ML033560463
| ML033560463 | |
| Person / Time | |
|---|---|
| Site: | Harris  |
| Issue date: | 11/12/2002 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| FOIA/PA-2003-0358 | |
| Download: ML033560463 (3) | |
Text
November 12, 2002 SHEARON HARRIS FIRE PROTECTION INSPECTION POTENTIAL ISSUES AFTER SECOND WEEK OF INSPECTION The safe shutdown analysis (SSA) and procedures included many operator actions to compensate for lack of protection for safe shutdown train equipment and cables from fire damage. Physical protection of safe shutdown equipment and cables from fire damage is required by the licensee's approved fire protection program. Operator actions instead of physical protection require NRC-approved deviations. However, the SSA methodology for unprotected cables incorrectly provided physical protection for cables only if no operator action could be assigned. The SSA included about 40 such operator actions for the four fire areas/zones selected for inspection, and none of them have approved exemptions from the NRC. However, the licensee claimed that they had informed the NRC about such operator actions in a letter and that the NRC had 'tacitly approved' them.
The SSA did not analyze for fires in recognized fire areas or fire zones. Instead, the SSA further subdivided fire areas and zones into safe shutdown analysis areas. Also, the safe shutdown analysis areas boundaries did not always coincide with physical separation features such as walls - one analysis area boundary was in the middle of a room. The team found that some unprotected equipment/cables that were needed for safe shutdown during a fire were not identified by the SSA. In addition, some of the operator actions that were provided by the SSA were not fully analyzed to ensure that they would work.
Some of the operator actions that were in the SSA were not implemented in the procedures and some were inadequately implemented in the procedures. Also, the procedures contained many operator actions and preferred or optional methods and flowpaths that were not analyzed in the SSA and were not always protected from fire damage.
- 2. For a fire at 480V MCC 1A35-SA, auxiliary building 261 ft. level (in fire zone 1-A-4-COM-E and in SSA analysis area 1-A4-BAL-B5), AOP-36 sent an operator to MCC 1A35-SA to verify that two valves were open and to open their breakers to prevent spurious operation of charging system MOVs. The two valves were 1CS-169, charging pump suction header cross-connect; and 1CS-214, charging pump min-flow isolation.
Reliance on operator actions in the room that is on fire is not allowed by NRC regulations.
Control room operators did have procedural direction to de-energize MCC 1A35-SA if the fire team leader could determine that it was directly impacted by the fire. However, if they could not tell that the MCC was on fire (e.g., due to the room being full of smoke),
the operators would wait to see if spurious actuations were occurring before de-energizing the MCC. Fire models show that for a fire large enough to damage safety-related equipment, the room would likely be full of smoke before the fire brigade arrived.
Potential consequences of 1CS-1 69 spuriously closing would be stopping all flow to SSD charging pump B and immediate damage to the pump. Potential consequences of 1CS-214 spuriously closing would be stopping all min-flow from all charging pumps.
(This issue is similar to licensee self-assessment AR 00073540, which states that due to smoke, fumes, etc, not all sub-zones of fire area 1-A-BAL may be accessible to perform the required manual actions. Also, AR 00076623 addresses needed review of allowable transient combustible loading limits in view of the lack of rated fire barriers between fire zones.)
As corrective action, a procedure revision issued during this inspection directed operators to de-energize MCC 1A35-SA for a fire in the same room. Then operators would have to go to the MOVs to verify that they are open. However, one of the MOVs (1CS-214) apparently has no required emergency lighting. (AR 00076632)
For a fire in the auxiliary building 261 ft. level (fire sub-area 1-A-BAL-B), AOP-36 incorrectly sent an operator to the wrong MCC in the wrong room to open the breaker for valve 1CS-218 (charging pumps discharge header cross-connect) to prevent spurious operation of the MOV. The breaker is actually on MCC 1A35-SA, but AOP-36 incorrectly states that it is on MCC 1B35-SB. This is a third breaker on MCC lA35-SA that operators might not have de-energized if the MCC was on fire. (AR 00075337)
The procedure revision issued during this inspection listed the correct MCC. Potential consequences of spurious closure of 1CS-218 would be to stop charging flow to the RCS from the SSD charging pump B. However, charging pump B would still have min-flow unless 1CS-214 also closed, in which case there could be immediate damage to the pump.
