IR 05000313/1998021
| ML20207A783 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 05/24/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20207A782 | List: |
| References | |
| 50-313-98-21, 50-368-98-21, NUDOCS 9905270273 | |
| Download: ML20207A783 (26) | |
Text
1
..
ENCLOSURE l
l'
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
'
Docket Nos.:
50-313;50-368 License Nos.:
50-313/98-21;50-368/98-21 Licensee:
Entergy Operations, Inc.
i Facility:
Arkansas Nuclear One, Units 1 and 2 Location:
Junction of Hwy. 64W and Hwy. 333 South
)
Russellville, Arkansas Dates:
November 16,1998, through April 6,1999 Inspector:
R. Bywater, Reactor Inspector, Engineering and Maintenance Branch.
Approved By:
Dr. Dale A. Powers, Chief Engineering and Maintenance Branch i
Division of Reactor Safety l
)
l ATTACHMENT:
SupplementalInformation
.
i I
l
"
9905270273 990524 PDR ADOCK 05000313 j
O PDR
,
1
e
.
{
.
-2-EXECUTIVE SUMMARY Arkansas Nuclear One, Units 1 and 2 NRC inspection Report 50-313/98-21; 50-368/98-21 i
This announced, special inspection reviewed the licensee's implementation of post-fire alternative shutdown requirements for closeout of Unresolved item 50-313;-368/9623-01.
Plant Support A non-cited violation of 10 CFR Part 50, Appendix R, was identified involving failure to
have an acceptable alternative shutdown capability for the Unit 1 control room and cable spreading room if a fire occurred in the Unit 1 control room or cable spreading room, hot shorts could cause all eight High Pressure injection System injection valves (CV-1219, CV-1220, CV-1227, CV-1228, CV-1278, CV-1279, CV-1284, and CV-1285)
to spuriously close and to suffer mechanical damage, rendering them incapable of being reopened. This would prevent the operation of safe shutdown equipment necessary to provide reactor coolant makeup and maintain reactor coolant inventory. The licensee identified this condh!on in 1997 after the NRC questioned the survivability of j
motor-operated valves following spurious operation caused by hot shor1s. During this
'
inspection, the licensee initiated Condition Report CR-ANO-1-1998-0721, which contained a corrective action item to submit to the NRC a request for exemption from the fire protection requirements for this condition by December 31,1999, and implemented an hourly compensatory fire watch of the Unit 1 control room and cable spreading room (Section F8.1).
An unresolved item was identified involving the Units 1 and 2 alternative shutdown
capability with respect to reactor coolant system high/ low pressure interfaces. The NRC questioned whether the alternative shutdown capability met the requirements of 10 CFR Part 50, Appendix R, Sections lil.G.3, Ill.L.1, Ill.L.2, and Ill.L.7. Spurious operation of high/ low pressure interface valves during a postulated control room or cable spreading room fire may result in the inability to meet the performance goals of Appendix R. However, due to questions regarding the licensing basis of the facility, the Region IV Office plans to forward a request to the Office of Nuclear Reactor Regulation for assistance in determining whether the alternative shutdown capability is consistent with the licensing basis, and, if so, whether imposition of a backfit is warranted. As a result of this concern, the licensee reviewed its alternate shutdown procedures and improved the timeliness for completion of time-critical operator actions. Additionally, the licensee implemented an hourly compensatory fire watch of the Units 1 and 2 control rooms and cable spreading rooms pending resolution of this issue (Sections F8.2, F8.3, F8.4, and F8.5).
A weakness was identified involving the licensee's understanding, implementation, and
maintenance of the licensing basis regarding operator action timelines for a control room or cable spreading room fire. The NRC identified that the time required to complete specific required operator actions following control room evacuation measured during drills and documented in the procedure basis document, exceeded the timelines provided to the NRC in correspondence to justify the acceptability of the alternative shutdown capability. The licensee did not have adequate administrative controls in
.
l
.
-3-place to ensure that alternate shutdown procedure changes did not adversely affect safe
)
shutdown capability. The licensee evaluated these time differences and concluded that j
they had not adversely affected the ability to achieve and maintain safe shutdown in the
'
event of a fire. The licensee opened corrective action items to incorporate the time critical steps and their limiting times for completion into the fire hazards analysis; and, to require that alternate shutdown procedure changes receive fire protection engineer review to ensure that the ability to achieve and maintain safe shutdown in the event of a fire was not affected (Section F8.4).
b
.
_
,
.
.
-4-Report Details
)
Summary of Plant Status Both units operated at full power during the November 1998 onsite portion of the inspection.
Unit 1 operated at full power and Unit 2 was in a refueling outage during the February 1999 onsite portion of the inspection.
IV. Plant Support F8 Miscellaneous Fire Protection lasues F8.1 (Closed) Unresolved item 50-313: -368/9623-01: Consideration of Multiple Hot Short Actuations a.
Backaround As documented previously in NRC Inspection Report 50-313;-368/9623, the inspecto'rs reviewed the licensee's consideration of spurious operation of motor-operated valves due to a fire in the control room and noted that the licensee had not performed wiring modifications to preclude valve damage. The inspectors were concerned that the licensee did not have an adequate alternative shutdown capability, as required by 10 CFR Part 50, Appendix R, in that, motor-operated valves could be damaged following spurious operation and prevent the operation of equipment necessary to achieve and maintain safe shutdown.
In NRC Inspection Report 50-313;-368/9721, the inspectors documented additional review of this issue. The inspectors reviewed Engineering Report 97-R-0004-01,"NRC Information Notice 92-18 Evaluation," Revision 1; and, Calculations 96-E-0065-01," Unit 1 Safety Related Valve Survivability Evaluaiion Under Stall Thrust / Torque, Motor-Operated Valves," Revision 1, and 96-E-0066-01, " Unit 2 Safety Related Valve Survivability Evaluation Under Stall Thrust / Torque, Motor-Operated Valves," Revision 0.
The engineering report and calculations identified that many of the valves in the components of interest list in the fire hazards analysis (FHA) were susceptible to mechanical damage that could prevent manual operator action if a hot short were to
'
occur that caused spurious valve operation. However, the licensee determined that in no case would a single spurious actuation of a motor-operated valve prevent the ability
,
to achieve and maintain safe shutdown. If a single motor-operated valve were to spuriously actuate due to a hot short, either the valve would be capable of being
.
'
manually repositioned or an unaffected means of accomplishing the safe shutdown function would be available.
.
Engineering Report 97-R-0004-01 also addressed the issue of hot shorts on multiple motor-operated valves. With few exceptions, the evaluation concluded that for valves j
susceptible to damage due to fire-induced circuit failure, another path would be available
.
