ML13330B193

Safety Evaluation Supporting Util Addl Info Re post-fire Alternative Shutdown Sys Design

ML13330B193
Person / Time
Site:	San Onofre
Issue date:	04/08/1987
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML13330B192	List: ML13330B191 ML13330B193
References
TAC-64883 NUDOCS 8704160239
Download: ML13330B193 (13)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SOUTHERN CALIFORNIA EDISON COMPANY SAN ONOFRE NUCLEAR GENERATING STATION, UNIT NO. 1 DOCKET NO. 50-206

1.0 INTRODUCTION

By "05000361/LER-1984-020, :on 840326,w/unit in Mode 2 at 2% Power,Reactor Trip Occurred on High Steam Generator Level.Caused by Overfeeding Steam Generators During Manual Operation of [[system" contains a listed "[" character as part of the property label and has therefore been classified as invalid. Control Sys|letter dated April 24, 1984]], Southern California Edison Company (SCE), the licensee for San Onofre Nuclear Generating Station, Unit 1 (SONGS-1) proposed a revised alternative shutdown design (dedicated safe shutdown system) to achieve compliance with the requirements of Appendix R to 10 CFR Part 50, Sections III.G.3 and III.L. The staff's safety evaluation of the licensee's originally proposed alternative shutdown design was presented in a Safety Evaluation Report dated November 18, 1982. The staff's evaluation of the licensee's most recent proposal is addressed below. This evaluation supersedes that previously provided on this subject.

The licensee has described the post-fire shutdown capability for SONGS-1 in submittals dated April 24, 1984; May 21, September 30, October 4, and December 31, 1985; and February 18 and April 23, 1986. Additional information and clarification was obtained in a meeting with the licensee on November 15, 1985, and during a plant site visit February 6 - 7, 1986. The staff prepared a Safety Evaluation Report on May 15, 1986 which addressed the licensee's safe shutdown capabilities including the dedicated safe shutdown system. During the week of May 19, 1986, an Appendix R inspection was performed at SONGS-1 with findings documented in Inspection Report 86-24 dated June 6, 1986. On May 30, 1986 the licensee requested five additional exemptions-from Appendix R and revised two previous exemptions requests to incorporate alternate shutdown design changes found to be necessary while implementing Appendix R modifications.

In order to incorporate new information from the inspection and from the 8704160239 870408 PDR ADOCK 05000206 F

PDR

-2 additional submittal, the staff's May 15, 1986 evaluation has been revised as shown below. The licensee has provided a safe shutdown analysis for a fire event and has demonstrated that adequate alternative methods exist to compensate for fire hazards in areas and assure safe shutdown.

2.0 EVALUATION A. Systems Required for Safe Shutdown In the event of a fire concurrent with the loss of offsite power, the following components are used to provide the safe shutdown capability for SONGS-1. Reactor shutdown is initiated from the control room by a manual scram of the control rods, if an automatic scram has not already occurred. Primary coolant inventory and reactor shutdown reactivity are maintained with the charging pumps taking suction from the refueling water storage tank; if the charging pumps are not available the safety injection system can alternately be used. If reouired, reactor coolant system pressure may be controlled by the use of pressurizer heaters; overpres surization protection for the primary system is provided by the pressurizer power-operated relief valve (PORV)/block valve combination. Decay heat removal is accomplished through natural circulation, with steam release from the steam generators through power-operated, atmospheric steam dump valves. Cold shutdown conditions may be attained by use of the Residual Heat Removal (RHR) and supporting systems.

Decay heat can also be removed from the Reactor Coolant System (RCS) to achieve and maintain cold shutdown conditions via the Dedicated Shutdown System by using one or more steam generators in successive operating modes: a steaming mode and a single phase heat transfer mode. The.steaming mode begins immediately following

-3 reactor trip. Heat transferred to the secondary side of the steam generator(s) will generate steam that will be released to the environs initially through the safety relief valves and shortly thereafter, i.e.,

after auxiliary feedwater flow has been established, by controlling the atmospheric steam dump valves. Make up water will be supplied to the steam generators from the auxiliary feedwater storage tank (AFST) by a new motor driven auxiliary feedwater (AFW) pump G-10W, dedicated to that service. After the RCS temperature reaches approximately 2200F, the steaming mode will be terminated and a transition to the single-phase heat transfer mode will commence.

