ML18101B193

Final TER Salem Nuclear Power Station.

ML18101B193
Person / Time
Site:	Salem
Issue date:	11/30/1995
From:	Sullivan K BROOKHAVEN NATIONAL LABORATORY
To:	NRC (Affiliation Not Assigned)
Shared Package
ML18101B192	List: ML18101B193
References
NUDOCS 9601300016
Download: ML18101B193 (47)

Text

• *

• BROOKHAVEN NATIONAL LABORATORY FINAL TECHNICAL EVALUATION REPORT Salem Nuclear Power Station Prepared by:

K. Sullivan Department of Advanced Technology Engineering Technology Division Brookhaven National Laboratory Upton, NY 11973 November 1995

~'¢~

i

• • bnl.

( DUI/

DAT Enclosure

• v-I TABLE OF CONTENTS Section Page No.

1. Background .......................................................... 1

2. Review criteria ....................................... -................. 2

3. Scope of evaluation ............................... : ............ _........ 3

4.

• Alternative safe shutdown system design and use of repairs to achieve hot shutdown . . . 4 4.1 Discussion ......................... -.................. : ......... 4 4.2 Evaluation ..................................................... 5 4.3 Conclusion .................................................... 12

5. Fire-Initiated Spurious Signals ........................................... 13 5.1 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 5.2 Evaluation ............ *........................................ 15 5.3 Conclusion .................................................... 18

6. Evaluation ofPSE&G Request for Reconsideration of Exemption' ................ 20 6.1 Discussion ........ *............................................ 20 6.2 Evaluation .................................................... 21 6.3 Conclusion ..................................................... 22 APPENDIX A DOCUMENTS REVIEWED APPENDIXB DETAILED SYNOPSIS OF DOCUMENTS REVIEWED 11

1. BACKGROUND During the-period ofMay 17-21, 1993 and on July 19, 1993, NRC Region I conducted a triennial Appendix R post-fire safe shutdown inspection at Public Service Electric and Gas Company's (PSE&G) Salem Nuclear Generating Station, The scope of this inspection was focused on evaluating the licensee's compliance with the post-fire safe shutdown criteria contained in Sections m.G and ill.L of Appendix R As a result of this inspection, the following issues were identified:

(1) The Alternative Shutdown methodology was found to rely on the use of repair activities (e.g., cutting of electrical leads and installation of jumpers) to provide electrical independence from the affected fire area and/or restore operability of equipment required to achieve and maintain hot standby conditions; and (2) The licensee's analysis for spurious actuations that may occur a8 a result of fire was determined to be insufficiently conservative to the extent that the analysis .assumed only one spurious operation would occur, regardless of the extent of fire damage and the number of potentially affected circuits involved.

At the request of the NRC Office of Nuclear Reactor Regulation (NRR), the Engineering Technology Division ofBrookhaven National Laboratory (BNL) performed a comprehensive review of the licensing basis a5sociated with the plant's ability to achieve and maintain post-fire safe shutdown conditions. The scope ofthis evaluation was directed at determining:_, *

(1) The level of approval granted by NRR regarding the current alternative shutdown systein design and the use of repairs to achieve and maintain safe shutdown capability *

(2) The licensee's assumptions and methodology pertaining to the plant's ability to cope with spurious signals (operations) that might occur as a result of fire damage in accordance with the guidance presented in Generic Letters 81-12 and 86-10 .

• 1

2. REVIEW CRITERIA The criteria used during the review of the TVA submittal are included in the following NRC documents:

1. "Fire Protection Program for Operating Nuclear Power Plants," 10CFR50 Appendix R, (45 FR76611, November 19, 1980, and 46 FR 44735, September 8, 1981).

2. Generic Letter 81-12, dated February 20, 1981

3. NRC Memorandum To: D.G. Eisenhut From: R.J. Mattson,

SUBJECT:

"Fire Protection Rule Appendix R" dated March 22, 1982 (Clarification of Generic letter 81-12)

4. NRC Memorandum TO: R.H. Vollmer, From: R.H. Mattson,

SUBJECT:

"Position Paper on Allowable Repairs for Alternative Shutdown and the Appendix R Requirements for Time Required to Achieve Cold Shutdown," dated July 21, 1982.

5. Generic Letter 83-33, dated October 19, 1983

6. NRC IE Information Notice 84-09, "Lessons learned from NRC inspections of Fire Protection Safe Shutdown Systems"

7. NRC IE Information Notice 85-09, "Isolation Transfer Switches and Post-Fire Safe Shutdown Capability"

8. Generic Letter 86-10, "Implementation of Fire Protection Requirements," April 24, 1986 2

'v*

3.

SCOPE OF EVALUATION At the request of the NRC Office of Nuclear Reactor Regulation (NRR), Brookhaven National Laboratory (BNL) performed a comprehensive review of certain specific issues related to the ability of the Salem plant to achieve and maintain post-fire safe shutdown conditions. The scope of this evaluation was directed at determining:

(1) The level of approval granted by NRR regarding the current alternative shutdown system design's reliance on the use of repairs to achieve and maintain safe shutdown conditions, and (2) The licensee's assumptions and methodology pertaining to the plant's ability to cope with spurious signals (operations) that might occur as a result of fire damage in accordance with the guidance presented in Generic Letters 81-12 and 86-10.

(3) The licensee's submittal dated January 04, 1991 requesting reconsideration of exemption for Fire Areas FA-EP-lOOG and FA-PP-lOOH of Units 1and2.

• 3

4.

ALTERNATIVE SAFE SHUTDOWN SYSTEM DESIGN AND USE OF REPAIRS TO ACHIEVE-HOT SHUTDOWN 4 .1 Discussion Appendix R to 10 CFR 50 requires licensee's to provide fire protection features that are capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions remains free of ~re damage. Specific design alternatives for ensuring this capability are provided in Section ill.G.2 of.the rule. For areas of the plant where protection of systems required for hot shutdown can not be assured because it is not desirable or feasible to implement the fire protection features specified in Section III.G.2, an alternative or dedicated shutdown capability must be provided which is independent of cables, systems. or components in the area, room or zone under consideration.

Specific requirements defining an acceptable alternative shutdown capability are principally contained in Section ill.L of Appendix R to 10 CFR 50, with additional guidance provided in Generic Letter 81-12 (GL 81-12). With regard to the isolation of systems and equipment required for safe shutdown, paragraph ill.L.7 of the regulation states, in part: "Safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent op*eration _

of the safe shutdown equipment. With regard to the protection of systems/equipment required for hot shutdown, GL 81-12 states the following: (1) The equipment and systems used to achieve and maintain hot standby should bt: free of fire damage and capable of maintaining such conditions for an extended time period if equipment required to achieve and maintain cold shutdown is not available due to fire damage; (2) wiring, including power sources for the control circuit and equipment operation for the alternate shutdown method, must be independent of equipment Wiring in the area to be avoided, and (3) cabling require9 for or ass0ciated with the alternative method of hot shutdown for each fire area, must be physically separated by the equivalent of a three-hour rated fire barrier from the fire area.

At Salem, the control room, relay room and ceiling of the 460V Switchgear Room contain redundant trains of circuits associated with equipment required to achieve and maintain hot shutdown conditions. Since compliance with the separation and fire protection criteria of Section ill.G.2 of

.Appendix R has not been achieved in these areas, the licensee has developed an alternative shutdown capability to accomplish shutdown from outside the inain control room.

To provide assurance that required control and instrument circuits are effectively isolated from the affects of fire, the alternative shutdown system design typically incorporates the use of isolation/transfer switches that are located outside of the atrected fire area. These devices, once activated, provide the necessary degree of electrical isolation for potentially affected circuits and enable the control and/or monitoring of required equipment to be transferred to an area of the plant that is physically independent of the fire affected area(s). Recent NRC inspections of the alternative shutdown capability developed by the licensee have determined that in lieu of providing such 4

isolation/transfer switch schemes, the licensee has developed abnormal operating procedures which direct operators to perform repair activities (e.g. cutti.,W1.ifti.-1g leads and installiDgjumpcrs) necessary to isolate affected- circuits and regain control of required equipment. Additionally, the level of approval granted. by NRR regarding the use of repairs to achieve and maintain alternative safe shutdown at Salem could not be determined. To address this issue an evaluation of the historical fire protection licensing basis for Salem was performed. The results of this evaluation are discussed below.

4.2 Evaluation The evaluation of the Salem Nuclear Plant licensing basis associated with Sections III.G.3 and III.L of Appendix R was based on.a review ofa number ofNRC and licensee documents provided to BNL by NRR. This review was specifically directed at evaluating the level of approval granted by NRR regarding the current alternative shutdown system design with regard to the use of repairs to achieve and maintain hot shutdown conditions. A chronological outline and summary of documents determined to be specifically germane to the licensee's alternate shutdown capability is provided below. The reader is referred to Appendix A for a more detailed synopsis of the contents of each document reViewed.

4.2.1 Chronological Summary of the Appendix R Licensing Basis for the Alternate Safe Shutdown Capability of Salem Nuclear Power Plant

• 1.

2.