5-to accomplish the same shutdown function that would be free of fire damage. For example, Valves CV-2613 and CV-2663, the Unit 1 steam supply valves to the turbine-driven emergency feedwater pump, were susceptible to damage. The licensee considered this acceptable because the motor-driven emergency feedwater pump and associated tiowpath would be available to provide decay heat removal capability.
Engineering Report 97-R-0004-01 identified a problem with the eight high pressure injection (HPI) system valves: CV-1219, CV-1220, CV-1227, CV-1228, CV-1278, CV-1279, CV-1284, and CV-1285. All of the subject valve / actuator combinations were susceptible to mechanical damage that would prevent them from being manually repositioned. If all eight valve circuits were to have the same fire-induced circuit failure that resulted in valve failure in the closed position, an unaffected means of makeup capability would not be available. Only one of the eight valves was necessary to perform the safety function required to achieve and maintain hot shutdown. The licensee concluded that this was not a credible event and concluded that at least one valve would remain undamaged and available for use.
The licensee also identified a problem for Unit 1 involving the two decay heat cooler '
outlet valves: CV-1428 and CV-1429. Both of the subject valve / actuator combinations were susceptible to mechanical damage. If both valve circuits were to have the same fire-induced circuit failure that resulted in valve failure in the closed position, an unaffected means of providing decay heat removal capability would not be available without making repairs. Only one of the two valves was necessary to perform the safety function required to achieve cold shutdown and the licensee concluded that the failure of both valves was not a credible event. However, the licensee evaluated the possibility of both valves becoming damaged and concluded that the condition was acceptable because the valves could be readily repaired and were only needed for cold shutdown.
(The regulations allowed repairs of components that were only required to achieve and maintain cold shutdown.)
With respect to Unit 2, the licensee did not identify any concerns with components required for hot shutdown.
With respect to Unit 2 components required for cold shutdown, the licensee identified a concern with the four shutdown cooling-to-low pressure safety injection system valves:
2CV-5017-1,2CV-5037-1,2CV-5057-2, and 2CV-5077-2. Similar to the Unit 1 decay heat cooler outlet valves, all four of the subject valve / actuator combinations were susceptible to mechanical damage. if all four valve circuits were to have the same fire-induced circuit failure that resulted in valve failure in the closed position, an unaffected means of providing decay heat removal capability would not be available without making repairs. Only one of the four valves was necessary to perform the safety function required to achieve cold shutdown and the licensee concluded that failure of all four valves was not a credible event. However, the licensee evaluated the possibility of all four valves becoming damaged and concluded that the condition was acceptable because the valves could be readily repaired and were only needed for cold shutdown.
i l
6-b.
Inspection Followuo (92904)
The inspector reviewed the licensing basis for the facility with respect to compliance with 10 CFR Part 50, Appendix R, Sections Ill.G.3 and Ill.L. The licensee submitted its Appendix R compliance review to the NRC on July 1,1982, and responded to requests for additional information relevant to alternative shutdown capability on October 5 and November 1,1982. The NRC issued a Safety Evaluation Report (SER) on May 13, 1983, which concluded that the licensee's alternative shutdown capability design met the requirements of 10 CFR Part 50, Appendix R, Sections Ill.G.3 and Ill.L. The licensee also submitted the results of an Appendix R re-evaluation to the NRC on August 15, 1984. The NRC provided SERs in response to this submittal for specific exemption requests, but the NRC did not perform a re-evaluation of the licensee's alternative shutdown capability.
The inspector reviewed the above licensing documents and the fire protection program documents tabulated at the end of this report. The inspector also reviewed implementation documents for post-fire alternative shutdown capability. These included:
Procedure 1203.002," Unit 1 Alternate Shutdown," Revision 13 and its associated basis document,"ANO-1 Alternate Shutdown Procedure 1203.002 Basis Document,"
Revision 13/PC-4; and, Procedure 2203.014, " Unit 2 Alternate Shutdown," Revision 14 and its associated basis document," Alternate Shutdown 2203.014 Technical Guidelines," Revision 14.
The licensee's representative informed the inspector that the postulated event involving the failure of all eight Unit 1 HPI valves failing in the closed position was not credible.
Additionally, the licensee's reprac".tative informed the inspector that they believed they were in compliance with regulacy requirements. The licensee based this conclusion j
on its interpretation of the answer to Question 5.3.10," Design Basis Plant Transients,"
'
of NRC Generic Letter 86-10," Implementation of Fire Protection Requirements," which stated that the safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area. The inspector q
concluded that the licensee's interpretation of the Generic Letter 86-10 guidance was not correct.
The NRC's positions on the Generic Letter 86-10 guidance were provided in a letter dated March 11,1997, from Mr. Samuel J. Collins, Director, Office of Nuclear Reactor t
Regulation (NRR),do Mr. Ralph E. Beedle, Senior Vice President and Chief Nuclear Officer, Nuclear Energy Institute. Three of the relevant positions identified in the letter were: 1) the response to Question 5.3.10 specified the plant transient that licensees should consider to determine the design capacity of the alternative or dedicated shutdown system; 2) the response to Question 5.3.1," Circuit Failure Modes," reiterated the regulatory requirement that multiple spurious actuations caused by fire-induced hot shorts, shorts to ground, or open circuits must be considered and evaluated; and,3) the response to Question 3.8.4," Control Room Fire Considerations," stated that the damage to the systems in the control room cannot be predicted and the staff's response recognized that a fire can induce signals that cause operational changes (e.g., valves changing position) to the plant. With this information, the inspector concluded that the licensee was not limited to the consideration of only a single spurious actuation.
. - _ - - _
.
-7-10 CFR 50.48(a)," Fire Protection," requires, in part, that each operating nuclear power plant must have a fire protection plan so that the capability to safety shutdown the plant is ensured.
10 CFR 50.48(b) requires, in part, that all nuclear power plants licensed to operate prior to January 1,1979, shall satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Section Ill.G. The Arkansas Nuclear One facility was licensed to operate prior to January 1,1979.
10 CFR Part 50, Appendix R, Section Ill.G.2, requires, in part, that where cables or equipment of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located in the same fire area outside of containment, a means of ensuring that one of the redundant trains is free of fire damage shall be provided.
10 CFR Part 50, Appendix R, Section Ill.G.3, requires, in part, that alternative or dedicated shutdown capability is provided where the protection of systems whose function is required for hot shutdown does not satisfy the requirements of Section Ill.G.2. Alternative or dedicated shutdown capability was required for the Unit 1 control room and cable spreading room because this fire area contained redundant trains of systems necessary to achieve and maintain hot shutdown conditions that were not protected in accordance with 10 CFR Part 50, Appendix R, Section Ill.G.2.
