ML17202G516
| ML17202G516 | |
| Person / Time | |
|---|---|
| Site: | Dresden  |
| Issue date: | 07/06/1989 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML17202G515 | List: |
| References | |
| NUDOCS 8907110116 | |
| Download: ML17202G516 (13) | |
Text
UNITED STATES
- NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 SAf'ETY. EVALUATION. BY -HIE-Of'FICE-Of -NUCLEAR REACTOR.RE.GUlATION COMPLIANCE-WITH.APPENDIX R.T0-10.CFR PART.so,.ITEMS.III.G.3-A~U.III.L-AND EXEMPTION-REQUEST-FOR.WOT.SHUTDOWN-REP.AIRS DRESDEN.STATION1-UNITS.2.AND.3 DOCKET-~OS.-50*237/249
- 1.
INTRODUCTION By letter dated July 17, 1987, a safety evaluation (SE) was ;ssued regarding Apptndix R to 10 CFR Part 50, Items llI.G.3 and 111.L (alternative and/or dedicated shutdown capability for a fire event in the plant) for Dresden Units 2 and 3. The above SE addressed deviations from an earlier safety evaluation (ESE) dated January 19, 1983 on the above subject. The SE was necessitated by the licensee's reverification effort and associated findings relating to compliance with Append;x R requirements. These findings were identified in a number of subsequent subm1ttals by the licensee (August 9, September 18, and October 16, 1985; January 9 and May 30, 1986).
In the reverification submittals, the licensee considered zonal ~ntero.ction ana rt::vised the originally identified alternative hot shutdown paths, prqposed hot shutdown repairs, i.e., pulling out fuses and replacing blown fuses, and requested exemptions from the Appendix R, Item II I.G.1 requirement for performir19 such repairs. Subst:quently, by submittals dated September 10, arid November 17, 1987, and March 15, April 19, July 13 and September 16, 1988, the licensee further revised the Appendix R compliance program at Dresden. These submittals identified a few changes (e.g., handling fire induced spurious operations, high/low pressure interfaces, handling electrical isolation concerns, hot shutdown repairs and exemption requests) from the earlier subm1ttals on which the July 17, 1987 SE was based.
This SE is based on the subsequent submittals mentioned above, and Fire Inspection Reports 50-237/88-10 and 50~249/88-12 dated January 3, 1989 for Dresden Units 2 and 3. This SE addresses deviations from the January 19, 1983 ESE and it supersedes the July 17, 1987 SE.
It further evaluates the licensee's request for exemptions from the Appendix R, Item 111.G.1 requirement with regard to the proposed hot shutdown repairs. The SE addressing the lit~nsee's other exemption requests from applicable Appendix R requirements with regard to the fire protection features for Dresden Units 2 and 3 has been provided separately.
0907110116 s9o7o6 I
PDR ADOCK 05000237 I
p PDC
- 2.0 ROST.fIRE SAFE.SHUTDOWN.CAPABILITY 2.1 Systems.Required.for.Safe Shutdown In addition to the systems and components identified in the ESE for achieving safe shutdown for a fire in certain fire areas or their equivalent fire areas (see Section 2.2 of this SE for a definition of equivalent fire areas), the licensee identified the use of the high pressure coolant injection/low pressure coolant jnjection (HPCI/LPCI) systems. This approach would achieve hot shutdown in lieu of the isolation condenser (IC) shutdown method identified in the ESE.
Additionally, for a fire in certain plant areas/zones (RB2-I:
Zone 1.3.2, RB2-II: Zone 1.1.2.3, RB3-II: Zones 1~3.1 and 1.1.1.3 - see Section 2.2 of this SE for a fire area description), the licensee identified the use of the LPCI/
containment cooling service water (CCSW) system for decay heat removal to achieve and maintain cold shutdown in lieu of the normal shutdown cooling system and its*
associated supporting systems identified in the ESE.
The safe shutdown systems identified above are expected to be used during a severe fire event when other means of shutdown identified in the plant procedures are determined to be un-available.
2.2 Areas.Where Alternate.Safe.Sbutdow~-Is-Required As part of the1r reverification effort, the licensee examined the ne~d for providing alternate safe shutdown capability for Units 2 and 3 for a fire in any fire area or its equivalent fire area. The licensee defined an equivalent fire area as one or more fire zones which border other fire areas, and is either separated by a 3-hour rated fire barrier or by equivalent fire protection.
