IR 05000336/1999003
| ML20206N671 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 05/10/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20206N669 | List: |
| References | |
| 50-336-99-03, 50-336-99-3, NUDOCS 9905180030 | |
| Download: ML20206N671 (38) | |
Text
r U. S. NUCLEAR REGULATORY COMMISSION
REGION I
l Docket No.
50-336 Ucense No.
DPR-65 Report No.
50-336/99-03 Licensee:
Northeast Nuclear Energy Company Facility:
Millstone Unit 2 Dates:
March 22 - 26,1999 Inspectors:
R. Fuhrmeister, Division of Reactor Safety (DRS), Region I (RI)
P. Qualls, Office of Nuclear Reactor Regulation C. Cahill, DRS, RI R. Deem, Contract Engineer j
M. Villaran, Contract Engineer l
Approved By:
Lawrence T. Doerflein, Chief Engineering programs Branch Division of Reactor Safety
,
w 9905100030 990510 PDR ADOCK 05000336 G
pm
,
p
'
i EXECUTIVE SUMMARY
,
Millstone Unit 2 NRC Inspection Report 50-336/99-03
- This inspection consisted of a review of the actions taken by Northeast Nuclear Energy l
l Company to resolve Significant Issues List item 21, Fire Protection.
. Plant Supoort E The Millstone 2 safe shutdown methodology was found to be acceptable in a previously
-
l issued safety evaluation. The inspection team found no unresolved items within the l
areas inspected, and noted that the systems satisfy the performance goals of Appendix R. Therefore, the safe shutdown capability portion of the licensee's program was found i
to be adequate. (Section F2.1.1)
The level of protection provided for redundant trains of post-fire shutdown systems
-
satisfied the technical requirements of Section Ill.G and Ill.L of Appendix R to 10 CFR 50. (Section F2.1.2)
The licensee's administrative controls with respect to configuration control / Appendix R
-
compliance in the modification process were acceptable (Section F2.1.3)
The required maintenance and testing of the equipment supporting the Unit 1 electrical
-
backfeed to Unit 2 is up to date and is being tracked. (Section F2.1.3)
The timeline analysis performed for altemate shutdown did not accurately reflect the
-
conditions which could exist in that eventuality. Specifically, the analysis did not reflect the potential for the power operated relief valves, head vents, and letdown valves to remain open for up to five minutes after control room evacuation, due to bottle up panel cables being unprotected in fire area R-1. (Section F2.1.4)
,
The licensee's analysis and method of protection for fire-induced spurious equipment
-
operations satisfied Section Ill.G or Ill.L of Appendix R to 10 CFR 50. (Section F2.1.5)
A fire barrier penetration seal was installed and ins'pected in accordance with the
-
installation procedure, and the manufacturer's installation instructions. The installers and quality control (OC) inspector were knowledgeable of the procedural requirements and were properly trained. (Section F2.3.1)
The licensee has adequately implemented the commitment to perform inspections of.
i
-
silicone foam fire penetration seals for voids and material problems when the seals were
]
repaired or replaced. The seal inspection conducted by the Fire Protection Engineer was j
professionally performed and no seal deficiencies were identified. (Section F2.3.2)
i i
i
!
\\
.
il
.
.
l
-
,
During the review of the post-fire shutdown procedures, some problems were identified
-
related to sequencing of DC control power actions in the Unit 2 procedures, and some actions were not well coordinated between the Unit 1 and Unit 2 procedures. (Section
'
F3.1.1)
The plant equipment being used for post-fire safe shutdown was in good material
,
-
condition and attemative chutdown capability could be operationally implemented in a timely manner with the current staffing level of operating shift. (Section F3.1.2)
l The licensee effectively implemented the fire barrier inspection of the group 9 seals.
-
Additionally, the licensee identified deficiencies because of the increased training of the Site Fire Protection personnel, greater awareness of fire boundaries integrity on the site, and an improved inspection procedure. The corrective actions for the deficiencies appeared to be reasonabic. (Section F3.2)
The post-fire safe shutdown operator training and qualification tasks were
-
comprehensive, and reflecteri the current approved revision of the safe shutdown procedures. The tasks covered major steps in the procedures in sufficient detail to ensure the adequacy of the operators' level of understanding. (Section FS.1)
The inspectors determined that the augmented shift manning in place was adequate for
-
the performance of post-fire shutdown activities. The CONVEX procedure and manning appeared to provide adequate controls for deenergizing the offsite feeds to the electrical distribution system. (Section F6.1)
The audits and assessments of the Fire Protection Program conducted since the autumn
-
of 1996 have been effective in identifying deficiencies and areas for improvement. In addition, they have included followup of audit findings through the use of the corrective action program. (Section F7.1)
Fire brigade training and fire drill performance were acceptable.
-
l
,
Y iii l
i TABLE OF CONTENTS PAGE EXEC UTIVE S U M M ARY..................................................... ii TAB LE O F C O NTE NTS....................................................... iv F2 Status of Fire Protection Facilities and Equipment........................... 1
' F2.1 Post-Fire Safe Shutdown Capability................................ 1 F2.1.1 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown Ca p a bility............................................ 1 F2.1.2 Separation of Post-Fire Safe Shutdown Functions................ 6 F2.1.3 Operability of Post-Fire Safe Shutdown Capability.........
. 10
...
F2.1.4 Alternative Post-Fire Safe Shutdown Methodology.............
F2.1.5 Associated Circuits....................................
F2.2 Emergency Lighting and Communications.................
......
F2.3 Fire Barrier Penetration Seals.................................
F2.3.1 Fire Barrier Penetration Seal Installation....
.............24 F3 Fire Protection Procedures and Documentation.......................
. 26 F3.1 Operational Procedures and Operator Readiness.................... 26 F3.1.1 Post-Fire Safe Shutdown Procedures and Alternative Safe Shutdown Capability Procedures...........................
......
F3.1.2 Alternative Post-Fire Safe Shutdown Procedure Walkdown.......
F3.2 Fire Penetration Seal Inspection Procedure Review.................... 27 F5 Fire Protection Staff Training and Qualification............................. 28 FS.1 Post-fire Safe Shutdown Operator Training......................... 28 F6 Fire Protection Organization and Administration........................... 29 F6.1 Post-Fire Safe Shutdown implementation Staffing................... 29 F7 Quality Assurance in Fire Protection Activities.............................. 30
.
F7.1 Prog ra m Audits.......................'....................... 30 F8 Miscellaneous Fire Protection issues.................................... 31 F8.1 (Closed) Violation 50-336/98-05-010.............................. 31 F8.2 Other SIL 21 1ssues......................................... 31 F8.2.1 (Closed) Fire Brigade Training........................... 31 F8.2.2 (Closed) Fire Drill Performance........................... 31 F8.2.3 Thermo-Lag issues..................................... 32
.
iv
. - -..
.
.
.
.
_ _ _ - _ _ _
.
_ - - _ _ _ _ -
_
_
-
Reoort Details Backaround During an inspection conducted in 1996, the Nuclear Regulatory Commission (NRC) noted significant deficiencies in the Fire Protection Program for the Millstone Station. These
'
deficiencies are documented in NRC Combined Inspection Report 50-245/96-08; 50-336/96-08;50-423/96-08. The deficiencies included: quality assurance audits of limited scope, lack of followup on audit issues, lack of program direction for resolving and prioritizing identified issues, poor performance during a fire drill, and design issues which could affect the ability to safely shut down the reactor in a post-fire environment. Subsequent to that inspection, Northeast Nuclear Energy Company (NNECo) identified additional problems with the fire protection program. These issues were combined into Significant issues List (SIL) Item 21, Fire Protection j
Program.
'
Resolution of these deficiencies was documented in the SIL ltem 21 Closecut Package, issued March 5,1999, by NNECo.
This inspection consisted of a review of the SIL ltem 21 Closecut Package, observation of the condition of equipment in the plant, inventory of cold shutdown repair materials in the war' house, observation of an unscheduled fire drill, review of the site fire department training e
program and facilities, walk-through of a post fire shutdown procedure, and discussions with personnel.
F2 Status of Fire Protection Facilities and Equipment F2.1 Post-Fire Safe Shutdown Capability F2.1.1 Systems Reauired to Achieve and Maintain Post-Fire Safe Shutdown Caoability a.
Insoection Scoce (Inspection Procedure 64100)
The inspection team reviewed the licensee's post-fire safe shutdown methods to determine if the systems defined for use to achieve a'nd maintain safe shutdown conditions satisfied the reactor performance goals established by Appendix R to Title 10 of the Code of Federal Regulations, Part 50 (10 CFR 50).
b.
Observations ard Findinas The systems used to achieve post-fire safe shutdown must be capable of achieving the following performance goals:
Reactivity control capable of achieving and maintaining cold shutdown reactivity
-
conditions (K, < 0.99).
Heat removal capable of achieving and maintaining reactor coolant system (RCS)
-
temperature less than or equal to 200* F.
I w
-
L
Reactor coolant makeup capable of maintaining water level within the level
-
lndication of the pressurizer at all times during shutdown operation.
Process monitoring capable of providing direct readings to perform and control
-
i l
the above functions.
i l
Supporting functions capable of providing process cooling, lubrication, etc.
-
l necessary to permit operation of the equipment used for safe shutdown.
.
The equipment and systems used to achieve and maintain hot standby conditions must be free of fire damage during accomplishment of the above goals. Additionally, the l
equipment and systems used to achieve and maintain cold shutdown conditions must be
!
either free of fire damage or the damage must be limited to allow repair of the systems necessary to achieve and maintain cold shutdown conditions from either the control room or emergency control stations within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
i
'
During post-fire safe shutdown, the reactor coolant system process variables must be maintained within those predicted for a loss of normal attemating current (AC) power, and fission product boundary integrity must be maintained; i.e. there shall be no damage to the fuel cladding, and the integrity of containment and primary coolant system pressure boundary must be maintained.
Safe Shutdown, as defined by Northeast Utilities for the Millstone Nuclear Power Station Unit 2 includes the following plant conditions:
Hot Standby or Hot Shutdown: The reactor coolant system temperature is
-
greater than 200*F and K.,is less than 0.99, Cooldown: The transient condition between hot and cold shutdown, and
-
Cold Shutdown: The reactor coolant system temperature is equal to or less than
-
200'F and K.,is less than 0.99.