~
10 CFR Part 50, Appendix R, Section Ill.L.1, requires, in part, that alternative or dedicated shutdown capability provided for a specific fire area shall be able to maintain reactor coolant inventory.
10 CFR Part 50, Appendix R, Section lil.L.2, requires, in part, those performance goals for accomplishing safe shutdown shallinclude reactor coolant makeup.
10 CFR Part 50, Appendix R, Section Ill.L.7, requires, in part, that the safe shutdown equipment and systems shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment.
The operation of certain fire-related, safe shutdown equipment in Arkansas Nuclear One, Unit 1, was not protected against the effect of hot shorts. Specifically, if a fire occurred in the corftrol room or cable spreading room, hot shorts could cause all eight HPl System injection valves (CV-1219, CV-1220, CV-1227, CV-1228, CV-1278, CV-1279, CV-1284, and CV-1285) to spuriously close and to suffer mechanical damage, rendering them incapable of being reopened. This would prevent the operation of safe shutdown equipment that is necessary to provide reactor coolant makeup and maintain reactor coolant inventory.
The licensee initiated Condition Report CR-ANO-1-1998-0721 to document its actions on this issue and implemented a compensatory hourly fire watch of the Unit 1 control room and cable spreading room on November 19,1998. The inspector considered the implementation of the compensatory hourly fire watch an acceptable interim actio.
-8-As one of the corrective actions associated with Condition Report CR-ANO-1-1998-0721, the licensee performed Calculation 98-E-0058-01, " Probability of Hot Shorts Disabling All RCS Makeup Paths," to evaluate the safety significance of this issue. The calculation concluded inat,"the probability of hot shorts in the control cables for the valves in the HPI lines disabling all of the valves in a manner that would preclude their mboequent manual manipulation is so low as to be meaningless short of calling it impossible," and gentified the frequency as 2.05E-11/yr.
The inspector acknowledged that the due to the number of hot shorts required for loss of the reactor makeup function and the detection and suppression systems available, the postulated event may be of low probability. However, the NRC concluded that the condition was not in compliance with regulatory requirements and the condition was considered to be of more than minor safety significance because the plant may not be
,
I capable of achieving and maintaining safe shutdown if the event were to occur.
As another corrective action associated with Condition Report CR-ANO-1-1998-0721, the licensee documented that a request for exemption from the requirements of the fi,re protection program for this issue would be submitted to the NRC by December 31,1999.
During the exit meeting, the licensee's representatives informed the inspector that they had not concluded whether they were in agreement with the NRC's characterization of this issue as a violation and whether a request for exemption would be actually be submitted to the NRC for review; however, the licensee's representatives provided a verbal commitment that the hourly compensatory fire watch would be maintained until the issue was resolved. The inspector informed the licensee representatives that the licensee would have 30 days following the date of the inspection report to provide a response to the report if they contested the characterization of this issue ac a violation.
.
This was considered a violation of 10 CFR Part 50, Appendix R (50-313/9821-01).
However, based on the NRC's determination that this issue was a Severity Level IV violation and that the licensee had initiated a corrective action program item to submit a
,
request for exemption from the fire protection program requirements for this issue, it is being treated as a Non-Cited Violation, consistent with Appendix C of the Enforcement Policy.
F8.2 Unit 1 Pressurizer Electromaanetic Relief Valve and Block Valve issue a.
Inspection Scoce (92904)
During review of the licensee's alternative shutdown capability, the inspector reviewed a concern where only the single spurious operation of the Unit 1 pressurizer electromagnetic relief valve (ERV) (Valve PSV-1000) would result in a high/ low pressure interface transient and it had not been evaluated in the licensee's safe shutdown capability assessment. The inspector reviewed the FHA, licensing correspondence, and procedures to determine if the licensee's alternative shutdown capability was adequate.
b.
Observations and Findinas The licensee submitted its Appendix R compliance review to the NRC on July 1,1982, and responded to requests for additionalinformation relevant to altemative shutdown
_
.
'
4 capability on October 5 and November 1,1982. The NRC issued an SER on May 13, 1983, which concluded that the licensee's altemative shutdown capability design met the requirements of 10 CFR Part 50, Appendix R, Sections Ill.G.3 and Ill.L.
The SER stated," Unit 1 has a ERV block valve which could open spuriously. By letter dated November 1,1982, the licensee's representative stated that it will provide an isolation device locally to permit control of this valve."
The inspector noted that an isolation / control switch had been installed for the ERV block valve (Valve CV-1000) in accordance with Design Change Package 83D-1012; however, the plant was operated with the ERV block valve normally open. The inspector considered the SER to imply that the NRC had believed that the ERV block valve was normally closed. The licensee's representative informed the inspector that the plant had been operated in the past for extended periods of time with the ERV block valve closed because of ERV seat leakage and that the block valve may have been normally closed at the time of the subject licensing correspondence.
I The inspector reviewed Procedure 1203.002, the Unit 1 alternate shutdown procedure, and its associated basis document. The timeline for completion of operator actions located in the basis document (determined by measuring operator performance during drills) indicated that the ERV was not de-energized until 7 minutes following control room evacuation and the ERV block valve was not closed and de-energized until 25 minutes following control room evacuation.
The inspector questioned the licensee's representative regarding the delay for isolating and closing the ERV block valve and was informed that the timing of this step was inconsequential because the ERV itself was de-energized early in the procedure. The inspector asked whether the licensee's strategy with respect to high/ low pressure interface component transients was prevention or mitigation and was informed that the strategy was to prevent the transient by de-energizing the subject component to prevent i
a spurious actuation.
The inspector concluded that although the NRC had approved a methodology for alternative shutdown utilizing an isolation / transfer switch for the ERV block valve, the NRC had not provided an exemption from meeting the requirements of the regulations for alternative shutdown capability. The NRC provided guidance to the industry in Generic Letter 81-12, " Fire Protection Rule," that informed the industry that licensees were to assure that higMow pressure interfaces were adequately protected from the effects of a fire in order to prevent a fire-initiated loss-of-coolant accident (LOCA).
Additionally, the NRC provided additional guidance in the response to Question 5.3.10 of Generic Letter 86-10," Implementation of Fire Protectior P.aquirements, that informed the indtstry that the safe shutdown capability in an attemative shutdown system should not be adversely affected by a fire in any plant area, which results in spurious actuation of the redundant valves in any high/ low pressure interface line. The licensee had not evaluated its alternative shutdown capability with respect to the spurious opening of the ERV to determine if the Appendix R performance goals would be met. When questioned on this point, the licensee's representative informed the inspector that the performance goals of Appendix R, Section Ill.L would not be met if the ERV were to spuriously ope.
