ML17207A896

Safe Shutdown Capability

ML17207A896
Person / Time
Site:	Saint Lucie
Issue date:	02/04/1980
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML17207A895	List: ML17207A894 ML17207A896
References
NUDOCS 8003180040
Download: ML17207A896 (10)

Text

. AFF POS ITIOH SAFE SHUTNMH CAPABILITY Attachment ncl osure 3

Staff Concern Curing the staff's evaluation of fire protection programs at operating plants, one or more specific plant areas may be identified in which the staff does not have adequate assurance that a postulated fire will not damage both redundant divisions of shutdown systems.

This lack of assurance in safe shutdown capability has resulted from one or both of the following situations:

Case A:

The licensee has not adequately identified the systems and components required for safe shutdown and their location in specific fire areas.

Case 8:

The licenseo has not demonstrated that the fire pr otection for specific plant areas wiill prevent damage to both redundant divisions of safe shutdown coaponents identified in these areas.

For Case A, the staff has required that an adequate safe shutdown analysis be perfor ed.

This evaluation includes the identi ication of the systems required for safe shutdown and the location of the system components in the plant.

Mhere it is determined by this evaluation that safe shutdown components of both redundant divisions are located in the same fire area, the licensee is required to demons. rate that a postulated fire will not damage both divisions or provide alternate shutdown capability as in Case 8.

For Case 8, the staff may have required that an alternate shutdown capabili.y be provided wi.h is independent of the area of concern or the licensee may have proposed such a capabili ty in lieu of certain additional fire protection modifications in the area.

The specific modifications associated with the area of concern along with other systems apd equipmerft already independent of the area form the alternate shutdown capabi lity.

For each plant, the modifications needed and the combinations of systems which provide the shutdown functions ray be unique for each critical area;

however, the shutdown functions provided should maintain plant parameters within the bounds of the limiting safety consequences deemed acceptable for the design basis event.

Staff Position Safe shutdown capabili.y should be demonstrated (Case A) or alternate shu.down capability provided (Case

8) in accordance with the guidelines provided below:

1.

Desicn Basis Event

he des'.cn basis even. =or considering he need for alternate shu

down is a postulated fire in a specific f're ar a containing redundant safe shutdown cables/equipment in close proximity ~here i. has been determined hat fire prate tion means cannot assure that safe shutdown capability will be preserved.

wo cases should be considered

(1) offsi te power is available; and (2) offsi:e power is not available.

g00S180 0 fo

~~

~ \\

~

2. L'imitina Safet Conseouences and Required Shutdown Functions 2.1, 2.2 2.3 Ho fission product boundary integrity shall be affected:

a.

Ho fuel clad damage; b.

Ho rupture of any primary coolant boundary; c.

Ho rupture of the containment boundary.

The reactor coolant system process variables shall be within those predicted for a loss of normal ac power.

The alternate shutdown capability shall be able to achieve and maintain subcritical conditions in the r actor, maintain reactor coolant inventory, achieve and main.ain hot standby" conditions {hot shutdown>> for a BWR) for an extended period of time, achieve cold shutdown* conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> anl maintain cold shutdown conditions thereafter.

+

As defined in the Standard Technical Specifications.

3.

Per ormance Goals 3.1 3.2 3.3 3.4 3.5 3.6 3

7 The reactivity control function shall be capable of achieving and maintaining cold shutdown reactivity conditions.

The reactor coolant makeup function shall be capable of maintaining the reactor coplant level above the top of the core for SWR's and in the pressurizer for PWR's.

Tne reactor heat removal function shall be capable of achieving and maintaining decay heat removal.

The process monitoring function shall be capable of providiog direct readings of the process variables necessary to perform and control the above functions.

The supporting function shall be capable of providing the process cooling, lubrication, etc.

necessary to permit the operation of the equipment used for safe shutdown by the systems identi ied in 3.1 - 3.4.

