05000482/LER-2002-004

LER-2002-004,

Wolf Creek Generating Station
Event date:	08-06-2002
Report date:	10-17-2002
Reporting criterion:	10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
4822002004R02 - NRC Website

Background:

Wolf Creek Nuclear Operating Corporation (WCNOC) is in the process of performing an analysis of fire areas as part of a post fire safe shutdown (PFSSD) project to determine whether a fire in a single area could adversely affect the safe shutdown of the plant. During the fire area inspection phase of the project, WCNOC personnel discovered that potential problems exist with the separation of cables for redundant components required for post-fire safe shutdown. The first condition was identified on June 7, 2002, and was described in LER 2002-004-00, dated August 2, 2002. The first supplement, dated September 13, 2002, describes a second condition that was identified on July 19, 2002. This supplement describes a third condition that was discovered on August 20, 2002.

Condition 1:

Valves EJHV8811A [EIIS Code: BP-ISV] and BNHV8812A [EIIS Code: BP-ISV] are motor operated valves that supply Residual Heat Removal (RHR) System [EIIS Code: BP] pump suction from the containment . recirculation sump and from the refueling water storage tank (RWST), respectively. During a fire in the plant, it is the function of valves EJHV8811A and BNHV8812A to provide a barrier to draining water in the RWST to the containment recirculation sump. Control circuits for these two valves are routed together in the "A" safety injection pump room (Fire Area A-2), the corridor of the auxiliary building [EIIS Code: NF] at elevation 1974 ft. (Fire Area A-1) and the corridor of the auxiliary building at elevation 2000 ft. (Fire Area A-8). The same condition exists with the control circuits for valves EJHV8811B and BNHV8812B in the opposite train. Control circuits for these two valves are routed together in the "B" safety injection pump room (Fire Area A-4) and also in the auxiliary building corridor at elevation 1974 ft. A single fire in either pump room or in the auxiliary building corridor at elevation 1974 ft. could cause a hot short that could result in inadvertently draining the water in the RWST to the containment recirculation sump. Water normally available from the RWST to be used for the core cooling injection phase would not be available if this were to occur.

Condition 2:

The RHR pump room coolers and the Centrifugal Charging Pump (CCP) room coolers utilize Essential Service Water (EJ) [EIIS Code: Bl] as the cooling medium. During a fire in the plant, it is the function of these room coolers to provide adequate room cooling for the continued operation of their respective pumps in order to maintain the plant in a safe shutdown condition.

A postulated fire in the auxiliary building corridor at elevation 1974 ft. (Fire Area A-1) could cause the loss of motor control centers (MCCs) NGO1A ("A" train) and NGO2A ("B" train). These MCCs supply redundant PFSSD equipment such as "A" and "B" train pump room coolers and miscellaneous valves.

Condition 3:

The centrifugal charging pumps (CCPs) [EIIS Code: P] are used to inject borated water into the reactor to maintain reactor water inventory, maintain shutdown reactivity margin, and maintain a flow of cooling water to the reactor coolant pump (RCP) seals to prevent damage to the seals. A fire in the plant has the potential to cause the CCPs to not function properly and cause a loss of the capability to borate, maintain inventory, and cool the RCP seals.

Plant Conditions Prior to Each Event:

MODE — 1 Power— 100 Percent Normal Operating Temperature and Pressure Condition Descriptions:

Condition 1:

At 0815 on June 7, 2002, the Shift Manager was notified of a condition where a postulated fire event could cause a cable-to-cable hot short. This event has the potential to cause the RWST to drain to the containment recirculation sump. During the fire area inspection phase of the Post-Fire Safe Shutdown project, it was discovered that the control cables for two redundant motor operated valves, EJHV8811A and BNHV8812A, are routed together in the "A" safety injection pump room and in the auxiliary building corridors at elevations 1974 ft. and 2000 ft. The two valves are in the same electrical separation group, but are redundant in their function of conserving water inventory in the RWST. Further investigation determined that the control cables for motor operated valves EJHV8811B and BNHV8812B in the other electrical separation group have the same configuration since they are routed together in the "B" safety injection pump room and in the auxiliary building corridor at elevation 1974 ft. A fire in any one of these areas has the potential to damage the control cables to the EJHV8811A/B valves causing the valves to spuriously open due to a hot short. � Fire damage to the control cables to the BNHV8812A/B valves could result in the valves not responding to a close signal due to an open circuit. This condition would cause the water in the RWST to drain to the containment recirculation sump.

