ML042380311

Fire Protection Baseline Inspection - Browns Ferry Units 2 & 3

ML042380311
Person / Time
Site:	Browns Ferry
Issue date:	08/10/2004
From:	NRC/RGN-II
To:
References
FOIA/PA-2004-0277 IR-03-007
Download: ML042380311 (10)

Text

FIRE PROTECTION BASELINE INSPECTION BROWNS FERRY U2,U3 INPUT FOR INSPECTION REPORT NO.: 50-260,296/03-07 INSPECTOR:

S. Walker, Electrical Lead K. Sullivan, BNL (Contractor)

R. Rodriguez, Intern N. Staples, Intern INSPECTION DATES:

Week 1 of onsite inspection - September 8 -12, 2003 Week 2 of onsite inspection - September 29 - October 3, 2003 Type of Inspection: TRIENNIAL FIRE PROTECTION BASELINE INSPECTION: 711111.05 Fire Protection Features and Post-Fire Safe Shutdown Capability A.

INSPECTION REPORT INPUT (ELECTRICAL)

1.

REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems

.01 Systems'Required To Achievb and Maintain Post-Fire Safe Shutdown

a. Inspection Scope The team reviewed the licensee's fire protection program documented in the Safety Evaluation Reports, the Browns Ferry UFSAR, and the Browns Ferry Unit 2/3 Appendix R Report to determine the systems required to achieve post-fire SSD. The team selected the minimum required equipment necessary for safe shutdown, which included the residual heat removal system (RHR) in Low Pressure Coolant Injection (LPCI) mode, RHR service water (RHRSW), and the main steam relief valves (MSRVs). In addition, supporting auxiliary systems such as, the emergency equipment cooling water system (EECW), Shutdown Board and Battery Board Room ventilation, and fire protection systems, were also included in the review to assess their availability for safe shutdown. The team also reviewed the safe shutdown equipment lists, system flow diagrams, and the separation analysis (INDMS Report) for each of the three selected fire areas=

dand porresppding dacen ares) to evaluate the completeness and adequacy of the Fire Protection Program; and whether the systems and components relied upon to mitigate fires in the selected fire areas had been correctly identified. The team conducted interviews and reviewed procedures to evaluate the licensee's criteria for executing the SSD methodology and to discern how the equipment required was being utilized; specifically when offsite power was not available. The team examined license basis documents to verify local manual operator actions were consistent with plant procedures. Specific licensee documents and drawings reviewed during the inspection are listed in the Attachment.

b. Findings No findings of significance were identified.

.02 Fire Protection of Safe Shutdown Capability

a. Inspection Scope For the selected fire areas, the team evaluated the frequency of fires or the potential for fires, the separation of systems necessary to achieve safe shutdown, and the separation of electrical components and circuits located within the same fire area to ensure that at least one train of redundant safe shutdown systems Is free of fire damage. The inspectors gauged the effectiveness of the licensee's separation analysis based on the review of safe shutdown procedures, calculations, cable routing and schedule reports, supporting license conditions, and any additional affiliated information.

b. Findings No findings of significance were identified.

.03 Post-Fire Safe Shutdown Circuit Analysis

a. Inspection Scope The team reviewed how systems would be used to achieve and maintain reactivity control, overpressure protection, inventory control with high or low pressure Injection systems, and residual heat removal during and following a postulated fire in the fire areas selected for review. The inspection specifically focused on systems and equipment necessary to achieve and maintain hot shutdown conditions because damage to these systems could pose a significantly greater risk than damage to systems required to achieve cold shutdown conditions. In addition, the inspectors reviewed a sample of the HVAC system for the selected fire areas. Portions of the licensee's Appendix R Report which described the methodology and system flow diagrams were reviewed. Control circuit schematics were analyzed to identify and evaluate cables important to safe shutdown. The team traced the routing of cables through fire areas selected for review by using cable schedules and separation calculations and analyses. The team walked down these fire areas to compare the actual plant configuration to the layout indicated on the drawings. The team also utilized the aforementioned Information to determine if the reqiuirements for protection of control and power cables were met.