The equipment and sys

.ems used to achieve and maintain ho.

standby conditions (hot shutdown for a SWR) should be (1) free of fire damage; (2) capable of main.aining such conditions for an extended time period longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the equipment required to achieve and main.ain cold shutdown is not available due to fire damage, and (3) capable of beinq powered by an onsite emergency power system.

Tne equipment and systems used to achieve and maintain cold shutdown conditions should be either ree of fire damage or the fire damage to such systems should be limited such that reoai rs can be'made and cold shutdown conditions achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Equipment and systems used prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire should be capable of being powered by an onsite emergency power system; those used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be powered by

3..8 offsi te power.

These systems need not be designed to {1) se'ismic category I

criteria; (2) single failure criteria; or (3) cope with other plant acci/ents such as pipe breaks or stuck valves

.Appendix A BTP 9.5-1), except those portions of these systems which interface with or impact existing safe.y systems.

4.

PMR Eoui "ment C~nerall Hecessar For Hot Standb Reac.ivi Control (2)

Reactor trip capability (scram).

Boraticn capability e.g.,

charging

pump, makeup pump or high pressure injection pump taking suction from concentrated borated wat r supplies, and letdown syst~ if required.

Reactor Coolant Hakeuo (3)

Reac.or coolant makeup capability, e.a.,

charging pumps or the high pressure injec.ion pumps.

Power operated relief valves may be required to reduce pressur to allow use of the high pressur injection pumps.

Reac.or Coolant S stem Pressure Control (4)

Reac.or pressure con rol capability, e.g.,

charging pumps or pr ssurizer heaters and use of the letdown systems if required.

D ca Heat Removal (5)

Decay heat removal capabi li.y, e.g.,

power opera.ed relief valves, (steam generator) or safety relief valves for hea.

removal with a water supply and emergency or auxiliary feedwater pumps or makeup to the steam generator.

Service water or other pumps may be required to provide water for auxiliary feed pump suction if the condensate storage tank capacity is no adequate

=or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Process Aonitorino Ins.rumenta ion Process monitoring capability e.g., pressurizer pressure and

level, s

earn generator level.

Suooort.

The equipment required to support operation of the above desc",',bed snutdown eouipment e.g.,

component c"oling water set vi ce water, etc.

and cns i te power sources (AC, OC) with their associated ele trical distribu.ion sys"em.

a,

'1 h

I'

5.

PMR Eouioment General 1

Necessar For Cold Shutdown*

(1)

Reactor Coolant S stem Pressure Reduction to Residual Heat emova S stem HR aoaos

>tv Reactor coolant system pressure reduction by cooldown using steam generator power operated re>>ef valves or a mcspheric dvmp valves.

(2)

Deca'eat Removal Decay hea.t rer;oval capability e.g,, residval heat removal

system, component cooling water system arrd service water system to removal heat and maintain cold shu.down.

(3) sunoort Support tapability e.g., onsite power sources (AC

& DC) or offsite after 72 hovrs and the associated electrical distribution system to supply he above equipment.

Equipment necessary in addi.ion to that alreadv provided to main.ain hot standbv.

6.

8WR Eauioment G nerall Necessar For Hot Shutdown (1)

Reactivit Control Reactor trip capability (scram).

(2)

Reactor Coolant Makeup Reactor coolant inventory makeup capability e,g., reac.or core isolation cooling system (RCIC) or the high pressure coolant injection sys

.em (HPCI).

(3)

Reactor Pressure Control and Deca Heat Removal Depressurization system valves or safety relief valves for dump to the suppression pool.

The residual heat removal system in steam condensing

mode, and servi ce water system may also be used ror heat removal to the ultira heat sink.

(4)

Suppression Pool Cooiina Residval heat removal system (in suppression pool cooling mode) service water system to maintain hot shutdown.

