IR 05000272/1993080

Insp Repts 50-272/93-80 & 50-311/93-80 on 930517-21.No Violations Noted.Major Areas Inspected:Fire Protection/ Prevention Program

ML18100A668
Person / Time
Site:	Salem
Issue date:	09/22/1993
From:	Paolino R, Ruland W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML18100A667	List: IR 05000272/1993080 ML18100A666
References
50-272-93-80, 50-311-93-80, NUDOCS 9310220037
Download: ML18100A668 (44)

Text

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

REPORT NOS:

50-272/93-80 50-311/93-80 DOCKET NOS:

50-272 50-311 LICENSE NOS:

DPR-70 DPR-75 LICENSEE:

Public Service Electric and Gas Company P. 0. Box 236 Hancocks Bridge, New Jersey 08038 FACILITY:

Salem Nuclear Generating Station INSPECTION AT:

Hancocks Bridge, New Jersey INSPECTION DATES:

May 17-21, 1993 INSPECTOR:

(Team Leader)

R:JPao1iru;,Sl':ReaCtr Engineer ES, EB, DRS Other Participants and Contributors to this report include:

R. Bhatia, Reactor Engineer - Region I A. Finkel, Sr. Reactor Engineer - Region I P. Madden, Sr. Fire Protection Engineer - HQ/NRR K. Sullivan, Electrical - Brookhaven National Laboratory/Consultant H. Thomas, Electrical - Brookhaven National Laboratory/Consultant APPROVED BY:

H. Ruland, Chief, E trical Section ngineering Branch, DRS

Date

• EXECUTIVE SUMMARY During the period between May 17 - 21, 1993, and on July 19, 1993, a Nuclear Regulatory Commission (NRC) inspection team conducted a triennial Appendix R inspection at the Salem Nuclear Generating Station to assess the continuing implementation of the Fire Protection/Prevention Program, and to determine the extent and current compliance with

.Section III.G, III.J, and III.L of Appendix R to 10 CFR 5 Using Generic Letter 86-10 as guidance, the team reviewed Salem's one-hour fire barriers and identified installation procedures, installation methods, and installation drawings used to install the one-hour fire barriers that were not consistent with the methods of application used to construct the test specimen. The tests did not substantiate the fire resistive performance of the fire barrier material or properly document the methods used to apply the fire barrier to the test specimen in order to validate the installed configuration at Salem. Other team concerns included qualification tests that were not conducted or controlled by an independent test laboratory, and test specimens that were not subjected to the hose stream tes The team concluded that the Salem engineering and technical support staff had not provided adequate review or controls for installing a qualified one-hour fire barrier syste The NRC Safety Evaluation Report, "Fire Protection Rule - Alternate Safe Shutdown Capability Sections III.G.3 and ill.L of Appendix R to 10 CFR 50 - Salem Generating Station, Units 1 and 2," stated that, "No repairs or modifications are required to effect hot or cold shutdown utilizing the alternate shutdown method." The team noted that the alternate shutdown methodology employed by the licensee in the event of a fire in areas requiring control room evacuation relied on repair activities in order to provide electrical independence from the affected area and restore operability of equipment required to achieve hot shutdown

• conditions. In addition, the licensee's analysis also assumed that there would be a loss of all automatic functions in the event of a fire requiring alternate shutdown. Since automatic r function might not be lost, fire-initiated spurious actuation of these functions could compromise hot shutdown capabilit The team questioned the licensee's interpretation of the Generic Letter 86-10 guidance on spurious actuation. The team was concerned that the licensee analysis might not be sufficiently conservative. Specifically, in the event of a fire, which could potentially affect all unprotected cables and equipment located within the same fire area, the licensee had considered only one spurious actuation to be credibl ii

I_.

Based on the team's review of the licensee's surveillance test records, fire hazards analysis, technical specifications, and applicable licensing amendments, the team concluded that the licensee had an acceptable routine Fire Protection/Prevention Program that was being properly implemented and maintained. The team's review and verification of fire detection instrumentation, control of combustibles and ignition sources, fire department training, drills, and fire audits confirmed that licensee performance in these areas was in accordance with established procedures and instruction An announced fire drill conducted during this inspection and witnessed by team members provided additional evidence of the licensee's readiness and fire fighting capabilitie The team's findings are listed in Attachment C, along with the section of the report in which the items are discusse iii

TABLE OF CONTENTS EXECUTIVE SUMMARY...................................... ii INTRODUCTION....................................... 1 Background....................................... 1 Scope and Objective.................................. 1 Methodology...................................... 1 Interim Actions..................................... 2 Fire Protection/ Prevention Program (64704)....................... 2 Engineering Fire Protection Organization..................... 2 Site personnel fire prevention/control training..................

2 Fire Hazard Analysis................................. 3 Firewatch Program.................................. 4 Combustible Controls................................. 4 Fire Barrier Penetration Seal Inspection Program................

2. 7 Cable/Raceway Appendix R I-hour Fire Barrier Assemblies.........

2.7.1 Kaowool.................................... 6 2.7.2 3M FS-195................................... 7 2.7.3 Interam E-50.................................

10 Fire Surveillance Program.............................

13 Quality Assurance Audits of Fire Protection Program............

2.10 Fire Department Drill................................

2.11 Plant Tour and Inspection of Fire Protection Equipment...........

15 POST-FIRE SAFE SHUTDOWN CAPABILITY...................

15 Systems Required for Safe Shutdown......................

3.1.1 Process Monitoring.............................

3.1.2 Support Systems..............................

16 ALTERNATE SHUTDOWN................................

17 Procedures......................................

4.1.1 Procedure Review

.............................

4.1.2 Procedure Walkdown

...........................

4.1. Procedure Review/Protection for Spurious Signal Initiation of Automatic Functions...........

4.1. Procedure Review/Hot Shutdown Repairs......

4.1.2. 3 Team Observations During Alternate Shutdown Procedure Walkdown...................

21 Hot Shutdown Panel Testing and Surveillance.................

4. 3 Operator Training..................................

iv

• I Table of Contents ASSOCIATED CIRCUITS.................................

5.1 Review of Circuits Associated by Common Power Supply.........

5.1.1 Coordination of Electrical Protective Devices.............

5.1.2 Circuit Breaker and Relay Testing and Maintenance.........

5.1.3 High Impedance Faults..........................

26 Review of the Spurious Signals Associated Circuits Concern........

5.2.1 Isolation of Fire Initiated Spurious Signals/Hot Shutdown Repairs....................................

5.2. Potential for Spurious MOV Operations (Ref: IN 92-18)......................

5.2.2 High Low Pressure Interfaces......................

30 REVIEW OF THE COMMON ELECTRICAL ENCLOSURE CONCERN...

31 REDUNDANT TRAIN SEPARATION.........................

32 UNRESOLVED ITEMS.................................. 32 EXIT MEETING....................................... 32 ATTACHMENT A ATTACHMENT B ATTACHMENT C ATTACHMENT D ATTACHMENT E v INTRODUCTION Background Effective February 17, 1981, the NRC amended its regulation by adding Part 50.48 and Appendix R to 10 CFR 50 to require certain provisions for fire protection in nuclear power plants (Salem Unit 1) licensed to operate before January 1, 1979. Licensees were required to meet the separation requirements of Sections III.G.2., III.G.3., and III.L., or request an exemption in accordance with 10 CFR 50.48. Plants licensed after January 1, 1979 (Salem Unit 2), were subject to requirements similar to 10 CFR 50, Appendix R, as specified in the conditions of their Facility Operating License, commitments made to the NRC, or deviations granted by the NR PSE&G had previously submitted exemption requests to Appendix R in 1981, 1983, 1884, 1985, and 1986. The submittals, dated January 31, 1985 and January 17, 1986, were compilations, clarifications and resubmittals of previous requests based on NRC and PSE&G reviews. The July 15, 1988, submittal represented a complete package and replaced the previous submittals in their entirety. The July 15, 1988, letter requested approval of exemptions from the technical requirements of Section III.G of Appendix R to 10 CPR 50 in fourteen areas. On July 20, 1989, the NRC issued an exemption for Salem Units 1 and 2 from meeting the requirements of 10 CPR 50, Appendix R in thirteen fire areas and allowed the use of non-3-hour fire rated features in 3-hour fire barriers.Section III.G.2 of Appendix R requires that one train of cables and equipment necessary to achieve and maintain safe shutdown be maintained free of fire damage using one of three methods described. If these conditions are not met,Section III.G.3 of Appendix R requires an alternative shutdown capability independent of the fire area of concer.2 Scope and Objective The scope and objective of this inspection was to assess the adequacy of the licensee 's existing Fire Protection/Prevention Program and its implementation; and to evaluate the licensee's current post-fire safe shutdown capability and compliance with 10 CPR 50, Appendix R, Sections III.G (Fire Protection and Safe Shutdown), III.J (Emergency Lighting),

and III.L (Alternate Shutdown) in accordance with Generic Letter GL 86-1.3 Methodology The team reviewed the licensee's existing Fire Protection/Prevention Program and its implementation. The team evaluated the licensee's current post-fire safe shutdown capability and compliance based on:

the ability of the plant to achieve and maintain hot and subsequent cold shutdown conditions from outside the control room in the event of a serious fire,

the adequacy of the licensee's analysis and method of control for the Common Power Supply, Common Enclosure and Spurious Signals associated circuit concerns, and

• conformance of the alternative shutdown methodology implemented by the licensee to that which was approved by the NRC staff and described in the plant's Safety Evaluation Repor.4 Interim Actions In response to the cable raceway fire barrier concerns (see Section 2.7), the licensee instituted hourly fire watch patrols in plant areas where the fire barriers were installed. The team acknowledged that the issues raised concerning the fire barrier systems were generic in natur The remaining unresolved items relating to the Salem alternate shutdown methodology resulted from basic differences in interpretation of Appendix R licensing bases between the team and PSE&G. The team considered these issues as long-term design/interpretation questions that did not pose an immediate safety concer.0 Fire Protection/Prevention Program (64704)

