ML050380394

E-mail from P. Fillion to C. Payne - Turkey Point Report Input

ML050380394
Person / Time
Site:	Turkey Point
Issue date:	03/05/2004
From:	Fillion P NRC/RGN-II
To:	Payne D NRC/RGN-II
References
FOIA/PA-2004-0277, IR-04-007
Download: ML050380394 (9)

Text

-[ - y -

rharlie Payne - Turkey Point Report Input Page II From: Paul Fillion)

To: Charlie Payne Date: 3/5/04 3:27PM

Subject:

Turkey Point Report Input

/ $!r!7RAnAfnnrfnn4 TPAD JC1v)r-1%0vvJvv WN.JIVII ----

,A_Il rcaget I I Mail Envelope Properties (4048E2C8.DBO :5: 51853)

Subject:

Turkey Point Report Input Creation Date: 3/5/04 3:27PM From: Paul Fillion Created By: PJF(nrc.lov Recipients ATL PO.ATL DO DCP (Charlie Payne)

Post Office Route ATL PO.ATLDO Files Size Date & Time tpTFP407pjf.wpd 22855 03/05/04 03:25PM Options Expiration Date: None Priority: Standard Reply Requested: No Return Notification: None Concealed

Subject:

No Security: Standard

iCharlie Payne - tDTFP407Dif.wrpd Pagie I 1Charlie Payne tDTFP4O7Dif.wDd

- Pane II INPUT FOR TURKEY POINT 2004 TFPI REPORT 04-07 by Paul J. Fillion

.01 Systems Reguired to Achieve and Maintain Post-fire Safe Shutdown

a. Inspection Scope Focusing on the chemical and volume control system (CVCS), the team evaluated whether the safe shutdown analysis (SSA) properly identified and categorized components in terms of safe shutdown function. In addition, a sample of Instrumentation known to be necessary for safe shutdown, eg. pressurizer and pressure and level indication, was checked in the safe shutdown analysis.

The team considered the capability to safely shutdown given a fire in the selected Fire Area would cause a loss of normal power source to the safety-related buses.

Specifically the control circuit for emergency diesel generator 4A was reviewed in terms of the potential for permissives and interlocks being affected by a fire In Fire Area U, the Unit 4 Train B 4160 V switchgear room. The team checked that the 4160 V Train B normal power supply circuit breaker would not be disabled by a control room fire. This is important because the Train B emergency diesel generator breaker could not be closed if the normal power supply breaker remained closed and Train B Is the source of power for auxiliary shutdown operation.

b. Findings No findings of significance were Identified.

.02 Fire Protection of Safe Shutdown Ca6ability

a. Inspection Scope To address the issue of separation of redundant electric circuits located in the same fire area, the team determined which unprotected cables penetrated the wall between the Unit 4 Train A and Train B 4160 V switchgear rooms. The function of each of these cables was researched by the team to ascertain whether a fire In one switchgear room could affect the capability of equipment in the other room to achieve safe shutdown.

b. Findings No findings of significance were Identified.

.03 Post-Fire Safe Shutdown Circuit Analysis

a. Inspection Scope The team made a detailed review of a number of valves, instruments and other equipment relative to a postulated fire in each of the three Fire Areas chosen. This

. a Pavne - toTFP407Dif.Wpd Page 21 ICharlie I Charlie Pvne - toTFP4Q7oif.wod Paae 2!

review included examination of the licensee's essential equipment list, power supply, essential cable list with routing information, resolution of potential problem cables, elementary control diagram and special fire response procedures. The potential for spurious valve operation or malfunction was considered in the period immediately following a fire and in the period after operator realignment to hot standby mode but before fire extinguishing. In the case of control room fire, alternate shutdown was considered. The applicable criterion was that a fire would not degrade the ability to shutdown. The components reviewed in this portion of the inspection were:

Volume control tank outlet valve (MOV), LCV-3(4)-115C RWST to charging pump valve (AOV), LCV-3(4)-115B RCP 3B #1 seal leakoff control valve (AOV), CV-3(4)-303B Boric acid injection stop valve, MOV-3(4)-350 Charging flow control valve (AOV), HCV-3(4Y121 RCP thermal barrier component cooling water supply isolation valve, MOV-3(4)-716B RCP thermal barrier component cooling water return isolation valve, MOV-3(4)-626 RCS pressure indicator (at auxiliary shutdown panel), P1-3-406-1 RCS pressurizer level (at auxiliary shutdown panel), Ll-3-462-1 Excore neutron flux detector (at auxiliary shutdown panel), NI-4-6649B-3 Air handling unit 4E243B Air handling unit 4E244A EDG 4B voltmeter and wattmeter (at auxiliary shutdown panel)

Unit 3 components Iited above were reviewed'inrielationhtoith-cntroI -room-and Flre Area T, and the Unit 4 components were reviewed in relation to Fire Area U.

Coordination of AC power and DC control protective devices was considered in terms of fire induced short circuits resulting in loss of safe shutdown capability. Control circuits reviewed were LCV-3-115B and component cooling water pump 4B breaker.

b. Findings

Introduction:

A Green NCV was identified for failure to comply with 10 CFR 50, Appendix R, III.G.2, involving failure to protect a control cable for valve LCV-4-115B and a control cable for valve MOV-4-626 both in Fire Area U. Lack of protection for the LCV-4-115B cable could have lead to the water source for charging pump suction being

I Charlie Pavne - tDTFP407Dif.Wpd Paae 31 Charlie Payne toTFP4O7oif.wod

- Paae3I shut off thus damaging the charging pump. Lack of protection for the MOV-4-626 cable could have lead to loss of RCP thermal barrier cooling. Both of these problems together with existing shutdown procedures could have led to RCP seal damage. The licensee resolved this concern by modifying their shutdown procedure.

Description:

Valve LVC-4-11 5B Is In a flow path between the reserve water storage tank (RWST) and the charging pumps suction header. It is an air powered, solenoid controlled, valve. Electric power Is 125 VDC, and the logic is 'energize to open." The valve can be controlled from the main control room and the auxiliary shutdown panel.

The problem identified by the team Involves the following scenario or sequence of events. There is a fire in Fire Area U. It Is postulated the fire would be extinguished In approximately one hour. Immediately after the start of the fire, operators secure the 4A charging pump if running. Valve LCV-4-1 I 5B is opened from the control room to establish the reserve water storage tank (RWST) as the source for charging pumps.

Procedures direct starting (or re-starting) the 4A charging pump within one hour. After the 4A charging pump is started, valve LCV-4-1 15B spuriously closes due to a fire induced short-circuit in the un-protected control cable which terminates at the auxiliary shutdown panel in Fire Area U. Closure of the suction valve leads to pump damage.

Two other charging pumps are installed but they would not be available In this scenario.

The 4B pump may not have power by virtue of the fact that it is powered via the 4160 V bus which is in Fire Area U. The 4C pump, a Train A/B swing pump, would not be available because it is locked out by procedure due to diesel generator loading considerations.

Valve MOV-4-626 is a motor operated valve in the RCP thermal barrier component cooling water return header pipe, I.e. it controls cooling water flow from all three pumps.

It is powered from motor control center 4B. The valve can be controlled from the control room and the auxiliary shutdown panel. Because a control cable for this valve terminates at the auxiliary shutdown panel In Fire Area U and the cable is un-protected, a short-circuit between two wires could cause the valve to spuriously close. Closure of the valve stops RCP thermal barrier cooling. If this event happens concurrent with the loss of charging flow as described above due to closure of LCV-4-115B, all RCP cooling is lost, and a RCP seal LOCA could result. Procedures were written such that credit cannot be given for recognition and recovery from the spurious valve closures in time to prevent the seal LOCA. This problem resulted from lack of protection for cables of