February 20, 1981 April22, 1981 NRC forwards Generic Letter 81-12 (GL 81-12) to the licensee.

Letter from PSE&G to NRC forwarding commitment to comply with Appendix R Section 111.L and provide information requested in GL 81-12 . '

3. .May 1981 NUREG-0517, Supplement No.6, "Safety Evaluation Report Related to the Operation of Salem Nuclear Generating Station, Unit No. 2",

which states, in part:

"In Supplement No. 5 we stated that the alternate shutdown capability to achieve hot shutdown from outside the control room is now operational. This statement was in error... the applicant has not yet formally submitted a description of this capability."

• 5

4. May 11, 1981 NRC memorandum providing its report entitled: "Report on PSE&G Cable Separation Study (included as Attachment G to May 1981 SER). This document describes NRC's interim acceptability of Salem's alternative shutdown system design (i.e. reliance on operator repairs action). As noted in this report, the objective of this evaluation was to: "evaluate the adequacy of fire protection measures on an interim basis (emphasis added). The adequacy of the measures on a long-term basis will be covered by the staff in its review of the licensee's compliance with App. R."

5. June 4, 1981 NRC memo with copy forwarded to PSE&G, providing a summary of meeting held on April 13, 1981 with licensee to discuss the design of the alternate shutdown capability. With regard to the alternative shutdown capability, this memo states:

1. The installed alternative shutdown system does not satisfy the conceptual designs that were approved in the stafl's SER of November 20, 1979, and appears to be unacceptable.

2. The licensee should submit a more detailed description of the installed alternative shutdown system in response to the Eisenhut letter of February 20, 1981 (GL 81-12). This response should give* the staff as much information as is available to justify the acceptability of substituting personnel and procedures for 'hard-wired' control systems with transfer switches...

6. July 17, 1981 Letter from PSE&G to NRC forwarding response to Generic Letter 81-12. With regard to alternative shutdown the response states:

1. GL 81-12 Item 8(c): No transfer switches are used for the alternate shutdown capability... Some physical modifications may be required ... restoration of equipment and circuitry to original conditions.. .is an administratively.controlled action

2. GL 81-12 Item 8(g): The alternate shutdown procedures call out the need for special equipment to effect use of the

• particular function. Fuses are required to be replaced as part of the procedure ... actions are also taken by the operator to prevent the new fuses from being blown as part of the procedures

• 3. GL 81-12 Item 8(1): The procedures provide direction for any modifications needed to accomplish each functioa. Th~

equipment is readily available at a central area or prestaged at the actual location *

. 7. September 18, 1981 Letter from PSE&G to NRC forwarding the final Interim Fire Protection Program Safe Shutdown .and Interaction Report dated September 1981

8. April 20, 1982 Letter from NRC to PSE&G providing the results of the staff's review of the September l 981 Fire Protection Program. The relevant portions of the staffs review are as follows:

I. Enclosure 1, Paragraph 4: "The licensee should analyze all non-safety related associated power, control and instrumentation circuits to see that they meet the requirements of Section III.L of Appendix R. This means that they are identified as associated circuits so that they can be evaluated; and that they are isolated from alternative shutdown systems by the fire protection means listed in Section ill. G.2 or by suitable isolation devices."

.2. Enclosure 2, Paragraph 1: "The licensee's alternative shutdown procedure requires installation of electrical jumpers and pneumatic bypasses. It is our 'position that systems and components used to achieve and maintain hot standby conditions must be free-offire damage and capable to maintain such conditions for the duration of the hot standby condition."

3. Enclosure 3, Clarification of Generic Letter 81-12, Attachment 2, Safe Shutdown Capability, page 2: 11 Alternative shutdown equipment must be independent of the cables, equipment and associated circuits of the redundant systems damaged by the fire. 11 *

9. June 16, 1982 Letter from PSE&G to NRC providing a response to the staff's review comments contained in April 20, 1982 letter. Relevant portions include:

• 7

~ '

• 1. Response to Enclosure 1 Item 4: "During the May 14 meeting PSE&G representatives reviewed information related to the Salem plant electrical system design and identification of associated circuits... All circuits, including non-safety related associated circuits, have been identified and evaluated for potential affects of fire damage to determine compliance with Appendix R, Section m.L .as appropriate. II

2. Response to Enclosure 2, Item 1: "The alternative shutdown procedures used at Salem do not require the use :of electrical jumpers or pneumatic bypasses (emphasis added) to achieve hot shutdown conditions. Manual operation of the steam-driven auxiliary feedwater pumps, associated valves, and the steam generator relief valves provides hot shutdown capability for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Seal injection flow is established

• automatically by operation of any one of three charging pumps. After apprqximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the plant can be maintained in a hot shutdown condition even if spurious operations of equipment occur since the alternate shutdown procedures provide a mechanism to disconnect control circuits from potential fire induced damage at any time during the shutdown is necessary. 11

10. May 31, 1983 Letter from NRC to PSE&G forwarding Safety Evaluation Report for Appendix R lt~ms ill.G.3, and ill.L. With regard to repair activities during alternative shutdown, the SER states the following:

1. "The licensee has provided a safe shutdown analysis for a fire event, and has demonstrated that adequate redundancy and/or an alternative shutdown method exist for those systems required to assure safe shutdown. No repairs or modifications

. are required to effect hot or cold shutdown utilizing the alternate shutdown methods. 11 (emphasis added).

2. "The alternate shutdown method will be accomplished by procedural means, with actions performed at local shutdown stations or locally at the equipment. The. licensee has also provided a *summary of the functions for which alternate

. shutdown methods may be needed, and the manual actions required to accomplish each of the identified functions have been described. 11

• • 8

1 '

• 3.

"The alternate shutdo\vn methods have the capability of achie-.ing co!d 3hutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a fire event and no repairs are planned in order to achieve cold shutdown"

11. March 2, 1984 Letter from NRC to PSE&G providing the results of an inspection of Salem Unit 1 for compliance with Appendix R. As noted in this

• report, although all hardware modifications associated with the alternative shutdown capability (except source range monitor) were installed, the alternative shutdown system, including procedures for its implementation, were not required to be in place at the* time of this inspection due to schedule requirements of IO CFR 50.48(c) which allows the licensee until the end of the next refueling outage to place the system in operation. Therefore, the scope of this review performed by the inspection team concentrated on determining the overall acceptability of the alternative shutdown capability design and included verification that there was no dependence on repairs for achieving hot shutdown. For the purpose of the review, a* repair would include installing electrical or pneumatic jumpers, wires *or fuses to perform an action required for hot shutdown. As a result of this review, the following items related to repairs for hot shutdo~

were identified:

• - 1. the procedures for local start of diesel generators are unacceptable since the procedures include what the NRC considers repaifs (e.g.; removing wires from terminal points and reconnecting to other terminal points) ... since the equipment required for a normal local or remote start of all three diesel generators is located within* the relay room (an area requiring alternative shutdown) local start of at least one diesel generator independent of the relay room and without repairs must be provided.

. 12. January 26, 1988 Letter from NRC to PSE&G forwarding results of an inspection conducted to verify compliance with Appendix R Sections m.G, J, L and 0. With regard to repairs required to achieve hot shutdown, this report was found to state:

• 9

-~ I

• I. "The team in observing the operators perform some steps in the procedurn determined that some of the operator actions

• are repairs by NRC definition and, therefore, are not allowed during the hot shutdown phase (emphasis added). The repairs in question involve the use of pneumatic jumpers to prevent spurious actuation of valves. The licensee explained that an alternative to the use of pneumatic jumpers exists in the procedure but using the jumpers is the preferred way. The licensee also explained that the NRC has specifically reviewed the use of jumpers and has found it acceptable (emphasis added). The acceptability of hot* shutdown repair activities was cited as an unresolved item in the inspection report (URI No. 87-29-06) .

13. February 7, 1990 Letter from NRC to PSE&G forwarding the results of a routine safety inspection conducted by an NRC Region I inspector. Based on his review of NRC and licensee correspondence dated 6/16/82, 12/22/82 and 5/31/83, the inspector considered the acceptability of hot shutdown repair activities (Unresolved Item 87-29-06) to be cfosed.

A summary of the documents referenced by the inspector is provid~

below:

• 6/16/82: Letter from PSE&G to NRC, providing PSE&G's response to the staffs Request for Additional Information (RAI) dated April 20, 1982 which states:

"The alternative shutdown procedures used at Salem do not require the use of electrical jumpers or pneumatic bypasses to achieve hot shutdown conditions."

12/22/82 Letter from PSE&G to NRC. Although this letter is referenced by the Region 1 inspector, this document does not contairi any information relevant to the staffs evaluation of the licensee's reliance on repair actions to achieve and maintain hot shutdown.

5/31/83: Letter from NRC to PSE&G forwarding its Safety Evaluation Report for Appendix R Items ID.G.3, and IIl.L. As described previously, in its SER the staff states, in part: No repairs or modifications are required to effect hot or cold shutdown utilizing the alternate shutdown methods."