1 Engineering Fire Protection Organization The Nuclear Fire and Safety Manager is responsible for the programmatic aspects of the site protection functions including surveillance procedures, fire pre-plans and technical fire protection system engineering assistance. He also insures that fire fighting personnel are trained in accordance with their regulatory requirement The responsibility for performing the requirements of the fire protection program is delegated to the Senior Nuclear Fire Protection Supervisor. To support the Fire Protection Supervisor in providing fire protection engineering reviews is the Fire Protection Engineer (FPE) from the Systems Analysis Group. This supporting engineering function is responsible for reviewing engineering changes to the sites fire systems, maintaining the Fire Hazards Analysis, the Boundary Evaluations and the Safe Shutdown Analysis. The FPE also provides the design requirements for Appendix A to BTP APCSB 9.5-1, "Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976," dated July 23, 197.2 Site personnel f":are prevention/control training Fire training at the general employee level and fire department personnel level is developed and given by the fire department training supervisor. This training consists of general site fire courses and detailed courses for the fire department personnel. The licensee has established a dedicated fire department for this site. The fire department consists of a 1The parenthetical notation following the paragraph title denotes the NRC inspection procedure that was used by the team in conducting this inspectio minimum of 30 full time fire personnel. Of the 30 fire department personnel, 27 are

.

currently qualified to the site fire requirements with three in training. The team verified that the fire training supervisor maintains a listing of the qualified fire department personnel as described in Site Procedure, "Fire Department Training Program," FP-AP-ZZ-0009(Q). The inspectors verified that the 27 approved fire department personnel have taken all scheduled training as of May 19, 1993. The team also verified that the site fire shift personnel encountered during the inspection were aware of their shift fire system configuration and that they were aware of which items were on the firewatch list for their specific shift. The training supervisor had supplemented the class room training with video training tapes from the* "Fire Emergency Television Network." Using the video fire tape and industry information, the fire training supervisor had developed a wide range of fire training programs that were used in the continuing fire training program for the Fire Department Personne.3 Fire Hazard Analysis The Fire Hazards Analysis (FHA) is maintained in an updated status by the Fire Protection Engineer. For each approved and completed modification a fire analysis is required. If the modification changed the site fire system configuration, the FHA data sheets are update To verify that the system is performing as described, the team reviewed the modification calculations for a dry pipe sprinkler system change in the area of Panel 335 in Containment (No. ISC-2271) and an upgrade modification of a manual C02 system to an automatic transfer system from an existing ionization detector zone to an early warning only system (No. ISC-2160). The team verified that the FHA had been changed to reflect the changes in the fire design and the fire loading values in the affected fire area Modifications that affect the site are required by procedure to be reviewed by the fire protection engineer to determine the effect that the modification may have on the present design configuration. Procedure NC.DE-AP.ZZ-0007 (Q), "Specialty Reviews," described the guidelines that were to be performed by engineering when modifications were performed in accordance with Procedures NC.NA-AP.ZZ-0008 (Q), "Control of Design and Configuration Change, Tests and Experiments," and NC.NA-AP.ZZ-0013 (Q), "Control of temporary Modifications." The team selected three modifications performed in 1992, and two performed in 1993. In each modification package, there was an analysis performed by the fire protection engineering design function. This fire evaluation form, reference procedure NC.NA-AP.ZZ-0008 (Q) and 0013 (Q), was completed by the fire protection engineer. In two of the approved modification design packages the "Fire Hazards Analysis"

. was identified as requiring changes due to the modification. The team verified that the "Fire Hazards Analysis" for the identified fire zones had been changed to reflect the modification design change in the site configuratio *

4 Firewatch Program The site firewatch program is staffed by contract personnel and controlled by the Licensee's Fire Department supervisor. The contract firewatch personnel receive their fire training from their own supervisors under the direction and approval of the licensee's fire training supervisor. Daily watch assignments are made through their supervisors following daily staff meetings with the licensee's fire department supervisors. To assure that firewatch personnel are performing their assigned tasks, management personnel and the licensee's fire department supervisors are required by procedure to verify, on a random shift basis, both the time and location of each individual assigned to the firewatch program. The program for verifying that firewatch personnel complete the assigned watch schedule is described in the following procedures; (1) NFW-AP-001, "Firewatch Post and Personnel Inspectors," (2) NFW-AP-OP-004, "Rove Call-In," and (3) NFW-OP-002, "Firewatch Challenge Procedure." Using the above procedures, the team verified that management was checking their Firewatch personnel on a random shift basis. The team also confirmed that the licensee's Fire Department Supervisors were verifying that the Firewatch personnel was performing their assigned duties as require.5 Combustible Controls Nuclear Department Operational Fire Protection Procedure, NC.NA-AP.ZZ-0025 (Q),

identifies the operational requirements of the Fire Protection Program (FFP) for the Salem and Hope Creek sites. To support the combustible control requirements of Procedure NC.NA-AP.ZZ-0025, a Transient Combustible Worksheet form is required to be completed by the job planners and supervisors when materials are to be introduced into an area. The form contains listings of various types of materials and their estimated heat content valu The planners and supervisors add in the values of the materials, and, if the fire loading of the area is increased, the fire department supervisors (FDS) are notified. The FDS have identified on their site fire area maps the areas where added combustibles are located. This information is also added to the firewatch daily listing for their inspection to insure that the allowable fire loading level was not exceeded. The combustible control program was documented and monitored by both the fire department and firewatch personnel. Based upon the team's procedural review, the action taken by the planners and supervisor was in accordance with the established procedures for controlling combustible material.6 Fire Barrier Penetration Seal Inspection Program Inspections of the fire barrier penetration seals were performed by licensee fire department personnel (FDP) as described in Procedure SC.FP-SV.FBR-0026(Q), "Fire Barrier Penetration Seal Inspection." The licensee procedure specified that ten percent of the fire barrier penetration seals were to be inspected every 18 months. If one failure is identified then another sample of 10% is performed until no failures are identified. The last fire seal inspection was performed on April 1, 1993, and was completed on April 27, 1993. The team reviewed the work order (WO) package (No. 930401171).and determined that detailed

inspection instructions were listed in the WO package for uncovered penetrations and flexible boot covered penetrations. The work order included drawing numbers and document titles for various types of fire barrier penetrations that would be encountered as part of this WO inspection. The team verified that no safety concerns have been identified in the 10%

sample fire barrier penetrations inspected and documented during this WO inspection tas The licensee's review of NRC Information Notice (IN) 88-56, "Potential Problems With Silicone Foam Fire Barrier Penetration Seals," indicated that their installation techniques were not of the type described in the IN. The installation of the Salem silicone foam penetration seals was installed without the use of dams. The team concluded that if voids were formed during the installation process they would have been identified and corrected during the inspection proces.7 Cable/Raceway Appendix R 1-hour Fire Barrier Assemblies To comply with Appendix R to 10 CFR part 50,Section III.G.2.c., the licensee used three types of 1-hour fire resistive barrier systems (Kaowool, 3M FS-195, and 3M "Interam" E-50) to separate safe shutdown function within the same fire area. The Kaowool and the FS-195 systems were installed in the early 1980s and the E50 system was installed in 1991 and 1992. The qualification fire endurance testing documentation was reviewed against the fire endurance acceptance criteria guidance specified by Generic Letter (GL) 86-10. The acceptance criteria established by GL 86-10 is that stated in National Fire Protection Association (NFPA) Standard 251, "Standard Methods of Fire Tests of Building Construction and Materials," Chapter 7, Tests of Nonbearing Walls and Partitions. The NFPA criteria established the temperature rise limits for the unexposed surface of the fire barrier material and the barrier condition after the fire exposure and hose stream test. The acceptable maximum average temperature rise limit established is 250°F above the ambient laboratory air temperature at the start of the test. In addition, this criterion specified that the barrier shall have withstood the fire endurance and hose stream test without passage of flame, of gases hot eriough to ignite cotton waste, or of the hose strea Using this GL 86-10 guidance, the team reviewed the following areas: Fire endurance testing results and qualifications

- Review of internal temperature rise conditions; Cable conditions after being exposed to the test fire; Fire barrier system condition after the fire test; Fire barrier condition after being subjected to the hose stream test; Installation and construction attributes used to build the fire test specimen; Fire barrier configurations tested and the sizes of the raceway bounded by the licensee's fire barrier system qualification documentation; Raceway cable fill, types and construction used in the test specimens; and Physical properties of the fire barrier material teste *

..

'* Fire barrier design and installation ' Review of installation procedures to verify the installation methods used to construct the test specimen are the same as those used to construct the in plant configurations; Review of installation and design drawings; and, QA/QC records of the installation proces.7.1 Kaowool At the Salem Facility, 530 linear feet of the Kaowool fire barrier system was installed. This barrier system was installed on 18 and 24 inch aluminum cable trays. The cable filled in these trays range from 1 % to 40 %.

In support of the design and installation of the Kaowool fire barrier system used at the Salem facility, the licensee provided the team with the following fire test reports:

Underwriters Laboratories (UL), Inc., File R8758 project 78NK5345, dated September 6, 1978, entitled "Report on Cable Raceway Protection Systems Fire Investigation for Babcock and Wilcox of Augusta Georgia."

• Ceramic Fiber Technology, dated October 24, 1978, entitled "Tests for Fire Protection for Complete Fire Engulfment of Cable Trays and Conduits Containing Grouped Electrical Conductors," Charles E. Chaill The September 6, 1978, UL report documented their independent witnessing of the tests documented by Babcock and Wilcox Ceramic Fiber Technology in their October 24, 1978, repor The tested Kaowool system consisted of a 1-inch Kaowool blanket applied over the cables within the cable tray and an additional 2-inches of Kaowool (two 1-inch blankets) wrapped in four foot sections around the trays with overlapping butt joints. Five 18-inch cable tray specimens were tested in a small scale furnace (approximation of the furnace fire box dimensions - 36-inches x 36-inches). The maximum length of the tray exposed to the fire environment was 24 inches (2 feet) and the cable fill ranged from 33-35%. The cable tray construction at Salem is aluminum open ladder type. Of the five conduit/cable tray specimens tested, one aluminum tray configuration (test 3B) was considered to be applicable to Salem. The test acceptance criterion was based on the cables enclosed by the fire barrier system maintaining their circuit integrity during the fire exposure. The results of this test data identified that circuit integrity in the one circuit was lost at 1-hour and 1 minute. The

team noted the cable temperatures exceeded the 250°F delta above ambient air temperature conditions in approximately 22 minutes, and at 60 minutes the cable temperature was approximately 800"F. In the results section of the October 24, 1978, report the team noted one of the observations made was that the Kaowool blanket prevented the oxygen from reaching the cables and that they charred rather than burne From the review of the qualification report, the team identified other fire safety concerns as follows:

The tests were not conducted and controlled by a independent testing laborator *

The tests were small scale and did not bound the cable tray configurations or cable fill conditions installed in the plant. In addition, since the furnace was not considered a full or large scale test furnace, the test did not represent typical fire barrier material installations which would be installed on horizontal and vertical tray runs, cable tray Tee sections, or radial bend In addition, the test specimen was not subjected to a hose stream test. Therefore, the structural barrier integrity from the effects of cooling and eroding have not been evaluate The acceptance criterion of the fire barrier system was based on the circuit integrity monitoring. Cables in all tests exhibited significant signs of fire damage at the conclusion of the fire test.~

The team reviewed the installation details, drawing 248910-A-17702-A, used to install these fire barrier systems. The Kaowool fire barrier material and the design details used to install this material on the plant raceway were found not to be consistent with the methods of application used to construct the test specimen. The application of the 1-inch Kaowool blanket applied over cables within the cable tray, as required by the fire test, appears not be included in the design of these fire barrier systems at Salem. In lieu of installing this blanket over the cables the licensee installed a metal tray cover. The team determined that the thermal fire resistive performance of this alternative Kaowool fire barrier system is, therefore, considered unknown. The qualification of the installed Kaowool fire barrier system is unresolved pending NRC review of licensee evaluation/documentation in support of the installed fire barrier system as a 1-hour fire barrier (URI-272/311-93-80-01).