The single-phase heat transfer mode involves using the steam generator(s) as a once-through, single-phase heat exchanger. This will entail flooding the steam generators and main steam headers to establish a return flow path; however, manual isolation valves MSS 301 and 302 on the main steam headers will be closed in advance to limit the extent of steam line flooding.

(By letter dated May 21, 1985, the licensee stated that a detailed evaluation of the affected piping and supports would be performed, and that any modifications required to ensure that the lines are adequately supported, would be implemented). Return flow will be "letdown" to an existing circulating water outfall point through a new manual flow control valve and discharge manifold that is "teed" to the steam supply line for the turbine driven AFW pump, upstream of existing valve CV-113. In this mode of operation, the RCS cooldown rate is limited to 50F/hr due to the capacity of the AFW pump. Nevertheless, cold shutdown can be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> as required by Sections III.G. and III.L.1. of Appendix R to 10 CFR Part 50. The single phase heat transfer mode of operation will continue until normal residual heat removal system operation is restored.

B. Areas Where Alternative Shutdown is Required The separation criteria applied in developing the original SONGS-1 design were not consistent with the separation requirements of

-4 10 CFR Part 50, Appendix R. Therefore, the licensee conducted an evaluation to determine whether to reroute existing circuits and relocate existing components to establish separation, or provide other means of alternative shutdown capability. The evaluation identified a total of six fire areas/zones containing redundant safe shutdown divisions that are not adequately separated. Alternative shutdown capability is provided for these areas, which include the reactor auxiliary building lower level (Fire Area 1-AB-(-3)-2A),

yard area (Fire Area 1-YD-14-4D), circulating water pump well (Fire Area 1-YD-(-7)-4E) turbine deck (Fire Area 1-TB-35-9B), power block roof (Fire Area 1-PB-56-33) and the reactor coolant filter enclosure (Fire Area 1-AB-20-2N).

Redundant divisions for all existing shutdown related control and instrumentation circuits interface with one or more of these fire areas, and the congested equipment and cabling made it infeasible to establish adequate train separation within these areas. Therefore, the licensee has committed to provide alternative systems independent of the above fire areas to assure safe shutdown capability in the event of a fire in any of the areas. The licensee has stated that depending on the location of the fire, alternate shutdown may require operator action to locally control certain equipment. When manual actions must be undertaken, the time required to perform these manual actions has been evaluated to assure adequate time and manpower will be available. In order to achieve safe shutdown, the licensee has stated that a minimum of 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> are available before these manual actions need to be taken. The alternative shutdown provisions for each of the fire areas are discussed below:

1. Reactor Auxiliary Building Lower Level (Fire Area 1-AB-(-3)-2A) and Reactor Coolant Filter Enclosure (1-AB-20-2N)

A fire in these areas could result in losing portions of the chemical and volume control system (CVCS) and essential electrical systems that are used to achieve hot standby. In the event that both redundant charging pumps become inoperable

-5 due to a fire, alternative shutdown capability is provided by the Safety Injection System (SIS) whose circuits and components are located outside of this fire area/zone.

Spurious operation of valves associated with the charging system due to fire damage to cables has been considered by the licensee and found not to adversely affect SIS operation.

2. Yard Area (Fire Area 1-YD-14-4D).

Depending upon its location, a fire in this area could result in losing:

the cables for the pressurizer heaters, RWST isolation valve, charging pumps and associated equipment, charging RWST isolation valves, charging loop A control valve and seal injection flow control valves, flow control valves for AFW system, motor driven and steam driven AFW pumps, steam dump transfer control valve, CCW pumps, CCW heat exchanger isolation valves, CCW/RHR heat exchanger flow control valves, saltwater cooling pumps, use of the nitrogen bottles, station service transformers, and the 480V switchgear and 120V vital buses that are used to achieve hot standby.

In the event that the circuits for pressurizer heater groups B and D are damaged due to their being routed through this fire area/zone, alternative pressurizer heater groups A and C will remain available since their circuitry is routed through a different fire area/zone.

Cables for the redundant charging pumps G-8A and 88 could be damaged by a fire in this fire area/zone. However, the licensee has stated that cables for charging pump G-88 and its associated support equipment will be rerouted to maintain a separation of greater than 20 feet whenever possible. Where this separation is not possible, the cables will be provided with a 1-hour rated fire barrier. Therefore, chdrging pump G-8B will remain free of fire damage.