Iponts Ci4 quipment jncluded.Inte reth ew

're ItsteiJ Tbe i-Qe Potential for Spurious Actuation of all Safety Relief Valves

As observed during a recent triennial fire protection inspection performed at the Hatch Nuclear Plant, certain BWRs may be susceptible to fire damage that causes the electrical backup over-pressurization circuitry of the Safety Relief Valves (SRVs) to actuate. If this were to occur, all SRVs could spuriously actuate at a time when low-pressure, high volume makeup systems (e.g., RHR/LPCI) capable of mitigating this event may not be immediately available. A review of the routing of reactor pressure instrument cables, whose damage due to fire could initiate this event did not identify any interactions of concern in fire areas outside the Control Building. Unlike the scenario identified during the Hatch inspection, for fire areas other than the Control Building (an alternative shutdown area), the instrument cables evaluated appear to be provided with separation and/or protection sufficient to satisfy Section III.G.2 of Appendix R. It should be noted however, a comprehensive evaluation of this concern was not performed by either the inspection team or the licensee. The licensee has entered an evaluation of this issue into its corrective actions program. This evaluation will be tracked under PER No. 03-019211 -000

b. Findings No findings of significance were identified.

.04 Alternative Shutdown Capability

a. Inspection Scope This portion of the inspection was performed and evaluated by an NRC inspection team in June 2000. No findings of significance were identified. This is documented by Report No. 2000-008.

.05 Operational Implementation of Alternative Shutdown Capability

a. Inspection Scope This portion of the inspection was performed and evaluated by an NRC inspection team in June 2000. No findings of significance were Identified. This is documented by Report No. 2000-008.

.07.

Emergency Lighting

a. Inspection Scope The team inspected the licensee's emergency lighting systems to verify that 8-hour emergency lighting coverage was provided as required by 10 CFR 50, Appendix R,

Section II.J, to support local manual operator actions that were needed for post-fire operation of SSD equipment. l??-man

f. dat. ;eo caic ; field; ds

b. Findings No findings of significance were identified.

.09 Fire Barriers and Fire Area/Zone/Room Penetration Seals

a. Inspection Scope The teamn reviewed abnormal operating fire procedures (A0ls), fire damper location, and heating ventilation and air conditioning system drawings for a selected sample of equipment Iinted XLn VTe 1-0Q to confirm that access to shutdown equipment and selected operator manual actions would not be Inhibited by smoke migration from one area to adjacent plant areas used to accomplish SSD. The inspectors substantiated the licensee's position that hydrogen buildup in Emergency Battery and Shutdown Board Room 2A and 2B, would be maintained below the hydrogen concentration level in accordance with their design. Calculations, flow diagrams, circuit wiring diagrams, cable routing, Interviews, and field observations were utilized to foster the team's assessment.

b. Findings No findings of significance were identified.

.10 Fire Protection Systems. Features, and Equipment

a. Inspection Scope The team reviewed flow diagrams and cable routing information associated with the umppiipof th!pfir~e protection water supply system.,W)VY ?,FOraseleIed samplo ir protection ~equipment, the tea reviewed Condult and Cable Schedule Reports a!Qrng vith Appendix R Required Compo ts Re onim leti xI and pt yiyca ep tn ptecaberoueorh~eS. Pi r~en Pump 0 6

1 1t ??

The team verified that the selected components of the common fire protection water delivery and supply systems required for manual fire fighting and water-based fire suppression systems were not Inhibited from fire-induced failures.

b. Findings No findings of significance were identified.