2.7.2 3M FS-195 The Salem Facility has 14,500 lin~ feet of the 3M FS-195 fire barrier system installe This barrier system was installed on 18 and 24 inch aluminum cable trays, steel conduits (3/4-inch to 5-inch in diameter), and cable air drops. The cable fill in the conduits and cable trays range from 1 % to 40 %.

In support of the design and installation of the FS-195 fire barrier system used at the Salem facility, the licensee provided the. team with the following fire test reports:

3M Company, dated October 31, 1980, entitled "Cable Tray Fire Test Using 3M Fire Barrier System."

• Underwriters Laboratories, Inc., File R10125-1, -2 Project 82NK21937, dated October 19, 1983, entitled "Report on Electrical Circuit Protective Materials Under the Classification Program for Minnesota Mining and Manufacturing Co., of St Paul, Minnesota."

In a letter, dated March 18, 1981, to the licensee, the staff found the use of this 3M FS-195 fire barrier system as providing equivalent or better characteristics to that of Kaowool and, therefore, could provide an acceptable fire barrier for cable trays and cables. The staff did not address this material use on conduits and cable air drops. The staff concluded that the 3M fire barrier system met the requirements of Appendix R to 10 CFR Part 50 and was acceptable. This acceptance was based on the data presented in a October 31, 1980, 3M fire test repor The fire tests documented by this fire test report indicated that these tests were small scale (no furnace dimensions were identified in the report). Since this fire barrier material was installed after the February 17, 1981, effective date of Appendix R, these tests were reviewed against the GL 86-10 fire test acceptance criteri Based on the team's review of the 3M fire test report, several concerns were identified. The following is a summary of these concerns:

The test report was performed at the manufacturers facility and was not under the control of an independent testing laborator *

The furnace temperature control may have not exactly followed the American Society of Testing and Materials (ASTM) Standard El 19 fire test curve requirement *

• '

The drawing identifying the 3M test speci111en was conceptional in scope and no dimensions were identified. This figure identified that the barrier was constructed by placing the cable tray (width and material type unknown) in metal air duct (dimensions and gage of metal unknown) with the tray support in the middle of the duct. The metal duct was then covered with FS-195 (thickness of fire barrier material unknown). The drawing shows a substantial air space around the cable tray installed within the metal duct. The cable tray contained a 40% fill. The team reviewed the installation details, drawings 248909-A-1770-4 and 248911-A-1770-4, to determine if the in-plant configurations replicated the test configuration. The air space around the cable tray, which was indicated by the drawing in the test report was not incorporated into the design of the in-plant configurations. The installation details identify the

sheet metal enclosure around the cable tray with the FS-195 fire barrier materiaI applied to the sheet metal enclosure. In addition, the in-plant configurations used lacing wire in lieu of steel banding to hold the FS-195 material in p~ace. Both the tested assembly and the in-plant configurations used a body reinforcing wire around the exterior of the fire barrier assembly. Since the in-plant configurations did not incorporate the air space around the cable tray as required by the test configuration, the team concluded the thermal fire resistive performance of the in-plant designs to be indeterminate. In addition, this fire barrier material was installed on cable air drops and conduits, which were not addressed by the October 31, 1980, test repor The tests were small scale and did not bound the cable tray configurations, sizes, material construction (i.e., aluminum), cable fills, conduit sizes and fills, and the minimum cable size and diameter of the air drops installed in the plant. In addition, since the furnace was not considered a full or large scale test furnace, the test did not represent typical fire barrier material installations, which would be installed on horizontal and vertical raceway runs, cable tray Tee sections, or radial bend The test specimen was not subjected to a hose stream tes The results of the test report review identified that the metal duct temperature on the unexposed side of the fire barrier material exceeded the 250°F delta above ambient air temperature condition in approximately 30 minutes and at 60 minutes the temperature was at 620° In addition, the licensee provided a UL fire test report, dated October 19, 1983. This report documented the testing of 3M fire barrier assemblies, which utilized CS-195 barrier materia The basic difference between the CS and the FS material is the FS material is foil backed and the CS material is steel backed. During the test UL made the following observations:

"The flaming of the intumescent sheets became heavier and commenced smoking profusely by 10 minutes. The smoking and flaming of the intumescent sheets continued throughout the test. "

"However, within the steel junction box, the cable jacket arid insulation material was heat damaged and the copper conductors were visible. "

System No. 2 (5-inch conduit), "two conductor, No. 16 A WG cables were melted, charred and, in some places, completely missing from the insulated jackets."

In this report, UL classified three fire barrier systems as 1-hour rated. The acceptance criteria used for this classification was the American Nuclear Insurers Standard entitled

"ANI/MAERP Standard Fire Endurance Test Method to Qualify A Protective Envelope For Class lE Electrical Circuits." The team noted that this test standard acceptance criterion allows barrier bum through, the barrier assembly to be breached by the hose stream test, and allows temperatures to exceed the 250°F delta above ambient during the fire test, providing that cable circuit integrity is maintained. This criterion is less conservative than the acceptance criteria guidance provided in GL 86-1 The cable tray assembly classified by UL under this test program had a layer of inrumescent mat 3M Type M20A wrapped around the steel 24-inch cable tray. On the outside of the cable tray a steel frame with nominal 1-1/4 inch channels was constructed. This frame supports the outer layer of 3M CS-195 intumescent fire barrier material and creates an air space around the cable tray. The construction attributes of this cable tray test specimen are not replicated by the in-piant condition The conduit assembly classified by UL under this test program bounds steel conduits 2-inches to 6 inches. The 2-inch assembly, had a minimum of five layers of intumescent mat 3M Type M20A applied around the conduit. This classification. requires that five layers be installed on conduits ranging in size 2-inches to 4 1/2-inches. The 5 and 6-inch conduit sizes require a minimum of two layers of mat fire barrier material. In reviewing the licensee's installation Procedure S-C-1981-DSP-1303, Section 7.0, Installation Procedure -

Cable/Conduits, paragraph 7.5, specifies two layers of fire barrier material to be installed on conduits in general. In addition, the licensee uses this material on cable air drop. The licensee qualification test reports did not test the thermal performance of these configurations. The construction attributes of the conduit test specimen are not replicated by the in-plant condition Since these tests did not substantiate the fire resistive performance of the FS-195 fire barrier systems installed at Salem, the team determined that the results of these tests were not applicabl The team concluded that the fire resistive capability of the "in-plant" installation was indeterminate. The qualification of the installed 3M FS-195 fire barrier system is unresolved pending NRC review of licensee evaluation/documentation in support of the installed configuration as a 1-hour fire barrier (URI-272/311-93-80-02).

2. 7.3 Interam E-50 At Salem, 5,230 linear feet of the 3M Interam E-50 fire barrier system was installed. This barrier system was installed on 18 and 24 inch aluminum cable trays, steel conduits (3/4-inch to 5-inch diameter), junction boxes and cable air drops. The cable fill in the conduits and cable trays range from 12 % to 40%.

• In support of the design and installation of the E-50 fire barrier system used at the Salem facility, the licensee provided the team with the following fire test report:

Twin City Testing Corporation, dated September 1986, entitled "Qualification Fire Tests of the 3M Interam E-50 Series Fire Protection Mat for 1-Hour Rated Electrical Raceways."

These fire barriers were installed at Salem in 1991/1992. The fire endurance testing acceptance guidance of GL 86-10 was not followed in determining the fire resistive characteristics of these barriers. The licensee based the qualification of these fire barriers on the above test report. Acceptance of the report was based on the American Nuclear Insurers (ANI) criteria. The cable tray test specimen was a 24-inch wide aluminum tray installed in the test slab in a horseshoe configuration. The vertical drop into the furnace was 23-inches with the horizontal run of 34-inches. This tray configuration was divided into four segment The first segment consisted of a solid bottom tray which transitions into a ladder back 90° radial bend. This bend transitions into a solid bottom 90° radial bend and then transitions into a vertical ladder back tray segment. Included in this test assembly was an air drop, which dropped straight down from the test slab and entered the tray. One half of cable configuration had a 14% cable fill while the other half had a 40% fill. The second test assembly tested two 5-inch conduits (one steel and one aluminum) and a 10-inch x 10-inch x 6-inch junction box. The conduits were arranged in a horseshoe configuratio Based on the team's review of this report and the test assemblies, several concerns were identified. The following is a summary of these concerns:

The tests did not bound the cable tray, conduit and air drop configurations installed in the plant. In addition, since the furnace was not considered a full or large scale test furnace, the test did not represent typical fire barrier material installations, which would be installed on horizontal and vertical tray runs, cable tray Tee sections, or radial bend The tray configuration tested was not representative of the "in-plant" tray constructio The fire barrier construction details and method of fire barrier application were not documented in the report. The installation procedures included as Appendix E to this test report included multiple installation methods. The fire tests performed as part of this report did not validate all the various installation methods identified in this Appendix. From the test report, it cannot be verified how the fire barrier material was installed on the raceway test specimen The team raised several concerns associated with the technical content of this test repor The report did not follow the reporting format recommended by ASTM E-119 Section X2, Suggested Report Format. This report did not give the details of the structural design of the fire barrier system applied to the raceway; did not provide observations of the exposed face of the fire barrier system at 15 minute intervals (e.g., smoke conditions barrier condition, combustion or flaming conditions of the material during the test); did not provide details on how the test specimen was constructed, including the methods used to apply the fire barrier material to the raceway; and, it didn't include detailed photographs of the assembly being constructed, exposed surface prior to the fire test, exposed surface at the end of the fire endurance test, and the exposed surface before and after the hose stream tes The thermal data indicates the unexposed surface of the fire barrier material as measured on the cable tray side rail surface exceeded the 250°F delta in 50 minutes. Based on the results of this test and applicability with respect to substantiating the fire resistive performance of the E-50 fire barrier systems installed at Salem, the team considered the results to be indeterminate. The qualification of the installed 3M Interam E-50 fire barrier system is unresolved pending NRC review of licensee evaluation/documentation in support of the installed configuration as a 1-hour fire barrier (URI-50-272/311 93-80-03).