-6 The circuits associated with seal water return and letdown isolation valves CV-528 and CV-526 could be damaged by a fire, but the redundant seal water return and letdown isolation valves CV-525 and CV-527 located outside this fire area/zone, will remain available. This is due to the separation between the respective fire area/zones containing these valves and their associated circuits.

The control and power circuits for AFW pump G-10S, which are routed in this fire area/zone, could be damaged due to fire.

The licensee has stated.that the power circuits will be rerouted outside this fire area. The control circuits will either be rerouted outside this fire'area/zone or the capability will be provided in the switchgear room (located in a different fire area/-zone) to allow manual starting of the pump from the switchgear room.

The three component cooling water (CCW) pumps are adjacent to one another and could be damaged due to a fire in this area/zone. Loss of CCW would result in rendering RHR inoperable. Alternate shutdown capability is provided by use of the motor driven auxiliary feedwater pump for single-phase heat transfer mode of steam generator operation. The auxiliary feedwater pump is separated from the CCW pumps by greater than 100 feet, including 20 feet without in situ intervening combustibles. Additionally, loss of CCW may affect the operation of charging pump G-8B; alternate capability is provided by dedicated operation of charging pump G-8A which will remain available.

The cables for the redundant saltwater cooling pumps G-13A and B, could be damaged by fire. However, auxiliary saltwater cooling pump G-13C could be used to provide alternative pumping capability since its circuits are located more than 100 feet from the G-13A and B circuits.

-7 The licensee has stated that the train 1 (480V electrical distribution system) will remain available in the event train 2 and train 3 station service transformers are damaged by fire. Similarly, the train 2 and train 3, (480V electrical distribution systems) will remain available in the event train 1 station service transformers are damaged by fire.

Additionally, the requirements for manual actions for valves MOV-883 and MOV-1100C were evaluated by the licensee. The licensee committed by letter dated April 23, 1986 to provide adequate fire protection or implement modifications to assure the availability of these valves. The licensee's resolution of this issue was described in a submittal dated May 30, 1986 and was verified to be acceptable during the safe shutdown audit of the plant.

3. Circulating Water Pump Well (Fire-Area-1-YD-(-7)-4E)

A fire in this area/zone could result in loss of cables for saltwater cooling pumps G-13A and G-13B which are used to achieve hot standby. Auxiliary saltwater pump G-13C, which is located outside this fire area/zone, could be used as an alternative if saltwater cooling pumps G-13A and B are unavailable.

4. Turbine Deck (Fire-Area-1-TB-35-9B) and Power Block Roof (Fire Area 1-PB-56-33)

A fire in these areas/zones could result in the loss of circuits for pressurizer pressure transmitters, primary system

-8 hot-leg temperature transmitters and steam generator level transmitters which indicate in the control room. However, alternative indications are provided by dedicated shutdown system instrumentation located outside these fire areas/zones should a fire occur on the turbine deck and power block roof.

C. Dedicated Safe Shutdown System The licensee has provided a Dedicated Safe Shutdown System for the following fire areas:

1. Containment (I-CO-(-10)-1),

2. East Penetration Area (1-YD-20-4A),

3. West Penetration Area (1-YD-20-4B),

4. Turbine Building Ground Floor (1-TB-8-9A),

5. 4160V Switchgear Room (1-PB-14-8),

6. Control Room Complex (1-PB-42-16),

The Dedicated Safe Shutdown System (DSSS) is designed to provide the capability to achieve safe shutdown for any postulated fire in the above fire areas at San Onofre Nuclear Generating Station, Unit 1 (SONGS-1). The DSSS consists of: a dedicated onsite power source (diesel generator) that will serve centrifugal charging pump G-8A; an additional, dedicated motor-driven auxiliary feedwater pump G10-W; the existing remote shutdown panel and associated valves; and instrumentation and controls. The DSSS may be used independently of the above listed fire areas by procedural means, with actions being performed from local shutdown stations or at the equipment itself. The remote shutdown panel (Auxiliary Control Panel C-38) will be the primary control station for DSSS operations. The C-38 panel has been relocated to the DSSS switchgear enclosure building. Alternate process monitoring capability

-9 and instrumentation has been provided at the remote shutdown panel.

D. Other Areas With the exception of the areas identified above the licensee will ensure that all areas of the plant required to have safe shutdown capability will comply with the requirements of Section III.G.1 or III.G.2 of Appendix R to 10 CFR Part 50, unless an exemption request has been approved by the staff.

E.

