ML17201M275
| ML17201M275 | |
| Person / Time | |
|---|---|
| Site: | Dresden  |
| Issue date: | 12/28/1988 |
| From: | Hodor R, Holmes J, Parkinson K BROOKHAVEN NATIONAL LABORATORY, NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML17201M272 | List: |
| References | |
| 50-237-88-10, 50-249-88-10, NUDOCS 8901090207 | |
| Download: ML17201M275 (28) | |
Text
U. S. NUCLEAR REGULATORY COMMISSION REGION III Reports No. 50-237/88010(DRS); 50-249/88012(DRS)
Docket Nos. 50-237; 50-249 Licenses No. DPR-19; DPR-25 Licensee:
Commonwealth Edison Company Post Office Box 767 Chicago, IL 60690 Facility Name:
Dresden Nuclear Power Station, Units 2 and 3 Inspection At:
Dresden Site, Morris, Illinois Inspection Conducted:
April 18-22, May 11-13, August 15, and December 13, 1988 C\\.~
Inspectors: J. Holmes
~~~
R. Hodor (BNL)
~.*~~
K. Parkinson (BNL)
~~Jr.-
Approved By:
R. Gardner, Chief Plant System Section Inspection Summary tZ./Z7/8B Date lZ../t. 7 /SB Date I Z j-c,,.:a) B t.1 Date Ins ection on A ril 18-22, Ma 11-13, Au ust 15 and December 13, 1988 (Re orts No. 50-237/88010 DRS ; 50-249/88012 DRS Areas Inspected:
Special, announced inspection conducted to assess plant compliance with 10 CFR Part 50, Appendix Rand to review implementation of certain Fire Protection Program requirements.
The inspection was performed in accordance with NRC Manual Chapter Procedures 30703, 64100, and 64704.
Results:
Of the areas inspected, two apparent violations were identified.
The licensee has developed a safe shutdown methodology to prevent fuel clad damage or rupture of any primary coolant boundary in the event of a disabling fire in the plant. However, the methodology chosen by the licensee does not incorporate a dedicated safe shutdown par.iel for a disabling fire requiring the evacuation of the control room, but relies on many manual actions to achieve
- .:*;;io 109<).._0::'(_.,7 FDR AI:tlJ-c*v 89010?
1.7°'
- P*.
050()(:)'=:;'°.:*'7
,:{
...... 4*-* I F'DC
safe shutdown conditions.
The strength or weakness of this program in achieving its goals in safely shutting down the reactors will be dependent upon good operator training, prudent use of administrative controls and maintaining the present fire protection systems.
Weaknesses observed included the following:
(1) licensee did not provide administrative controls to insure that the required opposite unit equipment was available for the operating unit when the required opposite unit equipment was down for repair (Paragraph 3.g);
(2) administrative controls for combustibles were not effectively utilized in that the licensee permitted the storage of twenty 55 gallon drums of lube oil in a safety-related area where an exemption from the installation of a sprinkler system has been submitted to NRR due to the lack of combustibles in the area (Paragraph 4.b); (3) Unit 1 is no longer operational and does not appear adequately isolated from Units 2 and 3 (Paragraph 2.e.); and (4) in the event of a disabling fire, two hot shorts in multiple conductor cables 33674 and 33934 could cause the spurious operation of the target rock and the electromatic relief valves. While the safe shutdown analysis addresses spurious operation of one valve, the simultaneous spurious opening of the Target Rock Valve and all of the Electromatic Relief Valves has not been analyzed (Paragraph 3.f). Strengths were noted in the application of salient fire protection features b~tween Units 2 and 3 (Paragraph 3.h) and also in the coordination and execution of the fire pump capacity test (Paragraph 2.c).*
2
DETAILS
- 1.
Persons Contacted Commonwealth Edison Company (CECo)
- +E. Eenigenburg, Station Manager
- D. Barnett, Quality Assurance
- +B. Barth, Technical Staff Engineer
- W. Betourne, Quality Assurance
- R. Black, Assistant Fire Marshal
- +J. Brunner, Assistant Superintendent Technical Services
- R. Christensen, Operations
- +M. Dillon, Fire Marshal
- +T. Hausheer, Fire Protection Engineer
- +R. Johnson, Technical Staff Group Leaqer
- J. Kotowski, Operations Assistant Superintendent
- +T. Lewis, Regulatory Assurance
- G. Mauropoulos, Boiling Water Reactor Engineer
+E. Netzel, QA Superintendent
- +K. Peterman, Regulatory. As!surance Supervisor-..
- W. Pierce, Engineering Support Service
- D. Roberts, Fire Protection Engineer
- R. Roebert, BWR Engineering
- +C. Schroeder, Services Superintendent
- +J. Silady, Nuclear Li.cerising Administrator E. Skowron, Technical Staff Engineer
- +R. Stachniak, Technical 1.Staff Engineer
- J.. Wajciga, Production Superintendent
- +R. Wh~len, Tech Staff Mechanical System Group Leader
- J. Wi 11 i ams, Regu.l atory Assurance Sargent and Lundy (S&L)
R. Brown, Electrical Engineer F. Fisher, Electrical Engineer J. Kelly, Boiling Water Reactor Engineer C. Ruth, Electrical Engineer Professional Loss Control (PLC)
- M. Mowrer, Vice President
- C. Ksobiech, Senior Fire Protection Engineer U.S. Nuclear Regulatory Commission (NRC)
+S. Dupont, Senior Resident Inspector
- D. Jones, Project Inspector
- P. Kaufman, Resident Inspector
- Denotes those attending the April 22, 1988 exit meeting.
+Denotes those attending..the October 18, 1988 exit meeting.
- Denotes those attending the December 13, 1988 exit meeting.
3
- 2.
Licensee Actions on Previou~ Inspection Findings.
- a.
(Closed) Violation (237/85033-0l(ORS); 249/85029-0l(DRS)):
The licensee failed to consistently and effectively staff th~ fire protection coordinator position with the result that certain fire protection equipment was not installed, hardware and equipment were not being properly maintained, required training was not completed, and prompt and effective corrective action was not taken for identified deficiencies.
I~ the licensee's letter dated January 24, 1986, to J. Keppler, NRC, from D. Farrar, CECo, the licensee responded to the violation by indicating that a task force had been assembled to examine the various fire protection duties and tasks that are required to be performed on a company wide basis.
The licensee also indicated that, in the interim, a Nuclear Service Technical Fire Protection Engineer from the General Office would assist the station one day per week until the Task Force Report is accepted and implemented.
The licensee further jndicated that full compliance would be achieved after the Task Force recommendations had been reviewed, evaluated and implemented to the extent deemed necessary.
On July 16, 1986, a followup meeting was held in Region III.
In this meeting, the licensee presented several of the recommendations developed by the task force which included providing an Assistant Fire Marshal to the Dresden site and the formation of a fully staffed Corporate Fire Protection Group by late i987.
The licensee indicated that an Assistant Fire Marshal at Dresden'was hired as a result of the Task Force recommendation.
However, the Task Force recommendations had not been fully implemented and were being.
reviewed by upper management.
The inspector subsequently requested the licensee to provide a completion date as to when the Fire Protection Task Force recommendations would be implemented.
In a letter dated June 10, 1988, from C. Reed, CECo, to A. B. Davis, NRC, the licensee stated that during March 1988 Executive Management had reviewed previous fire protection program assessments and the status of the Fire Protection Task Force Report.