(=)

Process Monitorinc Process monitoring capability e.c.,

reac.or v ssel level and pressure and svpor ssion pool tempera:v,

'b (6)

Suooort Support capability e.g., onsite power source (AC 5 DC) and their associated distribution systems to provide for the shutdown equi pment.

7.

8WR Eouioment Generall Hecessa For Cold Shutdown~

At this point the equipment necessary for hot shu.down has reduced the primary system pressure and temperature

.o where the RHR system may be placed in service in RHR cooling mo¹.

Deca Heat Removal (2)

Residual heat removal system in the RHR cooling mode, service water system.

Suooort Onsite sources (AC 5 DC) or oif5ite after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and their associated distribution systems to provide for shutdown equipment.

Equipment provided in addition to that for achieving hot shutdown.

8. Information Reouired For Staff Review (a)

Description of the systems or portions thereof used to provide the shutdown capability and modifications required to achieve the alternate shutdown capability if required.

(b)

System design by drawings which show normal and alternate shutdown control and power circuits, location of componen.s, and that wiring which is in the area and the wiring which is out of the area that required the alternate system.

(c)

'fd)

IJ'erification that changes to safety systems will not degrade safety systems.

(e.g.,

new isolation swi:ches and control switches should meet design cri eria and s.andards in FSAR for electrical equipment in the system tha. the switch is to be installed; cabinets Pat

.he switches are to be mounted in should also meet -he same criteria (FSAR) as other safety related cabinets and panels; to avoid inadver.ent isola".ion from the con rol room, the isolation switches should be keylocked, or alarmed in the control room i, in the "local" or "isola-d" posi.ion; periodic checks should be made to verify swi ch is in the prooer position for normal operation; and a single transfer switch or o-her new device should not be a source or a single failure to cause loss of redundant safe y syste.;s).

Verification hat wiring, includIng power sc 'rces

=or he col 01 circuit and equi pmell oper a i on G1

~ie al erna e

shutdown method, is independent of equipmen wiring in

he area to be avo ded.

Verification that alternate shutdown, power sources, including all breakers, have isolation devices on control circuits th t are routed through th" area to be avoided, even if the breaker is to be operated manually.

Yerification that licensee procedure(s) have been developed which describe the tasks to be perform d to effect the shutdown method.

A sugary of these procedures should be reviewed by the staff.

Yerification that spare fuses are available or control circuits where these fuses may be required in supplying power to control circuits used for the shutdown method and may be blown by the effects of a cable spreading room fire.

The spare fuses should be located convenient to De existing fuses.

The shutdown procedure should inform the operator to check these fuses.

Yerifica.ion that the manpower required to perform the shutdown functions using the procedures oi (f) as well as to provide fire brigade nar5ers to fight the ire is available as required by the fire brigade technical speci ications.

Verification that adequate acceptance tests are performed.

These should verify that:

equipment operates from the local con.rol station when the trans er or isolation switch is placed in the "local" position and that the equipment cannot be operated from the control room; and Pat equip-ment operat s from the control room but cannot be operated at the local con rol station when the transfer or isolation switch is in the remote" position.

Technical Specifications of the surveillance requiremen s

and limi ing conditions for operation

=or that equipment not already covered 'by existing Tech.

Specs.

For example; i, new isolation and control switches are add d to a service water system, the existing Tech.

Spec.

surveillance r quire-ments on the service water system should add a statement similar to the following:

"Every third pump test should also verify that the pump s.ar:s from the alternate shutdown station af.er moving all service water sys.em isola.ion switches to the local control position."

Verification that the systems available are adequa~~

to perform the necessary shutdown functions.

The funct ons r quired should be based on previous analyses, i-possible (e.g.,

in the FSAP,),

such as a loss of normal a.c.

power or shu.down on a Group I isola.ion (BMR).

The eouipment required -.or the al:errate capability should bethe same or eoui valent to hat relied Gn in the above analysis.

(1)

Verification that repair procedures for cold shutdown systems are developed and material for repairs is maintained on site.