ML17291A263
| ML17291A263 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 07/15/1994 |
| From: | Parkinson K, Sullivan K BROOKHAVEN NATIONAL LABORATORY |
| To: | NRC |
| Shared Package | |
| ML17291A262 | List: |
| References | |
| CON-FIN-A-3870 NUDOCS 9407270316 | |
| Download: ML17291A263 (22) | |
Text
BROOKHAVEN NATIONALLABORATORY Technical Letter Report
- FIN A@870 - Task 30-On Site Followup Assessment of Post-Fire Safe Shutdown Startup Issues at Washington Nuclear Plant 2 (WNP-2)
Licensee: Washington Public Power Supply System Plant: Washington Nuclear Plant 2 (WNP-2)
Inspection Dates: June 20-24, 1994 NRC Lead Engineer: Mr. P. Quails (Region IV)
BNL Technical Specialists:
7/f ~
K ullivan Date (Electrical Systems Reviewer) c/7 K. Parkinson Date (Mechanical Systems Reviewer) bnl aus 9 g
DAT 9407270316 940713 PDR ADOCK 05000597 g PDR
- 1. GENERAL
SUMMARY
During the week of June 20 through 24, 1994 Mr. K. Sullivan and Mr. K Parkinson provided technical assistance to NRC Region IV during a reactive followup inspection at Washington Nuclear Power Plant (WNP-2). The stated objective of this inspection was to assess corrective actions taken by the licensee in response to twenty-one (21) specific Appendix R related issues described in Washington Public Power Supply System Interoffice Memorandum dated November 9, 1992. However, at the time of the inspection, the majority of engineering analyses and corrective actions were observed to be in a preliminary/draft status, with much of the licensee's reverification documentation still undergoing revision during the conduct of the inspection. The draft status of the licensee's reverification effort, prevented any determination of corrective action effectiveness. Therefore, at the direction of the NRC Lead Engineer, the scope of the inspection was revised to address the following issues:
Possible causes for the Appendix R deficiencies described in the licensee's November 1992 memorandum;
~ Factors influencing the licensee's timeliness of resolution; and,
~ Adequacy of the licensee's current approach for resolving identified issues.
At the exit meeting, the licensee stated that it expects to complete its currently ongoing evaluations and implement an acceptable resolution of all safety significant issues prior to start-up from the current refueling outage. The reverification effort and all remianing issues are expected to be resolved by September 1, 1994,
- 2. HISTORICAL BACKGROUND OF APPENDIX R ISSUES AT WNP-2 2.1 Previous Ins ection Findin s During the week of June 6 through 10, 1988, Mr. K. Sullivan of BNL, participated as a member of an NRC inspection team reviewing fire protection issues at WNP-2. By cover letter dated June 22, 1988, BNL submitted a Technical Letter Report (TLR) to the NRC inspection team leader. This report documents Mr. Sullivans'ctivities, observations and findings while providing technical assistance to the NRC inspection team. At the direction of the inspection team leader, the scope of work performed by Mr. Sullivan concentrated on the licensee's resolution of associated circuit concerns identified during previous NRC reviews (ref: NRC Inspection Reports 50-397/86%5 and 50497/86-25), and open items identified by NRR in its Safety Evaluation Report. Specific issues addressed during the inspection include: common enclosure associated circuits, High/Low pressure interface concerns, circuit breaker and relay coordination, high impedance faults analysis, adequacy of isolation/transfer switches provided to facilitate shutdown from outside the main control room, and the adequacy of separation provided for redundant divisions of cables associated with the ADS/SRV valves. As documented in the TLR, the review identified areas of weakness in the WNP-2 evaluation of Appendix R associated circuit concerns including its analysis of High/Low pressure interfaces and High Impedance Faults.
2.2 Licensee Identified Issues Subse uent to the 1988 NRC Ins ection 2.2.1 Non-Conformance Report No. 292-1284 1
As a followup activity prescribed by LER 921 8, WNP-2 Engineering reviewed the actions required for fires inside the main control room and participated in verification of post-fire safe shutdown procedures. As documented in Problem Evaluation Report (PER) 292-1284, dated November 11, 1992, the Engineering Department review identified ten discrepancies between the Appendix R analysis (NE-02-85-19) and procedures describing operator actions in response to a fire inside or outside the main control room. PER 292-1284 was determined to be reportable requiring a LER (LER 92-043) and NCR (NCR 292-1284).