In addition, the team reviewed Design Change Request (DCR) 2EC-3050 closeout package, dated January 15, 1992, DCR 3066 closeout package, dated May 22, 1992, and 2EC-3063 closeout package, dated May 22, 1992. This review evaluated the licensee's level of Q/QC for assuring the barriers were being constructed utilizing the construction attributes used to construct the fire barrier test specimen. Since the licensee's test documentation did not establish the fire resistive characteristics or document the methods used to apply the fire barrier material to the test specimen, this review could not verify if the installation instructions and methods of installation for constructing the in-plant configurations and construction techniques replicated the tested raceway fire barrier configuration In response to the indeterminate status of these fire barrier systems, based on the lack of proper qualification testing data substantiating the design of the in-plant fire barrier *system configurations and installations, the licensee instituted hourly fire watch patrols in the plant areas where these fire barrier systems (FS-195 and Interam E-50) were installed. The November 20, 1979, NRC Fire Protection Safety Evaluation found the use of the 1-inch ceramic fiber blanket (Kaowool) to be an acceptable method of providing the 1-hour fire barrier separation for safe shutdow On May 20, 1993, the licensee indicated that the fire barrier manufacturer (3M) had provided the licensee with additional qualification test reports for the Interam E-50 fire barrier system. The licensees provided them to the team for review. However, based on discussions with the licensee the team concluded that the report had not been reviewed and that an engineering evaluation of the qualification tests to verify the applicability to the Salem design and installation of the of the in-plant Interam E-50 configuration had not been

I I

performed. The team determined that in the absence of such engineering evaluation, which substantiated that the in-plant installations were bounded by the test reports and that the construction attributes used to construct the test specimens were applied to the in-plant installations, the qualification of the Interam E-50 fire barrier system remains unresolve.8 Fire Surveillance Program The team reviewed the following fire protection surveillance procedures and test results to determine if the fire equipment met fire system operating requirement *

SC-FP-ST.FS-0006(Q), "Fire Pump Annual Capacity Test"

Sl-FP-ST.FS-0009(Q), "#1 Diesel Fire Pump Operability Test"

Sl-FP-ST.LTS-0039(F), "Self-Contained Battery Powered Emergency Light Test"

SC-FP-PM.FS-0038(Z), "Fire Extinguisher Inspection" Where the test procedure required the reading of a tank gage, the team verified that the readings of the gages were calibrated and within the tolerances required by the procedur The team compared the present test results with the last test data taken on the same equipment to determine if any degradation of the equipment was evident. The test results reviewed indicate that the equipment was operating within the procedure test range toleranc The Salem No. 2 Fire Pump was out of service and being replaced with a new unit. To maintain the fire system in an operating status, fire department personnel cross-tied Salem valve No. 1FP30 and Hope Creek valve No. OKC-V115 so that the Hope Creek fire pumps could provide water to both units. The licensee stated that these two 10 inch line valves would remain opened until the new Salem No. 2 Fire Pump was installed and test verified operable. During the site tour the team verified that the valves were Red Tagged open and inspected each shift by the FD The team reviewed the Surveillance Procedure Sl-FP-ST.LTS-0039 (F) and surveillance records for maintaining the battery powered emergency lighting systems. These records are used to document the operational characteristics of the emergency lighting. The team determined that the lights are functional and the charging status of the battery is indicated, as required. Adequacy of the emergency lighting system to provide the proper illumination for access and egress to areas that also require adequate illumination to allow an operator to perform the required shutdown task was not verified during inspectio.9 Quality Assurance Audits of Fire Protection Program The team reviewed an Annual and a Triennial Audit of the fire protection program. The findings identified in the fire audits have been closed by the Fire Department Supervisor and were acted on in a timely manne *

Triennial Audit No. NQP-92-0480 (September 7 through September 18,992.) The scope of this audit included the following; (1) Fire Protection Surveillance Testing, (2) Installation of Fire Equipment per Referenced NFPA Codes, (3) Condition of Operating Fire Equipment, (4) Fire Training of Fire Department and General Employee Personnel, and (5) Fire Procedure Compliance. The team evaluation of the audit findings indicated there were no safety concerns identified in the audit; however, there were some inconsistencies identified in the fire procedures and pre-fire plans that were identified. These audit finding have been resolve Yearly Audit No. NQP-91-0558 (October 7 through October 30, 1991.) The scope of this audit included the following; (1) Fire Pre-Plans, (2) Work Order Fire Protection Reviews, (3) Observations of Fire Barriers, (4) Combustible Controls, (5) Fire Protection System Equipment, and (6) Hot Work, Fire Impairments and Transient Combustible Permits. The team evaluation of the audit recommendations indicated that there were no safety concerns identified in the audit findings; however, the audit team identified six recommendations none of which affected the operation of the sit.10 Fire Department Drill The team witnessed an announced fire drill on May 20, 1993. The drill scenario was reviewed by the team prior to the fire department starting the drill. The drill was announced clearly by the Salem Unit No. 2 control room personnel. The fire department brigade personnel arrived at the fire drill location within three minutes with the required equipment and support personnel. The team noted that the brigade leader had established good communication between the brigade members and the staff personnel. The fire department staff enhanced the fire scenario by filling the fire area with smoke. The smoke blacked out the fire area and required the brigade to use respirators during the entire fire scenario. The

• fire drill was completed within approximately 20 minutes with all objectives of the drill being meet. The drill was discussed with the brigade members after the fire equipment was returned to a fire ready condition. Observations noted by the team during the drill were also included in the drill review. No major problems were identified with either the performance of the fire brigade members or the equipment used. The results of this drill were documented on a "Drill Deficiency Follow-Up Form," which is described in Procedure ND.FP-AP.ZZ-0008(Q)-2, "Fire Brigade Drill Program."

Based on the team's review of the drill results, overall performance of the fire brigade was acceptable. The drill critique was appropriate in that it allowed all the brigade members to discuss the drill, performance strengths and weaknesses, and reinforced the training objectives of the drill and fire brigade training program.

2.11 Plant Tour and Inspection of Fire Protection Equipment During the inspection, the team walked down accessible vital and non-vital areas of the plant and visually inspected fire protection water system, fire pumps, fire water piping and distribution systems,post indicator valves, hydrants, and contents of fire hose houses. The inspection included area fire detection and alarm systems, automatic and manual fixed suppression systems, interior hose stations, fire brigade equipment lockers, fire barriers, penetration seals and fire doors. The team observed general housekeeping conditions and randomly checked inspection tags on portable fire extinguishers to verify that the required monthly surveillance inspections were performed. Fire extinguishers also were checked for type, location accessibility, and conditions. Additionally, licensee personnel encountered enroute were interviewe No deterioration of fire protection equipment was noted, tank gauges registered full, hoses had recently tested date stamps, battery lights were working and fire fighting clothing were in acceptable condition. The housekeeping and control of combustible material was goo No hot work or significant maintenance activities were observed during the tour. Based on interviews with a sampling of personnel from outside the fire department, the team concluded that licensee personnel were aware of station policy and procedures for fire watches, and reporting requirements and responding to fires. POST-FIRE SAFE SHUTDOWN CAPABILITY Systems Required for Safe Shutdown Appendix R,Section III.L.1 to 10 CPR 50 requires that alternate or dedicated shutdown capability shall, after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, be capable of achieving the following performance goals:

achieve and maintain subcritical reactivity conditions in the reactor

maintain cold shutdown conditions

be capable of maintaining the reactor coolant level within level indication in the pressurizer

provide direct readings of the process variables necessary to perform and control the above functions

provide process cooling, lubrication etc. necessary to permit operation of the equipment used to achieve safe shutdown.

During the achievement of the safe shutdown performance goals outlined above, the reactor coolant system process variables must be maintained within those predicted for a loss of normal ac power, the fission product integrity must not be affected; i.e., no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundar The systems required for safe shutdown of Salem Unit 2 were reviewed during the previous inspection (Ref: NRC Inspection Report 87-29) and found to meet the requirements of Appendix R. The licensee has specified the systems used to achieve safe shutdown, and the team verified that the systems were in us.1.1 Process Monitoring While maintaining the plant in hot shutdown conditions and during the transition to cold shutdown, the operators require process monitoring system support. Section 3.1 notes the alternate shutdown system requirements per 10 CFR 50, Appendix R, Section IIl.L.1. The licensee meets these requirements with the following instrumentation:

• * * * * * *

Pressurizer Level Steam Generator Level Steam Generator Pressure Reactor Coolant System Hot Leg Temperature Reactor Coolant System Cold Leg Temperature Pressurizer Pressure Nuclear Instrumentation Source Range These instruments provide the process monitoring information required to achieve and maintain the reactor coolant makeup, pressure control, and decay heat removal function Additionally, the process monitoring instrumentation supports monitoring natural circulation conditions, core reactivity, RCS subcooling margin, and compliances with Salem technical specifications pressure/temperature and cooldown limits. Therefore, the licensee meets the requirements of Appendix.1.2 Support Systems The systems and equipment used to achieve the safe shutdown functions require numerous miscellaneous supporting functions, such as ac/dc power, lubrication, HV AC, and proress cooling. The support systems are required to maintain acceptable performance of the safe shutdown components. The required safe shutdown support systems include:

• * * * *

Class lE Vital Power distribution system, Station service water system, Component cooling water system, Various plant HY AC systems, and Communications system.