The following paragraphs provide a detalied evaluatidn of the licensee's approach to meet the post-fire safe shutdown performance goals described above, as referenced in the Millstone Nuclear Power Station Unit 2 (MP2) Safe Shutdown Analysis (SSA).
Reactivity Control Function The reactivity control function is required to maintain the reactor core in suberitical conditions (Keff < 0.99) from reactor trip through cold shutdown. This requires l
compensation for any positive reactivity increases due to Xenon decay, RCS cooldown, or any boron dilution in the RCS. Reactor trip is accomplished from the control room by utilizing the manual reactor trip button in the main control room or from outside the control room by manually opening one of two control element drive mechanism (CEDM)
motor-generator (.MG) set input breakers (B0608 and B0505). Reactivity monitoring may be accomplished by monitoring the excore neutron flux instrumentation (Ji-001, Ji-002, r
..
- _ - _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ - _.
Ji-003, JI004 or Ji-001B,JI-0028) in the control room or from the neutron flux instrumentation located on the Hot Shutdown Control Panel (HSCP) (JI-0028-1].
Reactivity control is accomplished by using the charging system to inject borated water into the Reactor Coolant System (RCS) via the Chemical and Volume Control System (CVCS) makeup flowpath. There are two sources of borated water; the Boric Acid Storage Tanks (BAST) (short term) utilizing gravity feed, and the Refueling Water Storage Tank (RWST) (long term). Injection of borated water into the RCS compensates for reactivity increases due to Xenon decay and RCS temperature decreases.
Reactor Coolant System Inventory and Pressure Control RCS inventory control employing natural circulation to cool down is different from a normal reactor trip cooldown. With normal letdown isolated, required makeup has to be minimized to prevent the pressurizer from go:ng solid; the RCS cooldown also reduces the RCS water volume. The only need for raakeup is RCS boration and reactor coolant pump (RCP) seal cooling, if the RCPs are not stopped. RCS inventory controlis accomplished by the following:
RCS inventory makeup (when necessary) is accomplished by using the positive
-
displacement charging pumps with either the BASTS or the RWST as a source of borated makeup. Charging is manually controlled via the makeup flow path.
Pressurizer level indication is provided by Ll-110X or Li-110Y in the Control
-
Room or LI-103-1 on the HSCP.
RCS inventory loss is controlled by isolation of normal letdown, reactor vessel
-
head vente, and pressurizer power operated relief valve (PORV) isolation.
The RCS/ Shutdown Cooling (SDC) boundary is isolated by closure of SDC
^
-
isolation valves 2-SI-652 and 2-SI-651.
During the hot standby period, with the RCS isolated, the only makeup needed is
-
for RCS boration and during plant natural circulation cooldown for RCS contraction. Two pressurizer safety relief val 9es (2-RC-200, and 2-RC-201) are provided for overpressure protection of the RCS in hot shutdown. During a controlled cooldown, the pressurizer power-operated relief valves (PORVs) and the pressurizer are designed to ensure that the RCS pressure - temperature limits are not exceeded. To prevent inadvertent RCS depressurization, the pressurizer auxiliary spray and the normalletdown flow paths are isolated. The preferred method of pressure control is pressurizer level control using normal makeup, ambient losses, and inventory shrinkage. The pressurizer PORV is only operated if an increased depressurization rate is required. During cooldown, RCS pressure and temperature are monitored to verify that the plant does not exceed its cooldown curve limit of 80'F/hr when the RCS is above 230*F, and 30*F/hr when the RCS is between 230*F and 100*F.
.
l
-..
.
Reactor Heat Removal Function and Secondary Side Pressure and Level Control The RCS consists of two similar heat transfer loops connected in parallel to the reactor vessel. Each loop contains two reactor coolant pumps and one steam generator, along with associated piping and instrumentation. The natural circulation capability of the RCS provides a means of decay and sensible heat removal when the reactor coolant pumps are unavailable in the event of a loss of off-site power. During natural circulation, adequate primary to secondary heat transfer, RCS subcooling, and make-up inventory
- must be maintained. The auxiliary feedwater system (AFW)is required to support RCS decay heat removal and to provide steam generator inventory control. The AFW system uses the condensate storage tank (CST) for a source of secondary water. The AFW system includes one turbine-driven and two motor-driven pumps. The Turbine driven pump is used to feed steam generator #2, but can be used to feed both steam generators. The main steam (MS) system is protected against over-pressurization by a bank of eight code safety valves located on each steam line upstream of the main steam isolation valves (MSIVs). Additionally, upstream of the code safety valves, each steam line is provided with an Atmospheric Dump Valve (ADV) for relief protection, which can be manually actuated. The code safety valves and ADVs are accessible from outside containment, in the event a fire requires safe shutdown, auxiliary feedwater flow is sufficient to restore and maintain steam generator water levels above the lower limit of the steam generator narrow range level indication. The steam generator code safety valves are used as needed to remove decay heat during hot shutdown and the ADVs for cooldown to cold shutdown conditions. If the Unit 2 CST water supply becomes depleted, the fire water tanks can be manually aligned to provide an alternate source of water to the AFW system. If instrument air is available, the ADVs may be controlled remotely from the control room or the remote shutdown panel (C-10). If instrument air is not available, the ADVs are controlled locally from the turbine building.
Process Monitorina System While maintaining the plant in hot shutdown conditions and during the transition to cold shutdown, the operators require process monitoring system support. The following process' instruments are provided for safe shutdown:
Pressurizer Level
-
Steam Generator Level
-
Steam Generator Pressure
-
,
I RCS Temperature
-
Pressurizer Pressure
-
Excore Neutron flux
-
CST Level
-
BAST Level
-
RWST Level
-
.
,.
.
.-
..
.
.
.
. _ _ _ - _ - _ -. - _ _
These instruments provide the process monitoring information required to achieve and
'
maintain the reactor coolant makeup, pressure control, and decay heat removal functions. Additionally, the process monitoring instrumentation supports monitoring natural circulation conditions, core reactivity, RCS subcooling margin, and compliance with the Unit 2 technical specifications pressure / temperature and cooldown limits.
Sucoort Systems
' The systems and equipment used to achieve the safe shutdown functions require miscellaneous supporting functions, such as alternating current and direct current power, lubrication, heating ventilation and air conditioning (HVAC), and process cooling. The support systems required to maintain acceptable performance of the safe shutdown components are:
i Emergency power distribution system
-
Service Water (SW) system
-
Reactor Building Closed Loop Cooling Water (RBCCW) system
-
-
Communications system
-
Alianment of Unit 1 Electrical Backfeed and Self-induced Unit Blackout for up to 4 hrs While reviewing the licensee's Safe Shutdown Analysis (SSA), the inspection team determined that for alternate safe shutdown (fire area R-1) and at least one control room shutdown area involving the Lower 4160 Switchgear Room (fire area R-14), the shutdown process involved removing all electrical power to the unit for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
Review of the MP2 Individual Plant Evaluation for External Events (IPEEE) showed that a fire causing the loss of direct current (DC) bus A accounted for 35% of the unit's internal fire risk. Subsequent to tripping the reactor, all sources of electrical power are secured and all DC sources de-energized. Removing DC power is performed to ensure all solenoid operated valves, such as primary and secondary isolation valves, go to their fall safe positions. It also removes control power to electrical switchgear, which is performed to prevent fire induced false signals from causing mal-operation of equipment that could result in equipment damage. When questioned about the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> duration, the licensee stated that this is the time that could be necessary to establish and align the electrical backfeed from Unit 1, remove non-essential electrical loads and re-align the Unit 2 electrical buses. The inspection team noted that using electrical isolation to mitigate spurious operation of equipment due to fire damage would limit the operators'
mitigation capability and was not the most desireable approach, given the risk potential loss of DC power creates. However, the inspectors noted that the Office of Nuclear Reactor Regulation, on page 13 of the July 7,1990, Safety Evaluation Report (SER),
previously reviewed, and found acceptable, the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> delay in restoration of electrical power.
.
r-
Cold Shutdown When the RCS temperature and pressure have been reduced to less than 300*F and 265 psig, the SDC system is placed in service. During cold shutdown operation, reactor coolant flows from the RCS to the Low Pressure Safety injection (LPSI) pumps through the tube side of the SDC heat exchangers, where heat is transferred to the RBCCW system. The inlet (suction) lines to the SDC system are connected to the hot legs of both RCS loops. The SDC retum (discharge) lines are connected to each of the RCS cold
' legs. The desired RCS cooldown rate is maintained by throttling the flow through the SDC heat exchanger, c.
Conclusions The Millstone 2 safe shutdown methodology was found to be acceptable in a previously issued safety evaluation. The inspection team found no unresolved items within the areas inspected, and noted that the systems satisfy the performance ' goals of Appendix R Therefore, the safe shutdown capability portion of the licensee's program was found to be adequate.
F2.1.2 Seoaration of Post-Fire Safe Shutdown Functions a.
Inspection Scooe The inspectors reviewed Revision 3 to the Millstone Unit 2 Appendix R Compliance Report, which contains the analysis of the conditions which could exist in the post-fire environment, and the actions necessary to achieve safe shutdown after a fire in various areas of the plant.
,
b.
Observations and Findinos For fire areas other than those requiring an altemative or dedicated shutdown capability, Section Ill.G.1 of Appendix R to 10 CFR 50 requires, in part, that fire protection features be provided that are capable of limiting fire damage so that: (a) one train of systems necessary to achieve and maintain hot shutdown cortditions from either the control room or emergency control stations remains free of fire damage; and (b) systems necessary to achieve and maintain cold shutdown conditions from either the control room or emergency control stations can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
.
,
Validity of Safe Shutdown Analysis The licensee conducted a detailed review of the MP2 Appendix R compliance strategy and program documentation between 1997 and 1998. The review resulted in a major update and revision (Revision 3) of the MP2 Appendix R Compliance Report. The following items describe the scope and results of the licensee's review, as well as the inspection team observations:
' Fire Area Configuration Review - Licensing review of the documentation for fire area
definition per Generic Letter 83-3 definitions. Appendix R Analysis Areas and associated eval.uations ano exemptions were also reviewed.