With regard to the procedure deficiencies identified by Engineering, Section 4,2.1 of LER 92-043 attributes the root cause to "a failure of adequate interdepartmental communication between Engineering and'Operations...Because interfacing on Appendix R related issues between Engineering and Operations has been less than adequate, Plant procedures have not captured all Appendix R related requirements for operator actions. As a result of this, there have been
, numerous revisions." In describing the root cause of PER 292-1284. LER 92~3 also states: 'this programmatic deficiency has existed since 1984 and initial plant startup". A second cause for PER 292-1284 was attributed to deficiencies in the organization design of Engineering's Appendix R department and assignment of responsibilities."Specifically, it does not appear that oversight and processing of Appendix R related issues is clearly defined by Engineering.'ection 7.0 of LER 92-043 contains seven (7) recommended corrective actions. The inspector observed that two of the recommendations (recommendations 5 and 6) issued at that time address the same issues which formed the basis for the current inspection. Specifically, corrective actions 5 and 6 of LER 92-043 were found to state:
(5) Engineering should provide resolution of issues provided in an October 29, 1992 memo issued by the fire protection engineer titled Required Changes to the Appendix R Calculation.
(6) Engineering should provide resolution of issues provided in November 2, 1992 memo SS2-PE-92-0916 (note: this Interoffice Memorandum contains the 21 Appendix R issues addressed during this inspection)
With regard to the above recommendations, NCR 292-1284 contains a Corrective Action Plan developed by WNP-2 Engineering. A review of this document, dated 4/1/93, found it to indicate that Engineering's resolution of issues in the November 1992 Interoffice Memorandum (SS2-PE-92-0916) were to be divided into Short Term, Medium Term and Long Term actions, depending on the expected manhours required to address the issues. Of the 21 Issues described in the November 1992 memo, issue numbers 5, 8, 9, 10, 12, 14, 15, 16, 17, and 18 were designated Short Term issues; issue numbers 3, 6, 7, 11, 19, 20 and 21 were assigned a Medium Term priority and issue numbers 1, 2, 4, and 13 were designated as Long Term issues. Allocation of available resources appears to be the dominant factor used to determine the priority of specific issues. It does not appear that the potential safety significance of each issue was fully considered during the prioritization process.'or example, during a recent (6/94) review of the 21 issues described in the November 1992 interoffice memorandum, an independent contractor was requested by WNP-2 to 2
rank the relative importance of each issue. According to the independent contractor, items 2, 13, 19, and 20, were ranked as either "very important" or "important". However, the Corrective Action Plan assigned all of these issues as either medium term or long term actions which do not appear to have any commitment for date of completion.
An operating experience review performed by the licensee is documented on page 16 of NCR 292-1284. The results of this review indicate that from March 1990 through November 1992, a total of seven similar events have occurred, as documented in the following PER's:
PER 290-138 (3/9/90) PER 292-044 (1/1 6/92)
PER 290-530 (6/29/90) PER 292-287 (4/6/92)
PER 290-150 (9/19/90) PER 292-1244 (11/4/92)
PER 291-698 (8/28/91)
The review was found to indicate that corrective actions from the previous events listed above were not adequate, and concluded that 'procedure related issues should have all been found by now; also same for equipment/design problems...problem was the result of a lack of resources and commitment. If not corrected this problem will reoccur."
2.2.2 Quality Assurance Audit Results In accordance with the requirements of WNP-2 Technical Specifications (6.5.2.8e and 6.5.3.8h), during the period of April 12 through October 29, 1993, the WNP-2 Quality Assurance (QA) organization performed an audit to evaluate the effectiveness of the WNP-2 fire protection quality assurance program as established by the WNP-2 FSAR and Branch Technical Position 9.5-1.
The results of this evaluation were found to be documented in WNP-2 Quality Assurance Audit Report No.93-615. In its summary of findings,Section II of this report was found to state that several potential concerns related to 10CFR50 Appendix R compliance were identified which will require further evaluation. The report concluded that the concerns would be included in the scope of an Appendix R audit scheduled to be performed in March 1994.
In May 1994 QA performed an audit of the Appendix R program. The QA department audit number for this review is 294-029. During the inspection the team requested a copy of the formal QA report, but was informed that the report was not yet complete. However, upon request, the inspectors were provided with supporting documents and feeders to the formal report and conducted interviews with members of the QA audit team. As documented in QA audit plan dated April 22, 1994, the scope of this audit included a verification of the effectiveness of implementation of selected program elements including Fire Protection of Safe Shutdown Capability. Additionally, this audit included a followup of Appendix R issues raised as a result of the 1993 QA audit.