The review concluded that increasing the size of the Corporate Fire Protection Group was a desirable enhancement however Executive Management concluded that at that time the group did not need to be as large as recommended by the Task Force Report.
The June 10, 1988 letter states, 11 In summary, Commonwealth Edison believes that the fire protection program deficiencies at Dresden have been corrected and applicable corporate recommendations have been implemented.
Further implementation of the corporate Task Force recommendations will be driven by the desire to achieve excellence in fire protection for all our plants including Dresden.
11 4
~....
- b.
Based on the licensee's actions of assembling a Fire Protection Task Force to examine various fire protection duties on a company wide basis, hiring an Assistant Fire Marshal and implementing applicable Task Force recommendations, this item is considered closed.
(Closed) Unresolved Item (237/85033-02(DRS)~ 249/85029-02(DRS)):
The qualifications of the Station Fire Mars al did not appear to be commensurate with the list of responsibilities assigned to that position.
The lengthy list of responsibilities constituted a work load that may not have been achievable by a single individual, regardless of the individual's qualifications and experience.
In the January 24, 1986 letter, the licensee indicated that a Task*
Force had been assembled to examine the various fire protection duties and tasks that are required *to be performed on a company wide basis.
The Task Force**duties included review of the primary responsibilities of the Fire Marshal position.
The Task Force recomme~ded a proposed organizational structure for effectively performing fire protection duties in the company.
The Task Force indicated that given the nu~erous duties and responsibilities at the station level, all nuclear stations needed to* provide a full-time Assistant Fire Marshal and fire brigade instructor, in addition to the Fire Marshal.
Consequently, in a June 10, 1988 letter from C. Reed, CECo to A. B. Davis, NRC, the licensee stated that Commonwealth Edison
~believed that the fire protection program deficiencies at Dresden
\\had been corrected and applicable corporate recommendations -had been
,imp 1 emented.
Based on the licensee's actions of hiring an Assistant Fire Marshal, providing at least one quaTified fire brigade instructor to assist the Fire Marshal, and the June 10, 1988 response, this item* is considered closed.
- c. *
(Open) Unresolved Item (237/85033-03(DRS); 249/85029-03(DRS)):
Several of the. licensee's fire protection Technical Specification surveillance procedures did not contain appropriate test requirements and failed to incorporate quality affecting parameters as delineated in NFPA standards.
In the letter dated January 24, 1986 to J. Keppler, NRC, from D. Farrar, CECo, the licensee responded to the items identified by the inspector.
The licensee indicated that as a result of an NFPA code review the surveillance procedures would be revised.
During this inspection, the inspector reviewed the revised surveillance procedures that were previously identified as deficient.
During this review, the inspector identified the following concerns:
5
(1) Diesel Fire Pump Testing (a)
(b)
The inspector reviewed the updated licensee's diesel fire pump annual capacity check and weekly operability surveillance procedures to verify the automatic operation of the diesel fire pumps.
The inspector noted that the annual capacity check procedure did not verify automatic operation of the fire pump.
The licensee contended that the fire pump is automatically started at least once a month.
The weekly surveillance procedures direct the testing personnel to automatically start the fire pump by opening the test petcock which is on the side of the fire pump controller.
In the 15th edition of* the Fire Protection Handbook, Section 16, Chapter 6, Paragraph 5, titled "Annual Pump Test, 11 it indicates that when testing the pumps it is.not sufficient to initiate a pressure drop by the test cock on the controller to simulate automatic operation.
On June 2, 1988, the inspector informed the licensee that at least once a year, preferably during the annual fire pump test, the automatic mode of the controller should be tested by.opening a two inch drain valve (on a fire protection water system riser) or hydrant as inferred from the 15th Edition of the Fire Protection Handbook.
The licensee agreed to incorporate into the annual pump test procedure.a simulated pressure drop by opening a two inch drain on a fire protection system riser or opening a fire hydrant.
In the Unit 2/3 Diesel Fire Pump Check Surveillance Procedure,.ft indicates in Section C titled, 11 Prerequisites 11 that 11If a vibration analysis machine is to be used, the Fire Marshal should contact the cognizant Technical Staff Engineer.
11 The inspector discussed with the licensee the establishment of vibration analysis baseline data for the diesel fire pumps and conducting the fire pump vibrational analysis test in conjunction with the annual fire pump test.
The licensee indicated that the vibrational analysis will be performed as part of the annual fire pump test.
0 (c) In the NFPA 20 Formal Interpretations, No. 83-2, it indicates that the results of the annual fire pump test should be compared to the manufacture's certified shop test characteristic curve and field acceptance characteristic curve to determine the pump's ability
- to continue to attain satisfactory performance at peak loads.
6
'1;..-
During the previous inspection, it was identified by the NRC inspector that the original manufacturer 1s shop t~st curve or field acceptance test were not available to the licensee 1s staff. Since the previous inspection, the licensee has developed fire pump curves from the manufacturer data plates on the fire pump.
The licensee has incorporated the developed fire pump curves into their procedures as part of upgrading the Fire Pump Capacity Check Procedure.
During this inspection, at the request of the inspector, the licensee performed a capacity check for the Unit 2/3 Diesel Fire Pump.
The licensee performed excellently in the coordination and execution of the test.
No discrepancies were noted from the test results.
At the request of the inspector, the licen~ee agreed to update the procedure to include certain pump parameters such as water jacket temperature and oil pressure.
(2) Testing of Water Suppressi<m Systems Section 4.12.B.l(e) of Technical Specifications requires that
_fJr~_~uppre~-~.ion \\1ater. sy.s_t~ms b~ dernonstrated operable by.
- performing a system functional test which includes simulated automatic actuation of the systems throughout their operating sequence., The licensee 1s commitment in Section 3.5.E.3 of the Fire Hazard Analysis (FHA) Report requires that automatic sprinkler sys~ems ~onform to NFPA Standard No. 13.
The licensee 1s Surveillance Proced~re No. SP B4-6-39 faile~ to incorporate appropriate test requirements to demonstrate that the sprinkler system is oper~ble in accordance_ with NFPA 13 in that the procedure did not require flow from the two inch drain valve of wet or dry pipe sprinkler systems.
The licensee indicated to the inspector that the two inch drain test is not conducted because the fire protection water (river water) destroys the radwaste demineralizer beds.
The licensee contends that the two inch drain test does not need to be conducted because the fire protection control valves are provided with tampers or locks that ensure an adequate water supply will be available.
In additio~, the licensee contends that water is available to the sprinkler system because the inspector test is conducted.
The inspector discussed several methods of conducting the two inch drain test that would provide assurance that the system is operable and minimize impact to the demineralizer beds.
The inspector informed the licensee that the two inch drain test should be performed and that any deviation regarding the two inch drain test should be adequately justifi~d and documented in the NFPA Code Review Section of the Fire Hazard Analysis.
7..
The licensee indicated to the inspector that resolution to this issue will be provided tentatively by January 1, 1989.
Therefore, the unresolved item will remain open pending review and acceptance of the licensee 1s resolution to this issue.
- d.
(Closed) Violation (231/85033-04(DRS); 249/85029-04(DRS)):
An early warning automatic fire detection system was not installed in the Refueling Floor Area as required by provisions of Amendment No. 36 to Provisional Operating License No. DPR-19 and Amendment No. 33 to Facility Operating License No. DPR-25.