The licensee's FHA identified several assumptions that were used in their July 1,1982, Appendix R compliance submittal. Among these assumptions were: 1) In certain cases, credit for manual operation of equipment was taken if controls (and power for valves) could possibly be damaged by a fire. Such credit was only taken if sufficient
)
time was available to perform the required manual operations. And,2) Fire damaged i
cables were assumed to fail in their worst mode for the condition being assessed. For example, if it is more limiting for a valve to open rather to remain shut, it is assumed that associated cabling failed in such a way as to cause the valve to open.
The ERV and ERV block valve were included in the Components of interest List of the FHA. The FHA identified that the ERV must be closed or isolated but it did not evaluate whether sufficient time was available to perform the required manual actions.
Additionally, the FHA did not include an evaluation of the effect of fire damaged cable causing the ERV or the ERV block valve to fail open. Therefore,it did not appear that the licensee's FHA assumptions stated above were consistent with the actual design of the plant.
'
The licensee initiated Condition Report CR-ANO-C-1999-0045 to document its review of this higMow pressure interface issue and several other examples addressed in subsequent sections of this report. The licensee performed several calculations to evaluate the safety significance of this issue. These included:
Calculation 98-E-0058-02,"Probabilistic Safety Analysis of ANO-1 Fire Induced LOCAs,"
Calculation 98-E-0058-05," Probability of Hot Short of the ERV (PSV-1000) During a Postulated Fire," and Calculation 85-E-0072-03," Time to Loss of Subcooling or Loss of Pressurizer Liquid Inventory from Plant Trip with No Makeup Available Under Various RCS Leakpath Scenarios."
Calculation 98-E-0058-05 concluded that the probability of a hot short due to a fire in the control room or the cable spreading room which would open the ERV was 5.58E-04.
Calculation 98-E-0058-02 concluded that the conditional core damage probability of a fire in the control room resulting in opening the ERV was 5.82E-02. The conditional core damage probability for a fire in the cable spreading room resulting in opening the ERV was 9.12E-03. This calculation also evaluated the risk cost / benefit for operating the plant with the ERV block valve normally closed rather than open. The results of the
,
i calculation indicated that leaving it open was the safest configuration because this path was necessary for rnitigating non-fire accident scenarios.
'
Ca'culation 85-E-0072-03 determined the time available prior to loss of subcooling
.
margin for cases involving a spuriously opened ERV with no makeup capability available. The results of the calculation were dependent upon the time necessary to isolate reactor coolant system letdown flow. As an example, if the ERV was not isolated within approximately 3 minutes following event initiation and letdown was not isolated within approximately 7 minutes following event initiation, subcooling margin would be lost. As discussed below, the licensee revised its alternate shutdown procedure to accomplish these actions within these times following control room evacuation.
The inspector toured the control room, cable spreading room, the location of the power supply where the ERV was de-energized during performance of the alternate shutdown procedure, and the location of the ERV block valve isolation / transfer switc ~
\\
.
-11-The control room was continuously staffed and had smoke detectors in cabinets j
containing ERV and ERV block valve cables. The cable spreading room was
'
designated a "zero combustib!es" zone in accordance with the licensee's combustible controls program. The room was also provided with smoke detectors, line heat detectors in cable trays, and an open head automatic deluge system for all cable trays.
. The ERV cable was also routed through the adjoining integrated control system room.
Although separated by a block wall and bolted door radiant energy shield from the cable spreading room, it was considered part of the same fire area as the cable spreading room and control room. The integrated control system room had smoke detectors but it did not have an automatic suppression system.
As a result of these discussions with the licensee's representative regarding the
,
probability and consequences of fire scenarios and operator actions following control I
room evacuation, the licensee initiated an hourly fire watch patrol of the control room and cable spreading room (including the integrated control system room). Also, the licensee reviewed Procedure 1203.002 and changed the procedure to increase the likelihood that a high/ low pressure interface transient was prevented or terminated sooner. These changes included operator steps to attempt to close the ERV block vhlve prior to evacuating the control room, and rearrangement of steps to de-energize the ERV, isolate letdown, and isolate and close the ERV block valve earlier in the procedure fallowing evacuation.
The inspector questioned whether the alternative shutdown capability was in compliance with the requirements of Appendix R because a postu!ated fire in the Unit 1 control room or cable spreading room would cause the ERV, a high/ low pressure interface isolation valve, to spuriously open concurrent with its associated block valve, CV-1000, being open. This may result in the inability to provide alternative shutdown capability that meets the performance goals required by Appendix R. However, due to questions regarding the licensing basis of the facility and to acquire additional technical review of the licensee's calculations, this issue will be forwarded to NRR for assistance in determining if the licensee's alternative shutdown capability was consistent with its licensing basis, and if so, whether imposition of a backfit is warranted. The inspector
'
considered the licensee's interim actions acceptable to address the safety significance of this issue pending further NRC review. This issue is considered to be an example of an unresolved item involving alternative shutdown capability, pending completion of this
'
review (50-313;-368/9821-02).
c.
Conclusions The inspector questioned whether the licensee's alternative shutdown capability met regulatory requirements. The licensee performed analyses to evaluate the risk associated with spurious operation of the ERV and implemented procedural changes to increase the likelihood that spurious operation would be prevented or mitigated if it occurred. An unresolved item was identified for further NRC review of this issue. The licensee's representative provided a verbal commitment to maintain an hourly compensatory fire watch of the Unit 1 control room and cable spreading room until this issue was resolve,
,
..
-12-
F8.3 Other Unit 1 Hiah/ Low Pressure interfaces a.
Inspection Scooe (92904)
The inspector reviewed other higMow pressure interfaces that were identified in the
'
FHA. The inspector was concerned that the licensee had not adequately addressed the potential for a fire-induced LOCA.
b.
Observations and Findinos :
The FHA identified that the reactor coolant system high point vent valves (reactor vessel head, pressurizer, and hot legs) must be considered with respect to the safe shutdown goal of maintaining reactor coolant system inventory and pressure. Fire-induced circuit failure resulting in the spurious opening of any of these interfaces would result in the need for reactor coolant system makeup in less than the 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> that was assumed in the FHA.' The subject valves were included in the FHA Components of Interest List.
Procedure 1203.002 incorporated manual actions to de-energize these valves in the closed position following control room evacuation; however, the licensee did not
'
evaluate whether sufficient time was available to perform these manual actions.
Additionally, the licensee did not evaluate whether its alternative shutdown capability.
{
~
was adequate to mitigate a transient involving the spurious opening of one of these higMow pressure interfaces.
A postulated fire in the Unit 1 control room or cable spreading room would cause redundant reactor vessel head vent valves, redundant pressurizer vent valves, or redundant hot leg vent valves, each set constituting a higMow pressure interface boundary, to spuriously open.. This may result in inability to provide alternative shutdown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and Ill.L.7.