According to a QA Department summary document, dated June 14, 1994, this audit resulted in a total of six findings and three observations. With regard to the effectiveness of corrective actions for previously identified issues, the QA audit concluded that the corrective action plan for NCR 292-1284, which referenced several previously Identified issues of varying significance regarding 10CFR50 Appendix R compliance, "do not appear to have been thoroughly evaluated and corrected in a timely manner." The following issues were identified by QA as the more significant examples:
~ Lack of a complete evaluation of the effects of non-safe shutdown components on safe shutdown components;
~ Lack of a thorough response time analysis for a Main Control Room Fire;
~ Lack of analysis for mitigation of spurious actuation of the High Pressure Core Spray (HPCS) system; and,
~ Lack of analysis for mitigation of spurious actuation of Reactor Core Isolation Cooling system.
In the opinion of the BNL technical specialist, a common thread in the examples shown above is that they all appear to be attributable to a less than thorough analysis of Appendix R associated circuit concerns of spurious equipment operations and,false signals that may be occur as a result of fire. The licensee's failure to perform a comprehensive analysis of this concern appears to be attributable to questionable assumptions which formed the basis of its original safe shutdown analysis. For example, as the result of an apparently non~onservative assumption, the scope of the licensee's evaluation of fire initiated spurious equipment operations was limited to only those systems identified in the Safe Shutdown Analysis as being required to achieve safe shutdown.
Specifically, Section 5.4.8 of the WNP-2 Safe Shutdown Analysis (NES-7) was found to state, in part:
'Spurious signals are defined in relation to the minimum post fire safe shutdown system...'.
Additionally, WNP-2 Appendix R Systems Analysis Calculation NE-02-85-19, 1A, Rev. 0 dated 3/30/90 defines spurious signal cables as follows: "Cables that are located in a design basis fire area whose circuit integrity has been compromised by hot shorts, open circuits, or shorts to ground and could cause an Appendix R circuit to malfunction (emphasis added)." As a result, components of systems not part of the "minimum post fire safe shutdown system', but whose fire induced operation could adversely affect the plant's safe shutdown capability, such as spurious injection of the HPCS system (a non-credited system) into the RPV, were not included within the scope of the analysis and, therefore, were not evaluated.
A review of PERs and Interoffice Memorandums related to Appendix R issues found them to identify a number of concerns that are a direct result of this apparent deficiency. Specific examples include, but are not limited to, the following:
The identification of a number of potential High / Low Pressure interface boundaries that were not previously analyzed The potential for HPCS and/or RCIC to inject water into the RPV The potential for feedwater to continue to be injected into the RPV - the feedwater pumps will continue to operate as long as main steam is available and until closure of the MSIVs The potential for water hammer in RCIC or RHR lines As a result of Appendix R issues which were found to still remain unresolved from PER 292-1284, during the QA audit WNP-2 initiated PER 294Q59.
2.2.2.1 Potential for Secondary Fire in Turbine Building An independent auditor from another utility provided technical assistance to the QA audit team. As documented in the report submitted to WNP-2, and dated 6/15/94, the independent auditor identified the following concern:
'If a fire in one area causes systems to react in such a way as to cause another fire in a different fire area, the App R safe shutdown analysis must accomodate the effects of two fires. In addition to the loss of a contiguous fire barrier, loss of hydrogen gas seal oil flow can result in a turbine hall fire. Fire of this type have happened.
All generator H2 seal oil pumps are powered by the DIV A power sources and are not identified in the Appendix R safe shutdown analysis. Loss of busses. SM-2 and SM4 cause a loss of seal oil pumps, SO-P-AS and SO-P-H2S. These buses are not diesel backed and are considered lost. Loss of 250VDC bus S2-1, MC-S2-1 B or the interconnecting wires will result in loss H2 to the Turbine Hail environment and potential fire. These 250VDC buses are not analyzed or protected from an App R fire.
The App R safe shutdown analysis should be revised to ensure that a fire in any ~
of the turbine hall does not cause a loss of the DC powered H2 seal oil pump resuti,i~> >,
subsequent fire."
At the time of the inspection, a preliminary response to this issue was presented to the inspection team in a WNP-2 document dated June 20, 1994, signed by Mr. W. Harper. This response appears to credit the existing fire protection system for containing the fire within the immediate area of the generator.
The licensee's stated position appears to contradict a principal objective of the regulation to limit the spread of fire through the use of rated fire barriers. The inspection team disagreed with the WNP-2 apparent premise that the potential for initiation of secondary fires within the Turbine Generator Building Fire Area did not warrant additional review, and recommended that the potential for a loss of the DC powered H2 seal oil pump as a result of fire be fully evaluated.