• 10

. 1--

Based on our review of documents referenced in the Region 1 inspection report, the technical basis for closure of Unresolved Item 87-29-06 could not be determined. For example, the March 2, 1984 NRC inspection, which identified the licensee's need to perform repairs to achieve hot shutdown conditions in the event of fire in the relay room (an alternative shutdown fire area), was apparently not considered by the inspector during his evaluation of this issue. This finding is significant since it is contradictory to statements made by the licensee in its June 16 1982 submittal to NRR.

14. May 1993 NRC inspection determines that in lieu of providing an isolation/transfer switch capability in the design of.its alternative shutdown system, operators are procedurally directed to perform numerous, complex, repair activities (e.g., lifting of leads, cutting leads, installation of electrical jumpers, removal of fuses) in order to isolate potentially affected circuits and regain control of components.

15. July 1993 NRC walkdown of alternative shutdown operating procedures verifies the extensive nature of repairs required to achieve and maintain hot shutdown conditions.

Since the issuance of Generic Letter 81-12 (GL 81-12) on February 20, 1981, it appears that in all of the correspondence issued by NRR to the licensee, the staff has been consistent with regard to its concern for fire damage to non-safety related a~sociated circuits which may affect the alternative safe shutdown capability. In its evaluation of the licensee's response to Generic Letter 81-

. 12, the staff informed the licensee of the following NRC positions: (1) the need to perform an

• analyses necessary to identify associated circuits of concern arid, once identified, provide protection per Section m.G.2 or suitable isolation devices; and (2) systems and components used to achieve and maintain hot standby conditions during implementation of the alternative shutdown capability must remain free of fire damage. These positions were reiterated to the licensee in subsequent correspondence dated June 4, 1981 and April 20, .1982.

In its* June 16, 1982 submittal to NRR the licensee states that the alternative shutdown procedures used at Salem do not require the use of electrical jumpers or pneumatic bypasses, and that through manual operation of the steam-driven auxiliary feedwater pumps and related equipment, hot shutdown cancbe achieved and maintained for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Additionally, this response states that seal injection flow to the reactor coolant pumps (required to prevent an unisolable loss of coolant through damaged seals) will be automatically established by operation of one of the three charging pumps. The information contained in this submittal provided much of the technical basis for the May 31, 1983 Safety Evaluation Report (SER) issued by NRR, which states, in part: "No repairs or modifications are required to effect hot or cold shutdown utilizing the alternate shutdown methods." However,. each of the NRC Appendix R Team inspections conducted in 1984, 1988,

. . and 1993 described the licensee's necessity of performing frequently complex repair activities in order to

• 11

isolate potentially affected circuits from the fire affected area (i.e., Control Room, Relay Room, or Ceiling of the 460V Switchgear Room) and/or regain control ofrequired equipment. No evidence was identified during this review which indicates that the licensee's alternative shutdown system design and procedural methodology were approved by the NRR staff, except on a interim basis, as documented in Supplement No.6 of the staffs Safety Evaluation Report, dated May 1981.

4.3

Conclusion:

During the initial licensing process for Salem Unit 2, NRC field inspectors accepted the use of repair actions on an interim basis during the startup testing program. In its May 19.81 SER the staff clearly indicates that its approval of this approach is only acceptable as a short-term temporary measure, with long-term compliance pending staff review of the licensee's compliance with Appendix R None of the subsequent reviews performed by the NRR staff, Indicate approval of PSE&G's use of repair actions to effect hot shutdown conditions during implementation of its alternative shutdown capability. This observation is reflected in the results of subsequent NRC Appendix R Compliance Inspections conducted in 1984 and 1988, As a result of the 1988 inspection, staff approval of hot

• shutdown repair activities was identified as an Unresolved Item. In January of 1990, however, this Unresolved item was closed by a Region I inspector performing a routine safety inspection, apparently without NRR staff review and concurrence. The inspectors justification for closure of this issue appears to be based on his review of certain documents provided by the licensee. The applicable documents referenced by the inspector were also reviewed as part of this evaluation. However, we were unable to identify a clear technical basis for the inspectors decision to close this issue. Based on the results of our review, we conclude that Salem is not in compliance with Sections III. G and ill.L of Appendix R, and the licensee's alternative shutdown system design, as it currently exists, has never been fully reviewed and approved by NRR.

12

• 5.

5. 1 FIRE-INITIATED SPURIOUS SIGNALS Discussion Appendix R to 10 CFR 50 establishes fire protection features necessary to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions remains free of fire damage. Specific design alternatives for ensunng that required cables, equipment, and associated non-safety circuits, are adequately protected are delineated in Section ill.G.2 of the rule.

On February 20, 1981 the NRC forwarded Generic Letter 81-12 (GL 81-12) tO all reactor licensees with plants licensed to operate prior to January 1, 1979. In addition to restating the regulatory requirement for each licensee to determine whether the requirements of Section ill.G.2 of Appendix R were satisfied, GL 81-12 requested licensee's to provide information concerning those areas of the plant requiring alternative shutdown capability and defined associated circuits. With regard to the protection of systems/equipment required for hot standby, GL 81-12 states the following:

1) The equipment and systems used to achiev~ and maintain hot standby should be free of fire damage and capable of maintaining such conditions for an extended time period if equipment required to achieve and maintain cold shutdown is not available due-to fire damage; and,

• 2) Wtring, including power sources for the control circuit and equipment operation for the alternate shutdown method, must be independent of equipment wiring in the area to be avoided; and

3) Cabling required for or associated with the alternative method of hot shutdown for each fire area, must be physically separated by the equivalent of a three-hour rated fire barrier from the fire area.

As a result of its review of licensee submittals and meetings with licensees following the issuance of GL 81-12, the staff determined that the term "associated circuits" required further clarification. Subsequently, additional clarifying infonnation was provided as Enclosure 1 of a March 22, 1982 NRC internal memorandum, from R I. Mattson to D. G. Eisenhut. This document was then forwarded to PSE&G as Enclosure 3 of a NRC letter dated April 20, 1982.

With regard to circuits of equipment whose spurious operation could affect the safe shutdown capability, the staff determined that an adequate level of protection may be achieved through implementation of any one of the following methods:

1. Provide protection for circuits of concern per Section ill.G.2 of Appendix R, or

• 13

_1

\ '

• 2.

3.

Provide a meanS to isolate the equipment of concern from the fire area prior to the fire (an example of this method is pre-fire strategies which de-energize e~uipment whose fire-initiated spurious operation could adversely affect safe shutdown); or, Provide electrical isolation that prevents spurious operation (e.g., isolation/transfer switch schemes); or

4. Provide a means to detect spurious operations and then procedures to defeat the maloperation of equipment (an. example would be procedural guidance to establish

.manual control of a Motor Operator Valve that may spuriously operate as a result of a fire-induced failures in its control circuitry). *

• In April .1986, the staff issued *Generic Letter 86-10, "Implementation of Fire Protection Program Requirements." This document presents NRC's position on specific issues as responses to questions posed by industry. Specific guidance related to fire initiated spurious operations is contained in NRC responses to questions 5.3.1 and 5.3.10 as follows:

Question 5. 3 .1, requested the NRC to provide clarification of circuit failure modes to be considered in identifying circuits associated*by spurious actuation. In its response the NRC states:

"Sections Ill. G. 2 and lll.L. 7 of Appendix R define the circuit failure modes as hot shorts, open circuits and shorts to ground For consideration of spurious actuations, all possible.functionalfailure states must be evaluated, that is the component could be energized or de-energized by any one or more of the above failure modes.

Therefore, valves could fail open or closed; pumps could fail running or not running; electrical distribution breakers could/ail open or closed-:."

Question 5.3 .10 of Generic Letter 86-10 requested NRC to define plant transients that should be considered in the design of the alternative or dedicated shutdown capability. The NRC response is as follows:

Per the criteria of Section lll.L of Appendix R a loss of off.site power shall be assumedfor a fire in any fire area concu"ent with the following assumptions:

a. The safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area; and

b. The safe shutdown capability should not be adversely affected by a fire in anj plant area which results in the loss of all automatic functions (signals, logic) from the circuits located in the area in conjunction with one worst case spurious actuation or signal resulting from the fire; and

• 14

c.

The safe shutdown capability should not be adversely affected by a fire in

£119' plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line" Using the guidance presented in GL 81-12 and GL 86-10, during the period of May 17 through May 21, 1993, the NRC conducted an inspection of Salem Nuclear Power Plant for compliance with Sections ill.G, J., L., and 0., of Appendix R to 10 CFR 50. As a result of its review, the inspection team concluded that the licensee's analysis of the potential affect of fire-initiated spurious signals was not sufficiently conservative to the extent that the analysis and its resulting post-fire shutdown methodology, assumed only one spurious actuation would occur as a result of fire in any area, regardless of the number of circuits that may be exposed to fire damage. In response to the inspection team's concern, the licensee stated that this assumption was based on its interpretation of the NRC response provided to Question 5.3. IO(a) of Generic Letter 86-10, which states: "The safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area. "

5 .2 Evaluation The evaluation of the licensee's

• stated

• position with regard to fire-initiated spurious operations, was based on a comparison of applicable regulatory criteria and guidance described in section 2.1 above, to the licensee's methodology for evaluating fire-initiated spurious equipment operations, as documented in its August 2, 1993 submittal to NRC, and it's response to NRC Information Notice 92-18, as documented in its submittal dated October 26, 1993.