The licensee also considered zonal interaction; i.e., fire spreading from zone to zone in their reverification analysis.
(The licensee's earlier submittals assumed that fires would not spread from zone to zone).
When the analysis indicated that the requirements of Appendix R were not explicitly met, the licensee verified that the same alternate hot shutdown path and the same cold shutdown path (i.e., the normal shutdown cooling system path) were available for all the zones within a fire area or its equivalent with a few exceptions.
The cold shutdown exceptions are for Fire Zones 1.3.2, 1.1.2.3, 1.1.1.3 and 1.3.1 as discussed in Section 2.1 above.
The hot shutdown exceptions are for Fire Zones 1.1.1.5.D, 1.1.1.6, 1.1.2.5.D and 1.1.2.6, as discussed below.
The licensee also proposed modifications to provide either a 3-hour rated fire barrier, or equivalent fire protection features, for the affected zones to ensure safe shutdown capability. Based on their zonal interaction analysis, the licensee concluded that alternate shutdown capability was required for 11 areas (total 13 areas) as the requirements of Section III.G.2 were not met for these areas. These are:
(1)
RB2*I-U~it-2.Reactor.Building.Equivalent.Fire.Area-I This area contains the Unit 2 IC and its pipe chase zones.
Elevations 589'-0", 570'-0" and 546 1 -6" (Zones 1.1.2.5.A, 1.1.2.5.B and 1.1.2.5.C)
- (2)
RB2~I-Unit 2-Reactor.Building.Eguivalent.Fire.Area.I This area is the the Unit 2 shutdown cooling pump room.
Elevation 517 1 -6" (Zone 1.3.2)
(3)
RB2-II.. Unit-2-Reactor.Building.Equivalent.Fire.Area.II This area contains Unit 2 HPCI and LPCI valves, LPCI pumps, 480V motor control centers (MCCs), local reactor level and pressure instrumentation, 4 kV switchgear, 125V de reactor building distribution panel, 250V de MCCs, 480V switchgear and the Unit 2 part of the common refueling floor.
Elevation_ 476 1-6 11 (Zones 1.1.2.1, 11.2.1and11.2.2), elevations 517 1 -6 11 545 1-6 11
, 570 1-0 11
, 589'-0" and 613 1-0 11 (Zones 1.1.2.2, 1.1.2.3, 1.1.2.4, 1.1.2.5.D and 1.1.2.6)
(4)
RB3-I-Unit 3.Reactor.Building.Equivalent-Fire Area.I This area contains the Unit 3 IC and its pipe chase zones.
Elevations 589'-0", 570 1 -0 11 and 545 1-6" (Zones 1.1.1.5.A, 1.1.1.5.B and 1.1.1.5.C)
(5)
RIU.. 1.. Unit 3. Reactor. Building. Eguiva lent. Fire. Area. I This area is the traversing incore probe (TIP) room.
Elevation 517 1 -6 11 (Zone 1.4.1)
(6)
RB3-II Unit 3.Reactor.Building Equivalent.Fire Area.II This area contains Unit 3 HPCI and LPCI valves, LPCI pumps, 480V MCCs, local reactor level and pressure instrumentation, shutdown cooling pump, 4 kV switchgear, 125V de reactor building distribution panel, 250V de MCCs, 480V switchgear and the Unit 3 portion of the corrunon refueling floor. Elevation 476 1-6" (Zones 1.1.1.1, 11.1.1, 11.1.2), elevation 517 1 -6 11 (Zones 1.1.1.2, 1.3.1), elevations 545 1 -6", 570'-0", 589'-0" and 613'-0" (Zones 1.1.1.3, 1.1.1.4, 1.1.1.5.D and 1.1.1.6)
(7) TB-I. Turbine.Building.Eastern.Zone.Group.Fire.Area This area contains essentially Unit 2 cabling and equipment.
Elevations 469 1-6", 495 1-0 11 (Zones 8.2.1.A, 8.2.2.A), elevatibn 517 1 -6 11 (Zones 8.2.5.A, 8.2.5.B, Unit 2 diesel generator (DG) room 9.0.A, dirty oil tank room 8.1), elevations 534 1-0 11
, 538 1-0 11 (Zones 8.2.6.B, 8.2.6.A) and elevation 549 1-0 11 (Zones 8.2.7, station battery rooms 7.0.A)
(8) TB-J 1.. Turbine. Bui ldh1g. Centra 1. Zone. Group. Fi re. Area This area is common for both units and contains the mechanical control rod drive (CRD) cross-tie valve and a 480V MCC.