The licensee has requested an exemption from the requirements of providing a fire detection system on the Refueling Floor which is currently being reviewed by NRR.
Based on the exemption request, this item is closed.
- e.
(Closed) Open Item (237/85033-05(DRS); 249/85029-05(DRS)):
The licensee agreed to update their response to the NRC and describe the administrative controls and the actions that will be necessary to isolate Unit 1 from Unit 2 and Unit 3 since Unit 1 is no longer operational, but shares common are::as with Units 2 and 3.
The inspectors also requested that the licensee describe those administrative controls and actions that will be necessary to separate common areas.
In a letter dated January 24, 1986, to J.. Keppler, NRC, from D. Farrar, CECo (Responding to the Open Item), the licensee
- indicated that a stricter transient combustible control procedure would be developed.
In addition, a cognizant foreman was designated to assist.the Fire Marshal in timely.correcUon of housekeeping deficiencies.
The licensee indicated that a detailed memorandum discussing the propei handling of fire barriers had been discussed with al"? personnel at the station as part of the weekly 11 tailgate 11 staff meeting.
Also, Procedure No. DFPP 4175-1, Fire Barrier Integrity and Maintenance, has been revised to further clarify the proper handling and maintenance of fire barriers (including fire doors, fire dampers, fire walls, penetration seals) for mechanical and electrical components.
Based on the li~ensee 1 s updated response, this Open Item is considered closed, although other specific concerns are being raised as described below.
In the letter dated January 24, 1986, to J. Keppler, NRC, from D. Farrar, CECo, the licensee indicated that the separation of Unit 1 was being covered by the Appendix R review program and that this information was being added to the updated FHA for Units 2
~ and 3.
In Section 4.15.9 of the updated FHA the analysis describes that the only portion of the Unit 1 structure which contacts the Unit 2/3 structures is the west wall of the Unit 1 Turbine Building.
The FHA also indicates that the wall separating the Unit 1 Turbine Building from Auxiliary Electric Equipment Room (AEER) (Fire Zone 6.2) 8
. : -~*.
. **~*-........ ~,... \\..... *::.. ***--~~-*-.*::._***.-.. *.
-~
is a m1n1mum 3 foot 3 inch reinforced concrete three hour fire barrier.
The remaining wall west of the Unit 1 Turbine Building has metal
- siding on unprotected structural steel with openings (non-fire rated doors) that expose Unit 2 Safety Related Areas.
The Unit 2 side of this portion of the west wall is identified as Five Zone 8.2.5.A.
During this inspection, the inspectors noted large amounts of RAD worker 1s clothing and flammable/combustible liquids stored in Unit 1 in an area where i# a fire occurred the Unit 2 Fire Zone 8.2.5.A (Safety Related Area) may have been exposed since there is no fire rated barrier between the two areas on Elevation 517 1-6 11
- The licensee indicated to the inspector that in the event of a fire from Unit 1 affecting the Unit 2 side (Fire Zone 8.2.5.A) one Safe Shutdown Path would still be available.
The licensee 1s response would allow a fire to migrate from Unit 1 to Unit 2 AEER and* do.es not appear to be consistent with Section F.18 of the licensee 1s FHA which indicates that storage areas should be located such that a fire or effects of a fire including smoke will not adversely affect any safety-related systems or equipment.
On December 13, 1988, during a site visit, the inspector was informed by the licensee that the present abandoned equipment in Unit 1 restricts large amounts of combustible storage.
The licensee agreed to limit the combustible loading in the area to a low fire load (as defined by plant combustible load procedures) to at least 20 feet from Unit 1 control room walls and the metal-wall between Unit 1 and 2.
The inspector also observed two non~rated metal doors between Unit 1 and Unit 2 that were maintained in the open position.
Unit 1 is currently being Decommissioned and it is expected that combustibles will be stored in Unit 1 and that cutting and welding operations will be performed.
It is the inspector 1s concern that the Unit 2/3 Control Room and Unit 2 Safety Related areas may be exposed to Unit 1 fire since they are not separated by three hour fire walls or other recognized fire protection methods of protecting safety-related areas from adjacent exposures._
This is considered an unresolved item (237/88010-0l(DRS);
249/88012-0l(DRS)) pending resolution from NRR.
The licensee indicated that a three hour fire wall is tentatively scheduled to be installed between Unit 1 and the Unit 2/3 Control* Room by December 1989.
- 3.
Assessment of Appendix R Compliance On a sample basis, the inspectors examined measures that tha licensee implemented to assure safe shutdown capability and compliance with 10 CFR Part 50, Appendix R.
The inspection consisted of an assessment of the licensee 1s implementation of Appendix R requirements for physical plant conditions, required operator actions, systems, and components, operator training, supplemental procedures, and methodology employed to mitigate resultant adverse equipment operability due to plant exposure to fires.
The results of the inspector 1s review are as follows:
9
~*~*.. *. -***.:........ -'
- --***-.-~-
- f. '.
a.
Systems Required for Safe Shutdown The Appendix R goals required to achieve post-fire safe shutdown are:
Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions (reactor coolant temperature less than or equal to 200°F).
Reactor coolant makeup capable of maintaining water level above the top of the core at all times during shutdown operation.
Reactor pressure control and decay heat removal.
Process monitoring capable of providing direct readings to perform and control the above functions.
Supporting functions capable of providing process cooling, lubrication, etc., necessary to permit operation of the equipment used for-safe shutdown functions.
In accomplishing the goals outlined above, the equipment and systems used to achieve and maintain hot shutdown conditions should be free of fire damage and capable of maintaining such conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, using offsite or onsite emergency power.
The equipment and systems used to a~hieve and maintain cold shutdown conditions should be either free -0f fire damage or the damage to the~e systems should be limited such* that repairs can be made and cold shutdown conditions achieved w1thin 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, using offsite or onsite emergency power.
During the post-fire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal ac power, and the fission product integrity shall not be affected; i.e., there shall be no fuel clad damage, rupture of the containment boundary.
(1) Reactivity Control The licensee takes credit for a reactor trip even for a postulated fire that requires evacuation of the control room.
Upon loss of power, or in case of fire damage to the logic circuitry, the system is designed to fail safe (rods fully inserted).
(2) Reactor Coolant Makeup The isolation condenser method of hot shutdown utilizes the Control Rod Drive (CRD) Hydraulic System to provide"lTlakeup to the reactor vessel.
One of the two CRD pumps per unit provides all of the reactor makeup required due to leakage and shrinkage during cooldown.
The CRD pumps take suction from the condensate storage tank and the condenser hotwell.
The CRD pump's discharge 10.
0 (3) pressure can be monitored locally on me.chanical indicators P12(3)-302-73A and P12(3)-302-73B.
Local control pushbutton stations have been installed for the CRD pumps.
The CRD water headers for the two units are connected with a crosstie line which is normally isolated by manual valves.
The valves are located on the mezzanine level of the Turbine Building in the area with accessibility to either set of pumps.
Therefore, a fire in one unit will not prevent the other unit's pump from supplying makeup water to the affected unit.
The CRD pumps can be cooled by the Service Water system if normal cooling from the Turbine Building Closed Cooling Water (TBCCW) system is lost.
For those fires where the isolation condenser method of shutdown is unavailable, the High Pressure Coolant Injection (HPCI) system is used.