Condition 2:

At 0945 on July 19, 2002, the Shift Manager was notified of conditions where a postulated fire event could lead to the loss of MCCs that power post fire safe shutdown equipment in both trains due to inadequate horizontal separation in conjunction with improper breaker coordination. During the fire area inspection phase of the Post-Fire Safe Shutdown project, WCNOC personnel discovered that the power cables supplied from MCCs NGO1A and NGO2A for various non-PFSSD and PFSSD room coolers do not have adequate horizontal separation or proper breaker coordination as specified in 10 CFR 50 Appendix R. The PFSSD components are both trains of RHR pump room coolers and both trains of CCP room coolers. The non-PFSSD components are both trains of Safety Injection Pump room coolers and both trains of Containment Spray Pump room coolers. These cables are located in the auxiliary building corridor at elevation 1974 ft. A fire in this area has the potential to damage the power cables to these room coolers, resulting in loss of MCCs NGO1A, NGO2A and room cooling for the RHR pumps and CCPs. � This issue has the potential to cause the RHR and Chemical and Volume Control (BG) [EIIS Code: CB] systems to become unavailable to perform their post-fire safe shutdown functions.

Initial evaluation has indicated that existing breaker coordination is acceptable based on IEEE 242-1986, IEEE 603 Appendix A and IEEE Transaction on Industry Applications, Vol. 1A-8, No. 3, May/June 1972.

Performance Improvement Request (PIR) 2002-1670 tracks completion of this evaluation and any resultant plant modification required to ensure adequate breaker coordination for the subject fire area (A-1). These actions will be completed on or before December 15th, 2002.

Condition 3:

At 1030 on August 20, 2002, during the fire area inspection phase of the Post-Fire Safe Shutdown project, WCNOC personnel discovered that the power and control cables for both trains of CCP minimum flow valves, both trains of CCP discharge valves to the RCP seals, and both trains of CCP suction valves from the volume control tank (VCT) and the RWST are routed in the auxiliary building corridor at elevation 1974 ft. The cables for each train are routed in the same fire area and are horizontally separated by approximately 35 feet; however, there are intervening combustibles located between the cables for each train.

Basis for Reportability:

Condition 1:

A fire in any one of the subject fire areas (A-1, A-2, A-4 and A-8) has the potential to damage the control cables for valves EJHV8811A/B in a manner that causes the valve to spuriously open and damage the corresponding control cables for valves BNHV8812A/B in a manner that causes the valves to not respond to a signal to close. This would result in a flow path from the RWST through the open valves and into the containment recirculation sump. The post-fire safe shutdown function would be affected because the RWST function is required for hot shutdown.

Based on information known at the time of discovery, WCNOC made an eight hour Emergency Notification System call in association with 10 CFR 50.72(b)(3)(ii)(B) and 10 CFR 50.72(b)(3)(v)(A), (B) and (D).

Further evaluation and a review of NUREG-1022, "Event Reporting Guidelines 10CFR50.72 and 50.73," determined that this condition is reportable pursuant to 10 CFR 50.72(b)(3)(ii)(B) / 10 CFR 50.73(a)(2)(ii)(B) for any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.

This condition does not meet the reporting requirements of 10 CFR 50.72(b)(3)(v)(A), (B) or (D), or 10 CFR 50.73(a)(2)(v)(A), (B) or (D), since there is a reasonable expectation that the safety function of preventing water from draining from the RWST would have been fulfilled by valves EJHV8811A/B in the event of a fire.

Condition 2:

Due to inadequate cable separation in conjunction with potential improper breaker coordination, a fire in the subject fire area (A-1) could result in the loss of PFSSD components. The post-fire safe shutdown function would be affected because the Residual Heat Removal and Chemical and Volume Control functions are required to maintain the post-fire safe shutdown decay heat removal, reactivity control and inventory control functions. Based on the above information WCNOC made an eight hour Emergency Notification System call in accordance with 10 CFR 50.72(b)(3)(ii)(B).