- 3. 1994 APPENDIX R RE-VERIFICATION EFFORT To resolve Appendix R issues that remained unresolved from PER 292-1284, WNP-2 initiated PER 294459,"Appendix R Reverification", dated 6/6/94. The corrective action plan implemented by this PER has a scheduled completion date of September 1, 1994. Upon completion the corrective action plan should address all previously identified Appendix R issues and provide. a means of preventing their re-occurrence..lt should be noted, however, that at the time of the inspection, the reverification effort was an on-going project subject to frequent revisions during the audit. As a result, many of its stated dispositions and corrective actions were not considered by the licensee to be final, 3.1 Re-evaluation of Fire Initiated S urious 0 erations A review of PER 294%59 found it to include a comprehensive analysis of the effect of fire initiated spurious signals/operation of the non-safe shutdown systems and components on the
I I
ability to achieve and maintain safe shutdown conditions. This evaluation, which is currently being performed by WNP-2 Plant Engineering under Calculation NE-02-9445, appears to be based on a systems approach of evaluating the effect of spurious operations of components and equipment.
This revised analysis is being performed in two phases and is not restricted to only those components within defined shutdown system boundaries (as was assumed in previous analyses),
In the first phase of the analysis a screening of fluid and control systems was performed to ensure that failure of automatic systems or single spurious operations would not affect the required safe shutdown components. The screening criteria used in the phase 1 review is in the form of a check sheet containing a fifteen potential issues that were established by representatives of the WNP-2 Engineering, Operations, LIcensing, and Quality Assurance organizations. Concerns Identified during the system screening process are then individually evaluated and resolved under phase 2 of the calculation. The licensee's approach for evaluating the effects of fire initiated spurious equipment operations appears to be sufficiently comprehensive to identify spurious equipment operations that may adversely affect safe shutdown capability. If properly implemented, with findings appropriately resolved, this approach should result in an acceptable resolution for spurious operations of concern.
3.1 ~ 1 High/Low Pressure Interfaces During a review of the WNP-2 reverification effort documented in PER 29459, and discussions with licensee representatives, the inspector noted that based on its apparent interpretation of Generic Letter 86-10, the licensee has limited High/Low Pressure interface boundaries of concern to only those having two, or fewer, redundant valves in series. As a result of this position, the licensee has not evaluated any High/Low pressure interface lines which may have three or more valves in series.
With regard to defining high low pressure interfaces, Section 5.3.10, part c, of Generic Letter 86-10 states the following:
'The safe shutdown capability should not be adversely affected by a fire in any plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line."-
From this definition, the licensee's basis for restricting its evaluation to only those lines have two or fewer valves was not clear to the inspector. While it is recognized that the spurious opening of redundant series valves is a low probability event, the probability of occurrence must be balanced against the potential consequences, Therefore, the inspector was concerned that even if the licensee's position did, in fact, satisfy a literal interpretation of the Generic Letter (which it does not appear to do), such a definition may cause an insufficiently conservative evaluation to be performed. For example, high/low pressure interfaces of concern are typically Identified by an engineering assessment of plant P8IDs. Given the licensee's previously defined assumption,.the inspector was concerned that certain interface lines of potentially high consequence may be unjustifiably eliminated from further review. By elimination during the initial screening process, certain key factors that may contribute to the probability of occurrence, such as cable routing, would not be evaluated. During discussions with licensee, the BNL technical specialist recommended that the licensee reconsider its definition so that interface lines having a high potential consequence would not be arbitrarily eliminated from further review.
- 4. NNP-2 RESOLUTION OF SPECIFIC ISSUES During the inspection the licensee's proposed approach for resolving certain Appendix R issues described in its November 9, 1992, Interoffice Memorandum (IOM) was reviewed. Due to the current on-going, draft, status of the licensee's reverification effort a complete and thorough evaluation of all 21 issues identified in the IOM was not performed. However, specific issues reviewed are described in the folowing paragraphs. Item Numbers correspond to the numbering sequence of issues established by the 11/9/92 IOM. It should be noted that for brevity the description of items provided below has been paraphrased from wording contained in the original WNP-2 Interoffice Memorandum.
Item t:
Failure toAully evaluate the effects of fire damage.to non-safe shutdown equipment and systems on the ability to achieve and maintain safe shutdown conditions in the reactor.
