x Conclusions The team concluded that the licensee's attemative shutdown capability had a number of significant weaknesses. These included:
.
loss of the 120 Vac power causing loss of control room indication, forcing the l operators to abandon the control room;
.
loss of the 125 Vdc power causing loss of breaker coordination and a dual unit station blackout; I
-
potential for secondary fires that could hamper the ability of the operators to perform the safe shutdown in a timely fashion;
.
not adequately determining the worst case spurious signal or operation; and a crediting automatic actions to ensure MSIV closure.
j t
E1.4 Associated Circuits q i
" Insoection Scooe
, ' Appendix R, Section Ill G.1 requires that structures, systems and components important .
to safe shutdown be provided with fire protection features capable of limiting fire
. damage to ensure one train of systems necessary to achieve and maintain hot
! shutdown conditions remains free of fire damage. Options for providing this level of fire
<
protection are delineated in Section Ill.G.2. Where the protection does not satisfy
- Section Ill.G.2, then Section Ill.G.3 requires that an attemative or dedicated shutdown I capability and its associated circuits be provided that is independent of the cables,
. systems and components in the fire area. For such areas, Section Ill.L.3 specifically 4 requires the attemative or dedicated shutdown capability to be independent (physically and electrically) of the fire area and capable of accommodating both conditions where offsite power is available and where offsite power is not available for 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Additionally, Section Ill.L.7 requires that the safe shutdown equipment and aystems for I each fira area be known to be isolated from associated non-safety circuits in the fire area so that fire-induced faults (i.e., hot shorts, open circuits, and shorts to ground) in
- .
the associated circuits will not prevent the operation of safe shutdown equipment. It j further requires that associated c!rcuits of redundant divisions of shutdown equipment be separated, protected, or isolated from shutdown equipment so that a postulated fire involving associated circuits will not prevent safe shutdow In GL 81-12, " Fire Protection Rule," February 20,1981, and its subsequent clarificaCon on March 22,1982, the NRC provided guidance regarding potential configurations of associated circuits of concem to post-fire safe shutdown capability. NRC provided
, additional information regarding the potential impact o' hrebdud Silurcs in l associated circuits in IN 84-09 " Lessons Leamed from NRC Inspections ci Fira l' Protection Safe Shutdown Systems", IN 85-09 " Isolation Transfer Switches and Post Fire Shutdown Capabilitv; 'N 92-18 " Potential for Loss of Remote Shutdown Capability During a Control Room Fire," and GL 86-10 " Implementation of Fire Protection Requirements." As described in these documents, asmciated circuit configurations of
-
'concem to post-fire safe shutdown included:
_ - _ - _ _- ________-_--______-___-_
[.
I
.
Circuits which shared a common power supply with circuits of equipment required to achieve and maintain safe shutdown;
.
Circuits of equipment whose spurious operation or maloperation might adversely affect the successful accomplishment of safe shutdown functions; or
.
Circuits which shared a common enclosure with cables of equipment required i to achieve and maintain safe shutdown,
!
l The inspection team reviewed the licensee's methods for addressing associated circuits L of concern to ensure that fire-induced failures did not prevent the operation, or cause L the maloperation, of required safe shutdown components or systems, l Observations and Findings l
Common Power Supplies The common power supply associated circuit concem occurs when non-essential equipment shares a common power supply (for example, a switchgear, motor control
- center, or distribution panel) with equipment relied on to perform essential safe l l shutdown functions. In the absence of adequate fire protection features or electrical l coordination of electrical fault interrupting devices, such as circuit breakers, relays or fuses, fire-induced faults on branch or load circuits of a required power suppiy could propagate to cause a trip of a protective device located upstream of the supply, prior to
'
actuation of the individual branch or load protective device. This condition is considered unacceptable as it would result in a loss of electrical power to all safe shutdown loads l powered from the required power suppl Loss of 125 Vdc Control Power to 4160 Vac Switchoear Breakers l
At Quad Cities, in ileu of providing protection features necessary to ensure one train of shutdown systems woud remain free of fire damage, the licensee opted to designate
, these areas as areas requiring an alternative shutdown capability in accordance with the
! criteria of Sections II.D, Ill.G.3 and Ill.L. Electrical power required for the operation of
_
this alternative shutdown capability would normally be supplied to 4160 Vac switchgear buses 13,14,23 and 24 from the normal (off-site) power sources. However, since a fire '
in these areas was postulated to affect both the normal offsite pwer sources and the normal onsite emergency power sources, the licensee credited the use of the SBO diesel generators to power required shutdown loads. The SBO diesel generators, however, were not provided with any automatic start, load, or synchronization capabilit Consequently, a fire in TB-ll or TB-lli would require operators to manually align the electrical distribution system to the desired configuration (i.e., shedding of all non-essential loads and sequential reloading of required equipment) and to manually start and load the SBO diesel generator The licensee postulated that a fire in fire area TB-ll cr TB-Ill caused a loss of 125 Vdc control power to 4160 Vac switchgear that was relied m to power required equipment of
__ -- - - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ - _ _ _ _ _ _ - _-
- _ - - _ _ _ _ _ _ ____-_- ___ __-_-
,
,
both units, because the cables for the 125 Vdc power ran through the fire areas and were not protected from fire damage. As a result, the automatic fault-current interruption capability of circuit breakers associated with the 4160 Vac switchgear would be unavailable. Additionally, a fire in fire areas TB-ll and TB-Ill was postulated to initiate faults on non-essentialload cables connected to the required switchgear. This then l resulted in a fire-induced fault propagating to trip the upstream circuit breakers located 1
[.
l In the switchyard. This created a SBO condition in both units for an extended period of )
time until operators were able to manually align the electrical distribution system to the
]
desired configuration and manually start and load the SBO diesel generators. As J
discussed in Section E1.3, it also created a potential for secondary fires due to l
overloaded and faulted conditions on the EDGs. This in turn would create hazardous l conditions for operators implementing the alternative shutdown capabi;ity as well as for the fire brigade members attempting to extinguish the fir Anoarent Failure to Comolv with SSA Review Criteria l During review of the criteria developed by the licensee to perform its revised SSA, the
'
inspection team noted that the SSA stated in Section 3.1.1: "Per the requirements of 1
,
Appendix R,Section III.L Quad Citi>s satisfies the attemate safe shutdown functions as l l described below...The 125 Vdc system provides power for breaker control and circuit protection." However, the inspection team discovered that a fire in areas TB-Il or TB-Ill 4 could result in a loss of the 125 Vdc control power. Therefore, the team was unable to determine how this acceptance criterion was satisfied. The licensee stated that the
'
criterion was met because the switchyard breakers were protected; however, the inspection team deemed that the switchyard b aakers did not provide breaker control for required safe shutdown buses.
!
Hiah Imoedance Faults A comprehensive evaluation of this item was not performed. However, the licensee stated that the 4160 Vac and 250 Vac power distribution systems were susceptible to
! loss as a result of fire-induced multiple high impedance faults. To mitigate the potential impact a loss of these power sources would have on the ability to accomplish required shutdown functions, the licensee incorporated operator actions into post-fire shutdown procedures which require manually realigning or tripping potentially affected power sources, as necessary to power only those loads required to accomplish post-fire safe shutdown function Fire-induced Spurious Signals
,.
l
!
Fire damage to circuits and cables could adversely affect the post-fire safe shutdown capability by causing equipment to spuriously operate or to operate in an undesired or uncontrolled manner. The inspection team's assessment focused mainly on two areas:
.. The maloperation of required equipment due to fire induced darnage to j associated cabling or instrument sensing lines. Examples included false control l
i
F
,
,
and instrument indications that might be initiated as a result of fire induced grounds, shorts or open circuits in connected cable .
The inadvertent operation of components (shutdown related or non-shutdown related) that could adversely affect the plant's post-fire safe shutdown capabilit Examples include motor-operated valves, pumps, motors, and logic circuitr The fire protection requirements specified by 10 CFR 50.48 require that the fire
- protection program have a means to limit fire damage to structures, systems, and j components important to safety so that the plants safe shutdown capability is assured.
l
'
_ Additionally, Appendix R, Section Ill.G requires that associated non-safety circuits and cables that could prevent operation or cause mal-operation of systems and components important to safe shutdown be provided with a level of fire protection necessary to
_
i ensure such circuits will remain free of fire damage. Acceptable options for providing this level of fire protection are delineated in Section Ill.G.2.
t in GLs 81-12 and 86-10, NRC established that either physical protection from fire (per l Section Ill.G.2), or detailed electrical circuit analyses could be used to demonstrate that fire would not cause equipment to spuriously actuate in a manner that could adversely I
affect the post-fire safe shutdown capability of the plant. While either approach was acceptable, the use of analytical techniques placed greater importance on the assumptions, criteria, and review methodology which formed the basis of the analysis.
I Also in GL 86-10, NRC provided guidance related to identifying non-safety circuits that could prevent the operation or cause maloperation and defined the circuit failures to be considered. Specifically, NRC responded to Question 5.3.1 with the following guidance:
" Sections Ill.G.2 and Ill.L 7 of Appendix R define the circuit failure modes as hot shorts, open circuits, and shorfs to ground. For consideration of spurious actuations, allpossible functional failure states must be evaluated, that is, the component could be energized or de-energized by one or more of the above failure modes (emphasis added). Therefore, valves could fail open or closed; pumps could fail running or not running; electrical distribution breakers could fail open or closed..."