Also, for a fire at MCC 1A35-SA, the SSA and AOP-36 did not include operator actions to open the breaker on MCC 1A35-SA and verify open MOV 1CS-219 (charging pumps discharge cross-connect). This is a fourth valve powered from MCC 1A35-SA that could affect charging pumps. (AR 00076260) Potential consequences of spurious closure of 1CS-219 would be to stop all charging flow to the RCS from SSD charging pump B.
However, charging pump B would still have min-f low unless 1CS-214 also closed, in which case there could be immediate damage to the pump.
- 3. Engineering Service Request (ESR) -0100087, completed around 1/02, changed charging pump min-flow to go to the VCT (and not directly to the charging pump suction). The SSA did not recognize that this change introduced new potential challenges to the charging system and AOP-36 was not revised. For a fire in SSA areas 1-A-BAL-B (B1), 1-A-BAL-B (B2), or EPA, control power cables for MOV 1CS-165, VCT outlet valve, are not protected from fire damage and a hot short could cause the MOV to close. This would isolate the suction flowpath from the VCT for the running charging pump, which would have been undesirable. However, after the change, spurious closure of 1CS-1 65 would also isolate the min-f low recirculation suction to the charging pump, leaving the pump running with zero flow which could result in immediate damage to the pump. (AR 00076405)
- 4. For a fire at 480V MCC 35B, auxiliary building 261 ft. level (fire zone 1-A-4-COM-E and SSA area 1-A4-BAL-B4), the SSA and AOP-36 did not include manual actions for unprotected breakers/cables that could hot short and close MOVs 1CS-1 68 (charging pump suction cross-connect) and 1CS-1 66 (VCT outlet). The potential consequences of 1CS-1 66 spuriously closing was affected by the ESR-01 00087 change so that it could stop all flow to the running charging pump and result in immediate damage to the pump.
The potential consequences of a spurious closure of 1CS-168 would also be to stop all
flow to the SSD charging pump A which could result in immediate damage to the pump.
(AR 00076260) This is the seventh MOV that the team identified with unprotected cables that could spuriously actuate and adversely affect the charging system.
- 5. For a fire in the auxiliary building 261 ft. level (fire sub-area 1-A-BAL-B), the SSA and AOP-36 differed regarding actions to take for a fire near the boric acid tank (BAT). For a fire at or near the BAT, the SSA credited use of the RWST for the charging pump suction source but the procedure used gravity feed from the BAT if the boric acid transfer pumps and BAT level indication were lost due to a fire at the BAT. As corrective action, a procedure revision directed operators to use the RWST for a fire at or near the BAT. (AR 00075065)
- 6. For a fire at the B chiller, auxiliary building 261 ft. level (in fire zone 1-A-4-CHLR and in SSA analysis area 1-A-BAL-B2), AOP-36 directs operators to operate the B chiller. This is not consistent with the SSA. (AR 00075258)
- 7. Some SSA operator actions used methods that may not be fully analyzed or appropriate. One example is cycling a charging pump to control pressurizer level.
Another is entering containment to manually operate MOV I RH-40, RCS loop C to RHR pump B. The SSA and AOP-36 noted that containment might not be accessible and provided an alternate cold shutdown repair. However, that repair relied upon using cables that were in the room that was on fire (1-A-EPA) and were unprotected from the fire.
- 8. A fire in the turbine building can disable the motor-driven fire pump and also disable auto-start of the diesel-driven fire pump. Local manual start of the diesel fire pump for this fire area is not proceduralized. There may be safety significance but no specific NRC requirements for this condition. (AR 00075339)
- 9. Contrary to the fire protection program (UFSAR Section 9.5.1.2.3(b), fire nozzles in for each selected fire area are a type that is not suitable for use on electrical fires.
However, the fire brigade has a correct nozzle that they would use to fight a fire. (AR 00076621)
- 10. Contrary to OSHA requirements, the communication room (and SAS) in the auxiliary building lacked an exit sign and exit pathway lights. (AR 00076626)