__ -__ required-valVes-and failure-of thesafe-shutdown-analysis-to-ldentify-the-above-scenario.

Analysis: The problem is a performance deficiency because it Is a violation of 10 CFR 50, Appendix R, In that one train of safe shutdown equipment was not protected from fire damage. The performance deficiency is greater than minor because It affected the reactor safety cornerstone objective of Initiating events, I.e. fire. The fire protection risk significance phase 1 screening methodology was applied. The step I criteria were met in that fire barriers were degraded. Fire barriers were considered degraded because one train of shutdown equipment was not free of fire damage. Also detection capability in the fire area under consideration was also degraded as described In Section xxxxx. In applying the step 2 screening, the licensee's safe shutdown analysis paradigm is two trains of shutdown equipment in one fire area with no remaining capability outside the fire area. Having two trains in one fire area is a consequence of

a I Charlie Payne - tDTFP407p~if.wpd Page 41 I Chae Pa-I - t DTFr

• d the fact that the actual mechanical flow paths are not entirely redundant making the valves in question important to both trains of shutdown equipment. In general, the safe shutdown analysis addressed this situation with preemptive operator actions, some of which take place outside the control room. The finding was essentially that this approach was not entirely successful, and therefore need for a phase 2 analysis Is indicated by the screening methodology. All the sequences on the small break LOCA worksheet and sequences 5 and 6 on the loss of offsite power worksheet were evaluated. The small break LOCA worksheet was relevant because of the foregoing discussion. The loss of offsite power worksheet was relevant because a fire In the 4160 V switchgear room can cause a short-circuit on the incoming feeder from the Unit 4 startup transformer, which In turn means that the Unit 4 startup transformer must be automatically isolated and cannot be re-energized until repairs are made. If the fire then caused a short-circuit on the incoming feeder from the Unit 4 auxiliary transformer, this would cause a unit trip and a loss of power on both the 4A and 4B buses. Power could later be recovered at the 4A bus via the Unit 3 startup transformer.

The most important sequences are within the small break LOCA worksheet: sequences six and seven. Sequence six involves operator action to stop the RHR pump and long-term RCS makeup via the operator aligning to the reserve water storage tank.

Sequence seven involves early Inventory high pressure injection. None of these functions are degraded. In addition, the initiating event likelihood was adjusted by a factor of ten to account for the fact that two spurious operations had to occur to cause the RCP seal LOCA.

The fire mitigation frequency was calculated to be -3.2, and the problem existed for greater than 30 days. Standard fire analysis techniques indicated there was a credible fire starting in the switchgear that could damage the control cables at the nearby auxiliary shutdown panel.

Enforcement The finding is a violation of 10 CFR 50, Appendix R, lIl.G.2, and It was of very low safety significance. It met the criteria of Section VIA.1 of the Enforcement Policy and Is therefore being dispositioned as a Non-Cited Violation (NCV). It was entered into the licensee's corrective action program as CR 04-0610 (MOV-4-626) and CR 04-0683

-(L-CV-1115B). Theviolation probably-o-cc-urred dre-to-inadvertent-errorsln-safe-shutdown analysis. It was identified by the NRC during this inspection, and probably existed since Appendix R became a requirement. This NCV will be tracked as NCV 0500025112004007-xx, Failure to Protect One Train of Safe Shutdown Equipment Needed for RCP Seal Protection In Fire Area U.

.04 Alternative Shutdown Canability The team inspected the safe shutdown analysis and plant configuration In relation to the requirement that hot and cold shutdown from outside the control room (alternate shutdown panel) could be achieved and maintained with or without offsite power available.

i; I Charlie Pavne - tDTFP407Djf.wp~d Page ae551 I Chri Payne-- toF4.i~~

The team reviewed a sample of control circuits and fuse coordination applications from the viewpoint that transfer of controls from the main control room to the alternate shutdown panel should not be affected by fire in the control room.

.05 Operational Implementation of Alternative Shutdown Capability

a. Inspection Scope The team made sufficient review of surveillance procedures to determine whether or not the licensee was performing functional testing of the transfer/isolation switches, instrumentation and control switches at the auxiliary shutdown panel.

b. Findinas No findings of significance were Identified.