• These support systems adequately satisfy the requirements for providing support to the alternate shutdown syste.0 ALTERNATE SHUTDOWN The team's review of the licensee's abnormal operating procedure concluded that the licensee maintained its alternate shutdown capability in case of fire occurring in the control room, relay room, or ceiling of the 640 V AC switchgear room. The Abnormal Operating procedure has undergone a number change and format change since the last Appendix R inspection. The new number of the abnormal operating procedure, "Control Room Evacuation due to Fire in the Control Room, Relay Room, or Ceiling of the 460/230V Switchgear Room," is S2.0P-AB.CR-0002 Q(R3). The procedure is still written in a sequential manner; however, the two column format of the previous procedure (AOP EV AC-2) is no longer used. The former method of listing contingency actions in columnar format has been woven onto the body of the procedure. The procedure delineates the actions required to achieve cold shutdown. However, timelines for demonstrating the performance of critical operator actions were not available. The licensee has agreed to review this concern. (Refer to Section 4.1.1) Procedures Alternate Shutdown Procedure No. S2.0P-AB.CR-0002 Q, Revision 3, provides instruction to maintain the unit in hot shutdown or proceed to cold shutdown in the event of a fire in the Control Room, Relay Room, or ceiling of the 460V Switchgear Roo The normal shift complement for Unit 2 is comprised of 1 Senior Reactor Operator (SRO), 2 Nuclear Control Operators (NRO) with a reactor license, 2 Equipment Operators, and one Senior Nuclear Shift Supervisor (SNSS). Additional personnel, which will be available include an Equipment Operator with Chemical and Volume Control Experience and an Electrician with knowledge of Diesel Generators. The SNSS, Equipment Operator and Electrician are utilized as needed on both Units 1 and 2 on a shared basi Following a reactor trip and evacuation of the control room, the SNSS would take control of the plant shutdown at Panel 213 (Hot Shutdown Panel) and dispatch operators to the Emergency Diesels, the Aux. Feed Area, the Switchgear rooms, and the Penetration Area.1.1 Procedure Review The alternate shutdown procedure is constructed on a symptom basis to provide the operators with maximum flexibility to select the shutdown components/paths required to achieve safe shutdown.

• The procedure does not include mention of critical time lines to perform safe shutdown operations. This item is unresolved pending NRC review of critical time lines used in evaluating the plant's capability to complete the manual actions that are involved to achieve safe shutdown (URI 272/311-93-80-04).

A previous inspection (IR 87-29) identified repairs, which were being made to make T hot and T cold available at the Hot Shutdown Panel and determined that these repairs were unacceptable. In response to this finding, the licensee installed a modification consisting of key-switches in Panel 1016-2 to switch power to 22 loop Wide Range T hot and T cold (TA14941 and TA 14942) and in Panel 1017-2 to switch power to the 23 loop wide range T hot and T cold (TA 14943 and TA 14944).

The licensee included a consultant's (TERA) Cale #5617-022.2-00KO, dated October 12, 1987, in its safe shutdown analysis, which calculates the time required to achieve cold shutdown. The team determined that achieving cold shutdown in 63. 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, as stated in the calculation, was not possible since a reactor coolant soak time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (as stipulated in the control room evacuation Procedure S2.0P-AB.CR-0002 Q, Revision 3) was not included in the above calculation. In addition, the calculation assumed that hot shutdown can be achieved in four hours, which may require exceeding the plant cooldown rate of*

25°F/HR. Based on these findings, the team was concerned with the plant's ability to achieve cold shutdown in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> as required by Section ill.L of Appendix R. The licensee agreed to review the calculation. The adequacy of the licensee's analysis to demonstrate the achievement of cold shutdown conditions within the time limits specified by Section ill.L of Appendix R (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) remains an unresolved item (URI 272/311-93-80-05).

4.1.2 Procedure Walkdown The team walkdown and verification of the alternate shutdown procedure was performed on July 19, 1993. Prior to the walkdown, the licensee restated its assumptions, which form the basis of its alternate shutdown methodology and presented the team with a document titled

"Appendix R Alternate Shutdown Ground Rules." With regards to the potential spurious equipment operations this document stated:

"Salem's safe shutdown methodology assumes as resulting from the fire: recovery from any one spurious operation of a component or sustained signal and/or loss of all automatic function."

With regard to the spurious equipment operations, Section 5.5, "Associated Circuits," of the Salem Fire Protection Report (DE-PS.ZZ-000l(Q)-A3-SSA) stated that for each shutdown function and path, those components whose spurious operation would adversely impact the particular function and/or path was treated as safe shutdown components. Based on this statement, the team initially assumed that components whose spurious operation could adversely affect the achievement of safe shutdown conditions were provided with a level of protection equivalent to that required by Section III.G.2 of Appendix R. However, from

-*

discussions held with representatives of the licensee at the time of the May 17-21, 1993 inspection, it was learned that the Salem safe shutdown analysis assumed only a single spurious operation as a result of a fire in any area, regardless of the number of unprotected circuits of components whose spurious operation may be adversely impacted. A specific example discussed during the May inspection was the level of protection provided for a parallel pair of valves, such as the Service Water Header Isolation Valves at Salem. In this case, spurious closure of two valves would result in a loss of all Service Water to the three Emergency Diesel Generators (EDGs). For this scenario, the licensee stated that based on its interpretation of GL 86-10, only a single valve could be postulated to close spuriously as a result of fire damage, even though the control circuits for both valves may be damaged by a single fir Additionally, the licensee's analysis also assumes that there will be a loss of all automatic functions in the event of a fire requiring alternate shutdown. Since automatic function may not be lost, fire-initiated spurious actuation of these functions may compromise hot shutdown capabilit For the purpose of the procedure review only, all assumptions, which form the basis of the current methodology were considered to be valid. The overall objective of the procedure walkdown was to review the adequacy of implementation of the existing alternate shutdown methodology as described in Salem Operations Procedure S2.0P-AB.CR-0002 (Q),

Revision 3, dated May 7, 199 The shutdown scenario presented to the'c)perators during the July 19, walk-through was an uncontrolled fire in the control room coincident with a loss of off-site power (LOOP).

Although the licensee's analysis and shutdown methodology assume that only a single spurious operation will occur and that all automatic functions will be lost, the spurious operation of two 2 Service Water header supply valves was imposed and automatic starting of the emergency diesel generators was maintained rather than failing. The operators were informed that the automatic start and loading of the EDGs as a result of the LOOP was successful. Additionally, to field-verify the feasibility of contingency actions described in Attachment No. 2 of the procedure, the operators were informed that Service Water cooling to the operating EDGs was subsequently lost. The objective of postulating this scenario was to allow observation of manual operator actions described in the procedure. In general, operator competence and knowledge of the alternate shutdown procedure were satisfactor.1. Procedure Review/Protection for Spurious Signal Initiation of Automatic Functions The licensee's assumption of the loss of all automatic functions is not conservative. This assumption preempts the possibility for the occurrence, during an Appendix R fire,. of a spurious safety injection signal, containment spray actuation signal, automatic start and loading of an emergency diesel generator, etc. Procedural action for mitigation of undesired or adverse spurious actuation of automatic signal was not included in the* licensee's

procedure. Consequently, while implementing the control room evacuation in response to a fire, the operators could be required to respond to a simultaneous spurious safety injection or containment spray actuation without procedural guidanc The licensee's procedure assumes that the emergency diesel generators will not start automatically on a loss off-site power. Since the procedure is designed to provide operator instructions to respond to the scenario where the emergency diesel generators fail to start, the procedure does not provide instruction to mitigate automatic loading of the emergency diesel generators. Consequently, the operators would have to respond to a fire requiring a control room evacuation using a procedure that does not provide for potential equipment alignmen Upon detection of a postulated loss of service water, the procedure requires operators to shut down the EDGs. This action places the plant in a self-induced Station Blackout (SBO)

condition, which would require the spurious closure of two valves (one in each service water (SW) header). Local verification and manual alignment of all SW valves identified in the procedure was walked down with the operator. Each valve was equipped with a manual hand wheel and was accessible. During the verification of valve alignment; however, the operator failed to remove motive power to the MOVs at the associated MCC as described in the procedure. A failure to isolate electric power to the MOY during an actual fire event could result in the spurious reactuation of a valve after its position had been observed to be in the desired state.

The implementation of these contingency actions (valve position verification at each valve)

takes a considerable time to perform. At the exit meeting, plant operators stated that service water (SW) was reestablished and the EDGs were started in 40 minute The licensee's procedure assumes that an automatic turbine trip will occur from the manual reactor trip. This assumption is contrary to the licensee's methodology of assuming all automatic functions are lost. A licensee representative stated that the assumption that an automatic turbine trip occurs was conservative because the core heat removal rate would be reduced by the automatic turbine trip. Since an uncontrolled cooldown may be a limiting event, and may lead to emptying of the pressurizer and voiding in the reactor vessel, analysis of and protection for spurious signal initiation of an uncontrolled cooldown should be demonstrate.1. Procedure Review/Hot Shutdown Repairs In general, the alternate shutdown methodology implemented at Salem did not include the use of isolation/transfer switch schemes to provide electrical isolation and prevent fire damage to cabling and circuits of components required to achieve safe shutdown. Rather, the licensee relied on the performance of circuit modifications, which require the lifting of leads, replacement of fuses, and installation of jumpers to attain the required degree of electrical isolatio *

The plant operators are also directed to implement similar repair procedure to mitigate the effects of spurious equipment operations. Specific examples of repair activities required by the licensee's procedures are provided in Attachment The actions noted in Attachment D were typical of the repairs required to isolate and control components required for hot shutdown. The repair actions specified by Step 3.9 and many other steps of the Salem alternate shutdown procedure appeared to indicate that the facility was not being operated in compliance with the Safety Evaluation Report related to the Alternate Safe Shutdown Capability of Salem, dated May 31, 1983 (Refer to Section 5.2.1).

4.1. Team Observations During Alternate Shutdown Procedure Walkdown: The time that an emergency diesel may be operated and/or loaded without a service water supply has not been clearly established. During the exit meeting the licensee was requested to provide the results of this analysi A limit on the length of time that seal injection flow can be secured to the reactor coolant pump seals is not identified in the procedur Communications were conducted by use of Gaitronics and sound powered phones rather than using the UHF radio handsets as provided for in the procedure. During the exit meeting, the licensee was requested to provide the results of an analysis, which demonstrates that at least one of the communication systems used (Gaitronics or Sounded-Powered phones) would remain available during control room evacuatio Operators in the field were observed carrying procedures, tools, repair parts, flashlights, etc. Operators may require a means other than their hands to carry all the required items to free their hands to perform the safety functio Emergency lights are not installed in areas where manual valve operations may need to be performed in accordance with the procedur Emergency lights are not installed in the paths used to gain access to Service Water valves required to be manipulated to restore service wate The Hot Shutdown Panel (HSD) operator incorrectly interpreted the logic of Step due to the wording of the step. The purpose of Step 3.2 is to determine if the reactor is tripped not to determine_ if all the Step 3.1 actions were complete. Step 3.1 as currently written may cause an operator to be dispatched unnecessarily to locally trip the reactor when the reactor had already been trippe The procedure does not provide for the contingency actions in the event that the emergency diesel generators automatically start and load on a loss of off-site power.