Elevations 5i7 1-6" and 534 1-0 11 (Zones 8.2.5.C and 8.2.6.C)
~~ -----=-- -==
- (9)
TB~III--Turbine Building Western.Zone Group.Fire Area This area contains Unit 3 cabling and equipment.
Elevations 469 1-6, 11 495 1-0 11 (Zones 8.2.1.B, 8.2.2.B), elevation 502 1-6 11 (Unit 3 cable tunnel Zone 8.2.4), elevation 517 1 -6 11 (Zones 8.2.5.D, 8.2.5.E, Unit 3 DG Room 9.0.B), elevation 534 1-0 11 (Zone 8.2.6.D), elevation 538 1-0 11 (Zones 8.2.6.E, DC panel Room 6.1) and elevation 551 1-0 11 (Station Battery Room 7.0.B)
(10) TB~V.Turbine.Building.Equivalent.fire.Area This area contains the Units 2 and 3 control room and auxiliary electric equipment room.
Elevations 534 1-0 11 and 517 1-6 11 (Zones 2.0 and 6.2)
(11) RB-2/3.. Reactor-Building.2/3.fire.Area This area contains the Unit 2 HPCI room (Zone 11.2.3), Unit 3 HPCI room (Zone 11.1.3) and the swing DG 2/3 Room (Zone 9.0.C)
The licensee has provided an alternate hot shutdown capability for a fire in any specific area listed above independent of the area as required by Appendix R,Section III.G.3. Additionally, the licensee has identified fire zones listed above that lack fire detection and/or fixed fire suppression systems both of which are required by Section III.G.3. The licensee has requested exemptions from the III.G.3 requirements for the above zones and has provided justification based on their fire hazards analysis.
The licensee listed eight alternate hot shutdown paths; six use the respective unit IC and two use the respective unit HPCI/LPCI system for achieving and maintaining hot shutdown of either Unit 2 or Unit 3, or both, depending on where fire occurs.
Two of the IC alternate hot shutdown paths (Bl for Unit 2 shutdown for a fire in areas TB-1 or RB2-II, except for Zones 1.1.2.6 and 1.1.2.5.D; Al for Unit 3 shutdown for a fire in areas TB-III or RB3-II except for Zones 1.1.1.6 and 1.1.1.5.D) use the unit IC, DG 2/3, the other unit's power train, and local manual operation of the IC valves.
Two other IC alternate hot shutdown paths (A2 and B2 for shutdown of Units 2 and 3, respectively, for a fire either in area TB-II or TB-V) use DG 2/3, the respective unit IC and power train, and local manual operation of the IC valves..The remaining two IC alternate hot shutdown paths use the respective unit IC, power train and DG and do not require manual operation of the IC valves for a fire in the RB-2/3 fire area (E for Zone 11.2.3; F for Zone 11.1.3; E and F for Zone 9.0.C).
The HPCI/LPCI alternate hot shutdown paths (C for Unit 2 shutdown for a fire in RB 2-I area; D for Unit 3 shutdown for a fire in RB3-I area) use the respective unit HPCI/LPCI system, power train and DG.
For a fire in the Unit 2/3 reactor building common refueling floor (RB2-II:Zone l.l.2.6/RB3-II:Zone 1.1.1.6), or TB-IV (turbine building operating floor and vent floors), the two normal hot shutdown paths A and B are generally used for Units 2 and 3 shutdown, respectively, since the refueling floor and TB-IV area do not contain any safe shutdown equipment or cables. These normal hot shutdown paths use DG 2/3 and the respective unit IC and power train. The paths do not require manual operation of th~ IC valves. These normal paths are also used for a fire in either Zone 1.1.2.5.D (RB2-II) or 1.1.1.5.D (RB3-II) for the same reason mentioned above, provided the fire does not spread into another zone.
In such a case, the alternate hot shutdown path Bl or Al described above is used.
- The staff has reviewed the above mentioned alternate hot shutdown paths for Dresden Units 2 and 3, and finds them acceptable.
2.3 Section.III.G.2.of Appendix.R The licensee indicated that the.crib house (Zone 11.3) which contains the service water and diesel generator cooling water pumps, complies with the requirements of III.G.2 with a few exceptions dealing with barrier design and cable separation for whkh the Hcensee has requested exemptions.