.12 Fire Protection Licensing Basis

a. Inspection Scope The team reviewed license basis documents, including but not limited to Safety Evaluation Reports and Appendix R exemptions, to verify the licensees Fire Protection Program is consistent and in compliance with 10 CFR 50.48, "Fire Protection," and Appendix R to 10 CFR 50, "Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979K the approved plant conditions. By evaluating and comparing the licensees safe shutdown procedures, the Fire Protection Report, and various calculations of record against the license basis, the Inspectors were able measure the adequacy and congruency of the program.

b. Findings Licensee's Assumption of a Single Spurious Actuation Appears to be Inconsistent With the Current Licensing Basis and Other Design Basis Documents

==

Introduction:==

A finding was identified in that the licensee's position on spurious actuations are not consistent with the guidelines of 1 OCFR50 Appendix R,Section III.G.2., nor the licensee's current fire protection licensing basis. This finding is considered an unresolved item (URI) pending completion of the significance determination process (SDP).

Descriotion: In the majority of cases, two or more Independent circuit faults (e.g., a single hot short in each of two control circuits exposed to fire damage) must occur in order to cause more than one component to spuriously actuate. It Is the licensee's contention that GL 86-10 only requires consideration of multiple hot-shorts during the evaluation of components that comprise a high-low pressure interface. Based on this interpretation, the licensee has concluded that, except for cases involving high-low pressure interface boundaries, only one hot short need be considered to occur as a result of fire in any area. Specifically, it Is the licensee's position that since. multiple faults must occur in order to cause two or more components to spuriously actuate, scenarios involving multiple spurious actuations, such as branch (diversion flow) lines that consist of more than one normally closed valve in series, need not be evaluated for the potential for fire to cause both valves to spuriously open. This position does not appear to be consistent with Section III.G.2 of Appendix R which requires one train of cables or equipment (including associated non-safety circuits) to be free of fire damage, the licensee's current fire protection licensing basis or review criteria specified in several of

.the licensee's design basis documents.

Consistent with the requirements of Section III.G of Appendix R to 10 CFR 50, Section 3.5 (h) of the licensee's Safe Shutdown Analysis (documented in Section 3 of the Fire Protection Report), states that associated circuits located in a fire area shall not defeat the shutdown capability of the plant. Consistent with the guidance provided by the staff in Generic Letter (GL) 81-12, paragraph 3.5(h) (2) defines spurious operation associated circuits of concern to post-fire safe shutdown as those cables that have a physical separation less than that required by 10CFR50 Appendix R, Section III.G.2.

and have a connection to equipment whose spurious operation would adversely affect the shutdown capability. However, in describing the potential consequences of spurious actuations this section of the SSA states that the safe shutdown capability should not be

adversely affected by any one spurious actuation or signal resulting from a fire in any plant area. This assumption (only one spurious actuation would occur regardless of the number of circuits that may be affected by fire), does not appear to be consistent the circuit analysis methodology described in the licensee's current licensing basis, or circuit analysis criteria described in other design basis documents that have been developed by the licensee.

With regard to the licensee's current licensing basis, Section 3.2.1 of the staff's Safety Evaluation (SE) dated November 2, 1995, (Safety Evaluation of Post-fire Safe Shutdown Capability and Issuance of Technical Specification Amendments for the Browns Ferry Nuclear Plant Units 1, 2, and 3) states that the licensee's methodology for assessing compliance with Section III.G of Appendix R included the identification of associated circuits Pjin ot !wslted frkob rshutdwin blig and either meeting the fire protection requirements of Section IIl.G or providing justification where deviations from these requirements occur. In Section 3.2.2, the SE further states that associated circuits of components whose fire-induced maloperation could affect the safe shutdown capability were identified. In Section 3.7.3, the SE provides the following description of the licensee's methodology for evaluating spurious actuations that may be initiated by fire:

Circuits whose fire-induced spurious actuation could affect the safe shutdown capability were identified and evaluated.

When spurious actuation circuits of concern were Identified in areas other than the control building, the licensee treated them as required circuits and provided a level of protection equivalent to that required by Section III.G.2 of Appendix R.