• 22 Some valve tags for valves used to initiate closure of the main steam isolation valves are small and may be difficult to read under emergency lighting conditio HSD panel operator experienced difficulty communicating with the emergency diesel generator operator. (Work order 930706186 was previously issued to correct the problem) Operators performing repair procedures to allow operation of the safe shutdown components have to obtain the procedure(s), jumpers and fuses from the HSD panel operators, rather than at the locations where the repairs are being performe.

Operator performing attachment 5 was incorrectly given the procedure for operating the 22 Group rather than the 21 Grou Precautions for operating circuit breakers with the control power removed are not provided in the procedure or on the circuit breaker Extra lights added to various battery-powered emergency lighting circuits may cause excessive drain on battery, reducing emergency lighting availabilit Operator performing manual valve operations to restore service water to the emergency diesel generators simulated manual valve operations without simulating removal of power to the valve operator During an in-office review of the procedure following the plant visit, the valve lineup shown in the control room evacuation procedure was compared to flow diagrams contained in the Emergency Equipment Operation Instructions. During this review Step 6 of Attachment 2 of the control room evacuation procedure was found to omit 22 Header Isolation Valve 24SW2 The team provided the above observations for PSE&G evaluation and action as necessar The above items are subject to future NRC inspection.2 Hot Shutdown Panel Testing and Surve~nce Instrumentation provided on the remote shutdown panel was tested monthly as required by Procedure S20P-PT HSD-OOOlQ, Revision 0, Instrumentation - Remote Shutdown Pane This procedure was found to require testing of all instruments associated with channels A, B, C, and Inspection sheets were provided to demonstrate that the referenced instrumentation was tested on a monthly basis. When readings exceeded allowable limits, work orders were initiated to establish corrective action. A sample of work orders was reviewed and found to be implemente Based on the above, the instrumentation available in the event of a fire requiring control room evacuation was acceptabl.3 Operator Training The team reviewed Training Procedure NC.TO-TC.22.0305(Z). This document was the vehicle that was used to ensure that the senior reactor operators and reactor operators have had the prescribed training to meet the requirements of the NRC Examiners Standard (NUREG-1021, ES-603). Each operating shift was required to take the training outlined in this procedure annually and to perform an annual operating test as members of a control room crew. The training consists of classroom/simulator study and self study on the lesson plan The team reviewed training records for a selected shift of operators. These records indicated that training and testing on the control room evacuation Procedure S2.0P-AB-CR-0002(Q)

had been completed in 1991/1992, as required by the training procedure. During the week of the audit the operators were attending requalification training to meet the 1992/1993 requiremen The team concluded that the training program used to maintain operator proficiency in post-fire safe shutdown was satisfactor.0 ASSOCIATED cmcurrs The separation and protection requirements of Appendix R apply not only to circuits of required equipment but also to non-essential, or "associated" circuits that, due to fire damage, could prevent operation or cause maloperation of safe shutdown systems and components. Within the context of Appendix R, the term "fire damage" has been previously defined in Enclosure 1 "Interpretations of Appendix R" of Generic Letter 86-10, as the inability of a structure, system, or component to perform its intended function during and after the postulated fir *

Section m.G and ill.L of Appendix R to 10 CFR 50 require protection for associated non-safety circuits that could prevent operation or cause maloperation of systems necessary to achieve and maintain hot shutdown. Specific guidance describing acceptable methods of protecting the safe shutdown capability from fire induced failures of associated circuits have been promulgated by the NRC in Generic Letters 81-12 and 86-10. As described in Generic Letter 81-12, associated circuits of concern may be categorized into one of three distinct types:

Circuits associated by Common Power Supply (i.e., non-essential circuits, which share a common switchgear, motor control center or distribution panel with circuits of equipment relied on to achieve post-fire safe shutdown)

• Circuits associated by Common Enclosure (i.e., non-essential circuits, which share a common cable tray, conduit, junction box etc. with required circuits).

• Circuits whose Spurious Operation may adversely impact the achievement of a safe shutdown performance goa Due to the unique site specific configurations which may exist, the specific type and level of protection for each case must be based on a detailed engineering evaluation of the potential effect of fire-initiated cable faults on non-essential circuits that may be physically or electrically associated with cables and equipment relied on to achieve post-fire safe shutdown. Since the integrity of insulation and external jacket material for electrical cables is susceptible to fire damage, the safe shutdown analysis must conservatively assume that the functional integrity of cables, which are not provided with an equivalent level of separation and protection required by Appendix R, is lost when exposed to a postulated fire. The specific fault conditions to be considered in the analysis of associated circuits include:

a)

Hot shorts:

b)

Open circuits:

c)

Shorts to ground:

d)

Short circuits:

Energized conductor to non-energized conductor within a multi-conductor cable, or a short of an energized conductor in one cable to a non-energized conductor in another cable located within the same enclosure Separation of conductors resulting in an unusable cable with regard to proper function Short of a conductor to ground through the enclosure Short of a conductor or conductors to other conductors causing a circuit to be momentarily energized such that any seal-in device will change stat During the inspection, the potential effect of fire on each of the associated circuit configurations described above was evaluated on a sample basis. The specific sample of circuits reviewed was selected from the licensee's post-fire safe shutdown analysis and walk-through assessments of critical fire area Review of Circuits Associated by Common Power Supply The common power supply associated circuit concern involves circuits sharing a common source of electrical power (i.e., -switchgear, MCC, distribution panel, etc.) with equipment required to achieve post-fire safe shutdown. In the absence of adequate fire protective features described in Section m.G.2, or an acceptable level of coordination (selective

tripping) between electrical protective devices (i.e., circuit breakers, relays, fuses),

fire-initiated faults on unprotected branch/load circuits may propagate to a trip of the upstream feeder protective device of the power supply resulting in a loss of electrical power to all loads connected to the suppl S.1.1 Coordination of Electrical Protective Devices Selective tripping of electrical protective devices is necessary to ensure that fire initiated faults will be rapidly isolated by the protective device located nearest the fault, prior to the fault current propagating to a trip of any protective device located upstream of the affected power suppl Generally, coordination of protective devices is considered during the initial design of the electrical power system. However, due to a number of variables such as the applicability of assumptions used in the initial analysis with respect to Appendix R concerns, circuit modifications performed since initial construction of the plant, and a lack of administrative controls to maintain the initial design configuration (e.g., fuse replacement and maintenance/surveillance procedures), the initial analysis or "as-built" design may not accurately reflect the current plant configuration or fully satisfy specific concerns with regard to common-mode fire damag A previous Appendix R inspection, conducted during the week of September 14-18, 1987, identified examples of unsatisfactory circuit coordination conditions. As a corrective action, the licensee initiated extensive reviews of its electrical protective device coordination scheme and implemented modification The electrical protection provided for power supplies of equipment relied on to achieve safe shutdown was reviewed by the team on a sample basis. For each case, the licensee demonstrated an acceptable level of selective coordination through the presentation of Time/Current characteristic curves developed during its reevaluation of this concer The team concluded that the coordination/selective tripping capability of power supplies relied on to achieve and maintain safe shutdown satisfied the requirements of Appendix.1.2 Circuit Breaker and Relay Testing and Maintenance Circuit breakers and relays typically have adjustable settings and trip points. The specific values selected for the setting of these devices is largely based on the results of calculations performed during the plants coordination study; An established program consisting of surveillance testing and periodic maintenance is necessary to provide assurance that the selected settings will not drift or vary considerably over the life of the plant.

Salem has developed procedures for the test and maintenance of circuit breakers and relays of vital power supplies. Based on the team's review of these procedures, they appear to provide sufficient instructions to assure the long term maintenance of settings established in the plant's coordination study. Therefore, circuit breaker and relay testing and maintenance was acceptabl.1.3 High Impedance Faults As stated in Section 5.3.8 of Generic Letter 86-10, the NRC staff has determined that to meet the separation criteria of Section m.G, simultaneous high impedance faults (fault currents of a value that is just below the trip point of the protective device on each individual circuit) for all associated circuits located in a given fire area, should be considered in the evaluation of safe shutdown capabilit The Salem post-fire safe shutdown analysis was found to consider the potential effect of fire-induced high impedance faults. As a result of this evaluation the licensee has developed emergency operating procedures, which provide guidance to enable operators to shed non-essential loads from affected power supplies and restore power to required equipment. The team reviewed the licensee's methodology for mitigating the potential effects of fire-initiated high impedance faults and determined it to be acceptabl.2 Review of the Spurious Signals Associated Circuits Concern Within the context of Appendix R, spurious equipment operation is defined as the maloperation of electrical or electro-mechanical components caused by circuits, energized or deenergized, as a result of fire damage. This definition recognizes that electrical cables may be damaged by fire. This cable damage may prevent operation of components required to achieve safe shutdown or may result in maloperation of non-safe shutdown equipment, which may preclude attaining safe shutdow Electro-mechanical equipment includes ac and de motor-operated equipment and solenoid valves. Spurious operations can be expected to occur if fire damage induces the necessary control and/or power conditions in the respective electrical circuits. As described in NRC Generic Letter 81-12, specific circuits of concern include those, which have a physical separation that is less than *that required by Section ill. G of Appendix R and have a connection to equipment whose spurious operation or mal-operation could adversely affect the shutdown capability. This concern is principally comprised of two items: The maloperation of required equipment due to fire-induced damage to associated cabling. Examples include false motor, control, and instrument readings, which may be initiated as a result of fire induced grounds, shorts or open circuit * The spurious operation of safety-related or nonsafety-related equipment that could impact the successful accomplishment of a required safe shutdown function. An example of this concern is the spurious opening of motor-operated valves that would divert RCS coolant flow from the required flow pat In the absence of pre-fire isolation strategies, such as the disabling of MOV power cables, Generic Letter 81-12 lists either a capability that prevents spurious operations or a means to detect spurious operations and then procedures to defeat the maloperation of equipment. The associated circuit analysis should, therefore, demonstrate that all potential spurious actuations due to fire damage to unprotected cables in a given fire area have been evaluated and adequately resolved through either preventive features (e.g., installation of fire wrap on affected cables or electrical isolation from the fire area), or through the performance of post-fire, manual, operator actions, which provide the capability to detect and defeat potential spurious actuations prior to reaching an unrecoverable plant condition (e.g., opening of breakers and manually positioning MOVs). For each fire area the safe shutdown analysis should, therefore, identify potential spurious operation candidates for which resolution is required to protect the safe shutdown capability. From the list of circuits or components that is developed, resolutions to mitigate spurious operation of each device are then developed and implemente From a review of the Salem Fire Protection Report Safe Shutdown Analysis, the team identified a concern related to the licensee's basic assumption with regard to its analysis for spurious signals. Specifically, the team reviewed the Safe Shutdown Analysis description of the potential effect of a postulated fire in Fire Area 2FA-AB-84B, and questioned the description of the potential impact of fire in this area on Service Water system availability (Pgs. 5-214 & 5-215). The analysis stated: "Valves 21SW21 and 22SW21 have eabling located in this area. Valves 21SW21 and 22SW21 are normally open, diesel generator header isolation valves, which must remain open for post-fire shutdown." Per the Generic Letter 86-10 guidelines, only one spurious signal needs to be considere The team questioned the assumptions of the analysis of spurious signals as described in the Salem Safe Shutdown Analysis. The licensee stated that, "it was assumed that unprotected cabling could lead to spurious operation of a component," and that, "only one spurious operation was assumed to occur. " The licensee based this response on their interpretation of GL 86-1 The team stated that while multiple, simultaneous spurious operations of equipment were generally not considered credible, the spurious operation of all circuits within a fire area, which lack the separation and protection requirements of Appendix R should be considered, one at a time, and appropriate mitigating actions taken for each cas *