The FHA identified that the reactor coolant pump seal bleedoff isolation valves must be closed to prevent leakoff of high temperature water which can result in seal failure. The subject valves were included in the FHA Components of interest List. Procedure
,
1203.002 incorporated manual actions to de-energize these valves in the closed position following control room evacuation; however, the licensee did not evaluate whether
- sufficient time was available to perform these manual actions.
.
i
- A postulated fire in the Unit 1 control room or cable spreading room would cause redundant reactor coolant pump seal bleedoff isolation valves, constituting a higMow pressure interface boundary, to spuriously open and result in reactor coolant pump seal failure; This may result in inability to provide alternative shutdown capability that meets
. the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1,'lli.L.2, and lil.L7.
The FHA identified that the reactor coolant system letdown flow must be terminated to
. eliminate this inventory loss path and the letdown isolation valves were included in the Components of Interest List. Procedure 1203.002 incorporated manual actions to
.de-energize these valves in the closed position following control room evacuation;
f
' however, the licensee did not evaluate whether sufficient time was available to perform
'
'
A
..
.
\\
-13-these manual actions. The inspector noted that the NRC's May 13,1983 SER for the licensee's alternative shutdown capability identified that the letdown valves were not of j
concern for either unit. The inspector questioned whether this position was consistent with the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and
,
Ill.L.7.
l The FHA identified that the decay heat removal suction valves must remain closed to prevent a very rapid loss of reactor coolant system inventory and they were included in the Components of Interest List. The subject valves (CV-1050 and CV-1410 for Unit 1; 2CV-5038-1,2CV-5084-1, and 2CV-5086-2 for Unit 2) were closed with their associated power supply breaker open during normal power operation. The inspector noted that the NRC's May 13,1983 SER for the licensee's alternative shutdown capability identified that the decay heat suction valves were not of concern for either unit. The inspector questioned whether this position was consistent with the regulatory requirements of 10 CFR 50, Appendix R, Sections lli.L1, Ill.L.2, and Ill.L.7. The-inspector did not have a safety concern regarding the decay heat suction interfaces because the subject valves were not susceptible to spurious operation during normal power operation.
,
The inspector discussed each of these cases with the licensee to determine their significance. The consequences of spurious operation of each of the above interfaces (with the exception of the decay heat suction valves, which were already de-energized during normal operation and not susceptible to spurious operation) were bounded by the I
ERV case. The licensee had revised Procedure 1203.002 to move time-critical steps for isolating these interfaces earlier in the procedure. However, the inspector considered these cases to be additional examples of an unresolved item pending technical
)
assistance from NRR to determine if the licensee's methodology is consistent with the
'
licensing basis (50-313;-368/9821-02).
c.
Conclusions Additional examples were identified of an unresolved item involving the acceptability of the licensee's alternative shutdown capability with respect to high/ low pressure interfaces.
F8.4 Unit 2 Timeline for Operator Actions Followina a Control Room Fire a.
Inspection Scope (92904)
The inspector reviewed licensing correspondence, previous inspection reports, procedures, and safety evaluatiorss to investigate the acceptability of the licensee's post-fire control room evacuation procedures to achieve and maintain safe shutdown.
b.
Obsentations and Findinas During discussions regarding the methodology used to achieve and maintain safe shutdown in the event of a control room or cable spreading room fire, the licensee's representative referred to a previous NRC inspection that reviewed and closed an unresolved ite i-14-Unresolved item 50-368/8714-06 was opened during the 1987 NRC Appendix R implementation inspection and involved several Unit 2 high/ low pressure interface valves (Inspection Report 50-313;-368/8714). The valves were not protected from spuriously operating during a fire and the licensee's alternative shutdown capability was not designed to be capable of mitigating the resulting high/ low pressure interface transient.
The licensee's alternative shutdown strategy relied on preventing spurious actuation of the high/ low pressure interface valves. The item was documented as an unresolved
'
item, pending resolution of the issue between the licensee and NRR.
The NRC reviewed this unresolved item in 1990 and documented the review in NRC
Inspection Reports 90-28,90-37, and 90-42. The inspectors were concerned that operator response may not occur in a timely manner to prevent the spurious operation of the subject valves. In response, the licensee submitted a letter to the NRC Region IV Office on November 23,1990, which identified the cable failure mechanisms required for spurious actuation, fire detection and suppression capabilities available in the affected areas, and manual operator action timelines incorporated in Procedure 2203.014 for
de-energizing the valves following control room evacuation. The licensee concluded qualitatively that the probability of the specific conductors required for spurious actuation shorting together due to a fire was extremely remote. Additionally, the licensee documented that the time required for completing operator actions in accordance with Procedure 2203.014 to isolate components following control room evacuation ranged from 3.5 minutes for the emergency core cooling system (ECCS) vent valves and low temperature overpressure protection (LTOP) relief isolation valves, to 15.5 minutes for the reactor coolant system letdown valves.
The NRC acknowledged receipt of the licensee's letter in a reply dated December 27, 1990. The NRC's letter stated that the licensee's reply was responsive to the concerns raised in Inspection Report 50-313;-368/8714, that Unresolved item 50-368/8714-06 was adequately resolved and that this would be documented in NRC Inspection Report 50-313;-368/9042. Inspection Report 50-313;-368/9042 closed the unresolved item with no violation. The inspector noted that the report stated, "By letter dated November 23,1990, the licensee provided the additional information and the proposed corrective actions to prevent the spurious operation of these valves in case of fire..."
The inspector noted that the licensee's November 23,1990, letter contained no information regarding proposed corrective actions to prevent spurious operation of the valves. Therefore, the inspector concluded that the NRC may have inappropriately closed Unresolved item 50-368/8714-06. The licensee's response did not address the consequences of spurious operation of the high/ low pressure interfaces, the design capabilities of the alternative shutdown system, or whether the performance goals of Appendix R could be met. Further NRC review of the licensing basis of the licensee's alternative shutdown capability with respect to high/ low pressure interfaces will be performed during review of Unresolved item 50-313;-368/9821-02.
During this inspection, the inspector identified that the basis document for Procedure 2203.014, Revision 14 (March 18,1998), which documented the timelines for completion of operator actions that had been measured during drills, indicated that the times required for completion of operator actions were longer than they were in the licensee's November 23,1990, letter. For example, the ECCS vent valve de-energization steps now were performed at 15 rninutes, the LTOP relief isolation valve
.
-15-steps were performed at 15 and 25 minutes for each set of valves, and the letdown isolation valve steps were performed at 40 minutes following control room evacuation.