5.2.1 PSE&G Methodology for Evaluating Fire-initiated Spurious Equipment Operations During performance of its post-fire safe shutdown* analysis, the licensee identified the following two categories of components:

(1) Components whose operation was required to achieve safe shutdown. When identified, these components were designated "HSB ", if required to achieve and maintain h~t-standby, or "CSD", if required for cold shutdown (2) Components whose fire-induced spurious operation would prevent the successful achievement of safe shutdown. When identified, components in this category were designated "SOE" Following their identification, HSB, CSD, and SOE components were entered into a shutdown model and evaluations were performed for each fire area of the plant. With regard to components whose spurious operation would prevent the successful achievement of safe shutdown (i.e., those designated as "SOE"), this evaluation followed the following sequence:

15

• (1) Initial Evaluation:

If a-"SOE" component's cables were located in a fire area and were not protected from the consequences of fire per Section ill.G.2 of Appendix R, it was assumed the component would spuriously operate.

If, as a result of this initial evaluation, it was determined that a success path (one train of safe shutdown systems) was not available, the following iteration of the safe shutdown model was performed:

{2) Second Iteration:

The actual cabling in the fire area was evaluated for the ability of fire-induced failures .

to result in the spurious operation of SOE components. If, after this second iteration, a success path was still not available due to the spurious operation of components, the licensee applied its interpretation of the NRC response to Question 5.3.10 of GL 86-10; (i.e., only one spurious operation was assumed to be credible as a result of fire in any area).

Ifunprotected cabling of redundant SOE components was located within a fire area, PSE&G applied its interpretation ofGL 86-10, and assumed one of the redundant components would remain available. Specific examples illustrating the licensee's application of this approach include:

1. The charging shutdown function controls the concentration of boric acid and the water inventory of the reactor coolant system. During post-fire safe shutdown, this function is provided by the charging pumps drawing suction from the refueling water storage tank (RWST). The successful achievement of this function requires the normally aligned suction path from the volume control tank (VCT) to be isolated to avoid pump damage due to possible cavitation. To isolate the VCT, either one of two, normally open series valves {ICV40 and 1CV41) must be closed and remain closed. A fire-initiated fault on the control cables associated with either one of the series valves could cause a failure of the valve to close on demand or spuriously open.

Although the control cables for both valves may be damaged by a single fire, the licensee assumes (based on its interpretation ofGL 86-10, Q5._3.10(a)) that at least one of the series valves will not be affected by the fire, and will remain available.

2. In order for the charging pumps to draw suction from the RWST, either one of two, nonnally closed parallel flowpath valves {lSJl or 1SJ2) must remain open during the fire event. If either one of these valves was not capable of being opened or were to spuriously fail closed due to a fire-initiated spurious signal, the licensee's analysis assumes (based on its interpretation of GL 86-lO{a) ) that the redundant parallel tlowpath valve will remain available, regardless of the location of its connected cabling in relation to its redundant counterpart.

• 16

3.

'\ . *

• The licensee's safe shutdown analysis for Fire Area 2FA-AB-84B states: "Valves 21 SW2 l and 22SW2 l are normally open, diesel generator header isolation valves, which must remain open for post-fire shutdown. Per the Generic Letter 86-10 guidelines, only one spurious signal needs to be considered." Although the control cables for both valves are located in this fire are3., based on its assumption that only one spurious operation needs to be considered, the licensee determined that at least one flow path would remain available throughout the fire event.

5.2.2 PSE&G Response to NRC Information Notice 92-18 (Ref: PSE&G Submittal to NRC dated October 26. 1993)

On February 28, 1992 the NRC Office of Nuclear Reactor Regulation (NRR) issued Information Notice (IN) 92-18. The purpose of this document was to alert licensee's of conditions identified at several reactors that could result in the loss of capability to maintain the reactor in a safe shutdown condition in the event of a control room fire. Specifically, IN 92-18 cautions licensee's of the potential for a control roorri fire to result in hot shorts between control wiring and power sources of motor-operated valves (MOV's) which may result in spurious operation of the valve and*

mechanical valve damage sufficient to prevent reactor ope~ators from manually operating the valve.

During the May 1993 Appendix R inspection conducted by NRC Region I, the licensee stated that the conditions described in Information Notice 92-18 were not credible. However, as a result of a telephone conference held between the licensee and the staff on June 3, 1993, the licensee

• committed to provide a formal response to issues described in the Information Notice. By letter dated October 26, 1993, the licensee forwarded this response in a document titled: "Engineering Evaluation of SGS 1&2 Control Room Evacuation for Fire Induced MOV Hot Shorts as Discussed in NRC Infomiation Notice 92-18", dated August 20, 1993 ..

• The stated purpose of the licensee's evaluation was to assess concerns identified in NRC Information Notice (IN) 92-18 regarding the potential for loss of remote shutdown capability following a control room evacuation due to fire. The evaluation identified a total of 65 valves as being *specifically addressed within the Salem Control Room evacuation procedure and Safe Shutdown Analysis. As a part of its evaluation the schematics and wiring diagrams for all 65 valves were reviewed to determine which cables associated with the valves were routed in areas where control room evacuation may be required due to fire. (i.e., the Control Room, Relay Room, or Ceiling of the 460V Switchgear Room) .

.Of the 65 valves evaluated 51 have been identified as being susceptible to the hot short conditions described in the Information Notice. The evaluation was found to conclude: "due to system/component redundancies, at SGS 1&2. failure of any one (emphasis added) of these valves would not preclude a post-fire safe shutdown condition." This conclusion appears to be based on the following PSE&G position which formed the basis ofits evaluation: "As stated previously, SGS 1&2 .

comply with requirements ofGL 86-iO Section 5.3.10 ... Based upon this guidance, this evaluation considers only one credible spurious vatve operation~ Therefore, plant operators would still be able 17

to achieve a safe shutdown condition through the use of independent and redundant components or systems."

5. 3 Conclusion Appendix R to 10 CFR 50 establishes the need to prote~ a minimum of one train of equipment and its associated circuits used to achieve and maintain hot standby from the effects of tire.

By letter dated April 20, 1982, the staff informed PSE&G of the need to analyze non-safety related a.Ssociated circuits to see that they meet the requirements of Section m.L of Appendix R and stated that associated circuits of concern must be isolated from alternative shutdown systems per the requirements of Section ill. G.2 or by suitable isolation devices. As described in the cases cited above, however, the licensee does not take any positive action, such as those described in the NRC's clarification of Generic Letter 81-12, to assure that spurious operations of redundant components will not affect safe shutdown capability.

As described in Section 2.2 above, the licensee's analysis for tire-induced spurious operations assumes that if cables of redundant components required for hot shutdown are located in the same fire area, only one of the redundant cables would be affected by the tire in a manner necessary to cause its cqnnected equipment to spuriously operate. This assumption, however, appears to be contrary to established regulatory requirements. In its response to Question 5.3.1 of Generic Letter 86-10 the NRC signifies the need to consider multiple spurious operations that may occur as a result of tire by stating that" valves could fail open or closed; pumps could fail running or not running ..."

(emphasis added to note NRC reference of plural nouns).

In support ofits position, the licensee states that its assumption of one spurious operation is based on its interpretation of the NRC response to Question 5.3.10 of GL 86-IO(a), which states:

"The safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area. " When viewed in isolation, it would appear that the response provided by the staff supports the licensee's position that only one spurious operation need be considered as a result of fire.. However, when both the Question and its Response are viewed in their entirety and in the context in which the question was asked, such an interpretation no longer appears valid.

In Section S of GL 86-10, the NRC provides responses to specific questions posed by the industry with regard to Alternative and Dedicated Shutdown Capability. More specifically, Question 5 .3 .10 requests the NRC to define the plant transients that mQst be considered in the design of the alternative shutdown system. Clearly, neither this question or its response would appear to be applicable to the evaluation of tires in areas which do not require an alternative shutdown capability.

Additionally, intrinsic in the NRC response to this question, is its assumption that the licensee has

. identified potential spurious equipment operations and has provided a suitable isolation capability, as described by the NRC in its clarification of GL 81-12 (i.e., use ofisolation/ transfer switches). If the alternative shutdown capability relies on the use of isolation/transfer switches to provide necessary degree of electrical .isolation from the tire affected area( s), there is a potential* for spurious operations 18

to occur prior to actuation of the isolating device. Therefore, response (a) to Question 5.3.10 indicates that the licensee must consider the occurrence of one spurious operation iJrlor to !solation of potentially affected circuits.

The NRC response to Question 5.3.10 (a) of GL 86-10 may be better illustrated by an example of how it has been found to be applied by other operating plants: (1) An analysis is performed to identify all potential spurious operations of concern within the fire area; (2) protection/isolation per GL 81-12 is provided to ensure that one train of systems required for hot shutdown will remain free of fire damage; (3) J'he safe shutdown capability for the area is evaluated considering (per GL 86-10) one spurious operation to occur which is random and independent of those previously evaluated and for which protection has been provided.