The licensee provided justification for these exemptions based on their fire hazards analysis.
These exemptions have been evaluated separately. For a fire in the above area, either normal hot shutdown paths A and B or redundant hot shutdown paths E and F may be used for Units 2 and 3, depending upon where the fire occurs.
The licensee also indicated that for some of the fire zones in areas RB2-I1 and RB3-II listed in Section 2.2 of this SE, some of the safe shutdown functions will be protected in accordance with the requirements of III.G.2.
The licensee has requested exemptions from the applicable requirements of III.G.2, which have been evaluated separately.
2.4 Modificationi.for.Safe.Shutdown System Besides completing the modifications identified in the earlier SE, the licensee has completed the following modifications:
(1) Relocation of the local control station for MCC 38-1 main feed which power the DG 2/3 auxiliaries, from its previous location in the turbine building mezzanine floor (Zone 8.2.6.C) to the DG 2/3 room in the RB-2/3 area. This ensures the availability of one of the two redundant sources of power to the DG 2/3 auxiliaries out-side the turbine building. The control station for the redundant source, MCC 28-1, is located in the turbine building ground floor (Zone 8.2.5.C).
(2)
Installation of an automatic transfer switch on the power feeds for the DG 2/3 cooling water pump in the cribhouse. This modification ensures availability of at least one of the two redundant sources of power for the pump.
(3)
Installation of ladders to provide access to alternate hot shutdown and cold shutdown equipment.
In addition to the above modifications, the licensee has committed to pro-vide a number of other fire protection features. The adequacy of these features with regard to ensuring separation of alternate shutdown paths has been con-sidered in the evaluation of the exemption requests. The staff finds the above modifications acceptable.
3.0 EVALUATION The safe shutdown systems, equipment and components identified in Sections 2.2 and 2.4 of this SE are expected to be used during a severe fire event when other means of shutdown identified in the plant procedures are determined to be
v
- unavailable. Sections 3.1.1 through 3.5 identify how the performance goals outlined in Section 111.L of Appendix R to 10 CFR 50 are met when alternate shutdown paths are used:
3.1.1 Reactivity.Control Reactivity control is achieved by following the procedures described in the ESE.
3.1.2 Reactor.Coolant.Inventory
. Reactor coolant inventory is controlled by following the procedures described in the ESE except for the following:
(1)
Based on their analysis of fire-induced spurious operation of the main steam isolation valves (MSIVs), the licensee determined that no single fire can prevent both the inboard and outboard MSIVs on any steam line from closing on an isolation signal. Therefore, excessive loss of reactor coolant inventory from the reactor vessel via the main steam lines during a fire event is prevented by automatic closure of at least one MSIV on each main steam line. The safe shutdown procedures will also specify closure of the MSIVs from the control room for appropriate fire areas.
(2)
For a fire in either RB2-I or RB3-I area, the HPCl/LPCI shutdown path is used to achieve hot shutdown.
The control room operator places the HPCI into operation to maintain proper reactor water level. Reactor coolant inventory control is accomplished by manually operating the flow-controller to regulate water supply to the reactor vessel by the HPCI pump, which takes its suction from either the condensate storage tank (CST) or the torus. During this mode of operation, the operator will place the HPCI room cooler in operation, supplying it with cooling water from the service water system or the DG cooling water pump.
3.1.3 Reactor.Coolant Pressure.Control The "Target Rock" valve (mechanical mode) and the mechanical safety valves on the steam lines will be used for reactor coolant pressure control.
3.1.4 Reactor.Decay.Heat Removal For a fire in any plant area other than RB2-I or RB3-I, decay heat removal during hot shutdown is accomplished through the use of the IC, associated supporting equipment and procedures as described in the ESE.
For a fire in RB2-I or RB3-I areas, the HPCI system will be used in conjunction with the LPCI system in the torus cooling mode to accomplish decay heat removal during hot shutdown.
In this mode of LPCI operation, the operator will start one or two LPCI pumps (Division II) and open valves in either the torus test return line or the torus spray line to return water to the torus after it is cooled by the containment cooling heat exchanger. The operator will also start two con-tainment cooling service water (CCSW) pumps (Division II) to provide cooling water flow to the tube side of the heat exchanger and, additionally, open the discharge valve for the cooling water discharge header.