The inspector reviewed the 10 CFR 50.59 safety evaluation for the March 18,1998, revision of Procedure 2203.014. The inspector determined that the licensee did not perform an evaluation to determine if the procedure change impacted the operator response timeline and whether it would adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The licensee's representative informed the inspector that they did not have this evaluation requirement proceduralized in their program documents. Rath9r, it was incumbent upon the fire protection engineer to accomplish this evaluation during the routine fire protection review that occurred as part of the 10 CFR 50.59 safety evaluation process.
Operating License Section 2.C.(3)(b), " Fire Protection states that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Amendment 9A to the Safety Analysis Report and as approved in the Safety Evaluation dated March 31,1992, subject to the following provision: The
'
licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.
The licensee initiated Condition Report CR-ANO-2-1998-0436 to document this issue and developed an operability assessment which concluded.that the delay in operator actions did not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire, and was therefore acceptable. The licensee's evaluation determined that there had not been any significant number of operator actions added to the procedure since 1990 which may have contributed to the additional time requirements. Rather, the licensee's representative stated that operator self-checking and communications
standards had increased since 1990, and this resulted in a significant increase in the
{
amount of time required for operators to perform proceduralized tasks. In response to the procedure review concern, the licensee initiated a corrective action to ensure that the fire protection engineer reviewed revisions to the alternate shutdown procedures before they became effective and a corrective action to incorporate the time critical steps and limiting times for alternative shutdown into the FHA.
The inspector determined that this issue was not a violation because the changes to the fire protection program (revisions to the alternate shutdown procedure) did not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. However, the inspector considered the licensee's understanding and implementation of the licensing basis regarding operator action timelines following a tire to be a weakness.
l The NRC identified that the time required to complete specific required operator actions following control room evacuation, measured during drills and documented in the procedure basis document, exceeded the timelines provided to the NRC in correspondence to justify the acceptability of the alternative shutdown capability. The licensee did not have adequate administrative controls in place to ensure that alternate shutdown procedure changes did not adversely affect safe shutdown capabilit.
.
-16-c.
Conclusions The NRC may have inappropriately closed Unresolved item 50-368/8714-06 during a previous inspection. The licensing basis regarding the potential for fire-induced circuit failure resulting in spurious operation of redundant valves in high/ low pressure interfaces will be reviewed by NRC as part of the follow up on an unresolved item.
A weakness was identified.in the licensee's understanding and implementation of the licensing basis regarding operator action timelines following a fire. The !icensee did not have adequate administrative controls in place to ensure that alternate shutdown procedure changes did not adversely affect safe shutdown capability.
F8.5 Unit 2 Hioh/ Low Pressure Interfaces a.
Insoection Scope (92904)
'
The inspector reviewed the FHA, licensing correspondence and previous NRC inspection reports with respect to the Unit 2 high/ low pressure interfaces to determin6 if the licensee's alternative shutdown capability was in compliance with regulatory requirements, b.
Observations and Findinas With respect to the Unit 2 pressurizer ECCS vent valves,2CV-4698-1 and 2CV-4740-2, the NRC's May 13,1983, SER on the licensee's alternative shutdown capability stated that for both of these valves to open, four circuits would have to be spuriously completed in two locations and that this was considered unlikely, in NRC Inspection j
Report 50-313;-368/8714, the inspectors documented that this was an erroneous j
statement, i.e., that only two shorts, one in the control circuit of each valve, were required to cause spurious operation of this high/ low pressure interface.
j Procedure 2203.014 incorporated manual actions to de-energize the pressurizer ECCS vent valves in the closed position following control room evacuation; however, the licensee did not evaluate whether its alternative shutdown capability was adequate to mitigate a transient involving the spurious opening of this high/ low pressure interface.
A postulated fire in the Unit 2 control room or cable spreading room would cause Pressurizer ECCS Vent Valves 2CV-4698-1 and 2CV-4740-2, the redundant valves in a high/ low pressure interface, to spuriously open. This may result in inability to provide alternative shutdown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and Ill.L.7. This is considered an additional example of Unresolved item 50-313;-368/9821-02 to request assistance from NRR to evaluate the impact of the error in the SER for these valves and to determine if the condition is consistent with the licensing basi )
.
)
-
i-17-The licensee's July 1,1982, Appendix R compliance submittal and the NRC's May 13, 1983, SER do not address the LTOP relief isolation valves. Although Procedure
,
2203.014 incorporated manual actions to de-energizo the LTOP relief isolation valves in the closed position following control room evacuation, the licensee did not evaluate
'
whether its alternative shutdown capability was adequate to mitigate a transient involving the spurious opening of these high/ low pressure interfaces.
A postulated fire in the Unit 2 control room or cable spreading room would cause LTOP Relief isolation Valves 2CV-4731-2 and 2CV-4730-1, the redundant valves in a high/ low pressure interface, to spuriously open. This may result in inability to provide alternative shutdown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and Ill.L.7. This is considered an additional example of Unresolved Item 50-313;-368/9821-02 to request assistance from NRR to evaluate the omission of these valves from the licensing correspondence and to determine if the condition is consistent with the licensing basis.
A postulated fire in the Unit 2 control room or cable spreading room would cause LTOP Relief Isolation Valves 2CV-4740-2 and 2CV-4741-1, the redundant valves in a high/fow passure interface, to spuriously open. This may result in inability to provide alternative shuyiown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sectians Ill.L.1, Ill.L.2, and Ill.L.7. This is considered an additional example of Unres alved item 50-313;-368/9821-02 similar to the other LTOP valve example discussed above.
With respect to the Unit 2 reactor coolant system letdown isolation valves, the NRC's May 13,1983, SER stated that these valves were not of concern. In a similar manner as the Unit 1 reactor coolant system letdown isolation valves as discussed in Section F8.3, Procedure 2203.014 incorporated manual actions to de-energize these valves in the closed position following control room evacuation; however, the licensee did not evaluate whether sufficient time was available to perform these manual actions.
This may result in inability to provide alternative shutdown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and Ill.L.7.
This is considered an additional example of Unresolved item 50-313;-368/9821-02 to request ass.istance from NRR to determine if this condition is consistent with regulatory requirements.
The inspector also noted that the Unit 2 reactor vessel head vent valves,2SV-4668-1 and 2SV-4668-2; the Unit 2 high point vent valves,2SV-4636-1 and 2SV-4636-2; and, the reactor coolant system vent header valves,2SV-4669-1 and 2SV-4670-2, were identified in the Components of Interest List as direct reactor coolant system leak paths.
The NRC Inspection Report 50-313;-368/8714 identified that the flow capacity via these interfaces was less than that of the definition of a LOCA. However, the inspector noted i
that the FHA identified that inventory replacement may be delayed for approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> by limiting the rate of cooldown and maintaining a reactor coolant system leakrate less than the maximum allowed by the technical specifications. Spurious operation of
O
.