.08 Cold Shutdown Repairs

a. Inspection Scope

a. The team reviewed Fire Response Procedure 3-GOP-305, Hot Shutdown to Cold Standby, to establish whether or not the licensee had materials identified to accomplish repairs of components required to achieve cold shutdown conditions in cases where the analysis predicted repairs may be necessary. The criteria for this review was that the list of materials was complete and that the types of repairs envisioned could be completed within a time frame consistent with reaching cold shutdown in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

b. Findings No findings of significance were identified

4. OTHER ACTIVITIES 4A02 Identification and Resolution of Problems

a. Inspection Scope The inspectors reviewed a sample of licensee audits, self-assessments and CRs to verify that items related to the Turkey Point fire protection plan, and the capability to successfully achieve and maintain the plant in a safe shutdown condition following a plant fire, were appropriately entered into the licensee's corrective action program In accordance with the Turkey Point quality assurance program and procedural requirements. The items selected were reviewed for classification and appropriateness of the corrective actions taken, or initiated, to resolve the issues. In addition, the team reviewed the licensee's evaluations of and corrective actions for selected industry experience issues related to the fire protection area. The operating experience reports were reviewed to verify that the licensee's review and actions were appropriate.

Al I rh;;r1iP'PqvnP - tnTFP4()7nJf.wod Paae 61 I flh .-n tnTF4O

_ig .- . If~ _ Paae6I

b. Findings In reviewing CR-xxx, which dealt with the clarity and organization of time-critical manual actions in the fire response procedures, the team observed the CR appeared to be prematurely closed. When this subject was breached with cognizant operations personnel, they agreed with that the procedures needed enhancement relative to manual actions. A new CR was generated to address the issue. This will be a documented minor violation. [Section will be completed by Necota]

LIST OF DOCUMENTS REVIEWED Drawings 5610-E-144, Tray, Conduit & Grounding Miscellaneous Details, Rev. 31 5610-J-539P, Instrument Loop Diagram RCS Pressure Indication Alternate Shutdown, Rev. 4 5610-M-430-204, Instrument Loop Diagram, Charging Pump Pressure Discharge Flow & CVCS Hand Controls, Rev. 3 5610-E-27, Sheet 3Y, Elementary Diagram, Mechanical Auxiliaries Fire Pump Control Breaker 30305, Rev. 4 5610-E-27, Sheet 3Y1, Elementary Diagram, Mechanical Auxiliaries Fire Pump Motor P39, Rev. I 5610-E-1, Sheet 1, Main Single Line Unit 3, Rev. 33 5610-E-1, Sheet 2, Main Single Line Unit 4, Rev. 8 5610-T-E-1 592, Sheet 1, 125V D.C. & 120V A.C. Electrical Distribution, Rev. 39 5613-M-3047, Sheet 1, Unit 3, Piping and Instrumentation Diagram, Chemical and Volume Control System Charging and Letdown, Rev. 17 5613-M-3047, Sheet 2, Unit 3 Piping and Instrumentation Diagram, Chemical and Volume Control System Charging and Letdown, Rev. 38 5613-M-3047, Sheet 3, Unit 3, Piping and Instrumentation Diagram, Chemical and Volume Control System Charging and Letdown, Rev. 20 5613-M-3030, Sheet 5, Unit 3, Piping and Instrumentation Diagram, Component Cooling Water System, Rev. 16 5613-E-28, Sheet 36B, Elementary Diagram, Electrical Auxiliaries Diesel Generator 3A Relaying & Metering, Rev. 2 5613-E-25, Sheet 65B, Unit 3, Elementary Diagram, Reactor Auxiliaries Refueling Water Inlet Stop Valve into Charging Header - 115B, Rev. 2 5613-E-25, She~et33A7Uii37,Elementary Diagram, Rea-cto-rAuxiliaries-RCPThermal Barrler C.C.W. Isolation MOV, MOV-3-626, Rev. 2 5613-E-25, Sheet 27C, Unit 3, Elementary Diagram, Reactor Auxiliaries Boric Acid Injection Stop Valve MOV-3-350, Rev. 2 5613-E-25, Sheet 32H, Unit 3, Elementary Diagram, Reactor Auxiliaries RCP Bearing Oil CCW Supply Isolation Valve MOV-3-716B 5613-E-25, Sheet 34A, Unit 3, Elementary Diagram, Reactor Auxiliaries Volume Control Tank Low Level Isolation LCV-3-115C, Rev. 6 5613-E-25, Sheet 67B, Unit 3, Elementary Diagram, Reactor Auxiliaries RCP 'B" Seal Water Disch Isolation Valve CV-3-303B, Rev. 2 5613-E-25, Sheet 98A, Unit 3, Elementary Diagram, Reactor Auxiliaries Charging System Control Valve HCV-3-121, Rev. 0 5613-E-25, Sheet 5B, Elementary Diagram, Reactor Auxiliaries Charging Pump 3P201B