The operator will throttle flow as appropriate to obtain the desired cooling and will verify that the LPCI and CCSW room coolers are ;n service.
- For a fire in any plant area/zone other than RB2-I/l.3.2, RB2-II/l.l.2.3, RB3-II/l.3.l and 1.1.1.3, decay heat removal during cold shutdown 1s accomplished by using the normal shutdown cooling system, reactor building closed cooling water (RBCCW) system, the service water system, and the procedures outlined in the ESE.
For a fire in the zones identified above, the LPCI/CCSW (Division II) method will be used to remove decay heat during cold shutdown.
In this method, the vessel is filled using LPCI, with hot water overflowing to the torus through the relief valves. This method continuously ~ycles water though the core, through the relief valves to the torus and back again after cooling via the contdinment cooling heat exchanger. Water to the LPCI room cooler is provided using the unit DG's cooling water pumps or service water pumps.
Water to the CCSW room cooler is provided from the CCSW pump discharge and is routed through the cooler to the pump suction.
3.1.5 Process.MoRitoring Direct indication of process variables such as reactor vessel water level, reactor coolant system pressure and condensate storage tank water level are provided locally. Also, indication of IC water level for the IC hot shutdown paths, and suppression pool water level for the HPCI/LPCI hot shutdown paths, are available loca l'ly. Suppression pool temperature indication for the HPCI/
LPCI shutdown path is provided locally. Diagnostic monitoring includes local indications for service water system pressure and condensate transfer pump discharge pressure for the IC path and HPCI and LPCI pumps discharge pressure for the HPCl/LPCI shutdown path. Diagnostic monitoring available for cold shutdown systems includes indications of pressures for the RBCCW, normal shutdown cooling and the CCSW systems.
3.1.6 Support.Functions In addition to the systems needed to support the IC hot shutdown paths and the normal shutdown cooling system cold shutdown path 1dent1fied in the ESE, the HPCI, LPCI and CCSW room coolers are available to provide necessary support for the alternate shutdown systems. Control and monitoring for these systems are provided loca 1 ly.
3.2 72-Hour Requirement The licensee has reaffirmed that Dresden Units 2 and 3 have the capability to achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a fire event in any plant area, assuming a loss of offsite power.
3.3 Repairs Besides several cold shutdown repairs which are permitted by Appendix R and which are identified in the licensee's September 10, 1987 submittal, the licensee has identified a few hot shutdown repairs in their submittals. These are discussed below:
(1)
IC hot shutdown paths A2 and 82, which are used for achieving hot shutdown of Units 2 and 3 for a fire in TB-II or TB-V area require two condensate transfer pumps {located in TB-I, Zone 8.2.5.A, and TB-III, Zone 8.2.5.E)
- to be placed under local control. This, in turn, requires electrical isolation of these pumps.
The licensee proposed to achieve isolation by pulling out one fuse per pump at the applicable MCC on the floor above the pumps.
The licensee further stated that the pumps are not needed to provide makeup water to the !Cs until at least 20 minutes after the initiation of the !Cs, and that this provided ample time to remove the fuses.
The staff concludes that the licensee's exemption request from the III.G.1 requirement for the above hot shutdown repairs is acceptable sin~e it only involves pulling out two fuses and there is reasonable assurance that this can be done in a timely manner.
(2) Additional hot shutdown repairs to correct conunon power source, spurious operation and electrical isolation concerns are discussed in Subsections 3.4.3 and 3.4.4 of this SE.
3.4 Associated.Circuits.a~d.l$olation As part of their reverification effort, the licensee examined associated circuits concerns, including conunon power source, common enclosure, fire-induced spurious operations including possible high/low pressure interfaces, and an electrical isolation deficiency. The licensee has addressed these concerns in their submittals as discussed below.
3.4.1 Common Power.Source Regarding protection against fire-induced spurious operation and high impe-dance faults associated with conunon power sources (i.e., faults in non-safe shutdown circuits which compromise the power supply to safe shutdown loads powered from the same source), the Dresden units rely on manual operations specified in the shutdown procedures for a fire in the plant. These procedures include tripping circuit breakers, operating disconnect switches, and removing fuses. Specifically, the licensee stated that the plant safe shutdown procedures require the operator to shed all the non-safe shutdown loads from 4kV and 480V conunon power buses (associated with the hot shutdown paths that use the fire affected unit's own power train) by tripping the associated breakers in a timely manner. Additionally, these procedures instruct the operator to remove the 125V de control power fuses for the electrically operated breakers for the non-safe shutdown loads, if required. Fuses will be removed as necessary prior to tripping the applicable breakers, to preclude subsequent spurious closure. The licensee further stated that the applicable control power fuses are easy to identify and remove, readily accessible, and under periodic surveillance, and that their removal would not cause any undue hazard.