Review Safe Shutdown System and Component Selection and Performance Goals - A 100% review, by NNECo, of system and component selection and update of the Appendix R analysis model. This resulted in the addition of several new safe shutdown (SSD) components: service water system strainers, HVAC devices (integrated into the SSD model), RCP breaker control circuits (as a means to address spurious spray valve operation), pressurizer heater breaker control circuits (as a means to ensure remote trip capability), wide range steam generator level instrumentation, AFW flow indicators and selected temperature indicators, and emergency diesel generator (EDG) DC air compressors. Other devices were deleted from the analysis.
Validation of Cable Selection - Since no methodology for the earlier effort was documented, a validation of the cable selection for approximately 50% of existing SSD devices was performed by NNECo to demonstrate that prior cable selection had been performed correctly. Complete cable selection for all new SSD devices being added to the analysis was performed. Cable selection for additional components was performed while incorporating the results of plant modifications into the Appendix R analysis. In total, the cable selections for approximately 82% of electrical SSD components were reviewed by NNECo.
Validation of SSD Component and Cable Location - Validation of a sampling (10%) of SSD components for location and supporting cable routes was performed. The routing for an additional 150 randomly selected Appendix R cables was checked to ensure that there were no adverse impacts on Appendix R compliance.
I Review Plant Modifications Since 1994 - Modifications, which were identified, were incorporated into the Appendix R analysis.
Review Manual Actions and Emergency Lights - Those manual actions which were credited in the 1998 re-analysis were walked down. Accessibility and emergency lighting were evaluated. Deficiencies in emergency lighting were identified, documented and corrected through the installation of additional Appendix R lights, upgrade of existing non-Appendix R lights, and relocation of existing light heads under engineering work
,
request (EWR) 97-118B.
.
Computer Analysis - For Revision 3 of the Compliance Report safe shutdown methods were reviewed using an interactive database management system, entitled " Integrated Nuclear Data Management System"(INDMS). The INDMS is used to collect information on the location of SSD equipment, cables and associated raceways. The logical relationships, or Boolean Logics, are developed for cables-to-components, components-to-components, components-to-system, and system-to-SSD method. Then, by defining
.
the logical relationships among systems, components, and cables, the analysis was performed.
A number of changes resulted from the licensee's 1997-98 Revision 3 review of the Millstone 2 Appendix R Compliance Report. Some of the significant changes were:
Compliance strategy change in Fire Area R-3 no longer credits the Unit 1
-
backfeed.
New topical analyses for HVAC, Thermolag fire barrier issues, Information
-
Notice (IN) 92-18 modifications, Spent Fuel Pool temperature monitoring, manual action feasibility, and spurious actuation of engineered safeguards features (ESF)
systems.
-
Additional emergency lights to support operator actions.
-
Migration of data to a new analysis software platform and associated new reports
-
documenting the compliance strategy in each area.
Complete review and editing of the text sections of the Appendix R Compliance
-
Report.
Cable Routino Review The inspectors evaluated, on a sample basis, the adequacy of separation provided for power, control, and instrumentation cabling associated with redundant trains of shutdown equipment. The evaluation addressed cabling of components associated with decay heat removal, reactor coolant makeup, and shutdown cooling functions and included a sample of components whose inadvertent operation due to fire may adversely affect the post-fire safe shutdown capability. The specific components selected for review include:
the main steam isolation valves (MSIVs) (2-MS-64A & B), MSIV Bypass Valves (2-MS-64A & B), Reactor Water Storage Tank (RWST) to Charging Pump Suction Motor Operated Valve (MOV) (2-CH-504), RWST to Charging Pump Suction Air Operated Valve (AOV) (2-CH-192), Steam Generator 1 (S/G 1) Atmospheric Dump Valve (2-MS-190A), Steam Generator 2 (S/G 2) Atmospheric Dump Valve (2-MS-1908), AFW Flow Control AOV to S/G 1 (2-FW-43A), AFW Flow Control AOV to S/G 2 (2-FW-438),
Turbine Driven AFW Pump Discharge MOV (2-FW-44), and PT-4224 S/G 2 Atmospheric Dump Valve (2-MS-1908) position I/P instrument loop controller.
.
The adequacy of separation provided for cables of equipment associated with essential safe shutdown functions was based on a review of the following information:
'
(a)
Cable routing information retrieved from the MP2 computerized " Integrated Nuclear Data Management System"(INDMS),
(b)
Post-fire safe shutdown compliance strategies and separation analyses as documented in the MP2 Appendix R Compliance Report Revision 3, and (c)
Color-coded conduit and cable tray routing drawings prepared by the licensee
'
during the inspection.
As a result of this review, plant areas were identified where cables of redundant trains of components appeared to interact. For the purpose of this review, an interaction was identified whenever cables of redundant shutdown paths and/or divisions were shown on the INDMS cable logics and cable routing computer reports and on the cable tray routing drawings as being in the same fire zone. Following their identification, a sample of interactions was then selected by the inspectors for review and field verification to assess the comprehensiveness of the MP2 post-fire safe shutdown analysis and determine the adequacy of their dispositiori. No unacceptable conditions were noted during this review.
Conformance to Acoroved Exemotions in reviewing the licensees' SSA, the inspection team noted that the auxiliary feedwater discharge valves (2-FW-43A and 2-FW-438) used for post-fire safe shutdown were located in the same fire area. Review of an Appendix R inspection (50-336/87-16)
previously performed indicated that the licensee was cited for a Ill.G.2 violation of 10CFR50, Appendix R for these specific valves. Team inspection of the valves showed no modifications had been made and that no compensatory measures appeared to be in place. When questioned about this, the licensee stated an exemption now existed for these valves. Documentation was provided to the inspection team showing that NRC granted an exemption for these valves in May,1988.
It was also noted in review of the licensee's SSA that all three charging pumps used to provide RCS makeup and boration for reactivity contPol were located in the same fire area. When questioned about this, the licensee stated an exemption request was submitted in August,1998, concerning the charging pumps. The inspection team confirmed that this exemption was granted by NRC on March 16,1999.
'
c.
Conclusion l
For the sample of circuits selected for review during the inspection, the level of protection l
provided for redundant trains of post-fire shutdown systems satisfied the technical requirements of Section III.G and lil.L of Appendix R to 10 CFR 50.
.
I
<
F2.1.3 Ooerability of Post-Fire Safe Shutdown Caoability a.
Insoection Scooe During,the onsite inspection, the team reviewed how the licensee assured that the systems required for safe shutdown remained operable and available during maintenance periods and what surveillance testing was performed on them. The inspection team also reviewed the design modification process to evaluate the effect of
- modifications on Appendix R compliance. A representative sample of the licensee's administrative controls was inspected, as well as configuration controls of the safe shutdown equipment. The inspection team reviewed how operations would implement safe shutdown, given that a required system / train was isolated for maintenance purposes or surveillance testing.
b.
Observations and Findinas During a plant walkdown the physical condition of the equipment in the plant showed it to be well maintained. Components were properly labeled, with Appendix R equipment clearly identified. Equipment used to implement Appendix R safe shutdown is controlled in the Millstone Unit 2 Technical Requirements Manual (TRM). The surveillance
'
requirements for safe shutdown components were also contained in the TRM.
,
Equipment and tools required to implement cold shutdown repairs were also inspected.
The equipment listed in SFP 21, Rev.0 and contained in safe shutdown procedure AOP
2579AA, Rev.4 was compared to the equipment stored in the onsite warehouse. All
!
equipment required to perform cold shutdown repairs was stored in the onsite warehouse in a designated area for Appendix R exclusive use.
Confiauration Control /Accendix R Consideration in Plant Modifications l
A representative from the licensee's plant modifications group was interviewed
- concerning the existence of administrative controls in the plant modification and design
!
change process to include Appendix R considerations. The controlling document for all plant changes is the Millstone Nuclear Power Station Design Control Manual (DCM)
Revision 6, change 12. Chapter 3 of the DCM, entitl&d " Design Changes," provides
,
'
instruction for preparation of design change details, including the preparation of Form 3-28, " Supporting Design Change Package Details." This form details the required items that make up a valid Design Change Record / Minor Modification (DCR/MMOD) package.
Among the required items is completion of Form 3-2C, " Design Engineering Screening i
Evaluation ", which includes as item D. an Appendix R Compliance Review consisting of ten questions concerning the effect of the proposed changes on Appendix R compliance.
i l
If any of these ten questions are answered in the affirmative, then a detailed Appendix R/ Branch Technical Position (BTP) 9.5-1 Review must be completed by the respective Unit Appendix R Coordinator per the Fire Protection Program Instruction No. 2 (PI-2).
j
!
\\
-
l
-
d
.
Two recent plant modification packages were selected for review to verify that the modification process evaluates the potential effect of the modifications on Appendix R compliance. DCR M2-98031, Revision 1, Replacement / Reroute of Cables for Charging Pumps P18B and P18C, dated January 15,1999, identified the modification as Appendix R related and the required reviews described above were performed as part of the package. MMOD M2-98032, Revision 0, Valve 2-RB13.1B Components: Solenoid Operated Valve, Limit Switches and Associated Field Wiring Replacement, dated April 8,1998, reviewed and documented that the proposed replacements would have no
- effect on Appendix R compliance. These appeared to appropriately address Appendix R issues.
Unit 1 Electrical Backfeed to Unit 2: Eauioment Periodic Maintenance / Administrative Controls if offsite power is unavailable and the Unit 2 emergency diesel generators are disabled, it is possible to supply 4160VAC power to Unit 2 from the existing Unit 1 backfeed. The Unit 1 backfeed is capable of providing power from Unit 1 emergency buses 14C,14D, or the reserve station service transformer (RSST) to Bus 14H and then to Unit 2 Bus 24E.
The Unit 1 emergency diesel generator (EDG) will be credited to energize Bus 14H (via bus 14C or bus 14D) when providing power to Unit 2. The Unit 1 EDG loading calculation 98-EDG-01898E1 and Fuel Inventory Calculation M1-ENG-01877-M1 A evaluated and verified the capability of the Unit 1 EDG to support the Unit 2 Appendix R safe shutdown loads.