Condition 3:

Due to intervening combustibles, a fire in Fire Area A-1 has the potential to cause the above-mentioned valves associated with the CCPs to not function properly and cause a loss of the capability to borate the reactor, maintain water inventory in the reactor, and cool the RCP seals. Based on the above information, WCNOC made an eight hour Emergency Notification System call in accordance with 10 CFR 50.72(b)(3)(ii)(B).

A review of NUREG-1022, "Event Reporting Guidelines 10CFR50.72 and 50.73," determined that the cable separation condition is reportable pursuant to 10 CFR 50.72(b)(3)(ii)(B) / 10 CFR 50.73(a)(2)(ii)(B) for any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.

Root Cause:

Condition 1:

The control cable configuration for valves EJHV8811A/B and BNHV8812A/B are per original plant design.

Cable-to-cable hot shorts associated with the event in question were not analyzed as part of the Bechtel Fire Hazards Analysis. Therefore, the cause of this condition is due to cable-to-cable interaction not being considered in the initial plant design and specifically in relation to the routing of cables in the safety injection pump rooms and in the auxiliary building corridors at elevations 1974 ft. and 2000 ft.

Condition 2:

The improper breaker coordination for the room coolers has existed since plant startup. The cable configuration for the room coolers is per original plant design. The improper coordination necessary for the occurrence of a ground fault of the impedance required to open an upstream breaker prior to opening the load breaker is of very low probability and was not considered as part of the Bechtel Fire Hazards Analysis.

Therefore, the cause of this condition is due to improper breaker coordination and inadequate consideration of horizontal separation in the initial plant design.

Condition 3:

The control and power cable configurations for the suction and discharge valves associated with the CCPs are per original plant design. The condition was not evaluated in the Bechtel Fire Hazards Analysis because the assumption made was that cables manufactured to the requirements of IEEE 383 are not combustible.

Corrective Actions:

Condition 1:

A continuous fire watch was established in Fire Areas A-1, A-2, A-4 and A-8 until procedure OFN KC-016, "Fire Response," was changed to add steps 11 through 21 to prevent draining the water in the RWST to the containment recirculation sump. After the procedure was changed, an hourly fire watch was established to monitor the safety injection pump rooms and the auxiliary building corridors at elevations 1974 ft. and 2000 ft.

Condition 2:

An hourly fire watch was established in Fire Area A-1. A corrective action plan was developed within the WCNOC corrective action program to address this issue.

Evaluation and corrective actions for the improper breaker coordination condition are being addressed in PIR 2002-1670. The evaluation and disposition or plant modification will be completed to ensure adequate breaker coordination for Fire Area A-1 by December 15, 2002.

Corrective actions for cable separation issues identified during the post-fire safe shutdown review are being addressed by PIR 2000-2378. These corrective actions are scheduled for implementation prior to the completion of Refuel 13, currently scheduled for November 21, 2003.

Condition 3:

Hourly fire watches were established in elevation 1974 ft. of the auxiliary building (Fire Area A-1).

The evaluation and corrective actions for this condition, along with those identified in Condition 2, are being addressed in PIR 2000-2378. The evaluation and disposition or plant modification will be implemented prior to or during Refuel 13, currently scheduled for November 21, 2003.

Safety Significance:

The safety significance of each event is low based on the following:

Condition 1:

Once the control rods insert during a reactor shutdown, the plant is immediately in a safe shutdown condition (i.e., hot standby). In order to maintain a safe shutdown condition in the plant, the Chemical and Volume Control System [EIIS Code: CB] is required for boration and inventory makeup with the centrifugal charging pump (CCP) taking suction from the RWST.

If the RWST inventory were lost to the containment recirculation sump, the CCP would not have a direct suction path to the water. � Makeup from the RWST to the Reactor Coolant System [EIIS Code: AB] (RCS) would only be required to maintain the plant in a hot standby condition if the pressurizer level was decreasing or if positive reactivity was added. The safe shutdown methodology at WCGS relies on isolating the reactor such that very little makeup water would be needed and assumes no RCS cooldown.