Based on the above, the staff finds the licensee's approach for handling conunon power source concerns including the proposed hot shutdown repair (i.e., fuse removals) to be acceptable. The staff further reconunends that the.licensee's request for exemption from the Appendix R, Item III.G.l requirement, to allow the above hot shutdown repair be granted.
3.4.2 Common.Enclosure The conunon enclosure concern arises when redundant safe shutdown circuits are routed together in a raceway or enclosure and they are not electrically protected, or a fire can destroy both circuits due to inadequate fire protection means.
- Regarding the above concern, the licensee stated that redundant safe shutdown cables are not routed in common enclosures and that though some non safety-related cables may be routed in common enclosures with safety-related cables, the nonsafety-related cables are not routed between redundant safety-related divisions or trains. The licensee stated that all electrical circuits have been designed with appropriate protection from overcurrent conditions.
The licensee stated that applicable fire protection features (e.g., substantial fire barriers for areas or zone groups, wrapping of select cable trays and automatic suppression systems) provided for an area or a zone group will assure that a fire will not propagate out of the area or zone group.
The staff finds the licensee's handling of common enclosure concerns acceptable.
3.4.3 Spurious Operations Fire in some areas can impair safe shutdown due to fire*induced spurious
- operation of safe shutdown equipment. Therefore, isolated local control stations for safe shutdown equipment such as IC valves, shared (swing) DG 2/3 and its support equipment, and service water pumps have been provided.
Loss of reactor coolant (RC) inventory resulting from fire induced spurious opening of motor operated HPCI steam supply valves (when the HPCI is not supplying reactor vessel makeup) and spurious operation of RWCU valves, is prevented by tripping applicable breakers. These valve breakers are located in a 250V de MCC located in Unit 2 or 3 reactor building (El. 570'-0"). Alternatively, the feed to the MCC at the 250V de MCC in the turbine building could be tripped.
The above procedure will close the HPCI steam supply valve and isolate the RWCU system.
Spurious opening of the solenoid operated reactor head vent valves (resulting in RC inventory loss) will be prevented by a pre-fire action; i.e., ensuring closure by removing power from these valves. Steam venting of the main steam lines via spurious operation of the air operated IC valves is prevented by manually closing the applicable upstream valve.
To ptevent fire-induced spurious closure of the motor operated IC valves that are required to be open during IC operation, power to these valves is removed by tripping the applicable breakers located at the 250V de MCC 2A or 2B, or by tripping the feed to the applicable MCC at the 250V de MCC in the turbine building. These valves ma~ be subsequently opened manually. Spurious closure of the control rod drive (CRD) valves in the cooling water line will not disrupt the supply of makeup water to the reactor vessel during IC operation. This is because flow will be available through the charging water line and the scram injection valves, and also by ensuring that the scram signal is not reset.
The staff has reviewed the above procedures for handling fire-induced spurious operations and concludes that they are acceptable.
3.4.3.1 Spurious.Operation.of Reactor.Relief.Valves Fire-induced spurious actuation of a reactor relief valve (RRV-any one of four electromatic valves or one target rock valve for each unit) warrents special consideration and is, therefore, addressed separately in this subsection.
A fire event in Fire Area RB2-I, RB2-II, RB3-I, RB3-II, TB-I, TB-III or TB-V can result in spurious operation of a Unit 2 and/or Unit 3 RRV(s).
To
- eliminate such a potential, the licensee proposed to remove power from all relief valve circuits of Unit 2 and/or Unit 3 following a fire which
- affects Unit 2 and/or Unit 3. Specifically, for a fire in any one of the above fire areas except TB-I or TB-III, the licensee proposed to remove power by opening the respective breakers at the 125V de distribution panel(s) located in Fire Area(s) TB-I and/or TB-III. For a fire in Fire Area TB-I or TB-III. the licensee proposed to remove power by pulling out the affected unit's RRV control power fuses contained in an electrical panel in a different fire area (TB-I: Unit 2 RRV control power fuse panel is in Fire Area TB-V, Fire Zone 6.2; TB-III: Unit 3 RRV control power fuse panel is in Fire Area RB3-II, Fire Zone 1.1.1.3). The licensee stated that at any one time, only 20 fuses for the 5 RRVs for the affected unit(s) will require removal within 10 minutes after scram, that the fuses are easily identifiable and removable, and that their removal wi 11 not involve any significant operator hazard. Additionally, for a fire in any one of the seven fire areas, the newly installed automatic*
blowdown inhibit switch will be engaged from the main control panel (Fire Area TB-V) to prevent automatic/spurious actuation of the automatic blowdown system.