The methodology for identifying potential fire-induced spurious operations was to first Identify those components which could adversely impact safe shutdown of the reactor. These are the components whose spurious operation could result in either inventory loss from the vessel, or flow divergence or flow blockage in the Inventory make-up or decay heat removal systems. Once these potentially spurious components have been Identified, the cables associated with each component were Identified, along with their routing.

For each fire zone and area, those cables and components whose spurious actuation could adversely affect the safe shutdown of the reactor were identified and an appropriate method of resolution was Implemented.

Based on its review of the staff's SE, the Inspection team could not conclude that the staff had explicitly endorsed the licensee's design-basis assumption that only one spurious actuation would occur as a result of fire.

With regard to other fire protection design basis documents and supporting calculations, calculation ED-Q0999-940040, Rev 11, 12/21/00, "Appendix R Computerized Safe Shutdown Analysis' describes the methodology that was used to identify "Branch Line Components" of potential flow diversion paths from a required flow path. The stated purpose of this calculation was to document the ability of BFN Units 2&3 to comply with Appendix R separation requirements.Section III.C of the calculation states that for each branch line that could divert a portion of the process flow, the branch line was traced to a valve judged capable of isolating branch flow. An acceptable isolation valve is defined

in this document as: (c) A single power-actuated valve whose required position can be attained or maintained (emphasis added). In addition, design criterion BFN-50-747 "Fire Protection of Safe Shutdown" Rev.4, dated 10/2/96, which provides the basis for performing component and circuit identification for the safe shutdown analysis, specifically states that multiple spurious actuations must be considered one at a time in such a way that safe shutdown capability Is not adversely affected. This design requirement (consideration of multiple spurious actuations in a sequential (one at a time) manner), appears to be inconsistent with the licensee's assumption that only one spurious actuation would occur.

Spurious actuation of containment spray isolation valves FCV-74-57 and FCV-74-58 (RHR Loop A) or FCV-74-71 and FCV-74-72 (Loop B) is one example where multiple (two or more) spurious actuations could have a significant impact on the ability to achieve and maintain safe shutdown conditions. For each loop, two normally closed motor-operated valves (MOVs) are located in 18" branch lines off of the main 24" RHR LPC1 Injection flowpath. A fire which caused both valves to spuriously actuate at a time when that loop was relied on for safe shutdown could divert a significant quantity of LPCI flow or cause a drain down of the RHR injection line. In its evaluation of this concern (Table 5-3 of the SSA) the licensee states that no further analysis Is necessary because [based on its assumption in Section 3.5 of the SSA] a single spurious operation cannot open both valves. In accordance with NRC Inspection Module 71111.05, dated 3/06/03, a comprehensive review of fire-induced failures in associated circuits of concern to post-fire safe shutdown was not performed during this inspection. However, because of the analysis disparities described above, and because of the potential significance this failure scenario could have on the shutdown capability, the Inspection team did review the separation provided for control and power cables associated with valves FCV-74-57, FCV-74-58, FCV-74-71 and FCV-74-72. This review did not Identify any cases where both valves in each branch line would spuriously open at a time when their associated loop of RHR was credited for safe shutdown.

At the exit meeting the licensee was informed that the apparent inconsistencies between the SSA, SE and other design-basis documents would be categorized as an Unresolved Item pending completion of currently on-going industry and NRC initiatives to resolve associated circuit analysis Issues.

Analysis: Based on the objective facts, the team determined the finding impacted the configuration control" and "equipment performance" attributes of the mitigating systems cornerstone. It adversely challenged the availability, reliability, and capability of systems that respond to Initiating events; hence the finding is characterized as greater than minor. The finding was determined to have a potential safety significance greater than very low safety significance because fire induced spurious actuations of specific unanalyzed components could adversely affect safe shutdown capability. However, this finding remains unresolved pending completion of a significance determination.