With regard to the identified specific concern related to the potential effect of fire in Fire Area 2FA-AB-84B on the Service Water cooling supply to the EDG, a detailed review of this area identified that the subject cables were routed in a cable tray that had been wrapped throughout the area for other reasons. Although the subject cables were found to have an acceptable level of protection in this case, this protection was not installed as a result of the licensee's associated circuit analysis. Consequently, the team was concerned that due to the non-conservative assumption, which assumed only one spurious operation per fire regardless of the number or significance of potentially affected circuits, there was a potential that other circuits may not have an acceptable level of protectio During the exit meeting, conducted on May 21, 1993, the team noted that the assumption that only one spurious signal could occur, regardless of the number of unprotected cables of equipment that could spuriously operate as a result of fire in a single fire area, did not meet Appendix R requirements and remains unresolved (URI 272/311-93-80-06).

5.2.1 Isolation of Fire Initiated Spurious Signals/Hot Shutdown Repairs The alternative shutdown design implemented by Salem to achieve and maintain hot shutdown conditions in the event of fire requiring control room evacuation, does not incorporate the use of isolation/transfer switches to provide electrical isolation from the potentially affected fire area(s). Consequently, the alternate shutdown methodology directed operator actions, in this case, repair activities at various switchgear and motor control centers, to isolate the affected circuit(s) and regain control of components required to achieve hot shutdow Procedural guidance for performing the required actions is contained in two large (3-4 ")

binders identified as "Fire Hazard Analysis Emergency Equipment Operations." The team reviewed a typical repair procedure developed to isolate and establish control of motor operated valves in the event of fire requiring control room evacuation. Specifically, charging pump discharge isolation valve to regen HX 1CV68 was selected for review. In summary, specific activities to be performed include:

Removal and replacement of control circuit fuses,

Disconnecting and taping wiring connected to 10 terminals on either side of the terminal block, and

Installing a jumper on terminal block

• As discussed in Generic Letter 81-12, repairs or modifications may not be credited in assuming hot shutdown system availability. Each of the above actions constitutes a repair activity as defined by NRC guidance documents. Additionally, the Safety Evaluation Report related to the alternate safe shutdown capability of Salem, dated May 31, 1983, states: "No repairs or modifications are required to effect hot or cold shutdown utilizing hot or cold shutdown methods." The need to perform repairs to achieve hot shutdown conditions from outside the main control room was identified during a walkdown of the licensee's alternate shutdown procedures conducted during the previous Appendix R inspection (September 1987)

and documented as an unresolved ite Based on the above, the team questioned the acceptability of performing the required hot-shutdown repair actions. The licensee stated that the actions did not constitute repairs, and maintained that, in any event, the required activities were reviewed and accepted by NRR in its Safety Evaluation Reports. The team requested the licensee to provide copies of the historical background information related to this issue. This review identified the sequence of events provided in Attachment The acceptability of licensee reliance on local operator actions such as fuse removal, wiring modifications, and jumper installation to achieve post-fire hot shutdown from outside the control room is unresolved (URI 272/311-93-80-07).

5.2. Potential for Spurious MOV Operations (Ref: IN 92-18)

As discussed above,Section III.G of Appendix R requires that protection be provided for fire initiated faults on circuits that could adversely impact the achievement and maintenance of stable safe shutdown conditions. Additionally, Appendix R safe shutdown criteria require a minimum set of equipment to remain free of fire damage (operable) in the event of fire in areas requiring control room evacuatio NRC Information Notice (IN) 92-18, "Potential for Loss of Remote Shutdown Capability During a Control Room Fire," alerted licensees of the potential for a fire requiring control room evacuation to cause a single hot short in the control circuitry of various motor-operated-valves (MOVs) that could result in a spurious valve actuation and subsequent loss of valve operability. Specifically, since the postulated control circuit fault would cause the position limit and torque switches of the affected valve to be bypassed, mechanical damage of the valve due to overtorque could occur, thereby rendering it inoperabl Based on the above, the team requested the licensee to provide its evaluation of the MOV spurious operation concerns described in IN 92-18. In response, the licensee provided an internal memorandum, dated May 7, 1993, From: W. M. McDevitt Sr. Staff Engineer, To: P.E. Stinhauer, Engineering Assessment Supervisor, Subject: "Review of Information Notice 92-18, "Potential For Loss of Remote Shutdown Capability During A Control Room Fire."

• The stated purpose of this memorandum was to document the licensee's position with regard to the subject Information Notice (IN). The memorandum provided the licensee's interpretation of Generic Letter 86-10, which, in response to a question related to the types of circuit failure modes to be considered for spurious operations states, in part: "for consideration of spurious actuations, all possible functional failure states must be evaluated... valves could fail open or closed... " (Ref: GL 86-10, Question 5.3.1). It is the licensee's position that based on this statement only "functional failures" (i.e., valve fails open or closed) as described in the GL needed to be considered. Additionally, the licensee implied that the term "free of fire damage" was not applicable in this case since the definition given in Enclosure 1 "Interpretations of Appendix R" of GL 86-10, only referencesSection III.G.2 of Appendix R, and the hot short concern of the subject Information Notice only applies to alternate shutdown capability (Sections III.G.3 and III.L of Appendix R).

Based on this interpretation the licensee stated: "to further postulate spurious actuation to destruction is beyond the scope of GL 86-10 guidelines."

The memorandum then summarized the results of a circuit review that was conducted for MOVs utilized during alternate shutdown. The results of this review indicated that

"approximately 40 of 62 MOVs as listed in the Fire-Related Alternate Shutdown - Operating Instructions, are potentially subjected to the hot short concern." After providing a summary discussion on Salem's philosophy regarding cable fires, the memorandum concluded: "Based on the above...it is determined that the subject IN is considered not credible. Therefore, no further actions are recommended at this time."

Based on the above, the licensee's method of protection of equipment, which could be damaged as a result of fire in areas requiring alternative shutdown, as described in IN 92-18, remains unresolved (URI 272/311-93-80-08).

5.2.2 High Low Pressure Interfaces High/Low pressure interfaces identified by the licensee in Section 5.5 of its Safe Shutdown Analysis and their corresponding method of control include:

INTERFACES Pressurizer PORV & Block Valves: Reactor Head Vents: ~

Suction Valves:

METHOD OF CONTROL Manual action governed by written procedure to verify block valves closed 3/4" lines do not pose an immediate concern. Operator action to isolat Loss of coolant within charging pump capacity to provide makeu Motive power to at least one valve removed during power operations Normal/Excess Letdown:

Ability to control letdown ensured during alternate shutdown. For other areas at least one valve protected The team determined the protection for high/low pressure interfaces to be acceptabl.0 REVIEW OF THE COMMON ELECTRICAL ENCWSURE CONCERN Fire induced damage to non-essential circuits that are associated by common enclosure with circuits required to achieve and maintain safe shutdown may create circuit faults in electrically unprotected cables. Such faults could be of sufficient magnitude to create secondary fires. If such secondary fires were to occur in an enclosure, which contained cables required for safe shutdown, the successful achievement of safe shutdown would be adversely affecte The evaluation of this concern at Salem was based on an examination of a sample of non-essential cables found to be routed in a common enclosure with circuits required for safe shutdown. This examination included a review of the size, type, and construction of each non-essential cable selected. This information was then evaluated by the team to determine the adequacy of electrical protection provided for a sample of approximately 30 cables from among the hundreds of cables located in the six trays selecte The team identified one example of inadequate electrical protection. Specifically, a No. 12 A WG cable connected to a containment spray room cooling pump cable was protected by a 40 Amp circuit breaker. The 5 hp motor load of the room cooling pump has a full load current of 15.2 amps. Therefore, it appeared to the team that a lower rated circuit breaker would provide sufficient capacity for the pump while providing protection for the cable. At the time of the inspection licensee representatives concurred with the inspectors concer In describing the protection of non-essential cables, which share a common enclosure with cables of equipment required to achieve safe shutdown, Section 5.5 (Pg. 5-25) of the Salem Fire Protection Report - Safe Shutdown Analysis (DE-PS.ZZ-0001(Q)-A3-SSA states: "the rating of the cables utilized in the Salem units are such that fire induced shorting or *

grounding would result in a blown fuse or a tripped breaker before significant degradation of the cabling itself." However, contrary to this statement an example of apparently inadequate electrical protection was identified from a small sample of circuits selected for revie Therefore, it was not clear to the team if the licensee had performed a comprehensive analysis of the common enclosure associated circuit concern. The lack of adequate electrical protection for non-essential circuits, as described in the above example, causes the Common Enclosure Associated circuit concern to remain an unresolved item (URI 272/311-93-80-09).

32 REDUNDANT TRAIN SEPARATION To verify the adequacy of separation/protection provided for redundant trains of cables of equipment required to achieve safe shutdown in the event of fire, a sample of cables was selected and reviewed for compliance with Appendix R requirements or exemptions granted by NRR. This sample included power and control cables associated with the following equipment: Charging Pumps, Emergency Diesel Generator (control cables), SW Pump Discharge Valves. The evaluation was based on a review of color-coded cable tray and raceway drawings prepared by the license The team did not identify any areas of concern and the separation and/or protection provided for redundant trains of cables reviewed was acceptable.