A representative from the licensee's electrical maintenance group was interviewed concerning the periodic maintenance requirements for electrical equipment necessary to support the Unit 1 electrical backfeed to Unit 2. The Unit 2 4160VAC switchgear breakers are inspected and maintained via Procedures MP2M Form 2701J-117 "4160-6900 Volt Breakers" and MP 2720C3 "GE Model AM Magne-Blast Circuit Breaker Maintenance" once every 3 years. The Millstone Preventive Maintenance Management System (PMMS) is used to track the status of work orders for plant equipment. When a
'
preventive maintenance activity (PM) is completed, a'new automated work order (AWO)
is generated to perform the surveillance /PM for the next cycle, and the AWO is entered into the PMMS where it wa be tracked for performance when the next PM is due.
The Unit 1 Bus 14H 4160VAC switchgear breakers are inspected and maintained under procedure PT1422B "MP1 Bus 14H Vacuum Breakers and Switchgear Tests." This work was previously performed on a once per refueling cycle frequency. Since Unit 1 is permanently shutdown the performance frequency was changed in March 1999 to once per 5 years per PMCR 99-1116. PMMS will identify the next AWO to perform the PM and will be revised to reflect the 5 year frequency.
~
.
.
m
The Unit 1 Bus 14C and 14D 4160VAC switchgear breakers required to align the Unit.1 EDG to suppr 4 the backfeed to Unit 2 are inspected and maintained via Procedures MP 772.1 "GE Mudel AM Magne-Blast Circuit Breaker Maintenance" on a once per refueling cycle frequency. The inspection team was concerned about the administrative control of the periodic maintenance for the Unit 1 equipment supporting the backfeed and maintaining these controls in the future until the final status of Unit 1 and its equipment has been determined. Condition Report CR M1-99-0171/CR M2-99-1137 was written to l
address th'e concern that the PM frequency for these Unit 1 breakers needs to be i
changed to support the Unit 2, Appendix R, TRM requirements.
Samples of the most recent 4160VAC switchgear PM for Unit 2 (AWO M2-98-08022, i
January 1999, for breaker A312), Unit 1 Bus 14H (AWO M1-92-10793, January 1996, for breaker A601 and AWO M1-92-10797, September 1995, for breaker A602), and Unit 1
,
l Bus 14D (AWO M1-99-00289, January 1999, for breaker 4160-14D-2) were reviewed by I
the inspection team. The review verified that PMs associated with the backfeed circuit breakers were current and being tracked by the Millstone PMMS.
'
l c.
Conclusions The team concluded from the review of the Design Change Manual and samples of recent modification packages that the licensee's administrative control with respect to configuration control / Appendix R compliance in the modification process was acceptable.
Based upon its review of the maintenance records for the equipment supporting the Unit 1 electrical backfeed to Unit 2, the inspection team verified that the required maintenance and testing is up to date and is being tracked by the Millstone PMMS. Follow up by NNECo is required on the administrative control for periodic maintenance of Unit 1 equipment supporting the Unit 2 Appendix R TRM requirements and final disposition of Unit 1 equipment responsibility, once the long term status of Unit 1 has been finalized.
Within the areas inspected, the team did not identify any unresolved items.
F2.1.4 Altemative Post-Fire Safe Shutdown Methodoloav a.
Insoection Scope
.
A sample of required safe shutdown equipment listed in the MP2 SSA was selected for detailed evaluation. The objective of this evaluation was to assure the equipment design, layout, and post-fire safe shutdown analytical approach satisfied the Appendix R performance criteria for safe shutdown from outside the main control room.
l b.
Observations and Findinos l
l The licensee provided the timeline analysis that supported the implementation of post-fire safe shutdown procedures. The team was specifically concerned about the time constraints placed on performing required operator manual actions with the manning levels available to implement post-fire safe shutdown from outside the main control room,
given the potential of no electrical power for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> subsequent to control room i
evacuation. The licensee provided the inspection team with a RETRAN analysis of the l
l t
)
R-1 fire area. After reviewing the documentation, discussions with the licensee were held dealing with the applicability of the boundary conditions used and the adequacy of the analysis to enve! ope an Appendix R fire scenario. During these discussions the I
team pointed out that isolation of letdown and the reactor head vents would not occur until the DC control power to the solenoid valves was removed, and that the PORVs could be subjected to spurious operation until they were manually isolated. Therefore, the assumption of a constant RCS leakage of 13 gpm subsequent to reactor trip would not be bounding for RCS leakage. The inspection team had similar concerns about isolation of the main steam system, and securing of the main feedwater pumps in the analysis.
In response to the inspection team's concerns regarding the analysis, the licensee issued CR M2-99-1154, which involved developing a timeline that encompasses the potential for spurious actuations. In addition, the CR will revise the existing SSA and j
safe shutdown procedures as warranted by the results of the re-analysis.
c.
Conclusions The team concluded that the timeline analysis performed for attemate shutdown did not accurately reflect the conditions which could exist in that eventuality. Specifically, the analysis did not reflect the potential for the PORVs, head vents, and Ictdown valves to
{
remain open for up to five minutes after control room evacuation, due to bottle up panel I
cables being unprotected in fire area R-1, which contains the control room. This difference could a*fect the time available until charging would be necessary to maintain l
RCS inventory, and, therefore, the time for restoring electrical power.
F2.1.5 Associated Circuits a.
Insoection Scope
<
The potential effect of fire on associated circuit configurations was evaluated on a
- sample basis. This assessment included an evaluation of a selected sample of power, control, and instrument circuits for potential fire-initiated problems. The specific sample of circuits selected for review was based on an evaluhtion of components and equipment designated by the licensee as necessary for the achievement of safe shutdown performance goals.
b.
Observations and Findinas Section Ill.G of Appendix R to 10CFR50 specifies, in part, that associated non-safety circuits and cables that could prevent operation or cause maloperation of structures, systems and components important to safe shutdown, should be provided with a level of fire protection necessary to ensure such circuits will remain free of fire damage. Options for providing this level of fire protection are specified in Section Ill.G.2 of Appendix R.
.
in Generic Letter (GL) 81-12 dated February 20,1981, and its subsequent clarification, dated March 22,1982, the NRC provided the principal staff guidance regarding potential configurations of associated circuits of concem to post-fire safe shutdown capability. In addition, the staff, through the issuance of additional Generic Letters and Information Notices, has presented other opportunities for licensees to recognize the potentialimpact that fire-induced failures in associated circuits may have on the implementation of post-fire safe shutdown capability. Specifically, additional guidance related to this issue was disseminated in IN 84-09, IN 85-09, IN 92-18, and GL 88-10. As described in these documents, associated circuit configurations of concern to post-fire safe shutdown include:
~. Circuits which share a common power supply (e.g., Switchgear, Motor Control
=
l Center, Fuse Panel) with circuits of equipment required to achieve and maintain
)
safe shutdown; or, Circuits which share a common enclosure, (e.g., raceway, conduit, junction box,
.
etc.) with cables of equipment required to achieve and maintain safe shutdown; or, Circuits of equipment whose spurious operation or mal-operation may a
adversely affect the successful accomplishment of safe shutdown functions.
Review of Circuits Associated by Common Power Sucolv The Common Power Supply associated circuit concem is found when non-essential equipment shares a common power supply (for example switchgear, motor control center (MCC), distribution panel, or junction box) with equipment required to perform a safe shutdown function. In the absence of adequate fire protective features (per Section Ill.G.2 of Appendix R) or electrical coordination (selective tripping), fire-induced faults on branch load circuits of a required power supply may propagate to cause a trip (open) of a protective device (i.e. circuit breaker, relay, fuse etc.) located upstream of the supply, prior to actuation of the individual branch load protective device. This condition is unacceptable since it would result in a loss of electrical power to all loads powered from
!
the affected supply.
j J
.
Electric power sources for equipment needed to achieve and maintain post-fire safe shutdown of Millstone Unit 2 are identified in the Millstone Unit 2 Technical Requirements Manual (TRMCR 99-2-4, dated March 4,1999). As part of its safe shutdown circuit
analysis and cable selection described in Section 5 of the MP2 Appendix R Compliance
]
Report, Revision 3, the licensee has addressed the issue of associated circuits by
)
.
__
common power supply. MP2 has performed breaker / fuse coordination calculations for the electric power system and evaluated the adequacy of selectivo coordination provided within the requirements of the Appendix R compliance analysis. The breaker / fuse coordination calculation results for each voltage level are as follows:
(1)
4160VAC Buses: Calculation 97-ENG-1912E Rev. 00, "4.16kV Switchgear Relay Settings," identifies a potential coordination problem between breaker A312 (EDG A) and breaker A305 (tie to Bus 24E). This coordination problem could result in a trip of the EDG output breaker in response to a fault on the feeder
cable to Bus 24E. The Appendix R analysis addresses this coordination problem with manual actions for Fire Area R-3.
,
The licensee's. Appendix R compliance strategy credits alignrcent of Bus 24E (backfeed from Millstone Unit 1) as an alternate source of power to Busses 24C and 24D for Fire Areas R-1, R-11, and R-16. Overcurrent coordination does exist between feeder breaker A305 from Bus 24E and the largest load breaker (A303)
on Bus 24C and between feeder breaker A408 from Bus 24E and the largest load breaker (A409) on Bus 24D. This bus alignment is not automatic and will not be
. required until approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after tha loss of CVCS charging capability according to the licensee, which is sufficient time for implementing the necessary manual actions.
(2)
480VAC Buses: Calculation PA84-065-0753GE, Rev 01, " Millstone Unit 2 - 480V Breaker Overcurrent Trip Devices," determined that coordination exists for the 480V system.
(3)
125Vdc Buses: Calculation PA85-082-0812GE, Rev 02, " Millstone Unit 2 - 125V DC Coordination Study," identified a potential coordination problem between batteries, chargers, and inverters. The coordination problem can only occur due to cable faults in the same fire area where the three components are physically located so it is not an issue for Appendix R compliance.