Evaluation:
As discussed previously in this report, this evaluation is currently being performed under Calculation NE-02-94Q5 of PER 294-359. Failure of non-safe shutdown equipment is being evaluated on a system by system and individual component basis. The following are examples of potentially safety significant concerns that were identified as a result of the licensee's re-analysis of spurious signals:
~ Previously unanalyzed High/Low pressure interface boundaries were identified e
~ Potential waterhammer problems due to draining of RHR, HPCS, LPCS, and LPCI lines Potential for RPV overfill by HPCS, RCIC and LPCS e
Potential for RPV overfill by reactor feedwater pumps and condensate booster pumps At the time of the inspection, none of these issues were fully evaluated and dispositioned by the licensee.
Item 2:
When considering a Main Control Room fire, the time between SCRAM and assumption of Operator control of safe shutdown systems at the Remote and Alternate Remote Shutdown Panels and other remote locations is significant. That time (on the order of 5 to 10 minutes) becomes significant because potential equipment failures and circuit faults may result in Plant responses that must be dealt with by the minimum set of protected safe shutdown equipment available at the local stations. A portion of the Appendix R analysis deals with this time frame but does it only superficially.
The existing analysis should be strengthened to better document the specific equipment and system failure modes considered, or not considered, and the resultant Plant responses. For
example, the NRC has documented in a letter to G. Sorensen, dated Nov. 11, 1987 that the SSW pump must be started from the Remote Shutdown Panel in "less than 5 minutes if the diesel generator started concurrently with the reactor SCRAM". The existing analysis does "not address this requirement.
Evaluation:
(a) Time to Establish Service Water Cooling to EDG The analysis package in'eluded a procedure time line for Abnormal Condition Procedure 4.12.1.1, Control Room Evacuation and Remote Coo!down. The time line indicates that seivice water can be restored to the safe shutdown emergency diesel generator within 6 minutes of the diesel start. Because this time (6 minutes) is greater than the 5 minute time specified en page 14 of the WPN2 Safety Evaluation Report (SER) dated 11/11/87, the time line for service water restoration was reviewed as available analysis data allowed. The following information is germane:
~ The reanalysis document (undated) included in the analysis package, page 4, para A.11 Step 13, states that seivice water must be restored within 6 minutes and 30 seconds following a diesel start.
Abnormal condition Procedure 4.12.1.1, control Room Evacuation and Remote Cooldown, Revision 21, 1/28/94, Step 4 directs control room operator action to start service water pump SW-P-1 B. In accordance with Appendix R regulatory criteria a reactor scram is the only operator action permitted prior to evacuation of the control room. Therefore, manual start of the SW pump prior to control room evacuation is not normally permitted Abnormal condition Procedure 4.12.1.1, control Room Evacuation and Remote Cooldown, Revision 21, 1/28/94, Step 5.1 includes operator action to start service water pump SW-P-1 B at the remote shutdown panel.
Abnormal Condition Procedure 4.12.1.1, control Room Evacuation and Remote Cooldown, Revision 22, undated, Step 11, directs control room operator action to place service water pump SW-P-1 B in service. An explanatory note [must be performed within 6 min of DG 2 start] is included In this step.
Ucensee representatives reported that the emergency diesel generator manufacturer warranted diesel generator operation for two minutes without service water.
Additionally, the manufacturer informed the licensee that the diesel engine would in all likelihood continue to operate for greater than 2 minutes but an actual time limit was not provided. The licensee described a calculation, under development, that would demonstrate a capability to operate the emergency diesel generator for at least 6 minutes 30 seconds without service water. This calculation was incomplete and no determination regarding the calculation was made.
~ During the inspection, licensee representatives conducted a timed (simulated) walk down of the procedures for establishing service water flow to the emergency diesel generator in accordance with Abnormal Condition Procedure 4.12.1.1 and reported that seivice water was simulated restored in a maximum of 4 minutes 17 seconds.
The inspection team did not observe or verify the walkdown by the licensee.
(b) False Feedwater Control Signals The licensee provided the inspection team with documentation that an analysis being performed by the General Electric Company may demonstrate that, in the event of a control room fire, the main steam isolation valves (MSIVs) must be shut within 47 seconds following a reactor scram. The 47 second time limit to shut the MSIVs is required to prevent a reactor plant vessel (RPV) overfill in the event of a fire initiated main feedwater control spurious signal.
Unless a plant modification is installed to allow prompt MSIV closure in, the event of a control room fire requiring control evacuation, the licensee can not demonstrate the ability to shut the MSIVs within 47 seconds. Consequently, the licensee is investigating a procedure change to Abnormal Condition Procedure 4.12.4.1, Fire, that would provide the following actions:
lf the fire is in the Control Room, immediately send a Control Room Operator (CRO) to the Remote (RSD) and Alternate Remote Shutdown (ARSD) Rooms and have the CRO perform the following:
RSD Room
~ Ensure the RHR-V-24B control switch is in the NORM position, then place the RHR-V-123A and RHR-V-24B Power Transfer Switch in the EMERG position.