The licensee stated that the plant. shutdown procedures for a control room fire will require engaging the inhibit switch prior to evacuating the control room.
The licensee stated that the applicable panel for a fire in Fire Area TB-III will be readily accessible; but that access to the panel in Fire Zone 6.2 in Fire Area TB-V, for a fire in Fire Area TB-I, will require transit through the affected fire area itself and entry through one of the two 3-hour fire rated doors to Fire Zone 6.2. The licensee justified the above approach stating that the doors are widely separated (about 100 feet) and that partial automatic fire suppression systems have been provided in Fire Area TB-I that protect the area between the doors from fire damage.
The lice~see also described other fire protection features (e.g., a 3-hour fire rated masonry wall separating the two access doors north of column row E). The licensee claimed that these design features will ensure that for a fire in Fire Area TB-I, at least one door entrance to Fire Zone 6.2 will be accessible.
Based on the above design features, the staff concludes that the proposed manual action for a fir~ in Fire Area TB-I is feasible.
During a fire inspection conducted during April 18-22, 1988, the inspectors found that at Dresden Unit 3, the potential exists for fire-induced multi-conductor cable fault in two control cables associated with Unit 3 RRVs.
Such a fault can result in two or more RRVs spuriously opening, thereby compromising safe shutdown capability. It was further noted that fire-induced failures of these cables can result in bypassing and defeating the function of the automatic*
blowdown inhibit switch.
The licensee outlined modifications (e.g., installing two new control cables in a separate tray) to rectify the RRV spurious actuation concerns mentioned above in a submittal dated September 16~ 1988.
The staff has reviewed these modifications and finds them acceptable.
Based on the above, the staff concludes that the proposed procedures including hot shutdown repairs (i.e., fuse removal) for handling fire-induced spurious operation of the RRVs are acceptable.
The sta.ff further recommends that the licensee's request for exemption from the Appendix R, Item III.G.1 requirement, to allow performing the above hot shutdown repair, be granted.
The staff concludes that the proposed modifications to rectify concerns relatfog to multi-conductor cables are acceptable.
- 3.4.3.2 High/Low.Pressure.Interfaces One special category of spurious operation involves high/low pressure inter-faces.
The concern stems from the possibility that components on the low pressure side of the interface may not be designed for operation at the normal operating pressure of the reactor. Thus, if normally closed motor-operated interface valves were to open spuriously due to a fire event when the reactor was at pressure, the low pressure piping could rupture. The isolation valves may not be able to close.
The result would be an unisolable LOCA outside containment.
In the ESE, it was stated that Dresden Units 2 and 3 had no high/low pressure interfaces that relied solely on motor-operated valves for isolation. The shutdown cooling system (SCS), which usually contains such interface~, is designed to full reactor pressure (1250 psig) at~ temperature of 350°F. This is lower than the RCS design temperature of 575°F.
The staff.
has concluded, as stated in the ESE, that the SCS can withstand RCS temperature on a one-time basis; therefore, no protection against the possibility of fire-induced spurious opening of the high pressure-high temperature/high pressure-low temperature interface between the RCS and the SCS is needed on a one-time basis.
Subsequent to the issuance of the ESE, connections have been made between the low pressure designed fuel pool cooling system (FPCS) and the SCS which, in turn, is connected to the RCS.
As a result, high/low pressure interfaces (normally closed motor-operated valves) currently exist between.the SCS and the FPCS.
Regarding the above, the licensee stated that the power supply to four valves would be removed during normal power operation to preclude spurious opening. The licensee stated that the power to these valves will be restored only when necessary during outage activities (i.e., when the reactor is depressurized). The staff finds the above approach acceptable for preventing fire-induced spurious opening of the currently existing high/low pressure interface valves between the SCS and FPCS.