The calculation also identified a coordination problem between the individual 35 amp parallel branch fuses providing control p6wer for 4.16kV Switchgear 24 C, 24D, and 24E breaker close and trip circuits and the respective 100 amp dc feeder breakers on distribution panels DV10 and DV20. The MP2 Appendix R analysis models the potential for a loss of de control power to 4.16kV Buses 24C, 24D, and 24E due to this coordination problem and has incorporated appropriate manual actions into the compliance strategies for Fire Areas R-3, R-13, and R-14 to recover 4.16kV breaker control power.
(4)
P1164-MP2-COORD (D11, D12, D21, D22), " Breaker / Fuse Coordination For The Circuits of Panels D11, D12, D21, and D22 Which Are Credited To Perform An Appendix R Safe Shutdown Function," Rev. O, Dated January 19,1998, analyzed breaker / fuse coordination between the panel feeders and the largest branch circuit breaker for panels D11, D12, D21, and D22. These panels contain the branch circuit breakers downstream of fuses providing control power
.
i
_
i
for remote operation of specific equipment required to perform an Appendix R j
safe shutdown function such as Reactor Coolant Pump breakers (H104, H105, H201, and H202) and Pressurizer Heater breakers (80109, B0206, 80307, and 80407). The level of coordination was acceptable and no additional manual actions were identified by the licensee's study to resolve coordination issues.
(5)
120Vac Buses: Technical Evaluation M2-98-0113, Rev. 00, "120 VAC Vital Bus Appendix R Coordination Study," documents an acceptable level of coordination between the output characteristics of the vital inverters / static switches and the
'
branch fuses for vital panels VA10, VA20, VA30, and VA40.
On a sample basis from (1) thru (5) above, the team reviewed the adequacy of protection provided for power supplies of equipment relied on to achieve post-fire safe shutdown conditions. This evaluation included a review of protective device time / current curves and associated calculations and analyses developed for MP2. The specific sample of circuits selected for review included Bus 24C, Bus 240, Bus 14H (backfeed pathway from Unit 1), Bus 22E, Bus 22F,125Vdc Bus 201 A,125Vdc Bus 201B, and 125Vdc Panels DV-10 and DV-20. The sample of power supplies selected for review were found to be provided with a sufficient level of selective coordination between feed and load protective devices to address post-fire safe shutdown concerns.
' Based on the results of this review, the coordination / selective tripping capability of power supplies relied on to achieve and maintain safe shutdown was found to be acceptable.
Administrative Control of Fuse Replacement The licensee's administrative control for the replacement of fuses has been established through a work control procedure WC 5, Rev.1, " Fuse Control," dated March 22,1997.
The procedure sets up and maintains a master fuse list in controlled plant drawings.
The procedure ensures the use of standardized replacement fuses of the same type and
'
rating as originally specified.
The licensee provided Technical Evaluation M2-EV-99-0047, Rev. O, " Millstone Unit 2 Fuse Control Assessment of Current Status, includinh improvement Opportunities,"
dated February 24,1999 for review by the inspection team. The technical evaluation documents the ongoing implementation of the fuse control process used at MP2, evaluates the effectiveness of the process to support operation of the unit, and recommends immediate and long term actions for program improvement.
The team reviewed, on a sample basis, the adequacy of the fuse control process. Three fused control circuits on the Rear - Plant Auxiliaries Panel C06R were selected for verification: Fuse Blocks AFYH, AFYL, and A(2)FXA. All of the fuses were of the proper size and rating specified on the master fuse list Dwg. No. 25203-30022, Sheets A15 and A 16. However, the markings stamped on one of the fuses in Fuse Block AFYL were not completely legible; the licensee added replacement of the fuse to the open work order for that circuit.
-
Hiah Imoedance Faults To meet the separation requirements of Appendix R Section Ill.G.2, multiple high-f impedance faults (MHIFs) should be considered in the evaluation of electrical power supplies required for post-fire safe shutdown (Reference GL 86-10, Question 5.3.8).
j Associated circuits subject to multiple high impedance faults have been addressed as part of the MP2 SSD Circuit Analysis. A separate calculation has been prepared to document this study. The capability to recover from such an event has been considered for six types of electrical systems as follows:
)
(1)
4.16kV Switchgear: The team reviewed MP2 calculation 97-ENG-1912E2, Rev.
j 00, "4.16kV Switchgear Relay Settings" to identify the long time settings of the protective relays on 4.16kV Buses 24C,24D, and 24E. The review showed that MHIF conditions only result in the loss of 4.16kV Buses 24C and 24D for fire in areas R-14 and R-2, respectively. These losses are already assumed since the buses are located in these fire areas. Under the worst case Appendix R fire scenario, no more than 50% of the power cables associated with a 4.16kV bus could be subjected to simultaneous fire damage based on cable routing circuit
)
availability (load must be energized to be subject to MHIF current). Consequently the licensee judged that the loss of a 4.16kV bus due to MHIF was not possible.
(2)
480V Switchgear The routing of power cables associated with 480V loads on
]
Buses 22E and 22F were checked to determine their fire area locations. With the
!
exception of Fire Area R-15, all power cables are located in the same fire area where the associated 480VAC bus is not credited for safe shutdown, therefore these cables do not present a MHIF concern.
In Fire Area R-15, the Containment, the affected power cables feed the Containment Cooling Fans (F14A and F14C fed from Facility Z1 Bus 22E, and i
F148 and F14D fed from Facility Z2 Bus 22F) and the Proportional Group Pressurizer Heaters (P-1 fed from Facility Z1 Bus 22E and P-2 fed from Facility Z2 Bus 22F). Based on the division separation in Fire Area R-15, high impedance faults will only affect cables assoclated with one or the other train of equipment, but not both. Therefore the unaffected train will be available to support safe shutdown.
l (3)
480VAC Motor Control Centers (MCCs): The majority of the loads on the MCCs l
are only energized intermittently (valve operators). The licensee did not consider l
.
the existence of multiple high impedance faults on a bus with few connected f
loads to be credible.
l
'
i I
i
!
!
(4)
120 Vac Vital AC: Engineering Evaluation M2-EV-98-0113, Rev 00 identified those fire areas where the cumulative effects of MHIFs due to fire could result in bus voltage degradation and static switch transfer to the alternate power source.
,
The MP2 evaluation of the Vital AC power system determined that MHIF
'
conditions could only result in a potential loss of the Vital AC panels for fires in Fire Areas R-1, R-9, and R-10.
!
For a fire in R-1, Vital AC Panels VA10, VA30, and VA40 are considered lost.
The only vital circuits credited for use after a fire in R-1 are those supplied from Altemate Shutdown Panel C09, which is fed from Panel VA20, Circuit 4.
Therefore operator action may be required to deenergize all the circuit breakers in Panel VA20, with the exception of Circuit 4.
For a fire in R-9, Vital AC Panels VA10 and VA30 are considered lost because of their physicallocation in the area. Vital AC Panels VA20 and VA40 are not j
subject to MHIFs for a fire in this area and are available.
For a fire in R-10, Vital AC Panels VA20 and VA40 are considered lost because
of their physicallocation in the area. Vital AC Panels VA10 and VA30 are not subject to MHIFs for a fire in this area and are available.
(5)
Regulated AC Panels VR11 and VR21: A MHIF analysis for regulated AC Panels
,
VR11 and VR21, titled P1164-MP2-COORD/MHIF (VR11 And VR21),
i
" Breaker / Fuse Coordination And Multiple High Impedance Fault (MHIF) Recovery Actions For 120 VAC Panels VR11 and VR21 And The Circuits Of Panels VR11
!
and VR21 Which Are Credited To Perform An Appendix R Safe Shutdown
'
Function," Rev. 2, Dated October 16,1998, was performed and the results were i
incorporated into the safe shutdown analysis.
)
i (6)
125V DC Panels: MHIF analyses for DC Panels DV10, DV20, D11, D12, D21, and 022 have been performed for MP2. The results of MHIF analyses P1164-
MP2-MHIF (DV10, DV20), " Multiple High Impedance Fault (MHIF) Evaluation For I
~
The Circuits Of Panels DV10 and DV20 Which Are Credited To Perform An Appendix R Safe Shutdown Function," Rev.1', Dated October 16,1998, and P1164-MP2-MHIF (D11, D12, D21, D22), " Multiple High Impedance Fault (MHIF)
i Evaluation For The Circuits Of Panels D11, D12, D21, and D22 Which Are Credited To Perform An Appendix R Safe shutdown Function," Rev.1, Dated
.
October 16,1998, were incorporated into the safe shutdown analysis.
l
,
.
Review of the Sour:ous Sianals Associated Circuit Concem Fire damage to circuits and cables may adversely affect the post-fire safe shutdown capability by causing equipment to spuriously operate or mal-operate in an undesired and/or uncontrolled manner. This evaluation is principally comprised of two items:
1.
The mal-operation of required equipment due to fire induced damage to associated cabling or instrument sensing lines. Examples include false control, and instrument indications that may be initiated as a result of fire induced
'
grounds _, shorts or open circuits in connected cables.
2.
The spurious operation of components (shutdown related or non-shutdown related) that could adversely affect the plant's post-fire safe shutdown capability.
The fire protection requirements specified by 10 CFR 50.48 require that the fire protection program have a means to limit fire damage to structures, systems, and components important to safety so that the plant's safe shutdown capability is assured. Additionally, Section Ill.G of Appendix R to 10CFR50 requires, in part, that associated non-safety circuits and cables that could prevent operation or cause mal-operation of systems and components important to safe shutdown, be provided with a level of fire protection necessary to ensure such circuits will remain free of fire damage. Acceptable options for providing this level of fire protection are delineated in Section lil.G.2 of the regulation.
In GL 81-12 and GL-86-10, the NRC staff established that either physical protection from fire (per Section Ill.G.2 of Appendix R), or detailed electrical circuit analyses may be used to demonstrate that fire will not cause equipment to spuriously actuate in a manner that could adversely affect the post-fire safe shutdown capability of the plant. While either approach is acceptable, the use of analytical techniques places greater importance on the assumptions, criteria, and review methodology which form the bases of the analysis.