~ Ensure the RHR-V-27B and RHR-V-16B control switches are in the CLOSED position, then place the RHR-V-16B and 27B Power Transfer Switch in the EMERG position.
ARSD Room
~ Ensure the RHR-V-24A control switch is in the NORM position, then place its Power Transfer Switch in the EMERG position.
Ensure the RHR-V-27A control switch is in the CLOSED position, then place its Power Transfer Switch in the EMERG position.
Inform the Control Room that the RHR-V-27B, RHR-V-24B, RHR-V-27A, and RHR-V-24A Power Transfer Switches have been placed in the EMERG position.
Proceed to the B RPS MG set room and await direction from the Control Room to trip all 6 RPS EPA breakers, C72-S003A through C72-S003F,
This procedure action could be considered to be a type of fire pre-plan; but it would also be a departure from Generic Letter 86-10 guidance that specifies a reactor scram as the only allowed control room action for a control room fire requiring control evacuation. The proposed procedure action to ensure timely MSIV closure is a licensing issue that will require NRR resolution.
The above items demonstrate that the licensee's fire safe shutdown analysis and procedures require additional analysis and development before a determination can be made regarding the acceptability of the licensee's analysis, methods, and procedures.
Item 6:
The Reference 2) IOM states that it is acceptable for the Condensate Booster Pumps to continue to operate during post fire shutdown but that it is prudent to trip these pumps if they do continue to inject into the vessel. The analysis must Justify this position considering the vessel will rapidly overfill with these pumps injecting and could become solid if the MSIVs are closed.
Evaluation:
The licensee's Calculation NE-02-9445, undated and unverified, pages 2.002 and 2.003, para 3, discusses a GE analysis for the potential effects on RPV overfill and states that plant procedure PPM 12A.1.1, Fire, was revised to have the operator trip the condensate booster pumps before depressurizing the RPV. The preliminary analysis results contained in a GE letter from Kavhl Taghavi to Gordon W. Bradstad dated June 13, 1994, serial kt9402 did not include analysis results for the condensate booster pumps (SM-1,2,3).
Page 5.192 of the licensee's calculation NE-02-9445 (unverified) includes an analysis for condensate booster pump injection into the RPV. This document also Includes the disposition:
'Plant procedure 4.12.1.1 has been revised to open the breakers to the condensate booster pumps before blowing down the RPV to ensure that RHR-P-2B can inject suppression pool water through RHR-HX-1 B into the RPV."
Procedure 4.12.1.1, Control Room Evacuation and Remote Cooldown, Revision 21, dated 1/28/94, Page 5, Step 10), reads 'Ensure no more than two condensate booster pumps ,
are operating'. This is a control room subsequent action step following the reactor scram; therefore, Generic Letter 86-10 does not allow credit for this step.
Procedure 4.12.1.1, Control Room Evacuation and Remote Cooldown, Revision 21, dated 1/28/94, Page 9, Step 9), reads 'If RPV level increases to GT 60', perform the following: a Trip the condensate booster pumps (SM-1,2,3)".
Draft Procedure 4.12.1.1, Control Room Evacuation and Remote Cooldown, Revision 22, undated and not approved, Page 6, Step 4, includes direction to "Trip the condensate and condensate booster pumps and pull the control power fuses (SM-1,2,3) (must be performed within ten minutes following scram)".
The above information demonstrates that the licensee has initiated action to analyze the potential for condensate booster pump filling the RPV and initiated procedure action to control the condensate booster pumps.
Item 7:
The Reference 2) IOM states that it is acceptable for the RRC pumps to continue to operate during post fire shutdown but that it is prudent to trip these pumps (including the 15Hz supply). Failure to trip these pumps along with a cooling water supply failure (RRC and CRD which are not protected from the effects of fire) could result in a seal failure and subsequent leak into Containment. The analysis must be revised to provide an evaluation and justification for this condition.
Evaluation:
Page 5.25, dated June 19, 1994, of Calculation NE-02-945, includes an analysis that determines that the RRC pump seals are protected from damage by fire or spurious operation.
Item 8:
During post fire conditions, for fires outside the Main Control Room, it is possible that the.
RHR system (loops A and B) water leg pumps will be lost since they are not protected. For fires inside the Main Control Room, only the loss of the B loop pump need be considered.