The HPCI system consists of a steam
- turbine driven pump that can take suction from either the suppression pool or the condensate storage tank and pump water to the reactor vessel.
The steam that drives the turbine comes from the reactor and is exhausted to the suppression pool.
The HPCI system automatically initiates on low-low water level signal (-59 inches) or can be manually initiated from the control room.
The HPCI pump injects water from the condensate storage tank to the reactor vessel.
The HPCI system pumps makeup water to the reactor at a rate of 5,600 gpm.
The operator can manually operate th~ flow controller in the control room.
Condensate stor~~e tank level is normally monitored in the control room using level indicators L12/3-334I-3 and L12/3-3341-4.
Level can be monitored on mechanical indicators L12/3341-77A and L12/3341-77B located in the Turbine Building in the southeast corner of the Unit 2 reactor feed pump room.
If long-term operation of the HPCI system depletes the condensate storage supply, the operator will align the HPCI suc~ion with the suppression pool by opening Valves M02(3)2301-35 and M02(3)2301-36.
The HPCI suction is automatically shifted to the suppression pool when the condensate storage tank contains less than 10,000 gallons.
HPCI pump discharge pressure can be monitored in the control room on pressure indicator P12(3)2340-2 and locally on mechanical indicator P12(3)-2357.
Reactor Pressure Control and Decay Heat Removal Initial pressure control and~ decay heat removal for the reactor is supplied by the electromatic relief valves.
However, the target rock valve (mechanical mode) and mechanical safety valves on the steamlines will provide these functions if operation for the relief valves has been affected by a fire.
Long term (up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) reactor pressure control and decay 11
~*.:*
~.
heat removal is provided by the isolation condenser system in ihat the system is sized to handle the total decay heat load five minutes after scram.
The isolation condenser consists of two tube bundles in a large water-filled shell.
The reactor steam flows through the tubes, is condensed, and returns to the reactor vessel.
The water in the shell is boiled off and vented to the atmosphere.
The vent line to the main steamline is isolated upon initiation of the isolation condenser system.
If a fire has affected automatic operation of the accessible isolation condenser valves (M02(3)-1301-2 and M02(3)-1301-3; Valve M02(3)-1301-2 is normally open), the operators can remove power from the appropriate motor control centers so that the valves may then be opened by use of handwheels.
Normally open valves M02(3)-1301-1 and M02(3)-1301-4 are located in the drywell and are therefore not accessible for manual operation.
In the event a fire causes these valves to.
spuriously close, an alternate 480V*power feed to each of these valves is provided along with a local control station.
In addition, isolation switches have been installed for the normal control_and power cables.
If the valves spuriously close, the alternate feed is energized and the valves opened.
The operator can then deenergize the valves in the open position.
Valve M02(3)-1301-3 is manually throttled to control the cool down.
Initial° makeup to the condenser. will be supplied from the condensate storage tanks via the condensate transfer pump.
With no makeup, the water stored above the isolation condenser tubes is depleted in 20 minutes after initiation of the i sol at ion condenser system.
The* i so 1 at ion condenser level is normally monitored in the control room on level indicator L12(3)-1340-2.
The operator can locally monitor the level in the isolation condenser on an existing sight glass by opening two manual valves.
Any of the four condensate transfer pumps (two per unit) can supply makeup water to either unit's isolation condenser through the normally open tie line. Therefore, a fire in one unit will not prevent the other unit's pump from supplying makeup water.
- When the HPCI shutdown method is used, reactor pressure control and decay heat removal are accomplished by the HPCI turbine (driven by reactor vessel steam) in conjunction with electromatica relief Valves 2(3)-0302-38 through 2(3)-0203-3E.
The HPCI turbine steam supply line, the target rock valve, and the electromatic relief valves discharge to the suppression
- pool.
Continued operation of the HPCI system results in heatup of the suppression pool water.
One division of Low Pressure Coolant Injection (LPCI)/Comp~nent Cooling Service Water (CCSW) is sufficient to remove decay heat from the suppression pool.
The operator manually places the LPCI/CCSW system into"operation in the torus cooling mode from the control room, thus maintaining 12
... ***;--:;:_~ ~*- --:
- -:*::-.. :-~*':"'----:'"'
~ *'
~
the water temperature within acceptable limits.
The operator can also throttle flow as appropriate to obtain the desired cooling.
Each LPCI pump is capable of providing a flow of 5,000 gpm.
Each CCWS pump is capable of providing a flow of 3,500 gpm.
(4) Process Monitoring The operator requires a means to ascertain the values of various plant parameters in order to perform required system transitions and essential operator actions.
Various process monitoring functions are available to adequately support reactivity control, reactor coolant makeup, pressure control, and decay heat removal as follows:
Reactor Vessel Level Reactor Vessel Pressure Suppression Pool Level Suppression Pool Temperature Condensate Storage Tank Level Isolation Condenser Level Additionally, discharge pressure indication is provided for the CRD pumps, condensate transfer pumps and service water pumps.
Support Equipment The following equipment is available for post-fire shutdown:
Emergency Diesel Generators 4160V ac 480V ac 125V de 120V ac Communication System Emergency Service Water System (ESW)
Reactor Building Closed Cooling Water System (RBCCW)
.Turbine Building Closed Cooling Water System (TBCCW)
Containment Cooling Water System (CCSW)
Service Water System (SWS)
Fire Water System (FWS)
(5) Cold Shutdown Two systems are identified at Dresden Station to bring the plant to cold shutdown (reactor coolant equal to or less than 212°F).
The preferred shutdown cooling path is the shutdown coolin\\'.j path which utilizes the Shutdown Cooling System (SOCS).
For those fires where the SOCS is not available, LPCI/CCSW is used to achieve and maintain cold shutdown.
13
(I:,
f I
The SOCS pumps take suction from the reactor recirculation loops through motor-operat~d valves 1001-lA and 1001-18.
These valves are inside containment.
They are powered from 480VAC MCC 28-1 (38-1) which can be supplied from the emergency diesel generators.
They are closed until initiation requirements (reactor coolant system temperature less than 350°F) are met and operator action is taken.
The two inlet lines join in one header outside of containment.
This header feeds three separate loops.
Each loop has a DC powered motor operated pump inlet isolation valve (1001-2A, 1001-28, or 1001-2C), a centrifugal pump rated at 6,750 gpm at 11 full ope rat ion, 11 a heat exchanger, and a DC powered motor operated pump outlet isolation valve (1001-4A, 1001-48, or 1001-4C).
Downstream of the pump outlet isolation _valves, and still outside containment, the three branches again feed a common header.
This common header divides into two return lines, each containing an AC powered motor operated isolation valve (1001-5A and 1001-58).
Each return line penetrates the containment and rejoins the reactor coolant system through connections into one division of the LPCI system.
Each LPCI division connects to one of the reactor recirculation loops.
Although the capability exists to permit flow from and to both recirculation loops, normally only one loop is selected for such service.
Either Recirculation Loop Valve(s) 0202-5A(8) and 0202-7A(8) or 0202-4A(8) must be closed to prevent back flow through the reactor recirculating pump:
The heat exchangers of the SOCS are cooled by water from the RBCCW system, with the heat exchangers of the RBCCW system in turn cooled by the SW system.
If the SOCS is not available, the LPCI system can be used to inject cooling water into the core once the injection initiation limits (350 psig) are met. aThe system is a low pressure, high volume system capable of providing substantial volumes of cooling water to the core.