,
Also in GL 86-10, the NRC staff provided its guidance related to identifying non-safety circuits that could prevent the operation or cause mal-operation and defined the circuit failures to be considered. Specifically, the NRC staff response to Question 5.3.1 provided the following guidance:
" Sections III.G.2 and III.L.7 of Appendix R define the circuit failure modes as hot shorts, open circuits, and shorts to ground. For consideration of spurious actuations, allpossible functional failure states must be evaluated, that is, the component could be energized or de-energized by one or more of the above failure modes (emphasis added). Therefore, valves could fail open or closed; pumps could fail running or not running; electrical distribution breakers could fail open or closed..."
.
This guidance: (1) established that when performing a circuit failure analysis, one or more circuit failure modes (e.g., multiple hot shorts, a hot short combined with a ground or open circuit etc.) must be considered when identifying circuits that
can prevent the operation or cause the mal-operation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions; (2)
indicates that when the circuit analysis identifies circuits which can cause spurious actua+ ions that may affect the post-fire safe shutdown capability, they should be considered as circuits required for safe shutdown and be protected in accordance with the separation criteria of Section Ill.G.2 of Appendix R; and (3)
by the context of the question and its answer, presumes that a fire can cause multiple fire-induced spurious equipment actuations.
The licensee addressed the issue of spurious component operation through a systems-based separation analysis which included the following four steps:
(1)
Systems analysis to determine which components could prevent or inhibit safe shutdown due to their spurious operation (including high-low pressure boundaries)
(2 Electrical circuit analysis to determine which cables could cause the component to spuriously operate. This step requires the definition of circuit failure modes.
(3)
Electrical circuit separation analysis to determine where the cables that could cause spurious operation are located such that a single fire could cause component operation that could prevent safe shutdown.
(4)
Determination of the methodologies to prevent or mitigate spurious operations. These may include: circuit modification, pre-fire de-energization of circuits, and post-fire operator actions.
At Millstone Unit 2 the components which could adversely affect safe shutdown due to spurious operation are included on the safe shutdown equipment list. Circuit analysis and cable selection is performed for all passive (spurlous) safe shutdown components.
Where separation analysis demonstrates that a safe shutdown component is subject to spurious operation which would affect the capability to safely shut down, various means of isolation and/or manual actions are utilized to either prevent or mitigate the spurious operation.
Isolation of components prior to a fire is accomplished by the opening of designated circuit breakers / disconnect switches or removal of control circuit coils for the following equipment:
Loop 2 Steam Supply to AFW Pump Turbine MOV (2-MS-202)
Outboard and Inboard Shutdown Cooling isolation MOVs (2-SI-651 and 2-SI-652)
Main Steam isolation Valve Bypass MOVs (2-MS-65A and 2-MS-658)
In the event of a fire in area R-1 ( Main Control Room / Cable Vault) mitigation of spurious operation is accomplished by operation of transfer switches and isolation switches at the Bottle Up Panels C70A and C708, at the Fire Shutdown Panel C10, and by manual breaker operations.
For all other fire areas, written procedures are established to mitigate spurious operation of equipment via local breaker operations and manual positioning of valves. The assumptions used for performing the MOV hot-short evaluations in response the IN 92-
~ 18 are documented in Technical Evaluation MG-EV-97-0004, as well as the number and types of circuit failures that were to be assumed for the MP2 analysis.
Hiah Low Pressure Interfaces High/ Low Pressure interfaces exist where the high pressure Reactor Coolant System (RCS) interfaces with systems designed to withstand lower operating pressures. In the event cabling associated with electrically controlled devices (such as motor-operated valves) used to isolate the primary coolant boundary are damaged by fire, there is a potential for an uncontrolled loss of reactor coolant into the low pressure system, thereby resulting in a fire-induced loss of coolant accident (LOCA) through the high/ low pressure interface. Due to the potentially serious consequences of this event, the NRC has established more rigorous evaluation criteria for electrically operated devices which comprise a high/ low pressure interface boundary. Specifically, cables and circuits of these devices must consider the potential for fire to cause multiple, simultaneous, hot shorts of the proper polarity without grounding.
A description and evaluation of the methodology and results of the high-low pressure boundary analysis performed for Millstone Unit 2 is provided in Section 6 of the MP2 Appendix R Compliance Report, Revision 3. The licensee's analysis includes the following:
(1)
Systems analysis to identify the high-low pressure boundary interface.
(2)
Electrical circuit analysis to determine which cables could cause spurious operation.
(3)
Electrical circuit separation analysis to identif9 areas of noncompliance.
(4)
Corrective actions which are to be taken in the event that a single fire could induce the circuit faults necessary to breach the high-tow pressure interface.
.
.
As a result of the MP2 analysis, the following high low pressure interfaces were identified as locations requiring further evaluation. Evaluations made for each of the interfaces is described below, with the required resolution.
Series valves 2-SI-651 and 652 in the line from steam generator (S/G) 2 hot leg
-
to the LPSI pump suction: Both valves are normally closed during power operation. Downstream from these series valves and located outside containment is locked-closed manual valve 2-SI-709. However, this valve is
'
downstream from the piping class change (1500/300psig) and cannot be credited
for LOCA-prevention purposes. The motor leads for 2-SI-652 are routed through a knife switch in the control room which is maintained in the open position.
During the licensee's circuit review for these valves it was identified that the
'
existing circuit design could not assure that the valves would not spuriously operate for an R-1 fire (CR #M2-97-2604). Modifications were implemented to
'
eliminate this vulnerability by rerouting the motor leads for 2-SI-652 downstream of the disconnect switch in cable tray or conduit with no other energized cables.
This eliminates the potential for spurious operation of this valve due to hot shorts on the control or power cables. Valve 2-St-652 alone will provide the Appendix R high-low pressure interface between the RCS and the shutdown cooling suction line (Reference DCR-M2-97055 and LER 97-035-00).
DCR-M2-97055 rerouted the power cables for 2-SI-652, downstream from control room disconnect switch 89-Sl652, into a dedicated conduit in order to address the potential for spurious operation of this high-low pressure interface valve. The power cables were run in a dedicated conduit except for that portion of the run from a new tee fitting to the valve. At this point the power cable runs in existing conduit with the control cable for the valve. The new routing precludes the occurrence of three-phase hot shorts in the power circuit. Additionally, the control room disconnect switch 89-Sl652 is normally maintained in the OPEN position during plant operation in order to prevent control circuit damage from causing spurious operation of the valve.
The aforementioned changes effectively preclude spurious operation of valve 2-
,
SI-652 under any fire scenario. The RCS pressure boundary is thus maintained
'
by 2-SI-652. The in-series valve,2-SI-651, need not meet the same circuit analysis for high-low pressure interface.
CVCS Letdown Isolation AOVs 2-CH-515,2-CH-516, and 2-CH-089: these are
-
j fail-closed AOVs; double hot shorts to cables in ungrounded DC circuits would be required to cause a misoperation, which is not considered credible. Valve 2-CH-089 can be closed from the Fire Shutdown Panel C10 and operator action to deenergize DC power is credited to ensure that the RCS boundary can be maintained.
.
p
>
Pressurizer Vent SOVs 2-RC-422,2-RC-423,2-RC-424, and 2-RC-425 and
-
Reactor Head Vent SOVs 2-RC-414, 2-RC-415, 2-RC-416, and 2-RC-417:
double hot shorts to cables in ungrounded DC circuits would be required to cause
,
a misoperation, which is not considered credible. Operator action to deenergize DC power is credited to maintain the RCS boundary.
Pressurizer PORVs 2-RC-402 and 2-RC-404: double hot shorts to cables in
-
ungrounded DC circuits would be required to cause misoperation, which is not
,
considered credible. The PORVs have controls at the Bottle Up Panels which l
-
deenergize all conductors to the valves.
RCS Sample Connection AOVs 2-RC-001,2-RC-002,2-RC-003, and 2-RC-045:
-
double hot shorts to cables in ungrounded DC circuits would be required to cause misoperation, which is not considered credible. Operator action to deenergize
]
DC power is credited to maintain the RCS boundary, q
l RCP Seal Leakoff Isolation AOVs 2-CH-506 (inside containment) and 2-CH-198 l
-
and 2-CH-505 (outside containment): these are fail-closed AOVs;: double hot f
shorts to cables in ungrounded DC circuits would be required to cause misoperation, which is not considered credible. Operator action to deenergize
DC power is credited to maintain the RCS boundary.
Review of Associated Circuits by Common Enclosure
)
A review of the cable routing information provided by the licensee found non-essential cables to be routed within a common enclosure (e.g., raceway, cable tray, conduit, junction box, etc.) with cables of equipment required to achieve post-fire safe shutdown J
conditions. To determine if fire induced faults on these non-essential cables could i
initiate secondary fires due to inadequate electrical protection, the team selected a sample of cable enclosures, known to contain cables of equipment required for safe shutdown, for review. The inspection sample included non-essential cables routed in the following cable trays: (1) Cable Tray Z25BA10 above MCC B61 on elevation 14'-8" and,
,
(2) Cable Tray Z24RA20 above Panels VA40 and DV40 in the Z2 DC Equipment and Battery Room "B" on elevation 14'-6". For non-essedtial cables routed within each cable tray, the licensee was requested to provide information describing the size, type and construction of non-essential cables and the electrical protection provided (i.e.,
fuse / breaker size / type). For each of the enclosures selected, the electrical protection provided for non-essential circuits routed within the enclosure was found to be acceptable.
c.
Conclusion For the sample of circuits reviewed, the team concluded that the licensee evaluation of circuit breaker, relay, and fuse coordination for low-impedance, bolted faults satistied Section Ill.G of Appendix R to 10 CFR 50. It was also determined that the licensee has developed a controlled procedure to govem the replacement of fuses and is implementing a program to maintain and improve the control of fuses. From the sample
of circuits reviewed, the team concluded that the level of electrical protection provided for non-essential cables which share a common enclosure with cables of equipment relied on for post-fire safe shutdown was acceptable. Based on the above, the inspection team concluded that the licensee's analysis and method of protection for fire-induced spurious equipment operations satisfies Section Ill.G or Ill.L of Appendix R to 10 CFR 50.