This guidance (1) established that when performing a circuit failure analysis, one or more circuit failure modes (e.g., multiple hot shorts, a hot short combined with a ground
'
? or open circuit etc.) must be considsred when identifying circuits that can prevent the operation or cause the mal-operation of redundant trains of systems necessa,y to achieve and maintain hot shutdown conditions; (2) Indicated that when the circuit
._ , ~ analysis identified circuits which could cause spu aus actuations that may affect the
!
. post-fire safe shutdown capability, they should be considered as circuits required for
.
safe shutdown and be protected in accordance with the separation criteria of Section Ill.G.2; and (3) by the context of the questioq and its answer, presumed that a fire could
. cause mult:ple fire-induced spurious equipment actuation :
.p
_ _____ _ _____-__ _ _ ___ _ _ _ _ _ _ _ _ _____ _____ ___
.
.
l
[ The inspection team found that the licensee's analysis of potential fire-induced spurious equipment operations assumed only one spurious operation to occur as a result of fire in any area, regardless of the number, type, function, or specific location of potentially affected cables and circuit One example discussed with the licensee was evaluation of flow diveicion pathways having two normally-closed motor operated valves connected in series. Control cables of both valves were subject to damage as a result of a single fire, so the inspection team l considered that both valves could spuriously change position, in accordance with GL l 86-10, unless shown by separation, protection, or analysis that such spurious operations would not result from the fire. However, the licensee stated that, when cases such as this were encountered, it assumed that only one of the valves would spuriously change position and that no further evaluation was necessary, unless the valves comprised a high-to-low pressure interfac Potential for Fire to Cause Sourious Ooeration of Multiole Automatic Deoressurization System (ADS) Valves The licensee's SSA was based on demonstrating that a minimum set of systems would i be available to accomplish post-fire safe shutdown functions. As a result, for a fire in l fire crea TB-II, only RCIC was assumed to be available to perform the reactor coolant makeup function. Due to the limited makeup capability of this system, a fire which caused actuations of multiple ADS valves could significantly impact RCIC's ability to ensure the core remained covered. From a review of the SSA and discussions with the licensee, the inspection team determined that the SSA assumed that only one of five ADS valeas would spuriously actuate (open) as a result of fire damage, prior to it being isolated by operator actions. Based on this assumption, the spurious opening of one ADS valve for 10 minutes was assumed to be the worst case spurious actuation that would occur due to a fire in TB-ll and established the 31 minute time-dependent basis for operators to ensure the reactor coolant makeup functio As the basis for its position, the licensee cited a September 16,1988, letter which documented discussions between the licensee and NRC regarding the ADS design basis. In Attachment B to this letter, the licensee documented that, during a July 22, 1988, telephone conference call, the NRC Office of Nuclear Reactor Regulation stated j that when evaluating spurious operations of the ADS, multiple shorts between different j
' cables (i.e., cable-to-cable faults) need not be considered. However, the staff did
~
l
. consider shorts between conductors of a single cable to be a credible event that should be analyze :
To examine the technical basis for the licensee's stated assumption that only one ADS l
valve would spuriously actuate as a result of fire, the inspection team requested the
!
licensee to provide color-coded routing diagrams depicting the routing of ADS va!ve '
control cables located in fire area TB-II. The inspection team reviewed these diagrams l in conjunction with licensee representatives and found that control cables of all five ADS valves were subject to damage as a result of fire in fire area TB-II. Specifically, control cables associated with each valve were found to be routed in very close proximity
.
_________.______.._-_-__m.______..___.__-_____ -_____ _ _ _______. ____ __ _-J
___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - _ - - - _ _ _-_ - -
,
.
(either in the same cable tray or in stacked cable trays) within this area. To determine the specific type of cable faults that would be required to cause spurious actuation of each ADS valve (e.g., cable-to-cable faults or single short within each cable), the schematic control diagram (auto blowdown part 1, drawing 4E-1461) of a typical ADS valve control circuit was examined with the licensee. This evaluation revealed that a conductor-to-conductor hot short within a multiple conductor cable connected to the solenoid of each valve could cause each respective valve to spuriously actuate.
l Specific cables examined during this review included cables 14839 and 1506 Common Enclosure Associated Circuits I At Quad Cities 4160 Vac power cables were routed in a common enclosure (cable tray)
with cables that provided 125 Vdc control power to 4160 Vac switchgear breakers.
,
_ Therefore, a fire which damaged a single cable tray could cause the loss of 125 Vdc
_
control power and also cause a 4160 Vac power cable to be faulted. As described above, the consequences of this scenario on the operators ability to achieve and maintain safe shutdown conditions might be significant and included the potential for secondary fires to be initiated.
l- To evaluate the adequacy of electrical over current protection provided for non-essential cables which were routed in common enclosure with cables of equipment required to achieve and maintain safe shutdown, a sample of ten cables were selected at random for review. No deficiencies were identified as a result of this review, i c Conclusions Based on the above, the inspection team concluded that the licensee's mlysis of associated circuits did not appear to be sufficiently comprehensive to satisfy 10 CFR Part 50, Appendix R, Sections Ill.G and Ill.L. . Of concem was the assumption that only -
'one spurious operation would occur as a result of a fire in any given area, regardless of the number, type or location of affected cables and circuits. The team concluded that l
- this assumption had a significant effect on the time available for operator action, due to multiple ADS valves having cabling in fire area TB-ll. This is considered part of
' unresolved item 50-254/265/98011-01d(DRS).
E1.5 Fire Protection Comoensatorv Measures - Risk Sensitive Plant Areas Based on the results of the licensee's Individual Plant Examination of External Events and the inspection team's findings associated with this inspection, the licensee committed to perform fire watches and enhance fire prevention measures at the statio The incpection team reviewed these compensatory measures to assess their adequac A summary of the fire watches instituted by the licensee follows. The licensee committed to maintain these fire watches for the fire areas specified until resolution of the technicalissues was' achieved. Other compensatory measures and actions the licensee implemented included: enhanced controls over hot work in high risk or vulnerable areas; an enhanced transient combustible control program (red stripe transient combustible exclusion zones) and removal of unnecessary combustibles;
_
__- - __- __-
.
.
additional fire fighting equipment staged near the high risk / vulnerable plant areas; and an interim alternate shutdown method. The inspection team concluded that the licensee's commitment to implement and maintain the compensatory measures reduced the likelihood of a fire that would require the implementation of the interim SSA shutdown methodologie .4 ym: / ' s%}.3 m A % + ;.a., ; x n G Ty %;wWL !b 3y NNLhd $Mi ".' : z & ^.1 s ~.x.l i W De s
.
STATION BLACKOUT CABLE ONCE PER HOUR 13-1,24-1, AND TB-IV RESIDUAL HEAT REMOVAL ONCE PER HOUR RB-1N, RB-1S, RB-2N, RB-2S, TB-l, AND TB-Il VALVE SPURIOUS OPERATION HIGH PRESSURE COOLANT ONCE PER HOUR RB-1N AND RB-2N INJECTION PUMP ROOM PENETRATION SEAL 125 Vdc' ONCE PER HOUR RB-1N, RB-1S, RB 2N, RB-2S, RB-1/2, TB-l, TB-II, TB-Ill, TB-IV, TB-V, 13 1,14-1,23-1,24-1 MULTIPLE SPURIOUS ONCE PER HOUR RB-1N, RB-1S, RB-2N, RB-2S, RB-1/2, TB-1, OPERATIONS $ TB-ll, TB-Ill, TB-IV, TB-V, 13-1,14 1,23-1,24 1 E2 Engineering Support of Facilities and Equipment E Manual Fire Fiahtina Eauioment The inspection team toured all fire areas in the reactor building, turbine building, service building, and SBO diesel building. The inspection team observed the condition, location, and quantity of equipment available to manually suppress a fire in these areas. The inspection team selected fire areas SB-l, TB-ll and TB-Ill for detailed examination. The inspection team noted that the licensee had, as an interim compensatory measure, staged additional manual fire suppression equipment throughout the units to supplement the equipment permanently staged for fire response purposes. The additional equipment included fire hoses, fire extinguishers, foam applicators, and foam. The equipment was well maintained and was available for immediate use. The inspection team concluded that the licensee had sufficient manual fire suppression equipment available and staged in the risk sensitive areas of the plan E2.2 Field Walkdown of Post-Fire Safe Shutdown Caoability a. Insoection Scoce During the onsite inspection, a representative sample of the post fire safe shutdown equipment was observed. The inspection team reviewed the material condition of this equipment and visually checked its availabilit Based on the results of its evaluation of the technical issue, the licensee may add additional fire ar6as to be covered by the once per hour fire watch patro _ _ _ _ _ _ _
-
.
. Observations and Findinas ~
!