3.4.4 Electrical.I~olation Deficiency The electrical isolation deficiency concerned a fault on a remote circuit blowing ~ fuse needed for local control prior to isolation, consequently impairing the capability for local control of the needed safe shutdown equip-ment.
The licensee stated that quite a few hot shutdown circuits are singly fused and so are vulnerable to this problem.
A majority of these circuits are control circuits for the 4kV circuit breakers.
These breakers are equipped with local mechanical "TRIP" and "CLOSE" buttons that are good for one close and one trip operation without electrical control power. Additionally, the licensee stated that some of the remaining control power circuits are for 480V breakers associated with two condensate transfer pumps.
The applicable pump breaker can be jacked closed within 20 minutes after IC initiation {permissible time for supply of makeup water to the IC) in the event the control circuit becomes inoperable.
- The balance of the singly fused circuits involve local controls for four inboard IC valves for both units and controls for starting the swing DG 2/3 engine. A fire in certain plant areas ( RB2-II; RB3-II; DG 2/3 room in RB 2/3) may require local control for some of the hot shutdown components or equipment mentioned above.
The need for local control will depend upon the hot shutdown path specified for the fire area in Section 2.2 of this SE (a fire in RB2-II or RB3-II will require local controls both for starting the swing DG engine, and the other unit's IC inboard valves; a fire in DG 2/3 room will require local controls for both units IC inboard valves). For such fire events, the licensee proposed hot shutdown repairs to replace blown control power fuses for the isolation switches for the applicable components or equipment.
The licensee stated that the above operation will be performed in fire areas other than the affected fire area; the replacement fuses which are of the cartridge type will be readily accessible. The licensee has committed to maintain the applicable replacement fuses and the fuse pullers under periodic surveillance in the proximity of the fuse replacement locations, and to specify the needed manual operations, i.e., fuse replacement and operation of isolation switches as necessary, in the plant shutdown procedures.
The licensee further stated that a single fire at the most would require six fuses to be replaced.
The replacement fuses will be easy to identify and install in a timely manner (10 minutes after scram for the swing DG engine starting controls; 30 minutes for IC inboard valves).
The licensee claimed that since the circuits involved in*
the above procedures are low-voltage control circuits and the fuses though rated at 15 amperes will actually carry much less current, the above task will not pose any undue operator hazard.
Based on the above, the staff has determined that the licensee's proposed manual actions including the hot shutdown repair, i.e., fuse replacement, meet the intent and purpose of IE Information Notice Nos. 85-09, "Isolation Transfer switches and Post-Fire Shutdown Capability" dated January 31, 1985, and ar~, therefore, acceptable.
The staff further recommends that the licensee's request for exemption from the Appendix R, Item III.G.1 requirement, to allow the above repair for achieving and maintaining hot shutdown, be granted.
3.5 Safe.ShutdowQ Procedures.and.Ma~power In the submittals, the licensee stated that safe shutdown procedures have been developed to incorporate the above-described alternate shutdown paths, including procedures for handling possible fire-induced spurious operation of equipment needed for accomplishing safe shutdown *. The licensee further stated that these procedures would ensure that the necessary shutdown functions are performed at all times by avai'lable manpower.
The staff finds the above position acceptable.
4.0 CONCLUSION
The safe shutdown systems identified in Sections 2.2 and 2.4 of this SE are expected to be available during a severe fire event when other means of shut-down identified in the plant procedures are determined to be unavailable.
v
- The staff has reviewed the licensee's currently proposed rev1s1on to their originally submitted and approved alternate shutdown capability for Dresden Units 2 and 3 in accordance with Appendix R criteria. As stated in Section 1.0, this revision has been necessitated due to the license's reverification of their fire protection program at Dresden Units 2 and 3. This includes con-sideration of zonal interaction, high impedance faults, electrical isolation deficiencies, spurious operations including high/low pressure interfaces, proposed modifications and hot shutdown repairs to ensure alternate shutdown capability.
Based on its review, as discussed in this SE, the staff concludes that the revised alternative shutdown capability at Dresden Units 2 and 3 meets the requirements of Appendix R Item 111.G.3 and the performance goals of Item III.L and is, therefore, acceptable. The staff further recommends that the licensee's request for exemptions from the Appendix R, Item III.G.1 requirement, to allow ptrforming the proposed hot shutdown repairs (i.e., fuse removal and fuse replacement) be granted.
Principle Reviewer:
T. Chandrasekaran Dated:
July 6, 1989