Enforcement: 10 CFR 50.48 states, in part, "Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part."

Browns Ferry Units 2 & 3 Operating License, specify, In part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated February 1979.

The licensee's UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L. of Appendix R provides requirements to be met by alternative shutdown methods.

DOCUMENTATION Drawings 12050-DAR-095C, Appendix R Flowpath - Chemical & Volume Control System, sh. 1, Rev. 5 12050-DAR-096A, Appendix R Flowpath - Chemical & Volume Control System, sh. 3, Rev. 0 12050-DAR-095B, Appendix R Flowpath - Chemical & Volume Control System, sh. 2, Rev. 3 12050-DAR-095C, Appendix R Flowpath - Chemical & Volume Control System, sh. 2, Rev. 4 12050-DAR-095B, Appendix R Flowpath - Chemical & Volume Control System, sh. 1, Rev. 7 12050-DAR-074A, Appendix R Flowpath - Feedwater System, sh. 3, Rev. 1 12050-DAR-074A, Appendix R Flowpath - Feedwater System, sh. 1, Rev. 7 12050-FE-9OBA-2, Appendix R Block Diagram - Charging Pump System, sh. 1, Rev. 2 12050-FE-9OBB-2, Appendix R Block Diagram - Charging Pump System, sh. 2, Rev. 2 12050-FE-90BC-3, Appendix R Block Diagram -Charging Pump System, sh. 3, Rev. 2 12050-FE-9OBD-3, Appendix R Block Diagram -Charging Pump System, sh. 4, Rev. 3 12050-FE-9OCA-2, Appendix R Block Diagram -Auxiliary Feedwater System, sh. 1, Rev. 3 12050-FE-9OCB-2, Appendix R Block Diagram -Auxiliary Feedwater System, sh. 2, Rev. 2 12050-FE-9OHB-2, Appendix R Block Diagram - Emergency Diesel Control Isol., sh. 1, Rev. 2 12050-FE-90HC-2, Appendix R Block Diagram - Emergency Diesel Control Isol., sh. 2, Rev. 2 12050-FE-90GA-3, Appendix R Block Diagram - High/Lo Boundary Valves, sh. 1, Rev. 3 12050-FE-9OGB-3, Appendix R Block Diagram - High/Lo Boundary Valves, sh. 2, Rev. 3 12050-FE-3MN, Wiring Diagram-Appendix "R" Isolation Switch Panel, Rev. 0 12050-ESK-6DP, Elementary Diagram 480 V Circuits, MOV (2536), sh. 38, Rev. 18 12050-ESK-6NR, Elementary Diagram, Solenoid Oper. Valves (2456 & 2455C), sh. 1, Rev. 20 11715-ESK-5AN, Elementary Diagram 4160 V-Charging Pump 1-CH-P-1C, sh. 1, Rev. 15 12050-ESK-6PR, Elementary Diagram),Solenoid Oper. Valves (MS21 1A & B) sh. 40, Rev. 19 12050-ESK-6EA, Elementary Diagram 480 V Circuits, MOV (2370), sh. 49, Rev. 10 12050-ESK-6DN, Elementary Diagram 480 V Circuits, MOV (2289A & 2373), sh. 37, Rev. 16 12050-ESK-6DV, Elementary Diagram 480 V Circuits, MOV (2867A), sh. 44, Rev. 18 12050-ESK-6DW, Elementary Diagram 480 V Circuits, MOV (2867C), sh. 45, Rev. 14 12050-FE-9EV, Wiring Diagram 480 V Emer., MCC 2H1-2S (Sect. A, B, C), Rev. 17 12050-FE-9EQ, Wiring Diagram 480 V Emer., MCC 2H1-2N (Sect. G, H, J), Rev. 17 12050-FE-9FG, Wiring Diagram 480 V Emer., MCC 2H1-2N (Sect. G, H), Rev. 10 12050-FE-9EN, Wiring Diagram 480 V Emer., MCC 2H1-2N (Sect. C, D), Rev. 17 12050-FE-9EP, Wiring Diagram 480 V Emer., MCC 2H1-2N (Sect. E, F), Rev. 13 12050-FE-91 N, 480 V One Line Emergency, MCC 2H1-2N & 2S, Rev. 28 12050-FE-91 P, 480 V One Line Emergency, MCC 2J1-2, Rev. 28 12050-FE-34Z-6, Cable Tray Plan - Emergency Switchgear Room, Rev. 6 12050-FE-34BF-6, Cable Tray Plan - Emergency Switchgear Room, Rev. 6 12050-FE-34BH-7, Cable Tray Plan - CV & T, Orange Trays, sh. 1, Rev. 7 12050-FE-34BJ-5, Cable Tray Plan - CV & T, Orange Trays, sh. 2, Rev. 5 12050-FE-34BK-9, Cable Tray Plan - CV & T, Purple Trays, Rev. 9 12050-FE-42M-1 5, Sleeve Identification MCC Cable Entry, sh. 2, Rev. 15 12050-FE-3CD, Wiring Diagram, Auxiliary Shutdown Panel Train A, sh. 1, Rev. 15 12050-FE-3CE, Wiring Diagram, Auxiliary Shutdown Panel Train B, sh. 1, Rev. 15 12050-FE-3GC, Wiring Diagram, Auxiliary Shutdown Panel Train A, sh. 2, Rev. 11 12050-FE-3GD, Wiring Diagram, Auxiliary Shutdown Panel Train B, sh. 2, Rev. 14 11715-FE-3QA, Wiring Diagram, Auxiliary Monitoring Panel 1-EI-CB-203, sh. 1, Rev. 0 11715-FE-3QH, Wiring Diagram, Auxiliary Monitoring Panel 1-EI-CB-203, sh. 2, Rev. 0