The current analysis 'addresses only the loss of the loop B pump and must be revised to address the loss of both A and B pumps for fires outside the Control Room.
Evaluation:
Calculation NE-02-94Q5 Page 5.108, dated June 18,1994, provides an analysis for a loss of the loop B pump and Page 5.109, dated June 18,1994, provides an analysis for a loss of the A Pump.
Abnormal Condition Procedure 4.12.4.1, Fire, Revision 13, dated 1/28/94, Page'6, Step 21 includes the following action to keep the RHR water legs full:
If the fire is in Fire Area RC4, R-1, or R-5 (Attachment 7.2), start RHR-P-2B and RHR-P-2A within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or verify locally that RHR-P4 and LPCS-P-2 are running within one hour and each hour thereafter, Draft Abnormal Condition Procedure 4.12.4.1, Fire, Revision 14, undated, Page 8, Step 23 includes the following action to keep the RHR water legs full:
If the fire is in Fire Area RC-3, R-1, or R-5 (Attachment 7.2), start RHR-P-2B and RHR-P-2A within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or verify locally that RHR-P4 and LPCS-P-2 are running within one hour and each hour thereafter.
11
The licensee's action should allow closure of this item when the calculation and procedure have been approved.
Item 10:
The analysis incorrectly lists the wrong valve to be manually opened on loss of Control Room chiller as SW-V-822A instead of SW-V-822B.
Evaluation:
PER 294-0359, Corrective Action Plan, Action No. 11, includes the action to issue an SCN to revise the FSAR, F.4-2 Item 10, to change SW-V-822A to SW-V-822B. The Corrective Action Plan also provides for revision of the Appendix R calculation. This item should be reviewed when the:licensee's proposed actions have been completed.
Item 11:
The analysis requires an Operator action to trip air handling units WMA-AH-52B/53B to prevent smoke from entering the critical switchgear and cable spreading rooms if a fire starts in Fire area RC-XIII. Review of drawing M548 indicates that WMA-AH-52Af53Amay also be affected by a chiller area fire which suggests that both redundant cooling trains are affected.
Additionally, further evaluation is required to provide justification for not considering the effects of HVAC duct passing through, but not directly communicating with, the Fire Area.
The justification should be generic and address HVAC duct integrity in any fire area.
In addition to the above, the analysis should address the issue of potential duct and hanger structural failure and the results of fire damper closure.
Evaluation:
The licensee has prepared a draft calculation on air handling unit operation, and potential duct and hanger structural failure. The licensee's Corrective Action Plan provides an September 1, 1994 completion date for revising the Appendix R calculation, FSAR, and appropriate procedures.
Item 12:
The Reference 2) IOM requires an Operator action to assess fire damage and restore the Nitrogen supply to the SRVs within 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br /> from event initiation. The analysis should be revised to reflect the basis for this requirement.
Evaluation:
Page 30 of Attachment 2 to Calculation NE 02-85-19 provides an analysis of the nitrogen supply to the SRVs.
12
Item 13:
The NRC dictated to the Supply System that six SRVs, instead of three, must be utilized to bfowdown to a low pressure condition to allow RHR inJection within ten minutes of a fire event initiation if vessel water level cannot be maintained above a minimum level. This resulted in preliminary calculations identifying the minimum water level to be -82.5 inches.
This level conflicts with the requirements of EOPs which dictate that manual vessel pressure relief should not occur until the Top of Active Fuel is reached (well below W2,5 inches).
The analysis should be revised to identify the discrepancy between Appendix R requirements and EOP requirements and an effort made to resolve this conflict with the NRC. Operator training may also be affected by this conflict.
Evaluation:
The analysis package provided to the inspection team by the licensee did not include information that demonstrated resolution of the RPV level difference between the EOPs and the fire procedures.
Item 15:
The Reference 2) IOM instructs the Operators that switch DG-RMS-DG/20 must be operated prior to operating switch DG-RMS-DG2JRTS56B to prevent transferring to a faulted circuit.
The analysis should be revised to require this sequence of actions.
Evaluation:
The analysis provided to the inspection team included the statement "This circuit will be isolated from the main control room DBF once local control of DG2 is established per PPM 4.12.1.1 (the main control room evacuation procedure).
Item 17:
RCIC is not fire protected but may be available for shutdown and will be used by Operations if it is available for fires in the Main Control Room requiring evacuation to Remote Shutdown areas. The analysis should be revised to address the operational interface between credited safe shutdown systems and the RCIC system.