-18-the redundant valves in one of these interfaces may result in inability to provide alternative shutdown capability that meets the regulatory requirements of 10 CFR 50, Appendix R, Sections Ill.L.1, Ill.L.2, and lil.L.7. This is considered an additional example of Unresolved item 50-313;-368/9821-02 to request assistance from NRR to determine if this condition is consir, lent with the licensing basis.
To evaluate the safety significance of this issue, the licensee performed several calculations. These included: Calculation 98-E-0058-03, "Probabilistic Safety Analysis of ANO-2 Fire-Induced LOCAs," Calculation 98-E-0058-04, " Probability of Multiple Hot Shorts for LTOP/ECCS and High Point Vents," and Calculation 85-E-0072-04, " Time to Loss of Subcooling or Loss of Pressurizer Liquid Inventory with No Charging Pump Available Under Various RCS Leak Path Scenarios."
Calculation 98-E-0058-04 concluded that the frequency of occurrence of potential hot shorts in the control cables for the LTOP/ECCS vent valves and the reactor coolant system high point vent valves causing at least one open vent path that must be terminated from outside the control room was 1.96E-05/yr and 1.45E-06/yr, respectively.
Calculation 98-E-0058-03 concluded that the total core damage probability for a control room fire inducing an LTOP/ECCS vent valve LOCA was 1.88E-06/yr and the core damage frequency for a cable spreading room fire inducing an LTOP/ECCS vent valve LOCA was 7.06E-06/yr. This calculation also evaluated the risk cost / benefit of a proposed plant modification to remove power from the LTOP and ECCS vent valves,
>
which would prevent spurious operation. The results of this calculation indicated that the proposed modification resulted in a net increase in plant risk. This was because the vent paths would then be unavailable to be immediately used for non-fire-induced j
accidents involving loss of secondary system heat removal.
The ECCS vent valves were used in the emergency operating procedures to depressurize the reactor coolant system in order to use the HPI system following a loss of feedwater event for " feed and bleed" cooling. The licensee concluded that it was. not beneficial from a risk reduction perspective to prevent fire-induced spurious operation of the ECCS vent valves.
The LTOP relief isolation valves were not relied upon for accident mitigation. Their function was to be opened during plant startups and shutdowns to allow their associated relief valves to provide LTOP protection. Therefore, the licensee decided that power would be removed from Valves 2CV-4730-1 and 2CV-4741-1, which comprise the " red train" valves in each LTOP relief path. During startups and shutdowns, power to the subject valves would be restored to allow the valves to be opened and enable the LTOP function.
Calculation 85-E-0072-04 determined the time available prior to loss of subcooling margin or pressurizer liquid inventory for various high/ low pressure interface transients.
For spurious opening of an LTOP or ECCS vent path, subcooling margin was lost in less than 1 minute. Therefore, the licensee concluded that there was no manual action available that could mitigate this transient other than administrative controls to remove power from the valves. As discussed above, this option was chosen for the LTOP relief isolation valves but not the ECCS vent valve o
.
-19-Calculation 85-E-0072-04 also determined the time to isolate letdown system flow versus the time to regain charging system flow to prevent loss of prassurizer liquid inventory. For example, at maximum letdown system flow, if letdown flow was isolated at 11 minutes fo! lowing the start of the transient, charging flow must be initiated within approximately 27 minutes or pressurizer liquid inventory would be lost.
Evaluations were performed of other vent paths, including the reactor vessel and pretsurizer high point vents. Each was bounded by the letdown isolation time result.
The licensee revised Procedure 2203.014 to move performance of tims-critical steps earlier in the procedure. This increased the likelihood that a higMow pressure interface transient would b3 prevented or mitigated sooner.
The inspector toured the control room and cable spreading room. The fire detection and suppression system capabilities were similar to Unit 1. As a result of these discussions with the licensee regarding the probability and consequences of fire scenarios and operator actions following control room evacuation, the licensee initiated an hourly fire l
watch patrol of the control room and cable spreading room.
.
.
'
The inspector questioned whether the alternative shutdown capability was in compliance with the requirements of Appendix R because a postulated fire in the Unit 2 control room or cable spreading room would cause the redundant valves in any of several higMow
pressure interface paths to spuriously open. This may result in inability to provide l
alternative shutdown capability that meets the performance goals required by
'
Appendix R. However, due to questions regarding the licensing basis of the facility and in order to obtain additional technical review of the licensee's calculations, this issue will be forwarded to NRR. Assistance will be requested in determining if the alternative shutdown capability is consistent with the licensing basis, and if so, whether imposition of a backfit is warranted. The inspector considered the licensee's interim actions acceptable to address the safety significance of this issue pending further NRC review.
This is considered to be an example of an unresolved item involving alternative shutdown capability, pending completion of this review (50-313;-368/9821-02),
c.
Conclusions The inspector question whether the licensee's alternative shutdown capability met regulatory requirements. The licensee performed analyses to evaluate the risk associated with sptfrious operation of high/ low pressure interfaces and implemented j
additional administrative controls and procedure changes to increase the likelihood that spurious operation would be prevented or mitigated. Measures were established to
'
prevent or mitigate a higMow pressure interface for each major interface with the exception of the ECCS vent valves. Additional examples of an unresolved item were identified to request assistance for NRR to evaluate whether the alternative shutdown capability is acceptable. The licensee's representative provided a verbal commitment to maintain an hourly compensatory fire watch of the Unit 2 control room and cable spreading room until this issue was resolved.
.
.
.
-20-V. Manaaement Meetinas X1 Exit Meeting Summary The inspector conducted debriefing meetings with licensee representatives following the onsite portions of the inspection on November 19,1998, and February 11,1999.
Following additional in-office review, the inspector conducted an exit meeting via telephone on May 17,1999, to present the inspection results to licensee management.
The licensee's representatives acknowledged the findings presented but stated that a determination had not been made whether they were in agreement with the NRC's characterization of the Unit 1 HPl valve issue as a violation. However, the licensee's
'
representatives provided a verbal commitment that an hourly compensatory fire watch of the Unit 1 control room and cable spreading room would be maintained until the issue was resolved. Also, the licensee's representatives provided a verbal commitment that an hourly compensatory fire watch of the Units 1 and 2 control rooms and cable spreading rooms would be maintained until the high/ low pressure interface valve issue j
was resolved.