I The required post fire safe shutdown equipment appeared to be well maintained inside the plant. Locking devices were in place on equipment identified as requiring them, and ,
'
there was consistency between the plant drawings, and the in-plant operational configuration of safe shutdown equipment. The team verified that the RHR suction isolation valve from the CCST and the RHRSW cross-tie Isolation valves were locked closed, and that the RCIC torus suction isolation valve and the RHR heat exchanger isolation valve were locked open. During the on-site inspection, the licensee was asked if manual stroke tests of motor operated valves (MOVs) used to support safe shutdown were performed on a routine basis. The licensee stated that the surveillance procedure i
! used to periodically perform these tests was not updated to reflect the new SSA and, l
! for example, did not include the RHR torus reject valves. The licensee issued problem i identification form (PlF) Q1998-02268, May 2,1998, to revise the surveillance procedure and to implement steps to ensure that future revisions of the SSA would be captured in the plant surveillance and maintenance procedure Conclusions l The inspection team concluded that the plant equipment being used for post-fire safe l shutdown was in good material condition.
i E2.3 Fixed Fire Sucoression and Detection Systems The inspection team reviewed the licensee's code compliance review to determine the licensee's compliance with the National Fire Protection Association (NFPA) codes. The team also visually inspected the licensee's installed suppression and detection systems in fire areas TB-ll and TB-lll. The inspection team observed that, in general, the
- licensee used the guidance of the NFPA codes for fire detection and fire suppression L
systems. The inspection team noted that the licensee had an evaluation to justify code
, deviations and areas where full suppression and detection were not installed. The team concluded that the licensee's evaluation regarding the adequacy of its fire suppression and detection capability was in accordance with the applicable NFPA code E Emergency Liahting and Communications Insoection Scooe The inspecuon team reviewed the licensee's 8-hour emergency lighting in areas required by 10 CFR Part 50, Appendix, R Section Ill.J, to accomplish safe shutdown
_
conditions. The inspection team performal a walkdown of fire areas TB-ll and TB-ll!
'
and the access / egress routes to the RCIC pumps and observed a blackout test of the SBO diesel building to verify that adequate emergency lighting existe in addition, the inspection team evaluated the adequacy of the radio communication system the plant operators would use to implement the TB-Il post-fire safe shutdown
-
methodolog __ _ __-______________ ________
L
..
. Observations and Findings Emergency Lighting l Tha inspection team noted that the licensee was in the process of instal!ing additional 8-hour emergency lighting units to ensure that adequate lighting existed to accomplish
. the actions required for post-fire safe shutdown. At the time of the inspection, the
!
licensee had installed temporary lighting units to ensure that adequate lighting existe The licensee had a modification planned to install the units on permanent mounts. The team observed that the critical post-fire safe shutdown areas had emergency lighting units in near proximity and that the lights were aimed at the operational activity required l by the shutdown procedure. In addition the inspection team noted that access and egress routes appeared to have adequate emergency lightin [
'
The team observed that the temporary emergency lighting in the SBO diesel room 3 provided adequate lighting to perform safe shutdown activities required in the roo '
Communications For a fire in TB-II, the licensee's SSA assumed that control room evacuation was required and a dual unit shutdown was performed from outside the main control roo Radio communications is relied upon to coordinate the shutdown of both units and for fire fighting and security operations. The licensee indicated that the radios consisted of a number of channels that were routed through a repeater circuit and two 900 MHZ q channels that bypassed the repeater. The licensee stated that the two bypass channels a were used by operations to communicate and coordinate the post-fire safe shutdown operations; however, the fire brigade and security used a repeater channel for emergency services communications. Following questions by the inspection team, the licensee determined that the circuits associated with the radio repeater antenna would be fire damaged. This would result in the loss of radio repeater rendering the security
, and fire brigade radio channelinoperable. The licensee committed to provide a third I (new) bypass channel and evaluate the need for other additional bypass channels by June 12,199 Conclusions The inspection team concluded that the temporary 8-hour emergency lighting units ,
provided adequate lighting coverage to perform the required safe shutdown activities i
. until the permanent emergency lighting units could be installed, l i
L _' Based on the licensee's commitment to add an additional bypass radio channel and to study the need for additional channels, the team concluded that the communication system minimally supported both the dual unit shutdown and fire brigade operation !
l
. . . . . .
. .. .
. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _.
, .. .
I E2.5 Detection and Sucoression of Fires i insoection Scooe The inspection team audited the effects that the revised SSA would have on the technical basis supporting the Appendix R exemptions associated with fire areas TB-ll,
[- TB-lli, and SB-l. The team specifically reviewed whether the fire detection and suppression equipment in fire area TB-Il complied with the requirements of Appendix R, l Section Ill.G.3. The inspection team did not review the acceptability of detection and
- suppression in any other fire area.
L
'
! Observations and Findinas
'
' The inspection team observed that the revised SSA did not affect the technical basis for the exemptions which the NRC had previously granted for the fire areas inspected. The exemptions were for complying with Appendix R, Section Ill.G.2.
p The inspection team noted that, in the revised SSA, the licensee had adopted a Section Ill.G.3 alternate shutdown strategy for fire areas TB-ll and TB-lil. Section Ill.G.3 requires detection and suppression to be installed in the fire area of concem i when attemate shutdown is utilized. The licensee did not have full detection and suppression in fire area TB-ll. The unprotected section of this fire area contained two i.' transformers each with approximately 380 gallons of oil. The licensee had an evaluation which concluded,' based on having full detection and suppression in areas containing safe shutdown equipment and special protection for large hazards, that the lack of area
'
wide detection and suppression was acceptabl The inspection team did not concur with this assessment. During the inspection, the l Inspection team noted that the licensee's response to a fire in TB Il was dependent upon identifying its exact location. The inspection team noted that a transformer oil fire L would be unmitigated by an automatic suppression system. Although this fire may not
.
l' cause immediate damage to safe shutdown equipment, it cculd give o*f a large quantity i
'
of smoke, causing fire detectors in other locations in TB-Il to alarm. The smoke could
! be very heavy and obscure the correct location of the fire. The inspection team noted that failure to properly identify the correct location of a fire could cause the operators to
'
unnecessarily enter safe shutdown procedures and evacuate the control room, causing an additional hazard to the unit, and could delay proper fire brigade response.
L'
. . i
.. : Conclusions
!-
l The inspection team concluded that fire area TB-ll did not appear to have adequate fire E detection and suppression equipment to ensure compliance with Appendix R, Section Ill.G.3. This is part of the unresolved item (URI 50-254/ 265-98011-01e(DRS)). 1
L-
____
.
,
E3 Procedures and Documentation E East-Fire Safe Shutdown and Alternative Safe Shutdown Caoability Procedures Insoection Scoce l The inspection team audited the Quad Cities abnormal response procedures (QCARPs)
used for TB-fl, SB-l, and TB lil. The review focused on ensuring that all required functions for post-fire safe shutdown and the corresponding equipment necessary to perform those functions were included in the procedures. This audit also looked at consistency between the shutdown procedures and other procedure driven activities associated with post-fire safe shutdown, such as fire fighting activitie Observations and Findinos The team identified that QCARPs 0100-01, " Unit 1 Injection With SSMP," Rev. 2, April 22,1998, 0200-01, " Unit 1 injection With RCIC," Rev. 4, May 2,1998, 0500-01,
" Unit 2 Injection With SSMP," Rev. O, April 22,1998, and 0600-01," Unit 2 Injection With RCIC," Rev. O, April 22,1998, contained reverification steps that would have caused the operators to open a breaker they had previously closed. The licensee issued PlF Q1998-02258, May 1,1998, to correct this discrepancy. In QCARPs 0300-01, " Unit 1 Torus & Shutdown Cooling Using Div I RHR," Rev. 4, April 22,1998,0400-01, " Unit 1 Torus & Shutdown Cooling Using Div ll RHR," Rev. 6, April 22,1998,0700-01, " Unit 2 Torus & Shutdown Cooling Using Div I RHR," Rev. O, April 22,1998, and 0800-01,
" Unit 2 Torus & Shutdown Cooling Using Div 11 RHR," Rev. O, April 22,1998, the team discovered that there was not adequate direction for energizing the buses for RHR pump operation during a loss of offsite power. The procedures had steps to verify power to the RHRSW pumps, but not power to the RHR pumps. The licensee issued PlF Q1998-02367, May 7,1998, to include procedural steps to correct this discrepanc In reviewing the pressure suppression piping drawing (Drawing M-34, sheet 1, April 29, 1996), the inspection team noted that in the containment vent & purge piping there was a 24" containment penetration, isolated by two MOVs in series. The SSA did not consider containment isolation as being required for post-fire safe shutdown. Therefore the position of the containment isolation valves was not verified in the QCARPs. Since the SSA required a number of manual operator actions to be performed in the reactor building for post fire shutdown, the team was concerned about the spurious opening of both the inner and outer vent and purge valves, as it would put the drywell atmosphere in direct contact with the reactor building atmosphere. The inspection team expressed concems regarding the possibly of exposing the operators to airborne radiation or hot gases. The licensee's response stated that the creation of a pathway from the primary containment into the reactor building would require two spurious valve operations and that there would be no airborne radiation since there was no fuel cladding damage. In addition, the licensee indicated that whole body cooling units were available to operators performing manual actions in the plant. The inspection team conside ed that the potentiai for the drywell atmosphere to be open to the reactor building could impact the
______ ___
i
.