. UNRESOLVED ITEMS Unresolved items are matters about which additional information is required to ascertain whether an item is acceptable, or deviation/violation from regulatory requirements and licensee commitments. Unresolved items are discussed in Sections 2.7.1, 2.7.2, 2.7.3, 4.1.1, 5.2, 5.2.1, 5.2.1.1, and.0 EXIT MEETING The inspection team met with licensee representatives, except for personnel identified with an asterisk(*) in Attachment A, at the conclusion of the inspection on May 21,1993. For the alternate shutdown procedure walkdown and verification, the inspector exited via telephone conference with licensee personnel listed in attachment B. The team leader summarized the scope of the inspection and the inspection findings at that time. Licensee management acknowledged the inspection findings and confirmed its commitment to maintain the compensatory measures. in the form of fire watches for areas containing the 3M fire barrier systems FS-195 and Interam E-50 pending verification of barrier qualification. In addition, the licensee agreed to provide the Region with a schedule for resolving the NRC concerns, listed as unresolved items, via telephone on June 3, 1993.

• ATTACHMENT A Persons Contacted Public Service Electric and Gas Company M. Aplaugh, Lead Engineer - Nuclear Licensing J. Bailey, Nuclear Engineering Science Manager R. Bashall, Fire Protection & Penetration Seal Supervisor

• P. Benini, Principal Engineer - QA Audits R. Braddick, Senior Fire Protection Engineer

• R. Brown, Principal Engineer - Licensing & Regulation

• M. Bursztein, Nuclear Electrical Engineering Manager R. Chranowski, Technical Engineer P. Clark, Senior Staff Engineer

• L. Hajos, Salem & Hope Creek Supervisor (Acting)

T. Johnson, Electrical Engineer S. Karimian, Technical Consultant J. Kerin, Senior Fire Protection Supervisor S. LaBruna, Vice President - Nuclear Engineering

• C. Lambert, Manager - Nuclear Engineering Operations W. McDevitt, Senior Staff Engineer

• J. Morrison, Manager - Site Services R. Oakes, Atlantic Electric Site Representative K. Pike, Technical Department Manager (Acting)

R. Ritzman, Lead Engineer - Licensing & Regulation R. Rose, Engineering Assessment Group

• G. Schroeder, Senior Staff Engineer D. Shumaker, Senior Staff Engineer D. Smith, Station Licensing Engineer P. Steinhauer, Engineering Assessment Group Supervisor

• B. Thomas, Engineer - Licensing & Regulation F. Thomson Jr., Manager - Licensing & Regulation K. Wolf, Fire Protection System Engineer

• ' *

Attachment A

U. S. Nuclear Regulatory Commission S. Barr, Resident Inspector N. Blumberg, Chief, Performance Program Section - RI W. Hodges, Director, Division of Reactor Safety T. Johnson, Senior Resident Inspector W. Ruland, Chief, Electrical Section - RI J. Schoppy, Resident Inspector All personnel identified with an asterisk (*) were not present at the exit meeting of May 26, 1993.

~*

ATTACHMENT B

NRC Concerns/Unresolved Items Section 1. URI 272/311-93-80-01 Qualification of Kaowool 2. Indeterminate 2. URI 272/311-93-80-02 Qualification of 3M 2. FS-195 Indeterminate 3. URI 272/311-93-80-03 Qualification of 3M 2. Interam E-50 4. URI 272/311-93-80-04 Alternate Shutdown Procedure 4. Lacking Critical Time Lines 5. URI 272/311-93-80-05 Adequacy of Licensee Analysis 4. to demonstrate cold Shutdown within specified Time Limits 6. URI 272/311-93-80-06 Non-conservative Assumptions Licensee using only one spurious operation per fire incident 7. URI 272/311-93-80-07 Requirement to perform repairs 5. for Hot Shutdown contrary to SER statement 8. URI 272/311-93-80-08 Licensee method of protecting 5.2. equipment from damage by fire 9. URI 272/311-93-80-09 Lack of Electrical protection for non-essential circuits

-.

'*

ATTACHMENT C Persons Contacted Public Service Electric and Gas Company

• +

• +

+

• +

+

+

+

• +

• +

I.Bailey, Manager-Nuclear Engineering & Science R. Bashall, Fire Protection & Penetration Seal Supervisor F. Becker, Nuclear Equipment Operator (NEO)

R. Beckwith, Station Licensing Engineer R. Gallaher, Operations Manager (Acting)

P. Clark, Engineer R. Brown, Principal Engineer M. Davis, NEO T. Fay, Shift Electrician M. Healy, Shift Supervisor M. Kepantaris, Senior Shift Supervisor C. Lambert, Manager-Nuclear Engineering D. Lounsdbury, Shift Supervisor*

T. McClave, System Engineer-Electrical M. McDevitt, Senior Staff Engineer P. O'Donnel, Operations Manager K. Pike, NEO J. Priest, Licensing Engineer R. Reynolds, Engineer J. Robertson, Shift Supervisor J. Sabla, NEO R. Sharkay, Nuclear Control Operator M. Shedlock, Maintenance Manager M. Spencer, NEO P. Steinhauer, Engineering Assessment Supervisor C. Vondra, General Manager J. Zimmerman, Project Engineer Asterisk (*)denotes personnel taking part in Alternate Shutdown Procedure Walkdown of July 19, 1993. ( +) denotes personnel participating in telephone exit of July 29, 1993.

.*

ATTACHMENT D Examples of repair activities required by licensee procedures:

S2.0P-AB.CR-0002(Q), CONTROL ROOM EVACUATION DUE TO FIRE IN CONTROL ROOM OR RELAY ROOM, OR CEILING OF THE 460/230 SWITCHGEAR ROOM TECHNICAL BASES DOCUMENT, Rev. 3, Page 7, Paragraph 2.4, reads in part: "Local operation of equipment is accomplished by installation of jumpers, lifting electrical leads, and installation of pneumatic bypasses in the control circuit of the components."

S2.0P-AB.CR-0002(Q), Rev. 3, CONTROL ROOM EVACUATION DUE TO FIRE IN CONTROL ROOM, RELAY ROOM, OR CEILING OF 460/230V SWITCHGEAR ROOM, Page 5, Step 3.9, reads: "SEND and Operator to CLOSE 2PR6 and 2PR7, Pressurizer PORV Block Valves, IAW Book F, Fire Related Alternate Shutdown Equipment Operating Instructions." The Book F, Fire Related Alternate Shutdown Equipment Operating Instructions read in part to close PR-6:

At Pan 1-I a. Trip ckt bkr. at pan door to de-energize circuitry and allow door opening.

b. Remove cable through cover to right pa c. Remove control circuit fuses and discar d. At terminal block, disconnect and tape:

Wire #1 from terminal 1 of cable 2A3YAC2A-A *

Wire #6 from terminal 5 of cable 2A3YAC2A-A *

Wire #8 from terminal 27 of cable 2A3YAC2A-A *

Wire #2 from terminal 2 of cable 2A3YAC2A-A *

Wire #7 from terminal 4 of cable 2A3YAC2A-A *

Wire #5 from terminal 26 of cable 2A3YAC2A-A *

All wires from terminal 24 (right hand side wires only).

• All wires from terminal 25 (right hand side wires only).

e. Install jumper between terminal 4 and 26 on left hand side of terminal bloc f. Install new control circuit fuse g. Defeat door interlock on circuit breaker and close breake h. Observe RIGHT contact closure and subsequent reopening after about 10 sec.

i. When contact reopens, trip circuit breaker and leave in tripped (off) position."

c

_,_

ATTACHMENT E Historical Background Information Relating to Alternate Shutdown and Repairs May 1981:

NRR issued NUREG-0517, Supplement No.6: "Safety Evaluation Report Related to the Operation of Salem Nuclear Generating Station Unit No.2".

Section 9. 7 "Fire Protection System" of this SER states:

"By letter, dated November 5, 1979, the applicant... provided preliminary descriptions of the type of modifications he proposed. The applicant also stated that additional information would be provided to the staff when the analyses and design changes are finalized. The staff required that the interim results of PSE&Gs fire interaction analysis be reviewed prior to issuance of a full power license. To expedite this action an NRC fire protection review team was assembled for the purpose of conducting an on-site review... findings would be limited to the adequacy of the fire protection measures on a short-term basis. The adequacy of measures on a long-term basis would be covered by the staff in its review of the licensee's compliance with the requirements of Appendix R to 10 CFR Part 50 (emphasis added).

Additionally, this document was found to state: "In SER Supplement No. 5 we stated that the alternate shutdown capability to achieve hot shutdown from outside the control room is now operational. This statement was in error. As stated above the applicant has not yet formally submitted a description of this capability. " September 1981:

Salem formally submitted ~ description of its alternate shutdown methodology titled "Fire Protection Program Safe Shutdown and Interaction Analysis" to NRR for revie.

June 1982:

In response to an April 20, 1982, request for information from the NRC the licensee submitted "Fire Protection Program Safe Shutdown Interaction Analysis - Supplemental Information

• As stated in the Introduction of this report, "This report-reflects information discussed at a meeting held in Bethesda, Maryland, on May 14, 1982... " The format of the report was in the form of stating the NRC question or item verbatim, with a response then provided by PSE& *

• I Attachment E

• Item 1 of Enclosure 2 of the Salem report described above, was found to address specifically the issue of hot shutdown repairs during the performance of alternate shutdown. In this section the NRC stated:

"The licensee's alternate shutdown procedure requires installation of electrical

. jumpers and pneumatic bypasses. It is our position that systems and components used to achieve and maintain hot standby conditions must be free of fire damage... "

In its response the licensee stated:

"The alternative shutdown procedures used at Salem do not require the use of electrical jumpers or pneumatic bypasses to achieve hot shutdown conditions... All motor operated valves are equipped with a hand wheel, but the existing alternate shutdown procedures indicate a preference for the use of electrical jumpers." May 31. 1983:

NRC issued its Safety Evaluation Report on Alternative Shutdown Capability of Salem Units 1 & 2, which was found to state: "No repairs or modifications are required to effect hot or cold shutdown utilizing the alternative shutdown methods." January 1988:

NRC Inspection Report 87-29 described need to perform hot shutdown repairs as identified during walkdown of alternate shutdown procedure. Issue left as unresolved ite.

February 1990:

Based on information contained in documents provided to a regional inspector, issue was closed. (Report No. 311/90-01, Unresolved Item 87-29-06) July 1993:

During the July 19, 1993, walkdown of the alternate shutdown procedure, the licensee's apparent use of repairs (i.e., fuses and jumpers) failed to demonstrate that hot shutdown could be achieved without performing repairs.