The licensee states that it has developed hot-shutdown repair procedures which provide guidance necessary for operators to isolate affected circuits and establish local control of components should they spuriously operate. However, as discussed in Section 1 of this report; it does not appear that the licensee's reliance on the performance of such hot-shutdown repair actions was ever fully.

approved by NRR. Additionally, it should be noted that due to man-power limitations and the complexity of required repair activities, this method of re-establishing control of affected shutdown

. systems may not be possible if more that one spurious actuation were to occur as a result of fire jn a given area.

Based on the results of our review, we conclude: (a) the licensee's does not satisfy the requirements of Section m.G. of Appendix R to 10 CFR 50; to the extent that redundant trains of equipment necessary to achieve and maintain hot shutdown conditions may be damaged by a single fire, and (b) The licensee's analysis for fire-initiated spurious signals is inconsistent with established staff positions promulgated Generic Letters 81-12, 86-10 and Information Notice.92-18 .

• 19

• 6. EVALUATION OF PSE&G REQUEST FOR RECONSIDERATION OF EXEMPTION FOR THE UPPER ELECTR!CAL PENETRATION AREA {FIRE AREAS 1AND2 FA-EP-lOOG) AND INNER PIPING PENETRATION AREA (FIRE AREAS land 2 FA-PP-lOOH). .

The BNL evaluation of the licensee's request for exemption was limited to a review of post-

. fire safe shutdown capability aspects. Fire prevention, suppression, and detection features, as well as the combustible loading of the subj~ct fire areas were not specifically addressed as part of this evaluation.

6.1 Discussion By letter dated January 4. 1991, Public Service Electric and Gas (PSE&G) requested the staff to reconsider its previous denial of an exemption to 10CFRSO, Appendix R, ID.G.2 for Fire Areas FA-EP-lOOG and FA-PP-I OOH of Units 1 and 2 of the Salem Generating Station. This exemption was previously requested on July 20, 1988 and denied via Safety Evaluation Report of July 20, 1989.

Specifically, PSE&G requested reconsideration of the NRC denial of an exemption from Section ill.G.2 to the extent that it requires the separation of redundant safe shutdown cables by I-hour rated fire barriers plus area-wide automatic suppression and detection. Fire Areas FA-EP-IOOG and 2 FA-PP-IOOH are not provided with automatic suppression systems and area-wide detection capability.

FA-EP-IOOG and FA-PP-IOOH are defined as the Upper Electrical Penetration Area and Inner Piping Penetration Area. For the. purpose of its Appendix R evaluation, Fire Areas F A-EP-1OOG and F A-PP-1 OOH of each unit have been combined and evaluated as one fire area.

The Upper Electrical Penetration Area contains:

(1) The IA (2B for Unit 2) Emergency Control Air Compressor, (2) Switchgear and Penetration Area Ventilation System Supply Fans and Filters, (3) Penetration Area Exhaust Fans, (4) 230v Vital Ventilation Control Centers, (5) Air Conditioniqg Control Panels, and (6) Chilled Water System Chillers, pumps and expansion tank.

The redundant Emergency Control Air Compressor is located in the opposite unit's Upper Electrical Penetration Area (Fire Area F A-EP-1 OOG). The walls, floors, and ceiling of this area are all constructed of reinforced concrete with a nominal fire rating of3-hours, as previously approved by the staff by Generic Exemption 1 - July 1989.

The Inner Penetration Area contains primarily piping and consists of two levels: the lower level ori Elevation IOOft. between the Mechanical and Upper Electrical Penetration Area, and the upper level on Elevation 120ft. above the Upper Electrical Penetration Area. The major piping systems in this area are the Main Steam and Main Feedwater, and supply and return air ducts for the 20

Switchgear and Penetration Area Ventilation Systems. The walls, floors, and ceiling of this area are of all coru.iructed reinforced concrete with a nominal fire rating of 3-hours, as previously approved by the staff by Generic Exemption I - July I989.

Safe Shutdown cables are located in the Upper Electrical Penetration area (Fire Area F A-EP-I OOG) of each unit. The Inner Piping Penetration Area -(Fire Area FA-PP-I OOH) does not contain any cables required for safe shutdown. Cables located within Fire Area F A-EP-I OOG of Unit I and 2, are associated with the following systems:

• Chilled Water

• Auxiliary F eedwater

• HVAC- Charging

• Fuel Oil Transfer

• HVAC-AFW

• Main Steam Isolation

. *HVAC-CCW

• Power Distribution

• HVAC-RHR

• Secondary Depressurization

• Air Supply Cables required for safe shutdown in the event of fire within Fire Area FA-EP-IOOG, have adequate separation or are protected by rated fire barriers. Specifically, protection of redundant cables has been provided by enclosing shutdown cables associated with shutdown Path A in a configuration of 3M Brand Interam E-50 (E-53A) Series Mat to obtain a I-hour fire rated barrier.

This path includes cable IRP65-AT required for #13 Charging Room Cooler and #I I Residual Heat Removal Room Cooler. No safe shutdown cables exist in fire area FA-PP- I OOH of either Unit I or

2. Therefore, no cables were protected in this area.

In lieu of protecting the air supply and associated chilled water cabling, the emerge~cy*control air system will be used to supply control air to each safety related pneumatic valve actuator needed to achieve shutdown during a fire. The Emergency Control Air System consists of two redundant air

• compressors that are located in the opposite unit's Upper Electrical Penetration Area. That is, the Emergency Control Air Compressor's (ECAC) for Unit I is located in Unit 2 Fire Area FA-EP-IOOG and the ECAC for Unit 2 is located in Unit I Fire Area F A-EP-1 OOG. These areas are separated by 3-hourrated fire barriers as approved in Generic Exemption I - July 1989. Additionally, the power and control cables of the redundant ECAC are not routed through the Upper Electrical Penetration Area (Fire Area F A-EP-1 OOG) of the opposite unit. The ECAC piping arrangement consists of two fully redundant control air headers routed throughout each unit which are capable of supplying redundant control air to each safety related pneumatic valve actuator needed to achieve shutdown during a fire.

6.2 Evaluation Fire Areas FA~EP-lOOG and FA-PP-IOOH of Units I and 2 are not in compliance with Section m.G.2 of Appendix R because redundant trains of safe shutdown cables are protected by a one-hour rated barrier and the areas are not provided with automatic suppression systems and area-wide detection capability. In addition, redundant Vital Vent Control Centers are located in FA-EP-21

• 1OOG of both units. Protection for redundant c~bles of concern has been provided by enclosing shutdovm cables associated with shutdown Path A in a configuration of 3M Brand Interam E-50 (E-53A) Series Mat-to obtain a 1-hour fire rated barrier. The redundant Vital Vent Control Centers are separated by greater than 35 feet with a negligible quantity of intervening combustibles. Although no automatic suppression is located in the fire area, partial area fire detection is present in both areas above major equipment and manual fire suppression equipment, consisting of portable fire extinguishers, is available for each area.

Fire AreaFA-PP-lOOH does not contain any cables required for safe shutdown. A fire in FA-EP-lOOG could affect redundant cable8 associated with the Air Supply System and the opposite unit's Emergency Control Air Compressor. However, if a fire were to occur in this area, the redundant Emergency Control Air Compressor, located in Upper Electrical Penetration area of the opposite unit, would be available to supply control air to each safety related pneumatic valve actuator needed to achieve safe shutdown during a fire.

• 6.3 Conclusion Based on the above evaluation, installing automatic suppression and area wide detection systems would not significantly increase reactor safety and, therefore, this exemption should Qe

. granted. ~

22

APPENDIX A DOCUMENTS REVIEWED NQ. DOCUMENT SUBJECT

1. PSE&G letter to NRC dated 11105/79 Fire Protection Program Cold Shutdown Capability Units 1 & 2

2. NRC letter to PSE&G dated 11120/79 Amendment 21 to Facility Operating License and Fire Protection SER

3. NUREG-0517 Supp. 5 dated 01181 Unit2 SER

4. NRC Generic Letter 81-12 dated Fire Protection Rule

. 02/20/81

~'

5. PSE&G letter to NRC dated 03/19/81 Salem Nuclear Station No. 1 and 2 UnitS

• 6. *NRC letter to PSE&G dated 04/20/81 Compliance With 10 CFR 50 Appendix R Fire Protection Program - Backfit Items Compliance With 10 CFR 50 Appendix R, Fire Prot.ection Program, For Salem Generating Station Units No. 1 and 2

7. PSE&G letter to NRC dated 04/22/81 Compliance With Appendix R - Item 111.L Nos. 1 and 2 Units Salem Nuclear Generating Station

8. NUREG-0517 Supp. No. 6 dated 05/81 Unit No. 2 SER

9. NRC Memo dated 05/11181 (copy to Summary of Meetings and Site Visit to PSE&G) Review the PSE&G Cable Interaction Study

10. PSE&G letter to NRC dated 05/14/81 Fire Protection Program No. 1 and 2 Units Salem Nuclear Generating Station (PSE&G response to NRC 'Summary of