F2.2 Emeroency Liohtino and Communications a. " Insoection Scooe During plant walkdowns, the team evaluated the adequacy of both emergency lighting and communications, particularly where manual actions are required to support safe shutdown of the plant.
b.
Observations and Findinos Section Ill.J of 10CFR50 Appendix R requires eight hour emergency lighting coverage in any area manual operator actions are required during post-fire safe shutdown operations. Additionally, in the safe shutdown analysis, the licensee committed to maintain a voice powered communications system throughout the plant to meet Appendix A of Branch Technical Position APSCB 9.5-1 (BTP 9.5-1), which requires fixed emergency communications to be available.
The licensee was also requested to provide documentation demonstrating that communications and emergency lighting were evaluated and properly integrated into their Appendix R safe shutdown procedures. The team's review of this documentation identified no deficiencies, Concl$sions c.
The inspection team review of the licensee's documentation conceming emergency i
lighting and communications, and the safe shutdown procedure walkdown did not identify any program weaknesses or unresolved itemp in this area.
F2.3 Fire Barrier Penetration Seals F2.3.1 Fire Barrier Penetration Sealinstallation a.
Insoection Scooe (64704)
.
The inspector observed the installation of a fire barrier penetration seal, work order number M2-98-04473, at penetration number 802-1 by the B charging pump in Millstone Unit 2. The inspector reviewed the installation procedure, interviewed the installers and Quality Controls (QC) inspector, reviewed the installers' and QC certification / qualification matrix and monitored the installation.
.
b.
Observations and Findinos The inspector found that the installers were very knowledgeable about the installation procedure, document number CMP 718F, " Installation and Repair of Fire and Penetration Seals," and the manufacturer's installation instructions. The inspector found the installers and QC inspector qualifications to be up to date and properly documented. The QC inspector properly executed all of the required verifications and hold point inspections in accordance with the procedure.
.
c.
Conclusion The inspector concluded that the fire barrier penetration seal was installed and inspected in accordance with the installation procedure and the manufacturer's installation instructions. The installers and QC inspector were knowledgeable of the procedural requirements and were properly trained.
F2.3.2 Fire Barrier Penetration SealInsDection a.
Insoection Scoce (64704)
i in a letter dated June 29,1998, NNECo committed to perform inspections of silicone l
foam fire penetration for voids and material problems when the seals were repaired or
!
replaced. The inspector reviewed the changes made to CMP 718F, " Installation and Repair of Fire and Penetration Seals", that implements this commitment, sampled the inspection results, and observed the licensee conduct the inspection.
b.
Observations and Findinos The inspector observed the licensee's inspection of penetration number 936, conducted under work order M2-99-01489. This penetration separates the cable spreading room from the control room. The inspector found that the fire protection engineer (FPE) was l
knowledgeable about the inspection criteria and properly used the Dow Corning Color l
and Cell Structure Comparison Form, No.61-880, to determine adequacy of the foam.
I The inspector observed that the foam was satisfactory with regard to color and cell structure. Although the amount of material available for this inspection was relatively small, there was no indication of excessive voiding in the material.
l The inspector reviewed work orders M2-98-11477 and M2-98-11111 and found that the I
licensee had completed the silicone foam sea! inspection in accordance with section 4.1.4 of CMP 718F. Additionally, the inspector reviewed the licensee's matrix of completed silicone foam sealinspections and found that all of the seals inspected were satisfactory.
l The inspector reviewed change 1 to CMP 718F, and found that the procedure provides an adequate mechanism for the implementation of the licensee's commitment to perform inspections of silicone foam fire barrier penetration seals for voids and material problems when the seals were repaired or replaced.
,
.
I
!
)
)
i c.
Conclusion l
The inspector concluded that the licensee has adequately implemented their commitment to perform inspections of silicone foam fire penetration for voids and
.
material problems when the seals were repaired or replaced. The seal inspection l
conducted by the FPE was professionally performed and no seal deficiencies were identified.
F3 Fire Protection Procedures and Documentation
)
F3.1 Operational Procedures and Operator Readiness I
,
F3.1.1 Post-Fire Safe Shutdown Procedures and Altemative Safe Shutdown Capability Procedures a.
Inspection Scope (64100)
The team performed a review of AOP 2579A, Rev.7, " Fire Procedure for Hot Standby I
Appendix R Fire Area R-1," the MP2 operating procedure for alternate safe shutdown, and AOP 2579M, Rev.4," Fire Procedure for Hot Standby Appendix R Fire Area R-14,"
one of the MP2 operating procedures for post-fire safe shutdown from the main control q
room. The inspection team review focused on ensuring that all required functions for
'
post-fire safe shutdown and the corresponding equipment necessary to perform those
' functions were included in the procedures. The review also looked at consistency between the operations' shutdown procedures and other procedure-driven activities associated with post-fire safe shutdown (ie. fire fighting activities and security).
b.
Observations and Findinas In AOP 2579A, step 30 of the procedure provides for manual alignment of the instrument air cross-tie from Unit 1. Review of ONP 541 Rev.0 for Unit 1, the procedure for supplying Unit 2 with emergency power determined that step 1.3.3d required both the A and B instrument air compressors to be stopped. When questioned about this, the licensee stated that this was an inconsistency. Additionally, in AOP 2579A, the inspection team found that if offsite power were lost due to fire, there was the potential for the EDG to start and load normally in response to an undervoltage condition on a
,
4160VAC vital bus having potentially faulted cables, with the control power removed
]
from the circuit breakers supplying the faulted cables. Since the EDG would continue to
!
supply fault current to the damaged cables, any fire fighting activities near the damaged j
cables would become hazardous. When questioned about this, the licensee stated that it
'
was a step sequencing problem in the procedure. The licensee issued CR-M2-99-1117 to correct the inconsistency regarding the instrument air cross tie. To correct the sequencing discrepancy in AOP 2579A, the licensee issued CR-M2-99-1150 to ensure operator actions are performed in the appropriate order.in the procedure. No other problems were identified.
.
i
!
c.
Conclusions Based on the review of the selected post-fire shutdown procedures, the team concluded that there were some sequencing problems related to DC control power in the Unit 2 procedures, and that some actions were not well coordinated between the Unit 1 and
{
Unit 2 procedures.
F3.1.2 Alternative Post-Fire Safe Shutdown Procedure Walkdown
)
a.
Insoection Scoce (64150)
i The team performed a walkdown of AOP 2579A, Rev.7, with the licensee's operations staff. Areas inspected included the ability to perform required safe shutdown actiors in a j
timely manner and the technical adequacy of the actions and their sequence to meet i
predicted plant responses.
i b.
Observations and Findinos l
,
During the walkdown, the material condition of required post-fire safe shutdown equipment showed it to be well maintained. Locking devices were in place on equipment j
identified as requiring them, and there was consistency between the plant P&lDs and the
!
in-plant operational configuration of safe shutdown equipment, j
i The number of actions to be accomplished in the plant appeared to be within the capabilities of the assigned shift complement. Access to those areas where man'ual actions were to be performed was adequate, and had the required emergency lighting.
c.
Conclusions As a result of the walkdown, the team concluded that the plant equipment being used for post-fire safe shutdown was in good material condition and that altemative shutdown capability could be operationally implemented in a timely manner with the current staffing level of operating shift.
l
'
i
'
F3.2 Fire Penetration Seal Insoection Procedure Review a.
Insoection Scope (64704j The inspector interviewed the Unit 2 Fire Protection Engineer and walked down portions T
of fire penetration seal-group 9 to determine the adequacy of " Fire Penetration Seal l
Inspections" document number SFP 17, change number 1.
!
I
~
!
!
l l
l
i
.
b.
Observations and Findinas Change number 1 to SFP 17 incorporated training requirements, enhanced inspection guidance and more clearly defined responsibility designations for Site Fire Protection (SFP) and engineering. The inspector reviewed the Student Qualification / Training Status from the Training information Management System and found that all of the SFP personnel that conducted the group 9 inspections had completed the required training listed in section 2.1.2 of SFP 17.
The licensee identified additional fire barriers requirements during the revision to the Fire Hazards Analysis. These barriers were formed into fire penetration seal-group 9 and inspected in accordance with SFP 17. The licensee identified several potential discrepancies in this group and also several discrepancies that were beyond the inspection scope of the group 9 barriers. The additional deficiencies were identified because of the increased training of the SFP personnel, greater awareness of fire
'
boundaries integrity on the site, and an improved inspection procedure. The licensee initiated several condition reports, including M2-99-1040, M2-99-1059, M2-9'90489 and M2-99-0473, to document and disposition the findings. The licensee assigned compensatory fire watches and initiated corrective actions, as described in CR M2-99-0489 and M2-99-0473, that included performing a penetration seal inspection as
)
prescribed in section 1.2 of " Fire Penetration Seal Inspections' document number SFP 17, beginning with a sample of an additional 10% of the seals in the plant. NNECo engineering personnel determined that the additional 10% sample was warranted to determine if the improved training and inspection procedure would identify additional deficiencies. The licensee stated that the purpose of the 10% sample was to determine if these discrepancies were isolated and if additional corrective actions are required.
i c.
Conclusion I
l The inspector concluded that the licensee effectively implemented the fire barner
inspection of the group 9 seals. Additionally, the licensee identified deficiencies because of the increased training of the SPF personnel, greater awareness of fire boundaries integrity on the site, and an improved inspection procedure. The corrective actions for the deficiencies appeared to be reasonable and should help to ensure the soundness of the fire barrier penetration seal program.
F5 Fire Protection Staff Training and Qualification FS.1 Post-Fire Safe Shutdown Ooerator Trainina
!
I i
a.
Inspection Scope (64150)
A sampling of the licensee's training program was examined to determine the adequacy of integrating the safe shutdown required actions into the overall operator training program.
l
-
!
s
-
.
l
)
b.