.
l timely completion of the safe shutdown process. This was considered a weakness associated with the completeness of the SS Conclusions The inspectors concluded that the QCARPs v ere acceptable. However several minor problems with the completeness were identified. Additionally, a weakness regarding the failure to consider containment isolation valve spurious operation was identifie E3.2 Alternative Post-Fire Safe Shutdown Procedure Walkdown and Verification
! Insoec+ ion Sgggg The team performed partial walkdowns of the QCARPs pertaining to fire areas TB-ll,
,
and SB-l with the licensee's operations staff. Areas inspected included the ability to perform required safe shutdown actions in a timely manner and the technical adequacy of the actions sequence to meet predicted plant responses to the In addition, during its self-assessment of the SSA and the post-fire shutdown methodology for TB-ll, the inspection team evaluated the environmental affects a fire in the turbine building (e.g., smoke produced by a hydrocarbon / oil and cable fire) would have on operators performing the required manual shutdown actions in the turbine building as specified by the SSA and the post-fire alternative shutdown procedures.
, Observations and Findings l:
Protective Eauioment
,
Manual manipulation of 4160 Vac and 480 Vac breakers were required operator actions l in the shutdown procedures. If the 125 Vdc system was not available, performance of
! these actions would require donning protective clothing for 4160 Vac breaker closing operations. During the walkdowns, the team verified that protective clothing and other required equipment to perform the required manual actions existed and was readily j available. However, the storage locations for this equipment were not controlled and some of the equipment was being used for non-Appendix R purposes. Additionally,
-
protective equipment was found to be stored in the fire affected area (TB-il). In response to this issue, the licensee issued PlF Q1998-02326, May 5,1998, to provide i separate storage for the control of Appendix R equipment and to extend the currently
-
used Appendix R surveillance requirements to include this equipmen Number of Ooerating Shift Personnel L
'
While reviewing QDC-98-156, April 23,1998, the timed field walkdown validation performod by the licensee, the team found that for QCARPs 0300-01,0400-01, 0700-01, ed 0800-01, credit for additional personnel that were not part of the on shift crew was taken to perform manual operator actions required to maintain hot shutdown (establishing torus cooling in three hours). A similar statement wae contained in the
+
-- _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ _
O l
.
licensee's confirmatory action letter (CAL) closure letter of April 26,1998. Appendix R, l
Section lil L.4 states that the number of operating shift personnel, exclusive of the fire '
brigade, required to achieve and maintain hot shutdown conditions shall be on site at all times. The team brought this issue to the licensee's attention. The licensee issued PIF Q1998-02343 that initiated a revalidation of the procedures for establishing torus cooling. The licensee performed a procedure revalidation using just the on-shift crew prior to second week of the onsite inspection and verified that torus cooling could be initiated in accordance with Appendix R.
'
Procedure Verification i During the second onsite inspection week, additional discussions took place with the I licensee concerning the process amployed in the verification of the procedures, in the procedure verification document (QDC-98-156," Quad Cities Appendix R Procedures (QCARPs) Time Validation," Rev. O, April 23,1998), the acceptance criteria assumed the fire area that numerically contained the most manual actions would be the limiting fire area, regardless of complexity, or lack thereof, of the actions. The inspection team did not consider this assumption to be entirely valid, given the diversity of the manual actions to be performed. For example, establishment of torus cooling required an i operator to manually open/close two large MOVs located on top of the torus, while
'
wearing a cooling unit due to the high temperatures in the area. A second operator, meanwhile, was required to align six 480 V breakers located on two panels in close j proximity to each other in the turbine building in a mild environment. Using the ,
licensee's acceptance criteria, the time to perform the breaker manipulations would be i considered bounding, rather than the more time-consuming valve manipulation under the adverse conditions that would be experienced. The effect of this assumption upon 1 the licensee's ability to meet its safe shutdown time line is discussed in Section E Environmental Considerations l l
Since plant HVAC was not credited in the licensee's SSA, the team reviewed how the l t
environmental effects were factored into the post-fire safe shutdown procedures. Quad Cities administrative procedure (OCAP) 2110-01, Rev.1, the licensee's guidelines for working in heat stress areas, stated that for nsa-routine conditions stay times should not exceed 15 minutes when temperatures were greater than 132*F. QDC-98-059, Rev.1, was used to determine the proper personnel protection requirements for operator manual actions in the torus compartment during post-fire safe shutdown. In reviewing this calculation, the inspection team found that the calculated work time to open MO-1001-34A or B was 29 minutes, given the conditions in that area and the protective equipment required. This 29 minute duration did not support the 18 minute duration determined by the shutdown procedure re-verification for performing the same required action. When asked, the licensee was unable to resolve or explain the reason for the difference. The licensee was also asked about temperature conditions in the RCIC and MSIV rooms, two other potential heat stress areas of the plant accessed for safe shutdown. The licensee produced calculations for these areas showing the temperature in each did not exceed 132' i . _ . _
.
.. .
.. .
._ .
.. _ _ - _ _ _ - _ _ _ - . _ _ _ _ _ . _ _ _
j .
I The inspection team determined that the Quad Cities turbine building was subdivided j into five fire areas. These fire areas were interconnected by an open corridor that ran the entire length of the turbine building on the ground elevation and by three open t stairways which connected the ground floor with the mezzanine and operating floors. If ,
a severe fire were to occur in one of the three lower elevation fire areas (TB-l, TB-II, cr l TB-lll), the post-fire safe shutdown would be accomplished by the operators from J outside the main control room. Smoke produced by a severe fire in TB-Il would quickly I fill the fire area and migrate up the open center stairway, down the open common I l
corridor and up the open stainuays at the north and south ends of the turbine buildin In order to implement the required post-fire safe shutdown actions (e.g., re-align the
- station's electrical power distributions system), operators were required to transverse the north and south stairways and the common corridor. The licensee's SSA and procedures did not address the operators ability to perform these act6ns in a smoke-filled environmen Based on the inspection team's concems, the licensee committed to pre-stage dedicated self contained breathing apparatus for operator use near the access point to the turbine building and at other strategic post-fire safe shutdown locations within the turbine building as an interim measure until long term corrective actions could be instituted.
'
. Conclusions l The inspection team concluded that the QCARPs and CAL closure letter inappropriately
! took credit for non-shift operating personnelin order to maintain hot shutdown. Upon .
l .being brought to the licensee's attention, this apparent non-compliance with Appendix R
.
'
was corrected. Because the licensee was able to show that hot shutdown could be achieved and maintained with only the on-shift crew, no violation occurred. The inspection team also concluded that smoke from a fire could present a hazard to operators implementing post-fire alternative safe shutdown measures in the turbine building and that the licensee's SSA did not adequately consider this hazard.
l E3.3 Adeauacy of SSA / Fire Protection Related Modifications l
( l Insoection Scooe The inspectors reviewed design change package (DCP) 9700401 "RCIC Min Flow Line Change Due to Appendix R" and DCPs 980047 and 980048 "RHR Pump Minimum Flow i Valve."
b. . Observations and Findinas DCP 9700401 "RCIC Min Flow Line Change Due to Anoendix R" The purpose of this modification was to alter the control circuitry of the RCIC minimum flow valve, MO2-1301-60 so that it would automatically open or close whenever the RCIC steam inlet valve MO2-1301-61 opened or closed, in addition, the licensee
-__-_-_-____ . _ - _ _ _ _ ._ ._- -_ - _ _
.
.
Installed several 15 amp fuses in 250 motor control centers to isolate certain portions of the control circuit to prevent a secondary fire caused by overheating of the cable The inspectors were concerned that the modification did not resolve the concern for l damaging the RCIC pump due to a spurious pump start without a discharge path if more
!
'
than one spurious operation occurred. The cables for the RCIC 60 and 61 valves traveled in the same fire areas. In the SB-1, RB-1N, and RB-2N fire areas and in portions of the turbine building, the fire could cause a spurious start of the RCIC pump (opening of the RCIC 61 and 60 valves) and subsequently cause a spurious operation of -
the RCIC 60 valve to close. it would take less than ten minutes to damage the RCIC pump without a discharge path. The inspectors considered that this modification did not i resolve the potential damage to the RCIC pump due to spurious operations of equipment.
l
!
DCPs 9800047 and 9800048 "RHR Pumo Minimum Flow Valves" The purpose of the modifications was to change the configuration of the RHR minimum flow valves, MO-1001-18 A and B, from closed to open during normal operation.
l' Again, the inspectors were concerned that the modification did not correct the potential
!
for damaging the RHR pumps due to spurious operations if more than one spurious operation occurred. A fire could cause a spurious operation of the RHR pumps and subsequently a spurious closure of the RHR minimum flow valve. Conversely, a fire could cause a spurious closure of the RHR minimum flow valve and a subsequent j spurious operation of the RHR pumps. In either case, the RHR pump would be '
- damaged in about two and a half minute _ Conclusions Modifications performed for the RCIC and RHR minimum flow valves did not i appear to correct the potential damage to the RCIC and RHR pumps if multiple spurious operations of equipment occurred. This is considered part of URI 50-254/265/98011-01 E3.4 - Operability and Availability of Post-Fire Safe Shutdown Canability Insoection Scooe In an April 3,1998, letter, the NRC requested additional information concerning the allowable outage times (AOTs) for post fire safe shutdown equipment. On April 24, 1998, the licensee responded and committed to change its 67 day allowed outage for its
.various post-fire safe shutdown methods to 30 days. The inspection team reviewed the licensee's response and the basis for its revised AOT ,
-____--_ _ _ _ _ _ _ _ _ - - - _ _ _ _ _ _ . _ _ _ _ -
.
. Observations and Findinas
.