• • Meetings to Review the PSE&G Cabl~

Interaction Study')

3:

NQ. DOCUMENT SUBJECT

11. NRG letter to PSE&G dated 05/20/81 Salem Nuclear Generating Station, Unit No. 2 - Issuance of Facility Operat4tg License DPR-75

12. NRC memo dated 06/04/81 (copy to Summary of Meeting Held on April 13, PSE&G) 1981 with the Licensee to Discuss the Design of the Alternate Shutdown Capabilities at Salem

13. NRC letter to PSE&G dated 07/10/81 Combined Inspection 50-272/81-12 and 50-311181-11

14. NRC letter to PSE&G dated 07/14/81 Combined Inspection 50-272/81-14 and 50-3ll/81-13

15. PSE&G Report dated 07117/81 . Salem Generating Station Units 1and2~.

Fire Protection Program, Safe Shutdown and Interaction Analysis

16. PSE&G letter to NRC dated 08/04/81 Fire Protection Program No. 1 and2 Units Salem Nuclear Generating Station (Exemption Requests)

17. PSE&G letter to NRC dated 09/18/81 Fire Protection Program No. l and 2 Units Salem Nuclear Generating Station (Final Report on 'Safe Shutdown and (~

Interaction Analyses')

18. PSE&G Report dated 09/81 Salem, Generating Station Units 1 and 2, Fire Protection Program, Safe Shutdown and Interaction Analyses (Volume 1)

19. PSE&G Report dated 09/81. Salem, Generating Station Units 1and2,

. Fire Protection Program, Safe Shutdown and Interaction Analyses (Volume 2)

20. PSE&G Report dated 09/81 Salem, Generating Station Units 1 and 2, Fire Protection Program, Safe Shutdown

. and Interaction Analyses (Volume 3)

• NQ.

21.

22.

DOCUMENT NRC letter to PSE&G dated 11/23/81 PSE&G letter to NRC dated 12/04/81 SUBJECT Inspection Nos. 50-272/81-26 and 50-311/81-26 Request For Exemption From Appendix R Requirements Units 1 and 2 Salem Nuclear Generating Station

23. NRC letter to PSE&G dated 02/02/82 Routine November 24 - December 31, 1981 Resident Safety Inspection

24. NRC letter to PSE&G dated 04/20/82 Fire Protection Rule - 10 CFR 50.48(c)(5)- Altemative Shutdown -

Section IIl.G.3 of Appendix R to 10 CFR 50 Salem Units 1 and 2

25. PSE&G memo dated 05/19/82 . Telephone Conversation With NRC On Fire Protection

26. PSE&G letter to NRC dated 06/16/82 Supplemental Report Safe Shutdown and Interaction Analyses Fire Protection Program Salem Generating Station Unit Nos. 1 and2

27. NRC memo dated 08117/82 Distributed NRC Memo of 07/02/82 to R.H. Vollmer from R.J. Mattson Re:

Position Statement on Allowable Repairs for Alternative Shutdown on the Appendix R Requirement for Time Required to Achieve Cold Shutdown (provided provisional guidance only)

28. NRC letter to PSE&G dated 09/16/82 . Salem Nuclear Generating Station, Unit Nos. 1and2, Fire Protection- Request Fol'. Exemption From Requirements Of Appendix R to 10 CFR 50, Section IIl.G

29. PSE&G lette;r to NRC dated 11101/82 Additional Information To Support Exemption Request To Appendix R,Section III For Salem Generation Station

NQ.

• DOCUMENT

• SUBJECT

30. PSE&G-letter to NRC dated 12/22/82 Additional Information Fire Protection Review Units 1 and 2 Salem Generating Station

31. NRC letter to PSE&G dated 03/31/83 Transmittal ofNRC Tis For Safe Shutdown Emergency Lighting and Oil Collection Requirements

32. NRC letter to PSE&G dated 05/31/83 Salem Nuclear Generating Station, Unit 2 Fire Protection Requirement Of Appendix R To 10 CFR 50, Section III.G.2

33. NRC letter to PSE&G dated 05/31/83 Fire Protection Rule - Alternate Safe Shutdown Capability- Sections 111.G.3 and 111.L Of Appendix R To 10 CFR 50-Salem Generating Station, Unit Nos. 1 and 2 (SER transmittal)

34. NRC letter to PSE&G dated 06/17/83 Salem Nuclear Generating Station, Unit No. 1, Fire Protection - Request For Exemption From Requirements Of Appendix R To 10 CFR 50, Section 111.G

35. NRC Internal Memo SECY-83-269 dated Fire Protection Rule For Future Plants 07/05/83 (SECY 82-267)

36. PSE&G Internal Memo dated 11/02/83 Salem Generating Station Fire Protection

- Appendix R Audit (Appendix R modification schedule)

37. Inspection and Enforcement Manual Inspection of Safe Shutdown Temporary Instruction 2515/62, Rev. 1, Requirements of 10 CFR 50, Appendix R dated 11/09/83 (Section 111.G) at Nuclear Power Plants Licensed to Operate Before January 1, 1979

38. PSE&G memo dated 11/17/83 Salem Generating Station Fire Protection

- Appendix R Audit (Modification Schedule)

NQ.. *DOCUMENT *SUBJECT

39. NRC letter to PSE&G dated 11/28/83 10 CFR 50 Appendix R Safe Shutdown Inspection - Salem 1

40. PSE&G internal memo dated 12/02/83 Salem Generating Station Fire Protection

- Appendix R Audit (Modification Schedule)

41. PSE&G internal memo dated 12/19/83 Salem Generating Station NRC Fire Protection Audit on January 16-20, 1984 (Audit Preparations)

42. PSE&G letter to NRC dated 01/27/84 Fire Protection Inspection Salem Generating Station Unit No ..1

43. NRC IE Information Notice No. 84-09 Lessons Learned From NRC Inspections dated 01/13/84 of Fire Protection Safe Shutdown Systems (10 CFR 50, Appendix R)

44. NRC letter to PSE&G dated 03/02/84 Inspection No. 5-272/83-37

45. PSE&G memo dated 03/23/84 Fire Protection - NRC Inspection On Appendix R Compliance Unit 1. Salem Generating Station 46.. NRC Generic Letter 85-01 dated Fire Protection Policy Steering 01/09/85 Committee Report (Generic Letter 85-01)

47. NRC letter to PSE&G dated 06/04/85 Combined Inspection Report Nos. 50-272/85-08 and 50-311/85-09

48. NRC memo SECY-85-306 dated StaffRecommendations Regarding the 09/17/85 Implementation of Appendix R to 10 CFR50

49. NRC memo dated 03/07/86 Staff Requirements - SECY 306/305B, "StaffRecommendations Regarding the Implementation of Appendix R to 10 CFR 50"

'~

-,1 NQ. DOCUMENT SUBJECT

50. NRC G~neric Letter 86-10 dated Implementation of Fire Protection

. 04/24/86 Requirements

51. NRC Inspection and Enforcement Postfire Safe Shutdown, Emergency Manual Inspection Procedure 64100 Lighting and Oil Collection Capability at dated 03/16/86 Operating and Near-Term Operating Reactor Facilities

52. NRC letter to PSE&G dated 01/26/88 Inspection Report No. 50-311/87-29

53. PSE&G memo SCI-89-0350 dated ATS Item No. GL 86-10, Task No. 0012 10/24/89 "Address Administrative Controls Applicable to Alternate. Shutdown Procedures" Salem Generating Station

54. NRC letter to PSE&G dated 02/07/90 Inspection Report Nos. 50-272/90-01; 50-311/90-01

55. PSE&G letter to NRC dated 01/04/91 Request for Reconsideration of Exemption - Fire Protection Appendix R

56. PSE&G letter to NRC dated 817/95 Answers to NRC Questions for Reconsideration of Appendix R Exemption Request

57. PSE&G letter to NRC dated 10/26/93 Engineering Evaluation of Control Room Evacuation for Fire-Induced MOV Hot Shorts (IN 92-18)

• APPENDIXB Detailed Synopsis of Documents Reviewed The foHowing licensing information, identified in Appendix B, was considered to be germane to the hot shutdown repairs and/or fire induced spurious signals (operations): *

1. The PSE&G letter to the NRC dated March 19, 1981 (Appendix A, document S) included the following information regarding the use of repairs to achieve and maintain safe

• shutdown conditions:

a. Page 2 discussion of the design description ofIIl.G.1 capabilities: "The design features and alternate shutdown capability do not require repair of damaged cold shutdown systems in order to maintain plant safety."

b. Page 8 discussion of the design description ofIIl.G.3 capabilities: "Operation of.

valves and pumps will be accomplished at local stations external to the fire zone,~

of interest. Procedures will be provided to describe the actions to be taken by

, operating personnel for local operation."

c.

• Page 9 discussion of the design description ofIII.G.3 capabilities: "Repairs within the fire zone are not required. Procedures will direct personnel actions to achieve cold shutdown external to the fire zone. Any repairs which could be made to allow control room operations or additional equipment operability would enhance shutdown capabilities."