Evaluation:
The analysis package provided to the inspection team included analysis of several RCIC valves:
~ Impact item 06.01.04: Spurious opening of RCIC steam line drip pot drain valves RCIC-V-54, RCIC-V-25 and RCIC-V-26 could create a blowdown path from the RPV to the main condenser.
13
The calculation's disposition for this item was: Opening of this valve is acceptable since the flow rate is less than the makeup capacity of the RCIC pump, the radiological consequences are enveloped by those postulated for a RCIC steam line break outside of primary containment, and the released reactor coolant will not affect the required safe shutdown components. Therefore no design changes are required. The recommended actions recommended that no further action was required.
The inspection team does not consider no action to stop an uncontrolled release outside the containment to be an acceptable resolution,
~ Impact Item 06.02.01: RCIC will Inject water into the RPV on either spurious actuation or due to low reactor water level (RPV Level 2,-50') when the RPV is blown down to go.on alternate shutdown cooling.
I.
The disposition for this impact item awaits completion of an analysis by GE.
Impact Item 06.04.01: The RCIC system will automatically start on low reactor water level (RPV Level 2,-50"). If RCIC-MO-68 spuriously closes, steam would discharge to atmosphere (Main Steam Tunnel) through RCIC-RD-1 and 2.
The disposition contained the following: If the turbine does not trip, flow would still be restricted by the operation of the turbine, This would provide continued makeup to the turbine while ensuring sufficient time to diagnose a potential loss of suppression pool inventory. No recommended actions were made.
The inspectio'n team does not consider no action to stop an uncontrolled release outside the containment to be an acceptable resolution.
~ Impact Item 06.05.01: Opening steam isolation valve RCIC-V-45 could drain the RPV down to nozzle N38.
The disposition provided the following information: The turbine stop valve and governor valves should prevent drainage of large amounts of water. Nozzle N38 is well above the reactor core. The recommended action was stated as none.
The inspection team does not consider no action to stop an uncontrolled loss of inventory to be an acceptable resolution.
~ Impact Item 06.07.01: If RCIC Water Leg Pump RCIC-PQ is tripped due to the fire and water leaks from RCIC system piping, RCIC-P-2 starts on low reactor water level (RPV Level 2-50") could result in water hammer. Although the RCIC system is not required for safe shutdown, damage to the RCIC piping could potentially drain the Suppression Pool.
No disposition or corrective action was included for this item.
~ Impact Item 06.15.01: Actuation of RCIC will occur following blowdown when the reactor water level reaches RPV Level 2,-50". Fire damage could prevent the normal trip of the HPCS system when RPV water level reaches Level 8 causing overfill of the RPV.
The following disposition was stated for this item: GE will determine how long operators have to secure the RCIC pump before the RPV is overfilled, This time will be much larger than the time for HPCS to overfill the RPV. No recommended actions were included.
The above items demonstrate that the additional analysis and appropriate corrective actions should be. performed on the RCIC system.
Item 19:
During the sequence of events which can occur due to a Main Control Room fires it is possible that the HPCS may be actuated by a spurious signal and begin to inject to the reactor vessel. Since automatic logic is assumed unavailable, the high water level trip which would normally terminate HPCS injection may not be available. consequently, to mitigate this injection, PPM 4.12.1.1 requires manual trip of the system by tripping the pump breaker at the switchgear.
The analysis should evaluate the acceptability of breaker trip relative to the time necessary to evacuate the Control Room, take control of the Plant locally, assess the need to trip the HPCS and terminate operation at the switchgear.
Evaluation:
Resolution of this item awaits completion of a GE analysis. The GE analysis is in progress.
Item 20:
Fires in certain areas may result in the inadvertent actuation of the RCIC system'. Since RCIC is not credited for safe shutdown, system controls are not protected from the effects of fire.
Therefore, the system may continue to operate without the high vessel water level trip actuating.
The analysis should be revised to discuss the methods by which RCIC trip may be accomplished and the availability to these trips.
Evaluation:
Resolution of this item awaits completion of a GE analysis. The GE analysis is in progress.
15
Item 21:
The minimum fire protected safe shutdown mode for fires anywhere in the Plant is the Alternate Shutdown Cooling Mode. The analysis should be revised to include a discussion of the shutdown procedural steps necessary to utilize this mode using the minimum set of protected equipment. For example, the reactor vessel may become 'solid'n this mode due to the lack of upset water level indication to aid the Operator in controlling vessel level:
vessel pressure and RHR flow is available.
Evaluation:
The licensee's corrective action plan schedules completion of this item for September 1, 1994.
16
I I
/
l