The inspector asked the licensee's representatives whether any materials examined during the inspection should be considered proprietary. No information supplied to the j
inspector was considered to be proprietary, J
F, ATTACHMENT
SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee C. Anderson, General Manager, Plant Operations G. Ashley, Licensing Supervisor B. Bement, Unit 2 Plant Manager M. Cooper, Licensing Specialist
,
E. Jacks, Supervisor, Unit 1 Operations Standards
)
D. James, Manager, Nuclear Safety i
J. Kowalewski, Manager, System Engineering R. Lane, Director, Design Engineering C. Olson, Operations Training J
J. Remer, Design Engineer R. Rispoli, Supervisor, Engineering Programs M. Smith, Manager, Engineering Programs M. Stroud, Manager, Electrical and Instrumentation / Control Design Engineering
-
J. Vandergrift, Director, Nuclear Safety W. Walker, Fire Protection Engineer D. Williams, Senior Staff Engineer C. Zimmerman, Unit 1 Plant Manager NRC
.
K. Kennedy, Senior Resident inspector D. Powers, Chief, Engineering and Maintenance Branch INSPECTION PROCEDURES USED 92904 Followup - Plant Support
l
l
>
,
-2-ITEMS OPENED AND CLOSED
'
Opened 50-313/9821-01 NCV Non-Cited Violation of 10 CFR Part 50, Appendix R, for not i
having adequate alternative shutdown capability. A postulated fire in the Unit 1 control room or cable spreading room could cause high pressure injection system valves to spuriously close, suffer mechanical damage, and not be able to be opened for reactor coolant system makeup capability (Section F8.1).
50-313;-368/9821-02 URI Potential for spurious actuation of reactor coolant system high/ low pressure interface components during a control room or cable spreading room fire may not be in compliance with 10 CFR Part 50, Appendix R, for attemative shutdown capability (Sections F8.2, F8.3, F8.4, and F8.5).
Closed
'
50-313/9821-01 NCV Non-Cited Violation of 10 CFR Part 50, Appendix R, for not having adequate alternative shutdown capability. A postulated fire in the Unit 1 control room or cable spreading room could cause high pressure injection system valves to spuriously close, suffer mechanical damage, and not be able to be opened for reactor coolant system makeup capability (Section F8.1).
50-313;-368/9623-01 URI Consideration of Multiple Hot Short Actuations (Section F8.1).
LIST OF ACRONYMS USED CFR Code of Federal Regulations ECCS emergency core cooling system electror$agnetic relief valve ERV
FHA fire hazards analysis HPl high-pressure injection LOCA loss-of-coolant accident LTOP low-temperature overpressure protection NRR NRC Office of Nuclear Reactor Regulation
SER safety evaluation report
I I
i*
l k
3.:
LIST OF DOCUMENTS REVIEWED Precedures j
Number Title Revision
)
1203.002 Alternate Shutdown - Unit 1 13,15 2203.014 Alternate Shutdown - Unit 2 14,14-02 Condition Reports Number Title Date CR-ANO-C-1996-0278, Compare Unit 2 safe July 1,1998 Corrective Actionitem 6 shutdown capability assessment to Fire Hazards
Analysis and Alternate
'
Shutdown Procedure j
.
CR-ANO-2-1998-0436 Alternate Shutdown November 19,1998 Procedure 2203.014 revised without adequate documentation CR-ANO-1-1998-0721 NRC inspection identified November 19,1998 that ANO did not consider 8
'
simultaneous hot shorts as a credible occurrence CR-ANO-C-1996-0046, Results and corrective April 28,1997
)
Corrective Action items 1 actions from NRC September 5,1997 and 11 Information Notice 92-18 study
.
,
CR-ANO-2-1998-0436, Effects of procedure November 19,1998 Corrective Action items 2,7, changes on alternate January 29,1999 and 8 shutdown timelines CR-ANO-C-1999-0045 ANO informed that current January 29,1999
.
,
i licensing basis for fire induced hot shorts may not be in compliance with 10CFR50, Appendix R, Section li l I
w.
-4-
-
Information Reauest Forms Number -
Title Date 8156 Safe Shutdown Service October 31,1996 Water Flow Requirements
'8158 System Response to Volume September 20,1996 Control Tank Outlet Valve Failure Enaineerina Reoorts Number Title Revision 97-R-0004-01 NRC Information Notice 92-18 " Hot Short" Evaluation
'
Calculations
!
Number Title Revision 98 E-0058-01 Probability of Hot Shorts 1 PC-2 Disabling All RCS Makeup Paths 98-E-0058-02 Probabilistic Safety Analysis
.1 PC-2 of ANO-1 Fire Induced
>
LOCAS 98-E-0058-03
' Probabilistic Safety Analysis
of ANO-2 Fire Induced -
LOCAS-98-E-0058-04 ANO-2 Probability of Multiple 1 PC-2 Hot Shorts for LTOP/ECCS and High Point Vent Valves 98-E-0058-05 Probability of Hot Short of
,
the ERV (PSV 1000) During I
a Postulated Fire j
96-E-0065-01 Unit 1 Safety Related Valve
i Survivability Evaluation Under Stall Thrust / Torque, Motor Operated Valves 96 E-0066-01
. Unit 2 Safety Related Valve O
Survivability Evaluation j
Under Stall Thrust / Torque, Motor-Operated Valves -
~
J
-
.
.
-5-
..
Number Title Revision 85-E-0086-01 Unit 1 Safe Shutdown
-
Capability Assessment 85-E-0087-01 Unit 2 Safe Shutdown
Capability Assessment 85-E-0072-03 Time to Loss of Subcooling
or Loss of Pressurizer Liquid Inventory from Plant Trip with No Makeup Available Under Various RCS Leak Path Scenarios 85-E-0072-04 Time to Loss of Subcooling
or Loss of Pressurizer Liquid Inventory from Plant Trip with No Charging Available Under Various RCS Leak Path
-
Scenarios Drawinas Number Title Revision M-230, Sheet 1 Piping and Instrument 102 Diagram - Reactor Coolant System - Unit 1 M-231, Sheet 1 Piping and Instrument 102 Diagram - Makeup and Purification System - Unit 1 M-231, Sheet 2 Piping and instrument
Diagram - Makeup and Purification System - Unit 1 M-2230, Sheet 1 Piping and Instrument
Diagram - Reactor Coolant
.
System - Unit 2 M-2230, Sheet 2 Piping and Instrument
Diagram - Reactor Coolant System - Unit 2 M-2231, Sheet 1 Piping and Instrument 129 Diagram - Chemical and Volume Control System -
Unit 2
p o.
.
-6-
-.
Miscellaneous Title Revision Unit 1 Operating License 192 DPR-51 Unit 2 Operating License 192 NPF-6 Unit 1 Updated Final Safety
Analysis Report Unit 2 Updated Finni Safety
Analysis Report Fire Hazards Analysis
Design Change Package May 14,1984 83D-1012 "ERV Block Valve isolation Switch"
'
ANO-1 Alternate Shutdown 13/PC-4 and 15 Procedure 1203.002 Basis Document ANO 2 Alternate Shutdown 14 and 14/PC-2 Procedure 2203.014
' Technical Guideline
.
O
I
'
u