Performance Goals The performance goals for post-fire safe shutdown, including reactivity control, reactor coolant makeup, reactor coolant pressure control and decay heat removal, can be met using existing systems and equipment identified in Sections II.A and II.B. of this SER. Control over these functions can be accomplished from the DSSS remote shutdown panel or the control room, depending on the location of the fire. The licensee's DSSS method is governed by a single written procedure and relies on operator actions at local shutdown stations or at the required equipment. The process monitoring capability provided at the remote shutdown panel includes pressurizer pressure and level indication; A, B and C steam generator level indication; RCS loop A, B and C hot-and cold-leg temperature indication; and charging flow controller indication. The capability for local indication of tank levels and pressure, and temperature or flow indications of support systems will be identified in the shutdown procedures.

F. Repairs The licensee has stated that the only repairs necessary to achieve cold shutdown include (1) replenishing the oil supply for the dedicated

-10 diesel generator from the existing fuel oil storage tanks using a transfer pump and portable hoses; (2) providing additional compressed air or nitrogen for the operation of instruments and air operated valves using a portable air compressor or additional nitrogen supplies located onsite; and (3) connecting a fire hose from the main steam line letdown header to the outfall point. The available supply of fuel oil for the dedicated diesel generator is adequate for approximately 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> of operation, and the available supply of nitrogen is sufficient for approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of operation. Since the licensee states that approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> are required to achieve hot standby conditions, these actions will be required to proceed from hot standby to the cold shutdown mode.

Necessary equipment will be stored onsite, and procedures to accomplish these activities will be available.

G. Associated Circuits The licensee has conducted an extensive review of the present electrical system to determine plant capability to meet the criteria of Appendix R to 10 CFR Part 50.

All circuitry, indicators, instruments and power supplies associated with the Dedicated Safe Shutdown System (DSSS) are independent.from the identified fire zones for which DSSS capability is required, except for the containment fire area for which an exemption has been granted. The licensee's methods of protecting the safe shutdown capability are consistent with the guidelines provided by the staff in Generic Letter 81-12.

1. Common Power Source The licensee has stated that coordinated breakers or fuses will be provided to assure that faults on associated circuits will not cause a loss-of-power to equipment required for shutdown.

-11

2. Common Enclosure The licensee has stated that the common enclosure evaluation demonstrates that associated circuits will not endanger safe shutdown capability.

3. Spurious Signal Operation The licensee's analysis of alternate safe shutdown capability identified the individual components in systems that are needed to assure the DSSS function. The licensee's proposed design for the DSSS and local control station will provide the capability to electrically isolate DSSS components from fire areas. The DSSS design provides the capability to control all needed components independent of the fire area.

The licensee's analysis identified six high/low pressure interfaces where fire induced operation of the redundant valves in series could potentially result in a LOCA. For the interfaces in two pressurizer relief lines, the licensee stated that operator action will be taken to de-energize the power supply to the valve operators to prevent spurious operation; the valves fail closed on loss-of-power.

For the other valve interfaces, the licensee has stated that spurious valve operation is prevented either through compliance with the separation criteria of III.G.2 of Appendix R to 10 CFR Part 50 or by operator action to lock out the power breaker to one of the redundant valves.

H. Safe Shutdown Procedures and Manpower The licensee has stated that the procedures governing DSSS operation will be completed and personnel will be trained

-12 in their use. Furthermore, the licensee has stated that a normal shift crew (not including fire brigade members) provides sufficient staffing to perform the required manual operations in a timely manner, and achieve and maintain a safe hot-standby condition. Consequently, adequate personnel will be available on-site at all times for proper DSSS operation.

3.0 CONCLUSION

Based on the above, the staff concludes that the San Onofre Nuclear Generating Station, Unit 1 post-fire alternate shutdown system design provides one train of components necessary to achieve and maintain safe shutdown conditions. This meets the requirements of Sections III.G.3 and III.L of Appendix R to 10 CFR Part 50, with respect to safe shutdown in the event of a fire, and is, therefore, acceptable.

4.0 ACKNOWLEDGEMENT This Safety Evaluation has been prepared by A. Singh and R. Dudley.

Dated: April 8, 1987

Distribution Copies:

,Docket Files NRC PDR Local PDR PAD#1 r/f PAD#1 p/f TNovak, Actg. DD NThompson, DHFT OGC-Bethesda EJordan BGrimes JPartlow GLear PShuttleworth ACRS (10)

LFMB