The inspection team reviewed procedure QCAP 1500-2, " Administrative Technical l Requirements for inoperable Safe Shutdown Equipment," Rev. 6. This procedure
! revision reduced the AOT for the SSMP from 67 days to 30 days. The established AOT, which was previously approved and incorporated in the technical specifications (TS),
was not consistent with the plant's original licensing basis established by the NRC in safety evaluation report " Appendix R to 10 CFR Part 50, items Ill.G and Ill.L,"
December 30,1982. In this report, the NRC identified the need for the licensee to
! establish a TS for the SSMP that was equivalent to that for the RCIC pump in order to assure maximum pump availability. The TS for the RCIC pumps was 14 day Since the SSMP and RCIC had the same post-fire safe shutdown functionality goals to provide reactor water makeup, it appeared that it was the NRC's expectations that the SSMP would have a 14 day AOT in its TS. The licensee's justification for not applying a 14 day AOT to the SSMP was that it was not an emergency cora cooling system (ECCS) function and was comparable to the RHRSW pump, in that both were needed to maintain hot shutdown. The inspection team did not agree with the licensee's justification or their logic fer establishing the AOT for the SSMP. The licensee's
! noted that RCIC also was not an ECCS function and was primarily used in the event the l core was isolated due to the loss of feedwater. With respect to reactor safety (e.g., high pressure reactor water makeup and maintaining the core covered), the Quad Cities SSA, depending on the location of the fire in the plant, relied on either RCIC or the SSMP to establish core cooling during the initial phase of maintaining hot shutdow The RHRSW system was not used to establish initial reactor water makeup or core cooling, but was rather used to maintain long term hot shutdown by removing heat from the torus. Therefore the analogy comparing the SSMP to RHRSW appeared flawe In addition, the inspectors noted that the SSA, in certain fire areas, relied on use of a l portable battery cart in lieu of the station batteries to supply 125 Vdc motive power to the SRVs. Electrical power from the portable batteries was supplied to the SRVs by l performing a cold-shutdown repair to wire in control leads from the battery cart to the l l appropriate SRV cables at the termination cabinet in the reactor building or at the 3-hour 1 fire rated reactcr building / containment penetration. In reviewing procedure QCAP 1500-2, the team could not determine the AOT for the portable batteries, or whether the l battery cart was controlled by an administrative technical requirement (ART.)
. During the mid-inspection exit meeting with licensee management on May 8, the inspection team identified its concerns with QCAP 1500-2, the ATR associated with the SSMP, and the lack of either an AOT or an ATR for the battery cart. In a subsequent meeting on May 13, with NRC Region ill Management, the licensee committad to change the SSMP AOT to 14 days and to incorporate a 14-day AOT for the battery carts into QCAP 1500-2. In addition, the licensee committed to amend their license and revise the applicable plant technical specifications governing the SSM _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ - - _ - __ _ _ - ___ _ - __ _ -_ ____-
.
..
,
'
l Conciralona The Inspection team concluded that the AOTs established for the post-fire safe shutdown systems in procedure QCAP 1500-2, as modified by the licensee's May 13 commitments, should ensure that the non-unit specific post-fire safe shutdown equipment functions will be maintained operable under all unit shutdown and operating i
combination E4 Staff Knowledge and Performance E Post-Fire Safe Shutdown Implementation Staffina
! Insoection Scooe The inspection team reviewed the adequacy of shift manning to determine if th'ere was sufficient staffing to accomplish post-fire safe shutdown operations and adequately man the p; ant fire brigade.
' Observations and Findinas Administrative Policy QAP 0300-03, " Shift Manning," Rev. 26, June 1997, stated that the minimum shift crew for operation of the plant when both reactors were above 212'F was
'
comprised of eighteen individuals. Excluding fire brigade members, this left me unit supervisor (senior reactor operator), who controlled and coordinated each unit's shutdown, and four operators (two licensed reactor operators and two non-licensed operators) to the implement post-fire safe shutdown of a unit. This manning level was also stated in Section 6.2.2 of the SSA. The inspection team confirmed the licensee's time line for fire area TB-ll, taking into account the environmental conditions discussed r
in Section E3.2. The Inspection team's time line resulted in only a one minute margin for satisfying both the 10 and 31-minute time-critical parameters in.the licensee's shutdown procedure. The licensee's margins, per QDC-98-156, were slightly better at two and three minutes, respectivel The team discussed the lack of margin with the licensee. As a result, the licensee committed to augment the on-shift crew with an additional operator. The Inspection
,
. team concluded that this was an adequate compensatory measure until long term -
corrective action to reduce the number of post-fire safe shutdown actions could be implemente Conclusions
- Given the number of time critical operator actions required, the lack of consideration of
. environmental conditions, and other weaknesses in the licensee's SSA, the team concluded that the safe shutdown procedures were marginal. The licensee's commitment to add an additional on-shift operator alleviated the immediate concern until I the licensee could take long term action to reduce the number of post-fire required operator actions.
L 29 l-
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
'
.
l
'
E5 Staff Training and Qualifications E Post-Fire Safe Shutdown Ooerator Trainina The inspection team sampled the licensee's training progran. to determine the adequacy of integrating the safe shutdown required actions into the overall operator training program. The licensee maintained job performance measures (JPMs) for licensed operator training and re-qualification. .The following documents were reviewed, which were relevant to the post-fire safe shutdown QCARPs:
JPM/QCARP-0200-01 inhibit ADS by Pulling Fuses
! JPM/QCARP-0200-01 Manual Start of RCIC L JPM/QCARP-0500-01 Prevent Spurious Actuations - NSO
'
JPM/QCARP-0000-01 Control Room NSO Actions JPM/QCARP-0000-01 Control Room SRO Actions JPM/QCARP-0100-01 31 Minute EO1 Actions
The operator training and qualification tasks were found to be comprehensive and
, reflected the current approved revision of the safe shutdown procedures. The tasks j L covered major steps in the procedures in sufficient detail to ensure the operators had the needed level of understanding. The inspection team did not identify any weaknesses regarding Appendix R operator training and requalification. The team concluded that the training was satisfactor j E7 Quality Assurance in Engineering Activities E7.1 ' Safe Shutdown Analysis Review
- insoection Scone c On April 29,1998, in its CAL closure letter, the licensee stated "The review of the l revised SSA included four key elements: (1) review of the SSA acceptance criteria, (2) a j joint team review of four draft SSA revisions as well as the final SSA, (3) an industry ,
l expert team review and (4) a review by the Onsite Review organization. Additionally the
{
revised SSA was reviewed by a consulting firm (Nexus) and the Plant Operations ..
Review Committee (PORC). Finally, [ Quality and Safety Assessment] Q&SA conducted overviews of the Appendix R Pro %ct and verified that the Project Plan was being
- adhered to and the NRC commitments for this project were being adequately managed."
The inspectors' examined the comments and comment resolution from each of these l review j l
i h
. _ - _ _ - _ - _ _ - _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - - _ _
.
.
b. Observations and Findings Review of the SSA Accentance Criteria The inspectors reviewed the acceptance criteria which were identified in Section 1 of the SSA. The inspectors noted that acceptance criteria identified the applicable sections of l 10 CFR Part 50, Appendix R, as well as identifying the applicable generic information j guidance documents. The inspectors deemed the acceptance criteria to be appropriat However, the inspectors were unable to determine whether the SSA had been
'
compared to the acceptance criteria during the review proces SSA Review bv the Anoendix R Proiect Team -
The draft SSA was prepared and reviewed by both S&L and Comed personnel. Prior to the draft SSA being reviewed by personnel from the onsite review group, the draft SSA was reviewed by a combination of S&L and Comed personnel to ensure the technical ,
adequacy of the SSA. The inspectors reviewed the project instruction, division of j responsibility for the initial review and the final review of the draft SS S&L had prepared a division of responsibility which defined the responsible engineer and commentor for each section of the SSA. Per the project instruction, each commentor was to check his or her sections for completeness and technical adequacy with respect to the acceptance criteria and document their comments. The commentor would then resolve comments with the responsible engineer. The inspectors reviewed I
the comments which were within the text of the draft SSA, and could not determine whether the notes were comments by the commentor or resolution by the responsible engineer. Both the responsible engineer and the commentor signed to state that each section of the SSA was prepared and reviewed according to the project instructio However, the inspectors could not readily determine that an acceptance review of the SSA was performed by the commentors since the documentation did not so indicat The licensee agreed that the acceptance criteria review was in-process and not well documente in addition to the commentors' review, there was a final SSA review prior to its issuance to the licensee. The final review team consisted of responsible engineers and reviewers for each section. The licensee stated that this extra layer of review was to ensure the adequacy of the SSA. However, the inspectors identified one individual, who was designated as the responsible engineer for Section 3.2, that was designated as one of the final reviewers for Section 3. Due to the partial involvement c: the responsible ( engineer in preparing Section 3 of the CSA, it appeared that the review lacked independence bet'Neen the preparation and review phases of the SS Exoert Panel Review of the SSA
,
The inspectors determined that the expert panel reviewed Drafts 2 and 4 of the SS The first expert review team consisted of one Comed engineer and five contractors who (:
l t . - - - - _ _ _ _ _ _ _ _ _ _ - - _ - - - - _ _ - - _ _ - - - _ - - - - - - - _ _ _ _ -_ -
I l
l ,
reviewed Draft 2 of the SSA dated January 9,1998. The review scope included the following:
.