The pump is powered from 11 emergency" buses, and a 11 motor operated va 1 ves are powered from 11emergency 11 MCCs and are also outside containment, accessible for manual operation if needed.
The reactor vessel is allowed to fill using LPCI, overflowing hot water to the pressure suppression chamber (torus) through the relief valves.
The continuous cycle of water through the core, through the relief valves to the torus 0 and back again after cooling via the containment cooling heat exchangers, would only be limited by the design of the relief valves themselves.
These valves incorporate a spring which must be overridden by system pressure to open the valve.
The valve will reseat at approximately 50 psig and will b~ held shut until the core heats up again and raises pressure, or until the pressure is increa_sed to 150 psig by the LPCI pumps (design head 114 psig at 0 psig reactor pressure to 245 psig at 200 psig reactor pressure).
Suppression pool water is pumped through containment cooling heat exchangers and then injected into the reactor vessel.
14
~
.. ~*. *... *-
!},,..
t I
- b.
Alternate Shutdown The licensee has chosen five different Appendix R shutdown paths per unit.
Two of the paths per unit have been designated as alternative shutdown paths as described below:
Path Al utilizes the Unit 2 pumps and power train by mechanical crossties to shutdown Unit 3 for a fire in Fire Area RB3-II and Fire Area TB-III.
Path A2 is used to shutdown Unit 2 for a fire in Fir~ Area TB-V or Fire Area TB-II.
Path Bl utilizes Unit 3 pumps and power trains via mechanical crossties to shutdown Unit 2 for a fire in Fire Area RB2-II and Fi re Area TB-1.
Path B2 is utilized to shutdown Unit 3 for a fire in the Fire Area TB-V or Fire Area TB-II.
For a fire in the control room or auxiliary electric equipment room requiring control room evacuation, the licensee has developed Procedure EPIP 200-20 for post fire safe shutdown.
- c.
Procedures for Alternate Safe Shutdown The licensee has developed Procedure No. EPIP 200-20, Revision 4, dated April 1988, to be used in the event of a fire in the Control Room or the AEER which requires evacuation of the Control Room.
A staff of 13.licensee personnel is used to implement the procedure which provides for achieving stable hot shutdown for both Units 2 and 3.
A two-column format is used with one column assigning responsibility, and the other column listing the actions required.
The procedures include Attachments 1 through 9.
Each attachment summarizes the actions for an individual operator.
After stable hot shutdown conditions have been achieved, Procedure DSSP 200-5 is entered to bring the units to cold shutdown.
Once the decision to evacuate the control room is made, the reactors are tripped from the control room driving the control rods in for hot shutdown reactivity control.
Several other immediate actions are attempted in the control room prior to evacuation; however, if unsuccessful, they are covered by procedure from outside the control room after the evacuation.
The scope of the team review was to ascertain that post-fire safe shutdown using the steps in the procedure could be attained in a safe and orderly manner, while achievi~g the functional goals of Appendix R.
No unacceptable items were found by the team review of the procedure.
15
~
A walkdown of Procedure No. EPIP 200-20, Revision 4, April 1988, 11Contra1 Room Evacuation/Safe Shutdown, 11 was conducted on April 20, 1988, at 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />.
The purpose of the walkdown was to determine by simulation that alternate safe shutdown could be implemented in a safe and orderly manner for a fire in the Control Room__ or AEER.
Four inspectors accompanied the operators during the walkdowns.
The following conditions were specified for the simulated shutdown:
Reactor at 100% power with systems lined up in normal full power configuration.
Credit for one manual action prior to evacuating the Control Room.
Manual start of emergency diesel generator.
The team paid particular attention to the feasibility of each manual action, ease of access, operator familiarity with procedural steps o and equipment, communications, emergency lighting, and the direction of the shutdown by the shift engineer.
The walkdown was halted when the licensee had adequately demonstrated the capability to achieve simulated stable hot shutdown conditions.
No unacceptable items were identified by the team during the walkdown.
However, in subsequent discussion with the shift engineer the licensee was informed that a iisual aid, sho~ing on a single page the flow of actions for each of the nine Individual Operator Attachments, would facilitate the shutdown trafoing provided by the shift engineer.
The licensee agreed to implement this recommendation.
0 Hot Shutdown Repairs and Manual Actions The licensee has identified in Section 7.3 of the Dresden Fi re Protect ion Doc.umentat ion Package ent it 1 ed, 11 Procedures Relevant to Hot Shutdown, 11 hot shutdown repairs and manual actions necessary to achieve hot shutdown.
NRR has reviewed the identified hot shutdown repairs and manual actions in the July 17, 1987 SER.
Approval was granted contingent upon verification by the inspection team.
The team review conducted during the April 18-22: 1988 audit focused on verifying that the necessary actions can be completed within the specified times for assuring safe shutdown.
Based on a detail~d review of the Dresden safe shutdown procedures, including a wa,l kdown of the EPIP 200-20 procedure for shutdown outside the Control Room, the inspection team qetermined ~taking into account the licensee 1s available manpower for post-fire safe shutdown - 11 personnel exclusive of fire brigade) that post-fire safe shutdown can be 16
.. **.*;--~.:***-... *. -*.. ;*.*.*~.. *:: *--.--'~*.-
- - *-. *., ~.**.:*-*-.
. ~. i.:.-.: ". :';.....
'1)
I 1
l, j
accomplished.
This included the initiation of makeup to isolation condenser shell within 20 minutes, and closure of a spuriously opaned relief valve within 10 minutes.
- d.
Operator Training on Safe Shutdown Procedures
- e.
In addition to observing the operator's performance during the walkdown, training personnel were interviewed and lesson plans*
reviewed concerning operator training on Appendix R post-fire safe shutdown procedures and equipment.. Training records for operating shift personnel were also reviewed.
The areas reviewed were found to be satisfactory.
Protection for Associated Circuits The licensee's associated circuits analysis was provided in Dresden Station Units 2 and 3 Fire Protection Program Documentation Package, Volume 3, Book 1, Section 3.3, Associated Circuits.
The following associate.a circuits were evaluated:
Common Bus Concern The common bus associated circuit concern is found in circuits, either safety-related or non safety-related, where there is a common power source with shutdown equipment and the power source is not electrically protected from.the circuit* of concern.
Spurious Signals The spurious signals concern.is made up of two items:
The false motor, control, and instrument readings such as those which occurred at the 1975 Browns Ferry fire.
These could be caused by fire initiated grounds, shorts, or open circuits.
Spurious operation of safety-related or non safety-related components that would adversely affect safe shutdown capability (e.g., RHR/RCS isolation valves)._
Common Enclosure The common enclosure associated circuit concern is found when redundant circuits are routed together in a raceway or enclosure and they are not provided with adequate electrical isolation.
protection, or fire can destroy both circuits due to inadequate fire protection methods.
The inspection results were as follows:
17
f' I
- J (1)
Common Bus Concern The common bus concern consists of two items:
~**M -
~. *::- *** ***:* '.
- ~*.. -:-****..
- Circuit Coordination High Impedance Fault Analysis (a) Circuit Coordination Breaker Coordination is audited by reviewing the time current curves developed during the licensee's bus coordination study.
Licensee representatives stated that the original plant design provided circuit coordination.
However, documentation demonstrating coordination of electrical devices was not provided to the electrical inspector.
Additionally, licensee representatives stated that in the 480V distribution systems circuit coordination does not exist for some circuits.