Time would be available to take compensatory measures if the RWST water level was decreasing. If EJHV8811A or EJHV8811B were to inadvertently open, it would take approximately 55 minutes for the RWST to drain to the lo-lo alarm set point and approximately 94 minutes for the tank to completely drain.

These times assume a flow rate of 4190 gallons per minute from the RWST to the containment recirculation sump as shown in calculation M-BN-21 revision 0.

Use of the Chemical and Volume Control System for boration is not required until xenon levels decrease, which is approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after reactor shutdown.

Condition 2:

The affected fire area (A-1) contains no significant fire loading. Therefore, a significant fire is not expected to occur in this area. However, should a fire occur, operators would take actions necessary to extinguish the fire and restore equipment necessary for post fire safe shutdown.

If a plant shutdown occurs, once the control rods insert the plant is immediately in a safe shutdown condition (i.e., Hot Standby (Mode 3)). The CCP room cooler is required for hot standby. Adequate protection for the CCP room coolers is provided by:

• Thirty-five feet of horizontal separation between the "A" and "B" trains of CCP room cooler cables.

(Since intervening combustibles are located within this separation, the requirement for greater than 20 feet of cable separation with no intervening combustibles is not met.)

• high personnel traffic, such that any fire in the area would be quickly identified and acted upon; and

• overall low combustible loading in the area.

These factors improve the likelihood that the CCP room coolers will be available for Hot Standby conditions in the event of a fire.

During a reactor shutdown, if the RHR pump room coolers were unavailable due to a fire in area A-1, time would be available to take compensatory measures. The RHR system is not required until the decision is made to cool down the RCS from Hot Shutdown (Mode 4) to Cold Shutdown (Mode 5). Temporary ventilation units are available for use that could provide cooling for the pump motors. These units could be placed in service within two hours of the postulated fire, which is prior to the need for RHR system availability (a minimum of four hours following shutdown).

Condition 3:

The potential for the cables associated with these valves to be affected by a fire in Fire Area A-1, such that control of these valves is lost, is extremely low because:

• The horizontal separation between the trains is approximately 35 feet. (10 CFR 50 Appendix R requires horizontal separation of "more than 20 feet with no intervening combustible or fire hazards.")

• The "intervening combustibles" in this case are IEEE 383 electrical cables; such cables will not self- sustain a fire (i.e., they will not continue to bum after the source of heat is removed). As such, Fire Area A-1 contains no significant fire loading since the level of combustibles in this area is very low.

• The power and control cables for the valves are routed in electrical conduits. While the conduit is not a rated fire barrier, it provides some protection against damage from a fire. The valves can be manually manipulated if needed. The valves are not located in Fire Area A-1. While access to the valves may require traversing Fire Area A-1, the CCP and the valves are not immediately needed. Accessing the valves would not be done until after the fire was extinguished. After the fire is extinguished, temporary room coolers could be installed in the CCP room if needed to support operation of the CCP.

• RCS leakage through the RCP seals would be controlled to approximately 12 gallons per minute with component cooling water to the thermal barrier, providing cooling to the seals. Based on this leakage rate, make-up to the RCS would not be needed for approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> due to the pressurizer level starting at 17%, which is the level that letdown isolates.

• As stated in the safety significance for Condition 1 above, the use of the Chemical and Volume Control System for boration is not required until xenon levels decrease, which is approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after reactor shutdown.

Based on these considerations, the safety significance of each event is low.

Previous Events:

An occurrence of a similar event was reported via licensee event report (LER) 1999-009-00. In LER 1999- 009-00, it was determined that there was inadequate separation of cables for valves and level transmitters for the volume control tank. In the event of a fire, a potential existed for gas intrusion into the suction of the centrifugal charging pump. While corrective actions have been taken to address these conditions, an additional corrective action for LER 1999-009-00 was to validate the post fire safe shutdown analysis and to provide necessary correction to the Updated Safety Analysis Report (USAR). The validation consists of two phases: phase one reverifies the design criteria and phase two completes the post-fire safe shutdown analysis review. The conditions identified in this LER were discovered during phase two, which is currently in progress.