Procedures 2-FCA-2, Emergency Switchgear Room Fire, Rev. 17 0-FCA-1, Control Room Fire, Rev. 26

-0, Loss of Al AC Pe, Rev xx Calculations & Evaluations Technical Report EP-0017, Combustible Loading Analysis: NAPS Units 1 & 2, Rev. 2 Calculation EE-0027, Emergency Diesel Generator Loading.Sequencing, Rev. 1 ET CEP 00-0043, Availability of MOVs for Local Operation NAPS, Rev. 0 ET CEE 95-032, Plenum Cable Fire Protection Acceptability NAPS, Rev. 0 Electrical Engineering Standard STD-EEN-002, Design Standard for Cable, Rev. 5 NAPS Response to Request for Additional Information-IPEEE, Attachment 1, dated 8/6/99 NAPS Appendix R Report, Rev. 21 S-012-1, High Temperature O-Rings to Survive Loss of All Seal Cooling, dated 11/91 License Basis Documents NAPS UFSAR, Section 8.3, Onsite Power Systems, Rev. 38 SER Re Sections III.G.3 & lll.L of Appendix R to 10CFR50 Concerning Alternate Safe Shutdown Capability In Event of Fire. Facilities In Compliance With Requirements, dated 11/82 SER Re Appendix R to 10CFR50 Items III.G.3 & lll.L Supporting Utility Proposal for'Altemate Safe Shutdown Capability In Event of Fire, dated 11/82 NAPS Post Fire Safe Shutdown SE Submittal, dated 6/82 Work Orders / Work Request W.O. 422576-01, High Temperature O-Ring Installation for "B" RCP Seal, dated 4/3/01 Standards & Codes UL 910, Test for Flame Propagation and Smoke Density Values for Electrical and Optical Fiber Cables Used in Spaces Transporting Environmental Air, dated 2/95 IEEE 383, Standard for Type Test of Class 1 E Electrical Cables, Field Splices and Connections for Nuclear Power Generating Stations, dated 1974