The licensee's analysis identifies the lack of coordination between the 480V Switchgear Buses 18, 19, 28, and 29 main feeds to MCCs and the motor control branch circuits.
Based on the existing lack of coordination for 480V MCCs, the lack of readily available records, the lack of coordination curves demonstrating coordination, and the requirement to provide protection in the case of high impedance faults and spurious operation~, the licensee. has.
provided circuit coordination by manual operations.
The manual operations"specified in procedures include:
circuit breaker, ~isconnect, and switch operations and fuse removal~
The following circuits were randomly selected* for review toQverify that circuit coordination was provided procedurally:
CIRCUIT 4kV Bus 23 4kV Bus 24 480V Bus 38 480V Bus 39 480V MCC 28-2 125V DC Bus 3A 125V DC Panel No. 2 COMMENT Coordinated by procedures Coordinated by procedures Coordinated by procedures Coordinated by procedures Coordinated by procedures Coordinated by procedures Coordinated by procedures Manual credit for breaker coordination was found to be satisfactory.
~Control of fuse replacement is required to ensure maintenance of coordination for circuits protected by fuses.
The licensee does not have an established program or procedure for controlling fuse replacement.
By memo dated April 20, 1988, the licensee promulgated the following policy on replacing blown fuses:
18
Compare the new fuse to the old fuse to v~rify that they are 11 like for like.
11 This comparison should include manufacturer, physical size, shape, voltage
~
rating, current rating, and fuse type (quick-acting, slow-blow, etc.).
If illegible or missing markings on the old fuse do not permit a complete verification of voltage and current ratings or fuse type, the Shift Supervisor
_ will obtain verification of such data from wiring diagrams and/or vendor manuals or by consultation with the Technical Staff.
The licensee's policy on replacing blown fuses will provide protection for fuse coordination.
The effectiveness of this policy will be reviewed during subsequent inspections.
(b)
High Impedance Fault Artalysis The high impedance fault concern is found in the case where multiple high impedance faults exist as loads on a safe shutdown power supply and cause the loss of the -safe shutdown power supply prior to clearing the high impedance fault.
Since the licensee's procedures to manually coordinate electrical circuits will provide protection for-the high impedance fault concern, the licensee's -
protection for high impedance faults was found to be satisfactory.
(2) Spurious Signals (a) High/Low Pressure Interfaces High/low pressure interfaces are examined to determine if the licensee has provided measures to prevent fire induced spurious signals from producing a fire induced loss of coolant accident (LOCA).
NRC guidance for protecting high/low pressure interfaces includes:
Multiple (unlimited) hot short circuits, open circuits, and short circuits to ground are credible (the single spurious signal criteria does not apply). o Three phase hot short circuits are credible.
Hot short circuits in ungrounded DC circuits are credible.
The above guidance was employed in the review of the high/low pressure interface spurious signal concern at the Dresden Nuclear Station.
19
- -..........., *** :-~ *1--;** *-**,*.. T*'". **-*'-****~*.. -::...1**;:*.* -.-7* *' * * ****** ~:.:,-.*: ***-*.. *****-** **...-.*;**'..,.-)-~"':~ *,. **
- 1-.***-*.. **-** **
(3)
- ~ -~... -*** -::-.. **... -....
The licensee identified the shutdown cooling system on Units 2 and 3 as being high/low pressure interfaces.
The licensee 1s analysis demonstrated protection for the Unit 2 and 3 shutdown cooling high/low pressure interfaces.
ApRendix C, shutdown cooling system high/low pressure interface protection, provides the tethni ca 1 deta i1 s pertaining to the review of the Dresden Units 2 and 3 shutdown cooling high/low pressure interfaces.
(b)
Isolation of Fire Instigated Spurious Signals The licensee has provided isolation for fire instigated spurious signals by various methods, including:
Administrative controls Isolation/tr~nsfer switches Fire wrap Cable relocation Manual component operation The licensee hias requested exemption for hot shutdown
- repairs to accomplish the f~llowi~g~
To allow the pulling of fuses in order to place the condensate transfer pumps into local control.
To allow the pulling of fuses to defeat high impedance faults.
To allow the pulling and replacement of f~ses on selected control circuits in lieu of redundant fusing.
The licensee 1s methodology of pulling fuses is considered a hot shutdown repair which is not permitted by Appendix R.
The licensee had previously submitted an exemption request for fuse pulling. This is considered an Unresolved Item (237/88010-02(DRS); 249/88012-02(DRS)) pending disposition of the licensee 1s exemption request.
Common Enclosure The common enclosure associated circuit concern is found when redundant circuits are routed together in a raceway or enclosure and they are not electrically protected, or fire can destroy both circuits due to inadequate fire protection means.
During the inspection, licensee representatives stated:
Redundant safe shutdown cables are never routed in common enclosures~
20
-... **-~-* -***--,.......,. __ -*~-*
i.:
f' 1:,1
- 6
- f.
0 Non.safety-related cables*may be routed in common enclosures with safety-related cables, but non safety-related cables are never rout~d between redundant safety-related divisions or trains.
All cables are electrically protected.
y During the inspection, randomly selected non safety-related cables routed in common enclosure with safety-related cables were verified to be electrically protected.
Fire Instigated S~urious Oyeration of Unit 3 Target Rock Valve and Electromatic elief Va ve The NRC electrical inspector identified that, in the event of a disabling fire two hot shorts in a multiple conductor cable would cause spurious opening of the target rock valve and the electromatic relief valves.
The licensee indicated that, based on Generic Letter 86-10 and discussion held with NRR, they had analyzed and provided protection for spurious operation of the target rock valve or one of the electromatic relief valves.
During the inspection the Appendix R inspection team consulted with NRR and were advised that the target rock valve and
~he electromatic relief valves were not.considered to be high/low pressure interfaces.
The NRR Technical Reviewer was informed of the potential simultaneous spurious -0p~ration of the target. rock valve and all of the electromatic relief valves.by failure of control cable 33934.
The NRR Technical Reviewer stated that if fai*lure of a single cable could cause the simultaneo*us spurious.
operation of more than one single.electromatic relief valve, than a safety concern may exist.
Further discussions between the NRR Technical Reviewer and the electrical tnspector identified control cable 33934 as being a potential cable separation or common enclosure concern.
The inspector review of control circuits for Target Rock Valve 203-3A and Electromatic Relief Valves 203-38, C, 0, and E identified the following:
The Target Rock Valve and Electromatic Relief Valves open when 125VOC power is supplied to the Target Rock solenoid or the respective Electromatic Relief Valve picku~ coil.
125VDC power is supplied to the Target Rock Valve or Electromatic Relief Valves via the following relay contacts (Note:
the listed relay contacts are installed in series with the respective.solenoid or pickup coil):
VALVE 203-3A RELAY 2203-32/287-1068 CONTACTS 7&8 21 RELAY 2203-32/287-1078 CONTACTS 8&7
'r... f/
I l
203-38 2203-32/287-1068 9&10.