Review of potential unreviewed safety questions identified by the licensee
.
Review of draft SSA revision 2
.
Review of documentation package
.
Review of overall approach taken by the licensee
.
Determination of methods to expedite the current approac Although the expert panel provided written comments, there was no documentation ;
showing how the comments were resolved, other than the revised SSA. In some cases, I the inspectors were unable to identify how the resolution occurre For example, the inspectors noted that the expert panel recommended reviews of emergency lighting requirements and compliance with 10 CFR 50.48(a). However, as 1 documented in Inspection Report 50-254/265-97023, two months later, the inspectors identified in the draft SSA dated March 19,' 1998, that the lighting outside the SBO building was powered by the security diesel generator instead of batteries with eight-hour capacity. This configuration was not in accordance with 10 CFR Part 50, Appendix R, Section Ill.J. -This deficiency was identified to and corrected by the licensee. The licer.see subsequently completed a review of emergency lights on May 5, 199 The expert panel also recommended a review to address conformance with the requirements of 10 CFR 50.48(a). However, the inspectors were unable to confirm that the licensee had performed this recommended review. The licensee stated that this
,
comment was not to suggest performing another compliance review. Instead, the j l
completion of the SSA per the project instruction should have ensured compliance with 10 CFR 50.48(a). The inspectors considered the licensee's resolution to this recommendation to be narrow in scope. The licensee also stated that the comments from the expert panel were communicated to the Appendix R Team. Some resolutions to the comments were discussed verbally between the expert panel leader and the i Appendix R team members. However, the expert panel did not review the licensee's resolutions to ensure their adequac The inspectors also reviewed the comments made by a second expert panel which
[ consisted of the same Comed engineer, three of the five original contractors, and one ,
L additional contractor not previously involved. This expert review was performed on Draft i
!.
'
4 of the SSA dated February 27,1998. Unlike the previous review, there was no review j scope.- However, there was a resolution to each comment / recommendation made by -
j the expert panel. The expert panel identified several technical issues which did not l appear to receive adequate resolution. For example, the expert panel recommended j the manpower level specified in Section 6.2 of the SSA to be verified to be consistent I with IN 91-77, " Shift Staffing at Nuclear Power Plants." The licensee responded to this l recommendation by stating that the manpower requi.nments were in accordance with l
station administrative procedures. However, the licensee still failed to recognize that it ,
'
could not take credit for non-shift personnel to achieve and maintain safe shutdown
l 1
-________ ___ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _
. _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _
.
.
conditions, which specifically included torus cooling operation, until the inspection team again identified the issue (see Section E3.2)
The inspectors concluded that comments from both the expert panel reviews identified areas requiring additional verification and review. However, it did not appear that the i licensee took adequate actions responding to the comment Onsite Review of the SSA After the SSA has been issued to the site, the licensee formed a special onsite review team to review the prepared SSA. The inspectors reviewed QCAP 1500-16," Updating the Fire Protection Reports," Rev. 2, April 12,1998, and comments resulting from the onsite review.
l Step D.3 of QCAP 1500-16 required the fire protection system engineer and Appendix R engineer to review the fire protection report change and the supporting documentation, including other pending changes for cumulative affects of changes. However, this review process did not require review of the changes against the acceptance criteria identified in the SSA or the requirements of 10 CFR Part 50, Appendix R and other regulatory guidance. Therefore, because this was a case where the SSA was completely revised, the review process delineated in QCAP 1500-16 was not sufficien Step D.4 of the procedure required onsite review and approval by the system engineering supervisor for the proposed change to be incorporated into the fire protection report. Additional onsite reviews were assigned by the system engineering supervisor for the review of the SSA. Among the additional reviewers were two senior reactor operators. The inspectors reviewed numerous comments provided by the additional system engineers and operators. However, since they were not familiar with the requirements of 10 CFR Part 50, Appendix R, each individual reviewed the impacts on his or her system as related to the SSA. No special review against the acceptance criteria or the requirements of 10 CFR Part 50, Appendix R was performed. The comments tended to be typographical or to request clarificatio There were eight comments provided by the Appendix R engineer during the onsite review of the SSA. They were of a grammatical and typographical nature. None of the comments identified any deviation or exception of the SSA from the requirements of 10 CFR Part 50, Appendix R. The engineer stated that no deviation was identified since the SSA had been reviewed many times before. The inspection team did not agree with this conclusion, due to the potential non-compliances discussed in Section E Nexus Review of the SSA Following the completion of the second expert panel review, a contractor, Nexus, performed a vertical slice assessment of the draft SSA using NRC inspection modul The inspectors reviewed the scope and comments from this review.
,
L-_.----__________.____________ c
__ _ __ - - - - - - - - - - - - - _ - - _ - - - - - - - - - - - - - - - - - - - _ _ _ _ _ -.______ ___ _____. _______ __ _ _ _________ _ _
.
l The contractor identified nine issues that deviated from a regulation, license commitment or procedure. In addition,23 items were identified where the SSA did not follow NRC guidelines or were technically weak. This review further concluded that ;
some approved calculations, evaluations, and analyses that supported the SSA contained unverified information. The contractor identif:ed several technical issues l which, in the inspectors view, did not appear to receive adequate resolutions.
l The Nexus review identified that an analysis did not include a calculation of time available to mitigate fire-induced damage. Specifically, Calculation NDIT 97-012 "125 Vdc - 4 kV Cable Common Enclosure Concerns for Appendix R, November 26,1997, stated that if a fire were to cause a loss of 125 Vde, the loss would be detected I
immediately. In addition, it stated that the chance of a subsequent 4 kV power cable l l fault occurring before an operator could manually de-energize the 4 kV bus was extremely remote. However, the licensee, in this calculation, did not address the time l needed to manually de-energize the 4 kV bus before the occurrence of a fault upon a ,
I loss of 125 Vdc. The licensee's response to this comment was that the calculation has l been supplemented by another calculation, and the operator would not have to manually !
trip the feed breakers to the main and reserve auxiliary transformer. The licensee verbally explained to the inspector that NDIT 97-012 was r.o longer taken credit for in the SSA and modifications were done to improve the availability of 125 Vdc. Although the licensee no longer took credit for NDIT 97-012, the reference to this calculation was stillin the approved SSA as well as in the compliance matrix for Fire Area TB-II. The licensee initiated PIF Q1998-02611 to document this erro In addition, the Nexus review identified a potential noncompliance concerning a loss of :
safe shutdown power supply due to the loss of 125 Vdc and tho reliance on an upstream l breaker to clear a fault. Furthermore, the contractor also identified the potential to l damage the circuit breaker under a fault condition. The contractor recommended
'
revising the analysis to demonstrate coordination of the 4160 V system to eliminate reliance on the upstream circuit breakers to clear downstream faults. The licensee responded in part that the fault current would be less than the interrupt capability of the breaker. Therefore, the circuit breaker would not be damaged under a fault conditio However, the licensee did not address the concern for a lack of breaker coordination for the 4160 V syste The inspectors concluded that the review by Nexus revealed several vulnerabilities and noncompliance to the requirements of 10 CFR Part 50, Appendix R. However, the licensee's response did not adequately address some recommendation Q&SA Review l The inspectors interviewed a Q&SA staff member who was involved in the developing and reviewing phases of the draft SSA. The individualindicated that the Q&SA review was not an audit but an oversight activity. This in-process Q&SA review recommended a need to have a column in the acceptance criteria matrix for documenting the acceptance review of the SSA against the requirements of 10 CFR 50, Appendix However, the licensee did not take actions for this recommendatio L
. _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _
- -
~
i Conclusions
'
The inspectors concluded that there was insufficient documentation to show that the SSA had been reviewed against its acceptance criteria or Appendix R. Resolutions to recommendations and comments made by various reviewers were sometimes narrow in scope or did not address the comments. There was no documented review of the SSA against the acceptance criteria by any qualified individual except indicated by signatures that such review had been performed. in various reviews conducted, the licensee did not identify any exception or deviation from the acceptance criteria or other regulatory requirement E7.2 Comoliance Matrix for Fire Area TB-Il i i Insoection Scoce During the first week of inspection, the inspection team attempted to ensure that the conditions listed in the CAL had been satisfactorily met. However, the team soon ,
identified several situations where the technical requirements of 10 CFR Part 50, i Appendix R, Sections Ill G.1 and Ill.G.3 were not met, due to the licensee's 1 assumptions regarding the 125Vdc control power system, the number of spunous 1 equipment operations that could occur during a fire, and the use of non-shift personnel to achieve and maintain safe shutdown. Based on these examples, combined with the i deficiencies in the SSA verification process described in Section E7.1, the inspection i team was concerned about the overall quality of the SSA. These concerns were ;
presented to licensee management during a May 8 meeting, and were discussed during i a May 13 restart meeting. During this latter meeting, the licensee committed to specifically review fire area TB-Il against the SSA acceptance criteria and document the results of this review in an auditable for !