2. NRC Generic Letter 81-12 dated February 20, 1981 (Appendix A, document 4) included the following information regarding allowed fire damage and post-fire repairs:

a. Page 2, paragraph 33.5: "The equipment and systems used to achieve and maintain hot standby conditions (hot shutdown for a BWR) should be (1) free of fire damage; (2) capable of maintaining such conditions for an extended time

. period longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the equipment required to achieve and maintain cold shutdown is not available due to fire damage; ... "

b. Page 2, paragraph 3.3.6: "The equipment and systems used to achieve and maintain cold shutdown conditions should be either free of fire damage or the fire damage to such systems should be limited such that repairs can be made and cold shutdown conditions achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />."

• 1

• 3.

4.

NRC letter to PSE&G dated April 20, 1981 (Appendix A, document 6) requested PSE&G to confirm PSE&G's commitments to Appendix R, Sections Ill.G and 111.L for Salem Units No. f and 2.

PSE&G letter to NRC dated April 22, 1981 (Appendix A, document 7) included the following commitment: "We confirm.our commitment to comply with Section III.Land believe that the Salem alternate shutdown capability, which will be described in our response to Generic Letter 81-12, meets the intent of this requirement."

5. NRC memo dated May 11,1981 (Appendix A, document 9) reported the NRC,.s review of PSE&G's cable separation study. Information related to fire damage and repairs were included in the memo.

a. Page 1objective2: "Make a finding on the adequacy of the corrective actions implemented as a result of the cable interaction program. These findings should concentrate on the adequacy of the fire protection measures on an interim basis.

The adequacy of the measures on a long term basis will be covered by the staff in its review of the licensee's compliance with App. R."

b. Page 13: "PSE&G uses standard functional operating procedures (Operating .

Instructionl-3.8, Maintaining Hot Standby, Operating Instruction 1-3.6, Hot Standby to Cold Shutdown) and Emergency procedures (Emergency Instruction 4.9, Blackout) augmented by Appendices which detail alternative methods of system operation. Explicit instructi6ns for alternative operational methods are provided in a single document, indexed by system, which provides specific local operating procedures for each valve, motor, or component which may be required to be operated in order to achieve cold shutdown or to correct a mis-operation precipitated by fire damage. Each type of local operating instruction was reviewed by the team to confirm technical adequacy. Actual operation of a 4 KV motor, a 460 V motor, a motor operated valve, and an air *operated valve were demonstrat~d using these procedures. Local start of a diesel generator was reviewed for technical adequacy based on a drawing review. Demonstration of this capability was deferred until PSE&G completes a design change in progress to provide alternate control power at each diesel control center. The procedure presently requires pulling temporary cable to provide this alternative."

c. Page 13 and 14: "The aspects of the alternate. shutdown procedure that should be

• corrected are: ..... - Most local operating instructions require the use of special equipment or tools. These items are specifically identified in the procedure but have not been pre-staged in a defined location. These items include hand tools, pneumatic jumpers, prepared electrical jumpers, and diesel control power cables."

6. NUREG-0517 Supplement 6 dated May 1981 (Appendix A, document 8) provided 2

information upgrading the Safety Evaluation Report for Salem Unit 2.

a. Page 9-2: "The results of the on-site review were based upon approximately a fifty percent audit of the licensee's fire interaction analysis. All identified deficiencies were related back to specific basic assumptions arid criteria used by the licensee in the fire interaction analysis. 11

b. Page 9-3: "In SER Supplement No. 5, we stated that the alternate shutdown capability to achieve hot shutdown from outside the control room is now ..

operational. .... Subsequently we have found that the capability referred to did not include adequate consideration of fire damage, which necessitated the license conditions listed at the end of this section."

c. Page 9-4: "On this basis we conclude that Salem Unit 2 is acceptable for full power operation subject to license conditions listed below which will assure the timely completion ofrequired modifications: ... b.(3) Provide for pre-staging of the special equipment or tools required by local operating procedures. These.

items include hand tools, pn~umatic jumpers, prepared electrical jumpers, and diesel control power cables."

d. Page 9-6, paragraph 1: "PSE&G shall review its Fire Interaction analysis for any; additional areas impacted by the assumptions and criteria identified in the NRC review team's report as being inconsistently applied or with which the team did not concur. 11

• 1~ NRC letter to PSE&G dated May 20, 1981 (Appendix A, document 11) transmitted Salem Unit No. 2 Facility Operating License. The license directed PSE&G to take the following corrective action for deficiencies associated with the alternative shutdown capability:

a. Page 8, paragraph (iii): "Provide for pre-staging of the special equipment or tools required by local operating procedures. These items include hand tools, pneumatic jumpers, prepared electrical jumpers, and diesel control power cables."

b. Page 10, paragraph (12): "PSE&G shall review its Fire Interaction analysis for any additional areas impacted by the assumptions and criteria identified in the NRC review team's report as being inconsistently applied or with which the.team did not concur."

8. NRC letter to PSE&G dated June4, 1981 (Appendix A, document 12) identified two major differences in opinion between the licensee and the NRC:

a. "The first difference was that the licensee believed that the installed alternative 3

• b.

shutdown system meets the requirements of §IIl.G.3 and did not need to be evaluated against the criteria of §III.L."

"The second difference centered around the licensee's plan to complement the capabilities of an augmented remote control panel with dedicated and roving operators at other local stations."

At the conclusion of a meeting with the licensee, the staff informed the lice.nsee: "The

.installed alternative shutdown system does not satisfy the conceptual designs that were .

approved in the staffs SER of November 20, 1979, and appears to be unacceptable."

Additionally, the staff directed the licensee: "The licensee should submit a more detailed description of the installed alternative shutdown system in response to the Eisenhut letter of February 20, 1981 (Appendix A,. document 4). This response should give the staff as much information as is available to justify the acceptability of substituting personnel and procedures for 'hard-wired' control systems with transfer switches."

9. NRC letter dated July 10, 1981 (Appendix A, document 13) forwarded inspection reports to PSE&G as enclosure 1. Page 17 of enclosure 1 included the following fire protectio11o review comments:

a. . "The licensee's evaluation and modifications to provide adequate independence **

for redundant safe shutdown equipment and cable are incomplete."

b. "The review team concluded that fire protection measures currently in place are adequate for continued operation of Salem Unit 1 and for the issuance of a full power license for Salem Unit 2 with the understanding that corrective actions delineated in the Safety Evaluation Report will be implemented on a schedule subject to further staff approval."

10. NRC letter dated July 14, 1981 (Appendix A, document 14) forwarded resident inspector reports to PSE&G as enclosure 1. Page 20 of enclosure I reported the following: "The inspector witnessed the control room evacuation, establishment of control from the hot shutdown panel, control of the. transition to hot standby, maintenance of hot standby conditions for one hour and remote local operation of a fan coil unit, a service water pump, a service water valve and a diesel generator using procedures developed as a result of fire hazards analysis. The inspector observed effects of local control of charging from the control rooin." The report does not include information that allows the reviewer to determine if the procedures for local operations included repairs (i.e. use of electrical or pneumatic jumpers, fuse pulling, etc.).

11. PSE&G Interim Fire Protection Program Safe Shutdown and Interaction Report dated July 17, 1981 (Appendix A,. document 15) provided PSE&G's response to Generic Letter 81-12. The following specific information from the report was evaluated:

.4

. a. Page49: "It was originally intended that the plant operators would attempt shutdown from the control room. For functions that might become inoperable d?.le to a-fire, an alternate shutdown method would be used. Procedures were developed to accomplish individual functions (pump start/stop operation, valve open/close operation, diesel operation, etc.) for use by the operator as necessary.

Each function has its own specific procedure. A description of the procedures is provided in Section Vl.C.

The plant operating staff shall determine the appropriate method for achieving safe shutdown based on an assessment of plant conditions. Each postulated fire_

and its consequences are unique and no single fire shutdown scenario can be postulated. Operating flexibility is considered paramount for safe operation during any fire. More than one method was considered and procedures were developed to operate redundant equipment in the event of failures. The alternate shutdown procedures are incorporated into the station operating pro~edures as described in Section VII.A."

b. Page 54: "A postulated fire in the relay ropm could necessitate shutdown from the control room or external to the control room~ The procedural methodology requires that personnel be stationed at various locations to effect hot standby an&

to address contingent activities. These areas are the auxiliary feedwater pump .;

room, charging pump area, 4 l 60V and 460V switchgear rooms, and the diesel generator room. Roving personnel would be used to perform one-time manipulations of selected valves at motor control centers, instrument panels or at the valves and to provide system status information. Sufficient time exists for these activities to accomplish hot standby.

Hot standby would be maintained before deciding on actions to bring the plant to cold shutdown until the fire consequences and plant conditions are assessed.

Additional personnel would be used for proceeding to cold shutdown.

Repairs within the postulated fire zone are not required. The procedures are sufficient to direct personnel actions for cold shutdown external to the postulated fire zone. Any repairs which could be made to permit control room operations or to provide additional equipment operability would enhance shutdown capabilities.