2203-32/287-1078 10&9 or or 2203-32/287-106A 5&6 2203-32/287-107A 6&5 203-3C 2203-32/287-1068 3&4 2203-32/287-1078 4&3 or or 2203-32/287-106A 7&8 2203-32/287-107A 8&7 203-30 2203-32/287-106A 9&10 2203-32/287-107A 10&9 or or 2203-32/287-1068 5&6 2203-32/287-1078 6&5 203-3E 2203-32/287-106A 11&12 2203-32/287-107A 12&11 or or 2203-32/287-1068 11&12 2203-32/287-1078 12&11 When positive 125VDC is applied to terminal 13 of relays 2203-32/287-106A, 2203-32/287-1068, 2203-32/287-107A, and 2203-32/287-1078 the relays actuate to close the contacts listed above; a
Control Cable 33934,_ a 12.;.conductor 14 AWG cable, has conductors connected to terminal 13 of the above listed relays.
One of the conductors in cable 33934 has positive 125 VDC applied from panel 903-32, terminal EE-21.
(Drawing 12E-3462 SH 2 refers).
Si nee Control Cable 3393'4 is i nsta 11 ed downstream of the Auto 8lowdown Inhibit Switch ~03-3/287-304 contacts, auto"blowdown
- i nhi bit may be bypassed by *fire induced hot shorts in control
~able 33934.
Control' Cable 33674, a multi con.ductor cable, has conductors connected to 2203-32/287-1078 contact 11 via 2203-32 terminal 88-50 and 2203-32/287-1078 contact 5 via 2203-32 terminal 88-39.
One of the following spurious operations may occur from fire induced failure of Control Cables 33674 and 33934:
Hot shorting one conductor to the positive 125 VOC conductor in cable 33674 may cause either valve 203-30 or valve 203-3E to spuriously open.
Hot shorting two conductors to the positive 125 VOC conductor in cable 33674 may cause both valve 203-30 and valve 203-3E to spuriously open.
Hot shorting two conductors to the positive 125 VOC conductor in cable 33934 may cause valves 203-3A, 8, C, D, and E to spuriously open.
The licensee's analysis indicated that.the resolution for Control.
Cable 33674 discrepancies was:
"Target Rock (manual function) and safety valves are available for RPV pressure control".
The stated resolution does not demonstrate protection for simultanequs spurious opening of valve 203-30 and valve 203-3E.
22
-~.. ;.
~
The licensee 1s analysis also indicated that the resolution for Control Cable 33934 discrepancies was:
11While in hot shutdown, it is necessary to prevent the electromatic relief valves from spuriously opening to preserve the reactor vessel coolant inventory.
For fires external to the main control room, an AUTO SLOWDOWN INHIBIT switch at the MCB will prevent spurious blowdown.
If the fire is in the MCB, it may be necessary to trip all of the power fee~s to the blowdown logic.
This is covered by procedures.
Excessive reactor pressure will be controlled by the mechanically actuated target rock or s.afety valves.
11 This resolution does not appear correct since fire induced failures of cables 33674 and 33934 may bypass and defeat the function of the Auto Slowdown Inhibit Switch at the Main Control Board.
The licensee 1s resolution to trip all of the power feeds to the blowdown logic being covered by procedures is correct; however, the implemented procedures were developed to provide protection for the spurious opening of either the Target Rock Valve or one of the Electromatic Relief Valves.
Since simultaneous spurious opening of the Target Rock Valve and all of the Electromatic Relief Valves has not been analyzed, procedural protection has not been demonstrated.
The simultaneous spurious opening of the Target Rock Valve and Electromatic Relief Valves has a tremendous impact on reactor coolant inventory.based on the limited capacity of the CRD Hydraulic System to restore or*maintain reactor coolant inventory.
Due to the significance of this issue-and its generic implications, the spurious operation of the Target.Rock Valve and Electromatic Relief Valves has been referred to NR~. This is considered an Unresolved Item (237/88010-03(DRS); 249/88012-03(DRS)) pending resolution from NRR.
On August 15, 1988, the inspector met with the.licensee to discuss appropriate fire protection features and measures to prevent or mitigate consequences or spurious operation of the Target Rock Valve and Electromatic Rel.ief Valves.
In addition, the inspector walked down the areas of concern.
As a result of the discussions and walk down of the areas on August 15, 1988, a conference call was conducted on August 17, 1988, between Dresden, Quad Cities, CECo Licensing and Region III to discuss the fire protection features and compensatory measures that would be taken to prevent or mitigate the consequence of a disabling fire from causing a spurious operation of the Target Rock Valve and Electromatic Relief valves.
- Attachment D of a September 16, 1988 letter from J. Silady, CECo, to T. Murley, NRC, summarized the conference call of August 17, 1988.
In this letter, the licensee indicated that in all areas through which the subject cables are routed, there are automatic suppression and detection systems, except for the mezzanine floor of the Dresden Unit 3 Reactor Building which only has a detection system.
The following Interim Compensatory Measures were implemented for the affected areas of the reactor building mezzanine floor:
23
- .*:*****--... *;* ";**......, *--* ** :*.*--v.*:
t
- ' ** ** ~ :;;* * **
~*
l
- g.
r.
-~-.....--
~*-
Declared area combustible free fire zone Additional portable fire fighting equipment was brought into the area A combustible loading inspection was conducted
- per shift basis by station operators The licensee indicated that the above actions would commence immediately and be in effect until this issue is resolved.
Availability of Opposite Unit Safe Shutdown Equipment During Refueling Outages The licensee has selected two primary systems for achieving hot shutdown in the event of a disabling fire concurrent with a loss of offsite power.
The systems are the isolation condenser system and the HPCI system.
As previously mentioned, five different Appendix R hot shutdown paths per unit are identified in the licensee's safe shutdown methodo 1 ogy.
Four of the paths per unit ut i.l i ze the respective unit's isolation condenser, and differ only in that they employ different power trains, diesel generators, CRD pumps, and/or operating ~ethods. The fifth path per unit is the HPCI/LPCI.~ethod of shutdown.
The Dresden safe shutdown procedur*es uti 1 i ze safe shutdown equipment from the unaffected unit during certain fire scenarios.
Included in
_this equipment are condensate transfer pumps, CRD pumps, seryice water pumps, 4KV and 480V busses, and 480V*MCCs.
It was identified by the inspectors *that the licensee had no administrative controls to insure that the* required opposite unit equipment was available or that compensatory measures would be in place during a refueling outage to insure that at least one train* of safe shutdown equipment was available in the event of a disabling fire in the operating unit.
The failure of the licensee to establish procedures o~ controls to ensure that required alternative shutdown equipment was available for safe shutdown of the operating unit when the opposite unit (which houses the alternative shutdown equipment) was in an outage or shutdown and the required alternate shutdown equipment was removed from service for scheduled maintenance or repair is considered a violation of Appendix R to 10 CFR 50 (237/88010-0S(DRS);
249/88012-0S(DRS)) as described in the Notice of Violation.
At the request of the inspectors, the licensee developed draft administrative controls for safe shutdown equipment during refueling outages (letter dated April 21, 1988, from E. D. Eenigenburg, CECo, to J. Holmes, NRC).
The draft administrative procedure has been forwarded to NRR for
- review.
24
- 4.
- h.
Fire Protection of Safe Shutdown Capability In !he licensee 1s safe shutdown report, the licensee has identified several safe shutdown pathways in which at least one pathway per unit will be available in the event of a disabling fire in either Unit 2 or Unit 3.
The inspectors toured both units and observed fire walls and suppression and detection systems which appeared to be well designed and installed as described in the Safe Shutdown Report.
There were no identified discrepancies, however, a concern has been identified regarding the adequacy of separation of Unit 1 from Unit 2/3 (See Unresolved Item (237/88010-0l(DRS);
249/88012-0l(DRS)) of this report).