I The inspection team reviewed the resulting compliance matrix, NDIT SO40-QH-0534 j
" Safe Shutdown Report Compliance Matrix, Fire Area TB-II," Rev.1, May 18,1998, as !
well as the comments made during the review proces i Observations and Findinos The inspection team noted that the matrix concluded that, for TB-II, Quad Cities was in ;
'
full compliance with Appendix R, although it did note that NRC had " technical disagreements"in the area of 125 Vdc and multiple spurious operations. The compliance matrix did not identify any of the other concerns discussed in Sections E1.3, E1.4 or E2.5 of this repor The inspectors reviewed the licensee's review comments. The comments were made on draft copies of the compliance matrix, and the documentation of resolution consisted of a line through the comment along with the commentors initials. Additionally, each of the four commentors wrote on the comment sheet that all their cornments had been satisfactorily resolved, and signed the document. In some cases, it was possible to tell how the comments were resolved, based on the changes between the original draft and
-
_ . -
.
.
the approved version. However, other comments were not incorporated and there was no documentation available to show exactly how the comments were resolve Discussions with the commentors revealed that comment resolution was done as a collegial process, with some comments being resolved through discussion, without any documentation. For example, one commentor asked "What about smoke?" The comment was resolved through discussion, without any changes made to the documen When asked, the commentor stated that he was assured that the operators would not be in an area where smoke would affect the ability to achieve safe shutdown, and, l therefore, he had no further concems. However, as discussed in Section E3.2, the
'
inspection team considered smoke to be a valid concem. Additionally, as discussed in Section E7.1, the compliance matrix contained a reference to an NDIT that was superseded. Although at least one of the commentors checked each of the NDITs referenced, this incorrect reference was not identifie Conclusions l The inspection team concluded that the compliance matrix did not thoroughly identify or ;
justify areas where full compliance with Appendix R was not achieved. The comment l c process was not entirely auditable, due to comments being verbally discussed without l l written justification as to how they were resolve !
l 1 V. Management Meetings X1 Exit Meeting Summary
'
The inspection team presented the initial inspection results to members of licensee
,
management on May 8,1998, following the first week of inspection. The technical issues were
!
discussed as part of a Quad Cities restart meeting on May 13,1998; correspondence regarding this meeting will be docketed separately. The final conclusions of the inspection were
_ presented in an exit meeting on May 22,1998. The licensee acknowledged the conclusions presente The inspection team reviewed several items that were considered as proprietary. The proposed content of the inspection report in regard to these items was discussed with the licensee and did not impinge upon the proprietary status. The proprietary items were returned.
[
l l
l l
.,.
,
I
_ _ _ - __-__ _ -_ _ _ _ - _ _ _ - _ - - _ . _ _ - - _ _ _ _ _ _ _ - _ - - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _
.
-
)
i PARTIAL LIST OF PERSONS CONTACTED Licensee Personnel I
Comed
]
J. Benjamen, Vice President, Oversite J. Dimmette, Site Vice President D. Helwig, Senior Vice President J. Hosmer, Engineering Vice President O. Kingsley, President, Nuclear Generation Group R. Krich, Vice President, Regulatory Services P. Lawless,6 d Cities Fire Protection Team Liaison W. Pearce, Quad Cities Station Manager S. Perry, BWR Vice President C. Peterson, Regulatory Affairs Manager R. Ryback, Senior BWR Nuclear Licensing Administrator D. Sager, Vice President, Generation Support 2 l G. Stanley, PWR Vice President MidAmerican Enerav Comoany D. Tubbs, Senior Engineer- Nuclear
'
NRG
A. Beach, Regional Administrator, Rlil'
J. Caldwell, Acting Regional Administrator, Rll!2 L. Collins, Resident inspector, Quad Cities 2 M. Dapas, Deputy Director, Division of Reactor Projects (DRP)
L. Marsh, Chief, Plant Systems Branch, Office of Nuclear Reactor Regulation (NRR)
C. Miller, Senior Resident inspector, Quad Cities M. Ring, Chief, Branch 1, DRP K. Selburg, Resident inspector, Quad Cities K. Walton, Resident inspector, Quad Cities
' Attended only May 8,1998, Exit Meeting 2 Attended only May 22,1998, .Ixit Meeting
!
l
_
- _ - _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ - - _ - _ - _ - _ _
, _ _ _ - _ _ _ - _ _ _ _
_ _ _ _ __ _-_ _ _____ _________-_ _ _ - ____ ___,
.
.
ACRONYMS AND INITIALIZATION AC Alternating-current ADS Autoinatic Depressurization System AOT Allowed Outage Time ATR Administrative Technical Requirement l BNL Brookhaven National Laboratory {
CAL Confirmatory Action Letter l CFR Code of Federal Regulations !
Comed Commonwealth Edison
{
CCST Contaminated Condensate Storage Tank DC Direct-current DCP Design Change Package ECCS Emergency Core Cooling System EDG Emergency Diesel Generator GE General Electric GL Genenc Leher HVAC Heating Ventilating and Air Conditioning i JPM Job Performance Measures IN information Notice
.MOV Motor-Operated Valve MSIV Main Steam isolation Valve NFPA National Fire Protection Association l NRC Nuclear Regulatory Commission l OSR On-site Review l PIF Problem Identification Form l PORC Plant Operations Review Committee l QCAP Quad Cities Administrative Procedure QCARP Quad Cities Abnormal Response Procedure Q&SA Quality and Safety Assurance RAT Reserve Auxiliary Transformer RB Reactor Building RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RHRSW Residual Heat Removal Service Water System S&L Sergeant and Lundy SB Service Building SBO Station Black Out SER Safety Evaluation Report SSMP Safe Shutdown Makeup Pump SRV Safety Rel!ef Valve SSA Safe Shutdown Analysis TB Turbine Building UAT Unit Auxiliary Transformer URI Unresolved item i Vac Alternating-current Voltage Vdc Direct-current Voltage h
,
!
l
_ _ _ _ _ _ _ _ - _ - _ - _ - _ _ _ _ _ _ _ - . - _ _ - - - _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ -_ . - _ _ . _ _ _ ._ __
i
.
-
l l
INSPECTION PROCEDURES USED l
64100 Postfire Safe Shutdown, Emergency Lighing and Oil Collection Capability at Operating and Near-term Operating Reactor Facilities 64700 Fire Protection Program
ITEMS OPENED I Ooened 00-254/265-98011-01 URI Justification for: (a) loss of 125 Vdc breaker contm, (b) fire induced failure of non-safe-shutdown equipment; (c) automatic closure of MSIVs; (d) single spurious operation, including effect of ADS failures on the time line; and (e) adequacy of fire detection and suppress!on in firo area TB-I DOCUMENTS ENCLOSED .
l The foliowing documents were reviewed by the inspection team and were determined not to be l controlled in the ilcensee's document control program. Therefore, copies of the occuments are l enclosed with this repor I May 4,1998, Entrance Meeting Slides l
'
May 22,1998, Exit Meeting Slides
..
_
.
_
_
M a
"dj:: s +
y 4P ]]4
_
_
_
_
_
_
, eI?
_
_
_
,4
_
_
_
_
_
_
.
_
-
-
9 P C 9 a
.
-
_
_
_
_
8 t L OL A Qv u
.
.
-
'
a
_
.
.
p Cad
_
w el
.
o l
e n s
s is nui CN ,'
g r t
.
~ &
T ei e a
o,+-
.
S'
e RI s .
,'
a ens
_
,._-
.
'
ms a
m t L p a a
'
e r et i a kc t o d s e in
.
-
r o ,e,
-
n
,
,
..
_
_
_
,
n l
~.
-
,$'
-
l
' _
_
$
aV:. g as ma #e
_
_
.
_
_
_
_
m
_
.
.
_
.
.
_
_
_
PiI r n n O n
s psp
-
o
_
.
_
.
cp f
.
e _o
_
.
.
e ce e n r e t c t i
n d o o iig T
o n t
r n r e _o we o a Pm r
o a d
a r d t o s r y k i n
a e o(
r s c
k s'
e s l N
a s R mM e C e
& t i
C . o g m
E .
.
)d .
.
_
.
,
M a
y P a
})_ z
=
oj,< 9 _.~'^
_
,
'
.
,4 t P
9 Ma a r t
NC
8 d d
e L i
c i
a RA CL u Qp w w
.
N n o a Tu eg OlCa p o d
s m'
n*
A
.
c h
h e e sui Cw n
id e n r t i c ie n e a
l
~ g I s T nS Te e a Rs t a ep a &
m m met
,
,
a co i -
L Me
t a a r in ,-
I^
-
=
b'
-
n d ko
.
_
_
_
a e g r s n ~
e
~
_
_
_
-
r m
_
_
_
_
_
(
M Q ,.
,
5'4
- 9 h
]' g .
j
.
d i -
h Q
Q r n oot
$'
a g
a M_
M M
M M
nf i ol
&
c g ,
M,.
oe
'
i W
'n, E',.
'
t cp
a
'
'
os
'
t bg'
Me 4 S t n h
M d
4, r g
s oI r
d
$
h b
/,
w
-
i e P e h
M E
C t r M'
W'
i nus Co d
"?
h
'M o
=
%
'%
M E
m r i
b'u'
h'
dt l S"
[
N' .
M a cC e
A d
1'
u pL QsA
-
[i da b 8 M'
b'
E h
n 9 C
a e
h d
b I 1 M'
d .
[
e_n M
k'
bs 4
, y
'
-
,@g" j M a
w (,llln[4 i 2 i
['
ng
-
-
~
.
_
] )1S
_
_
.