I[Char-lie Payne - tDTFP407rpif.wpd Page Pae7 71 I Carle ayn nTP4Onj.w 5614-E-25, Sheet 33A, Unit 4, Elementary Diagram, Reactor Auxiliaries RCP Thermal Barrier C.C.W. Isolation MOV, MOV-4-626, Rev. 4 5614-E-25, Sheet 8B, Unit 4, Elementary Diagram, Reactor Auxiliaries Pressurizer Heater Backup Group 4B Breaker 40408, Rev. 3 5614-E-25, Sheet 32H, Unit 4, Elementary Diagram, Reactor Auxiliaries RCP Bearing Oil CCW Supply Isolation Valve MOV-4-716B 5614-E-25, Sheet 32G, Unit 4, Elementary Diagram, Reactor Auxiliaries RCP Bearing Oil CCW Supply Isolation Valve MOV-4-716A 5614-E-28, Sheet 8A, Elementary Diagram, Electrical Auxiliaries Diesel Generator Breaker 4AA20, Rev. 5 5614-E-28, Sheet 14A, Elementary Diagram, Electrical Auxiliaries 4160V Switchgear Bus 4A Lock Out Relay, Rev. 2 5614-E-28, Sheet 1B, Elementary Diagram, Electrical Auxiliaries Auxiliary Transformer Breaker 4AB02. Rev. 8 5614-E-25, Sheet 2B, Elementary Diagram, Reactor Auxiliaries Component Cooling Water PP 4B Breaker 4AB13, Rev.5 5614-J-806, Sheet 2B, Instrument Loop Diagram Pressurizer Pressure and Level, Rev. 0 Calculations and Analysis 561 0-M-722, Appendix R Safe Shutdown Analysis (Pages relevant to the selected fire areas) 5610-E-2000, Appendix R Essential Cable List (Parts relevant to the components selected for review) 5610-M-723, Appendix R Essential Equipment List (Portions relevant to the systems reviewed) 5177-265-EG-22, Breaker Fuse Coordination (Portions relevant to Inspection scope)

JPN-PTN-SEEP-93-01 1, Safety Evaluation for Potential for Loss of Remote Shutdown Capability During a Control Room Fire, Rev.0 Procedures 3-OSP-300.1, Alternate Shutdown Panel 30264 Operability Test, dated 9129/03 3-OSP-300.2, Pre-Staging Equipment and Alternate Shutdown Panel 3C64 Switch and Instrumentation Alignment Check, dated 1112/01 CRs Reviewed 02-1268-1&2, Feasibility of performing manual actions with respect to normalized criteria 04-0580, Evaluate an alternate method to define time-lines that could enhance manual action sequences and interactions 04-0292, Operations practices not fully reflected In Pre-fire Plans procedural format 04-0124, Manual action required to trip RCP breakers when trip from main control room not available 03-4126, Procedure enhancement recommended to assign groups of fire zone manual actions to designated operators 04-0033, Credited valves MOV-3/4-860A&B and 861A&B in path from containment sump to RHR suction could be affected by fire 03-1330&1330-1, RCP seal protection circuit analysis issues