Observations and Findinos The licensee maintains Job Performance Measures (JPMs) for licensed operator training j
'
and for re-qualification. The following documents for Unit 2 were reviewed, relevant to the safe shutdown procedures:
JPM-092, Rev.3 Transfer controls from the control room to C-10 JPM-052, Rev.3 Manual Operation of a 4160 volt breaker
'
The operator training and qualification tasks were found to be comprehensive and reflected the current approved revision of the safe shutdown procedures. The tasks covered major steps in the procedures in sufficient detail to ensure the adequacy of the operators' level of understanding.
,
c.
Conclusions j
]
'
The inspection team review of the licensee's training program did not identify any program weaknesses or unresolved items in the area of operator training and re-qualification.
I F6 Fire Protection Organization and Administration F6.1 Post-Fire Safe Shutdown imolementation Staffino a.
Insoection Scope The team reviewed the adequacy of shift manning to determine if there was sufficient staffing to accomplish post-fire safe shutdown operations and adequatc y staff the plant fire brigade.
b.
Observations and Findinos The Millstone Unit 2 Final Safety Analysis Report (FSAR) states the minimum shift crew for operation of the unit is comprised of six individuals (2 senior reactor operators,2 reactor operators, and 2 non-licensed operators). Implementation of a recent operational directive required that an additional operator be added to the operating shift, bringing the current shift staffing level to seven. In the safe shutdown procedures, isolation from offsite power is performed by the Connecticut Valley Electric Exchange (CONVEX) load controller. Section Ill.L.4 of Appendix R states that personnel required to implement safe shutdown shall be onsite at all times. The licensee stated that operation of the main generator output transformer breaker and the reserve station service transformer breaker by CONVEX is a state PSC requirement, and is controlled by operating instructions. The inspection team reviewed CONVEX MANNING
-
requirements and Operating Instruction 6913. The team determined that the CONVEX staffing and procedures are adequate to control these Unit 2 operation c.
Conclusions l
The inspectors determined that the augmented shift manning in place was adequate for
'
the performance of post-fire shutdown activities. The CONVEX procedure appeared to provide adequate controls and the licensee stated that historically, cooperation with
CONVEX was good. Although the team did not i.dentify any program weaknesses or j
unresolved items in the area of post-fire safe shutdown implementation staffing, an exemption or provision of a contingency action in the safe shutdown procedures for the
- CONVEX actions may be necessary. The licensee stated this would be evaluated.
j F7 Quality Assurance in Fire Protection Activities l
l F7.1 Proaram Audits i
'
!
a.
Inspection Scope t
The inspector reviewed fire protection program audits and self-assessments which have been conducted since the fall of 1996, to determine what improvements have been implemented in the audit and oversight of the fire protection program.
b.
Observations and Findinas Quality Assurance Audit A24057/A25119 was a triennial audit of the fire protection l
program. The audit was conducted December 2 - 13,1996. The audit identified l
deficiencies with program procedures, housekeeping, surveillance and maintenance l-procedures, the process for performing fire protection reviews for design changes, and
!
the effectiveness of corrective actions for previous audit findings. An Adverse Condition l
Report was issued to document the findings and track corrective actions.
!
In June of 1997, Engineering conducted a self-assessment of the Millstone Unit 2 fire I
protection program. The purpose of the self-assessment was to implement the PI-21 methodology for reviewing Engineering Topical Areas for the Fire Protection Program.
The results of the self-assessment were documented in Engineering Self-Assessment Report ESAR-PRGM-97-040, issued June 25,1997.'The report included a table of thirty six recommendations for program improvements, of which eleven were identified as
!
required for restart. Items necessary for restart included revisions of the Final Safety l
Analysis Report, Technical Requirements Manual, Fire Hazards Analysis, and Work Control Procedure WC7. Deficiencies identified included fire barrier penetration seals l
which did not meet three hour criteria since they were installed only to the six inch thickness of the wall, and the need for a procedure for performing engineering l
evaluations of fire protection issues.
,
4
l
!
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _.
Nuclear Oversight Audit MP-98-A-16 was conducted August 10 - 21,.1998. The audit found increased management attention and team work in the Fire Protection Program.
Condition Reports were issued to document deficiencies identified, and track corrective action completion. Deficiencies identified included fire dampers in locations other than those described in the Fire Hazards Analysis, no fire protection system engineer for Unit 2, and Emergency Lighting Unit maintenance procedure deficiencies. In addition, the audit report included updates on the status of four previous audit findings.
c.
Conclusions The inspector determined that the audits and assessments of the Fire Protection
>
Program conducted since the autumn of 1996 have been effective in identifying deficiencies and areas for improvement. In addition, they have included followup of audit findings through the use of the corrective action program.
F8 Miscellaneous Fire Protection issues F8.1 (Closed) Violation 50-336/98-05-010: failure to maintain in effect all provisions of the approved fire protection program. Several seals were identified that did not meet the requirements of Safety Evaluation Report dated October 21,1980, in that they were not tested in accordance with the ASTM E-119 Fire Endurance Test. The licensee initiated CR M2-98-3811 to address the issue. The inspector reviewed the CR and interviewed the Unit 2 Fire Protection Engineer and found that the corrective actions identified in the CR were reascnable.
F8.2 Other SIL 21 issues F8.2.1 (Closed) Fire Briaade Trainina: Subsequent to the October 1996 inspection documented in NRC Combined Inspection Report 50-245/96-08; 50-336/96-08; 50-423/96-08, NNECo changed the fire fighting organization from unit specific fire brigades to a site-wide fire company. The inspector reviewed records of fire fighter training, and inspected the upgraded fire training facility. The inspector determined that the fire fighting training curriculum and facility were excellent. This issue is closed.
.
F8.2.2 (Closed) Fire Drill Performance: NRC Combined Inspection Report 50-245/96-08; 50-336/96-08; 50-423/96-08 documented an instance of poor performance by the fire brigade during an unannounced drill at Unit 2. A remedial drill was required to demonstrate adequate performance. In addition, the report documented deficiencies in the drill critique, including contradictory statements by the ci+ique leader. During the current inspection, the inspectors observed a fire drill at ' u to evaluate fire brigade performance. The brigade responded within the designated time, and the simulated fire suppression activities were excellent. The critique following the drill was attended by all drill participants, was well-conducted, covered all aspects of the brigade performance, and focused on ways to improve the response. This issue is closed.
.
-__
__
_-_
l
F8.2.3 Thermo-Lao issues The licensee has initiated corrective actions to address the various Thermo-Lag issues.
The inspectors specifically verified installation of an attemative cooling water source for the emergency diesel generator coolers. As noted in Section F2.1.2, the inspectors found the level of protection provided for redundant trains of post-fire shutdown systems satisfied the technical requirements of Section Ill.G and Ill.L of Appendix R to 10 CFR 50, and therefore the issues were sufficiently addressed to allow restart. However, since these are licensing issues, the final resolution of the thermo-lag issues will be performed by the Office of Nuclear Reactor Regulation.
F8.2.4 Conclusion Fire brigade training and fire drill performance were acceptable.
. PARTIAL LIST OF PERSONS CONTACTED Northeast Nuclear Enerav Company B. Willkens, Director, Design Engineering J. Price, Director, Millstone Unit 2 P. Lucky, Manager, industrial Safety S. Garvin, Manager, Site Fire Protection R. Joshi, Manager, MP2 Regulatory Compliance S. Gatcomb, Supervisor, Engineering Assurance T. Cleary, Sr. Licensing Engineer, MP2 Regulatory Compliance H. McKenney, Fire Protection Coordinator B. Pokora, Appendix R Coordinator Nuclear Reoulatory Commission J. Linville, Chief, Projects Branch 6 D. Beaulieu, Sr. Resident inspector
'
P. Madden, Sr. Fire Protection Engineer INSPECTION PROCEDURES USED 64100 Postfire Safe Shutdown, Emergency Lighting and Oil Collection Capability at Operating and Near-Term Operating Reactor Facilities 64150 Triennial Postfire Safe Shutdown Capability Reverificatiori I
64704 Fire Protection Program
.
- _ _ - _ _ _
!
n
!
ITEMS OPENED, CLOSED, AND DISCUSSED
,
Opened l
None
,
Closed Significant issues Ust item 21, Fire Protection
!
Violation 50-336/98-05-010, Failure to maintain in effect all provisions of the approved fire l
protection program.
'
l l
Discussed l
!
l None LIST OF ACRONY.MS USED
'
AC~
Altemating Current
>
ADV Atmospheric Dump Valve AFW Auxiliary Feedwater System AOV Air Operated Valve AWO Automated Work Order l
BAST Boric Acid Storage Tank
'
BTP Branch Technical Position CEDM Control Element Drive mechanism CFR Code of Federal Regulations CST Condensate Storage Tank l
CVCS Chemical and Volume Control System DC Direct Current DCM Design Control manual DCR Design Change Record EDG Emergency Diesel Generator
'
ESF Engineered Safeguards Feature EWR Engineering Work Request FPE Fire Protection Engineer
,
!
FSAR Final Safety Analysis Report GE
- General Electric GL Generic Letter
,
.
HSCP Hot Shutdown Control Panel
!
l HVAC Heating, Ventilation, and Air Conditioning i
IDNMS Integrated Nuclear Data Management System
l IN Information Notice
'
IPEEE Individual Plant Evaluation for External Events LPSI Low Pressure Safety injection
-
MG Motor - Generator l
l i
r
!
l t
l.
l MHIF Multiple High Impedance Faults MMOD Minor Modification MOV Motor Operated Valve MP2 Millstone Nuclear Power Station Unit 2
,
MS Main Steam System MSIV Main Steam Isolation Valve NNECo Northeast Nuclear Energy Company NRC Nuclear Regulatory Commission NRR-Office of Nuclear Reactor Regulation l
Pi Program instruction PM Preventive Maintenance Activity PMMS Preventive Maintenance Management System PORV Power Operated Relief Valve RBCCW Reactor Building Closed Loop Cooling Water System RCS Reactor Coolant System
RSST Reserve Station Service Transformer RWST Refueling Water Storage Tank SDC Shutdown Cooling SER Safety Evaluation Report l
SFP Site Fire Protection S/G Steam Generator SIL Significant issues List SSA Safe Shutdown Analysis SSD Safe Shutdown SW Service Water System TRM Technical Requirements Manual
,
l
.
-
.
=
)