-
_
_
_
_
_
- l a a m 6, s}4
_
_
_
i
_
_
_
_
_
_
.
-
_
QDNDRC
_
a
_
_
_
,
_
u a Ro e A
_
_
.
,
d
_
_
_
_
_
a
_
i Ccqu u
.
_
_
_ l L
dy
_
.
Cn
_ .
s T me C
-
-
.
_
Cc s is
_
_
_
_
_
i e e h a n ts o l
tip t
i e s ee
_
_
_
e mt f u s s d t c o e
.
r u r o r
_
_
_
Cl e a n - I no
_
_
i o i t n n I
u l e r f o op s t n e
.
_
r
_
.
_
_
.
l r me r
_
-
t e .
.
-
r p a ct i
f a
o o ca
_
.
t a
_
i n n e
.
_
_
_
r t
=
s
_
_
.
-
.
_
_
.
_
_
_
_
_
_
.
_
.
.
.
.
-
_
.
~
_
.
.
_
_
_
_
.
.
-
_
_
_
.
-
_
_
_
.
adi14i(n i
_
_
_
n 3 , m; &l g _
,-
_ 1 j
0
3
0
0 g 0 0 0 0 g
- e s
7 .t eA
.
0 . 0 d wCNCC
-
D io t Ro o a hu s tn Cmu n yio l ee ~ Et e - nr d r . ip o C Tp Sr r a o e a c r u a tr h n st t ae n t e ms e t i odp r m m ds e nof a e e e up r t l md mn aa t t i
.e .
ny e g a r e ~ g e n tt i ev r megi a i ew n l e r t
#
;
KRDP eioh ffd2 a a nhrc i i l t Mc t r .u
.
n Sa r sQ i t ud Cu a i a e l l ha d
.
r iDy v l dL N .p aeu ne l s eor nug C .ar
.
m h t s e e - d . CTBDJPP = i hmliama i a a r L n BL l t t .
=
L eHaRraa l s an moowwC b bwl l o - Fe l e n ee uy r l t e s s r sl s s Em.
_ o l d _ - w _ _ _ . . . . - _ _ _
_ _ ,1 _ _ _ _ i; ..
) iany,A .
_ _ _ _ _ _ d _ _ _ _ _ NQ m . _ _ _ _ -
- - - - -
. _ CCHOFRu _ _ _ _ _ m _ - o Ca . _ - . - o o op mo _a _ . n e r d _ . t p p e n h C C r r e s r i g Ai t _y e r t a h Li e - h t e vi t Cs n e
.
l s i os i v e s c u r o em nm I st i pt e e . cd t t oio nsu p p o r t - _ _ _ _ . _ _ J
---.-----,-.r-- - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
x
>
m $ k O e - er Cn w C/3 N '
L .-.
_ _ _ - - - - _ . . _ S - - - - S P u o r _ . _ o . . - mOHPt u h
- - Dl e u b mh a e r
my s I pmiio F xe g s t i l e a i c n m r y F n a r o s n a P l v B c t e C e a o r h m s r f o a e e s r n n s mge t s O a n s L c e T L I N E l
.
e
- - - -
D , _ _ _
- -
_ _ - _ . _ p e A N _ r s o cc o t i g c o e u c n s o s n n B s i t a t r a s
- - -
s b o e -
-
ul e i l l s
- -
e i s yt c, d P om n a w e R t r in l l O ba ug t e B I e dme E ot n t p o r v o e M br s l e mgh i s ,t a n d
_ _ _ _ _
- - - - -
F - CCC - D H C o r o r o B e n o v Ao n r e r e f i t e D E l
-
n c c r h o ( e t i t e mup S Cc t v e d e n e Ae d i n d i t s d I L Co t a c j e c a a
-
s a G S d e t i o c t b l l l f e N
,
n ie f s Cg o s i s o n r o i r e h u B m3 n t i u t a r t d o A b a mie S e gn s s a u s e s l i w n E t i n e c S b e l pa - l a F o b i I a X l d i t s y
)
E S
!
lllll l (1ll
~
- . - -
- - - - -
iE n sq DRS e e p B r u e e u ve d t ap i u r i a l c o k dmp o e u e r o e e d s I C fn 1 t 2OS u d E e xp Ooo e r MD PE 5p Vt i p p p mr a t d i n RSI Don or o t i i o n a t O G Cs t n i s n s i o n V N B a (S g E BS t t t e r ,O u MB A y
) Bi e d E S a s t
N E t e y r TS S C ar t - - - - - - - - -
.
- - - - -
I mr T I M4 p r a p n r mB E a e e o r
M o ve s e v i o s i e t t e e O P d n e d r t p r .g u D H Y t o l i S s c l u a p o g c mn t i i a s e S g mh e d e s t I C t - i n b u i np a
-
n t l a g r n A l s g e e t t f c d o i i r b l (T onp c i o T a e E n a r c c s i Me c t e i n C e n P t e p r p H s s h i Ac o b r o A i bg L l g i l i h e r T S e m r e s N y t r
) s s G i
s k E a S r e _ _ a s _ _ _ _ . _ _ _ _ _ _
- - _ _
- - - -
_ _ _ _ . . . A Q - C . O - . _ - - - - - c C o p H - t e i o A m r n s R P m u a t o U c o s n i r s M o r R e c a r o A X t d s i l i t r o e n n s a u s d P t c e e d t u r si f i E
/ e d
m p n e R s e ( l i d F q u E O f i e O n c e P d R e d m o M d e A
)
l N C E
_ - _ - - - _ . _ _ T _ _ _ . _ . . _ _ . _ _ _ . _ H i o S e c A . _ _ . . g o l t _ _ h f i o . . l H _ s c . e _ . . _ . _ . _ r - h s n e E . _ . _ p d c . _ . e e c o _ k . _ . r M - f . f o i n i n o r r m e d c o d i n A a n
/
s r p o a t N c e t a r a e d P s t g e t e b E a n d d y R d a l c c F r a ( d s t i o C n O N
)
T
_
- - - - - - -
P N I MM _ _ . o r c r
-
mWF We pa ak Ra l I i u l E n _ Ru _ _ _ _ _ e d i t i _ - _ s r d t p s b c e mo Oe n l e s a c d e wg r a n e a O i k 1 n n a s T pmo l 0 t s s n c s e . _ r g
t o r e i d i z a Rs e H o ve 2
- < v i
e n o t i u s m E R l t 0 1 e in e e d wf i n
ms i
t o e d e d d e p t F _ . .
< d iil s
f n e e r
-
A
0 a i l s u e d ms e u C - y e s n l t T t e dp s O r i o R r i S - _ t _ i _ _ _ - _ z e _ _ _ _ . - . - _ _ m m d - . M
_ _ _ . _ _
- - -
_ _ _ _ _ mDO i S D _ _ . _
- -
_ _ . _ _ _ _ . p e p a e P m Af . _ e s _ f _ c e _ _ _ r e r . _ . r . . i o g . o n _ _ - a . h S _ . c _ . . vs t o i e h e n e e r v u s / di
.
s a t s e L _ _ . . n b d s i c t o . _ _ l _ r e e wn . . d i . _ a n . e p i / s S n Unp U i t h e s a n l d e c g o r e f F f r i t o B a M i r e n ms a e M e P d l y i n s
- A R
t r a r o i n e t e c e s t Y t i a o b l n i s s h y e st d e s m _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _
N R CQ FU I R D A M E AMP C I YERT EOI E
2TT I S
,
E N CS 9G 9 T T 8 I O A T NIO E N - . . _ . _- X I T ,
! : !
_ . _ . . _ _ . P RAI e dt n _ _ _ _ _
- - - - - r - - -
o _ _ v _ _ C CCI Ej RRC de _ . _ _ _ _ _ _ _ _ o o o mmnr P Ep x e c p e e f i o n i s ir t i F E e n e om I _ l t f i _ p p r t a i a E e r c R _ _ l t mQnS . l _ e e c s Me f _ S _ . t a a t t i _ e e Aen v R P r e u E _ _ _ . . E Nws e i l Re h e a l l f v e a e Aa c I e . . i _ wrd v wtt i e s d c Cp mS a t . _ ma z r . i R _ l u i a My i t - o o r d a h t i o o - S F
-
n d e mc l i t r o u I n d e Mt e e l o a i e t S s l a u d b s d b s vd e o K l o - y r e e y u f ANo l
- - -
a yr l l o c a Fi r mw e n n M e R t e v t r e a i o t n m r Rs M a t i v b e c h
/
A n s i s Be t E D r e s p k e h io D
- -
r i l Mgnd o s U e c e d e PE us C l r t m b e r s ub e a l T I i ds h e O
;
d N
- - - - - - .- E v
MImRI e n RsuRRa e e F o p d c e l p d r d up r d d u I r u e u u a i yf o v c e a s c e e c s e c e t e R s a e e i n e s c o or s i f i f i r A E h R t l f e l e e u n ,n e e t c r t r s f e s t u t d o be r r I h u r i n o l a ve e q n S c i t wroo r u a t d o a c d n e r ir e
)r s y i
t e n t i v K wo n n p o p e t m e
/
my i c e s R n y s t r o d o e n i va p a t o E s t e l c s c u c t D m&n s d e a t i o
(
d e U C i s n t t r e i b u c t i o T I t i o n
,n O
N , }}