Fire Protection Features As part of the Appendix R compliance assessment, several fire protection features were also reviewed as listed below:
Carbon Dioxide Systems Control of Combustibles
- a.
Carbon Dioxide System The licensee has provided total flooding carbon dioxide (C02 }
suppression systems for the AEER, three diesel generators and the Diesel Tank Rooms.
The i.nspector requested the original C02 concentration test r~sults for the die~el _generator rooms.
The licensee indicated that the original "tests were not available however C02 concentration tests were planned to be conducted by the end.of the Unit 2 refueling.
outage.
At the request of the inspector, the licensee performed puff tests on Diesel Generator No. 3.
As a result of the test, -the licensee was informed of the following inspector observations:
(1)
(2)
(3)
Two employees entered the testing.area immediately after the C02 discharge test. Measures should be provided tb ensure that personnel will not enter the test area until the appropriate personnel have tested the area to ensure it is safe to enter.
0 Procedures should inform test personnel of specific fire dampers and other equipment that are expected to function during the performance of the test.
<)
During the C02 puff test, Damper 3-5772-102 failed to close.
(4) The predischarge alarm for the diesel room C02 system is an audible alarm.
There is no visual alarm.
The licensee was requested to verify that the audible alarm is sufficient to warn personnel that may be in the area with the diesel operating.
This is considered an Open Item (237/88010-05(DRS);
249/88012-05(DRS)) pending review of the licensee 1s actions.
25
As a result of the C02 auxiliary equipment failure the licensee initiate~ a work request for HVAC Damper 3-5772-102.
The licensee acknowledged the inspector 1s concerns previously identified and indicated that actions regarding these concerns would be tentatively completed by November 30, 1988.
- b.
Control of Combustibles 10 CFR 50.48(a) requires that each operating nuclear power plant have a fire protection plan that satisfies Criterion 3 of Appendix A to 10 CFR Part 50.
It further requires that the plan describe specific features necessary to* implement the program such as administrative controls to limit fire damage to structures, systems, or components important to safety so that the capability to safely shutdown the plant is ensured.
The licensee satisfied Criterion 3 by meeting the applicable requirements of Sections III..G, III.J, and III.O of Appendix Rand by meeting the fire protection requirements identified in the guidelines of Appendix A to Branch Technical Position B.T.P APCSB 9.5-1 as reflected in the staff fire protection safety evaluation issue<l prior to the effective date of the Appendix R rule.
In Section B;2 of the licensee 1s response to the guidelines of Appendix A to APCSB 9.5-1 (Amendment 2-2/86) the licensee indicated that.effective administrative measures have been implemented to prohibit bulk storage of combustible m~terials inside or adjacent to safety-related buildings or systems during operation or mai nte.nance perfods.
The licensee has implemented Administrative Procedure 11Control of Transient Combustibles, Storage Areas and No Smoking Areas.
11 The
~
procedure establishes guidelines for storage and handling of transient combustible materials in certain areas of the plant which contain safety-related components and/or equipment important to safe shutdown.
These plant areas are identified below:
Unit 2/3 Reactor Building Unit 2/3 Turbine Building Unit 2/3 Cribhouse Unit 1 Cribhouse The procedure is provided with a fire loading of common material chart that establishes a low, medium or high fire load based on the amount and type of material (such as wooden scaffolding, Class 1 or 2 combustible liquids, etc).
The procedure indicates that for low transient fire loads, additional fire protection equipment or a work permit is not required.' However, the work area should be kept clean and all materials removed as soon as practicable.
26
,~
,,j I, **
loi 0
For medium transient fire loads, the procedure requires *the completion of a transient combustible permit (OAP Form 3-3A) and the placement of a supplemental fire extinguisher at the jobsite. The permit is to be completed by the responsible work group supervisor or foreman and posted in the work area.
One copy should be sent to the Fire Marshal.
The procedure further indicates that the Fire Marshall may specify additional requirements upon receipt of the permit.
For high transient fire loads the responsible work group supervisor must obtain the approval of the Fire Marshal on the permit before posting it in the work area.
At this time, the Fire Marshal will specify appropriate requirements on the permit such as supplemental fire extinguishers, hoses or fire watches.
The procedure further specifies that during major outages, transient combustibles shall be controlled in accordance with the combustible control procedure except that the accumulation of transient combustibles is permitted provided the accumulation of transient combustibles does not exceed that which could be removed by the end of the next normal shift.
On April 12, 1988, when Unit 2 was operating and Unit 3 was in an outage, an NRC inspector identified that approximately twenty 55-gallon drums of lubricating (lube) oil was stored in a safety-related area on Elevation 517 1
6" (southwest corner -
Fire Are~ 1.1.2.2) of the Unit 2 Reactor B~ilding.. The licensee had previously requested an exemption from Section I.II.G.~ of Appendix R that required fixed fire suppression system in.this are?.
The licensee indicated to th~ inspector that on March 31, 1988,
'the lube oil was transferred to the Unit 2 side for approximately 13 days before it was discovered as a problem and transf~rred to the Unit 3 trackway.
The inspector requested the.transient combustible permit for the lube oil observed at the Unit 2 Reactor Building, Elevation 517 1-6 11
, Southwest corner.
The licensee was unable to provide the inspector with the transient combustible permit (short term document) for the specified storage of the lube oil in the Unit 2 Reactor Building.
However, according to the Fire Marshal, he was informed of the transfer of lube oil to the Unit 2 side and concluded that the temporary storage of lube oil was acceptable and no additional fire protection features were required based on the following:
(1)
( 2)
(3)
(4)
Low traffic area Fire detection was available Lube oil flash point characteristics were such that it was difficult to ign:ite Safe shutdown could have been achieved in the event of a disabling fire utilizing the equipment for safe shutdown Path B-1 27
-.. ---~--- -*
~**
{,..,....
- r The licensee had established a formal transient combustible procedure however it did not appear that the transient combustible permit was effective for preventing the storage of lubricating oil in the Unit 2 Reactor Building.
The failure of the licensee to meet the requirements of their approved fire protection program by permitting the storage of twenty 55-gallon drums of lube oil in the safety-related area is considered a violation (237/88010-0G(DRS);
249/88012-0G(DRS)) as described in the Notice of Violation.
- 5.
Open Items Open items are matters that have been discussed with the licensee,°that will be reviewed further by the inspector, and that involve some action on the part of the NRC, the licensee, or both.
Open items disclosed during the inspection are discussed in Paragraphs 3.e and 4.a.
- 6.
Unresolved Items
- 7.
Unresolved items are matters about which more information is required in order to ascertain whether they are acceptable items, or items of noncompliance, or deviations.
Unresolved items.disclosed during the inspection ar~ discussed in Paragra~hs 2.e, 3.e, 3.f, 3.g, 4.a and 4.b.
Exit Meeting The inspector met with licensee representatives on October 18 and December 13, 1988.
The lice~see indicated the likely content of this report.and the information discussed during the inspection was not
.considered proprietary in nature.
28
. :..... *.*.. *:* -~-~ -~. -~ *:.... --~.*~* :*,. :. :.. :. ;. *.*... **. *:".
.... -.-*.. :***---.-~..*. *:**. **.:**:.. *-** ~-:: ~*:*.""
- ~*... :*,***-*-*. _,... - *-*--.-~--