These decisions would be made by operating and technical personnel following an assessment of fire damage."

c. Page 55: "The procedures are written in a manner which directs the operator in a step-by-step progression to achieve the intended goal. All of the necessary information has been included in each instruction so that the individual performing the action does not need to search out referenc,e material or equipment.

Tue instructions are written with the assumption that the individual performing

• 5

t '

the action possesses limited technical ability."

• d. Page 57: 2CC215, excess letdown heat exchanger CCW supply isolation valve, is identified as a component reqllired to achieve hot shutdown conditions.

e. Page 60: .21SWl7, 21 header tie valve, is identified as a component required to achieve hot shutdown conditions.

f. Page 63: 2A diesel generator is identified as a component required to achieve hot shutdown conditfons.

g. Page 65: This page contains the procedure (local operating instructions) for manipulating 2CC215. The pieces of equipment required to perform this procedure are listed as: "Screwdriver (for valve closure), Pneumatic Jumper (for valve opening), and Tools and fittings for pneumatic jumper installation (for valve opening)."

The procedural operating instructions were listed as follows:

"CAUTION: Electrical circuits may be energized.

CLOSE: AtPnl. 743 Disconnect wire onPt. #1 of terminal block TB2 which goes to SV-688. (Terminal block TB2 is in the upper right comer of panel.

Wire to be disconnected is on left side of terminal block. The corresponding wire on the right side is Wire #3.)

OPEN: AtPnl. 743

1. Close manual valve in control air line which supplies SV-688.

2. Disconnect control air lines on both sides of SV-688.

3. Install pneumatic jumper across control air supply line for SV-688 and control air line 14490-A (those lines which were disconnected).

4. Open manual control air valve which was closed in step 1."

h. Pages 66: This page contains the procedure (local operating instructions) for 6

• manipulating 21SW17. The pieces of equipment required to perform this procedure are listed as:

1.

2.

Screwdriver Fusepuller

3. Jumper wire with spade lugs (12")

4. 2-l 5a, l l 5v Cartridge Fuses" The procedural operating instructions were listed as follows:

"OPEN: 1. AtPan3F

a. Trip ckt. bkr. at pan door to deenergize circuitry and allow door opening.

b. Remove cable trough cover to right of pan.

c. Remove control circuit fuses and discard.

d. At terminal block, disconnect la. Wires on terminal #4 (right hand side wires only) lb. Wires on terminal #2 (right hand side wires only)

e. At terminal block, jumper:

la. Terminal points #5 and #12 (install jumper on left hand side of terminal block) * .

f. Install new control circuit fuses."

1. Pages 83 and 84: These pages contain the procedure (local operating instructions) for restoring control power for the 2A diesel generator. The pieces of equipment required to perform this procedure are listed as:

"l. Voltage Tester

2. Screwdriver 7

t *

3. Connecting Power Cable (2)

4. - Electrical Tape."

The procedural operating instructions for control power restoration are listed as follows:

"I. At Engine Control Panel:

a. Remove wires (4) on right side of terminal points CPI, CP2~ CPS

.and CP6 in the engine control panel and tape.

b. Connect terminals of the emergency connecting power cable to these terminals:

Wire 1 to terminal point CPS (+)

Wire 2 to terminal point CP6 (-)

Wire 3 to terminal point CPI (+)

Wire 4 to terminal point CP2 ( - )

c. Route emergency connecting power cable to the No. 2 ASDS 125 VDC Distr. Panel (Elev. 64, 4KV SWOR Room).

, 2. At Exciter Cubicle (Diesel Room) EC:

a. Remove and tape wires 1 and 2 on right side of terminal points CP3 and CP4 on terminal block TSS (left side of panel).

b. Connect terminals of the emergency connecting power cable (2C#2) to terminals:

Wire 1 to tei-minal point CP3 (+)

Wire. 2 to terminal point CP4 ( - )

c. Route emergency connecting power cable to the No; 2 ASDS 12S VDC Distr. Panel (Elev. 64, 4KV SWOR Room).

3. At No. 2 ASDS 12S VDC Distr. Panel:

a. Open rear door of panel.

b. Connect terminals of the emergency connecting power cable to circuit breakers 6, 7 and 8 terminals:

8

ii.. *.,

' r *

• 1. Cable from ECP Wire 1 to terminal point 1 (+) breaker 6 Wire 2 to terminal point 2 (- ) breaker6 Wire 3 to terminal point 1 (+) breaker?

Wire 4 to terminal point 2 ( - ) breaker 7

2. Cable from EC - replace breaker 8 with 50 amp .

Wire 1 to terminal point 1 (+) breaker 8

• Wire 2 to terminal point 2 (- ) breaker 8" J. Page 107: PSE&G's response to a Generic Letter 81-12 request for information was provided as follows:

"No transfer switches are used for the alternate shutdown capability under

• postulated fire conditions. The instrumentation added for hot standby is independent of existing process and protection system instrumentation. All other equipment required for shutdown will be lo*cally operated at the device. Some physical modifications may be required for certain devices such as jumpers, removal of wires, and deenergizing control P<?Wer. The alternate shutdown method and modifications are described in Sections VI.B and VI.C. The alternate shutdown method is essentially procedural and under administrative control.

Restoration of equipment and circuitry to original* conditions following the use of these procedures is an administratively controlled action."

k. Page 109: PSE&G's response to a Generic Letter 81-12 request for information was provided as follows:

"The power sources needed for alternate shutdown, the dedicated somce for new instruments and switchgear and motor control centers for required devices are not located in the postulated fire zone needing alternate shutdown methods. The control circuit cables used for remote control of circuit breakers and motor cpntactors from the control room are routed through the postulated fire zone.

These cables can be identified on the cable block diagrams of Section IV.C. Each control circuit is provided with isolation protection via either circuit breakers or fuses."

• 9

' t *

• 1. . Page 110: P3E&G's response to a Generic Letter 81-12 request for information was* provided as follows:

"The alternate shutdown procedures call out the need for special equipment to effect the particular function. Fuses are required to be replaced as part of the procedure if the potential exists for them to be blown by the effects of the fire. No checks are made; the fuses are replaced to assure* operability. Actions are also taken by the operator to prevent the new fuses from being blown as part of the procedure. Spare fuses are available to accomplish these actions. The potential effects of blown control circuit fuses have been addressed in*the alternate shutdown capability and procedures."

m. Page 111 : PSE&G's response to a Generic Letter 81-12 request for information was provided as follows:

"The alternate shutdown procedures have been checked and verified to attest to techni.cal accuracy and equipment accessibility for local operation. A sample of the procedures was checked to verify local operation of equipment during the NRC Audit at Salem on 4/20/81 - 517/81. Equipment was also successfully operated using these procedures during the Startup Test for Shutdown From Outside Control Room (SUP 82.5) in accorruince with the license requirement for Unit 2. Although the actual tests were only performed on Unit 2, the alternate shutdown procedures are similar for both Units.

There are no transfer switches for remote/local control utilized for the alternate shutdown capability for postulated fires." .

n. Page 112: PSE&G's response to a Generic Letter 81-12 request for information was provided as follows: *

"No repairs or modifications are required in the postulated fire zone to effect cold shutdown utilizing the alternate shutdown procedures. All activities are external to this area.

The procedures provide direction for any modifications needed to accomplish each function. The equipment is readily available at a central area or prestaged at the actual location."

o. Page 114: PSE&G's response to a Generic Letter 81-12 request for information 10

L-' ' )

• y )

was provided as follows:

"The need to provide a listing or drawing showing all these cables is not warranted since associated control circuits are provided isolation via circuit breakers or fuses. These circuits are electrically protected from the required fire shutdown circuits by at least a breaker or fuse. The system is eclectically coordinated and in compliance with the separation criteria established for Salem.

Furthermore, the alternate shutdown procedures provide explicit direction to the operator on how to prevent misoperations and to be isolated from the postulated fire zone equipment and cables."

p; Page 115: PSE&G's response to a Generic Letter 81-12 request for information was provided as follows:

"Misoperations that may occur during the time frame from fire initiation until the implementation of the alternate shutdown procedure will not adversely affect plant safety since correctiv~ action can be taken."

12. PSE&G letter to the NRC dated September 18, 1981 (Appendix A, document 17) forwarded the final Interim Fire Protection Program Safe Shutdown and Interaction Report dated September 1981 and inchlded PSE&G's final response to Generic Letter 81-12.

13.

• NRC letter to PSE&G dated April 20, 1982 (Appendix A, document 24) provided specific responses to PSE&G's responses to Generic Letter 81-12 as contained in

.PSE&G's letter to the NRC dated September 18, 1981 (Appendix A; document 17). The following excerpts from the NRC's direction to PSE&G are germane to this evaluation:

a. Enclosure 1, paragraph 4: "We are concerned that non-safety related associated circuits can sustain fire damage that can affect alternative shutdown circuits and thereby prevent post-fire alternative safe shutdown. Our concern includes power, control arid instrumentation alternative safe shutdown circuits. The licensee should analyze all non-safety related associated power, control and instrumentation circuits to see that they meet the requirements of Seetion IIl.L of*

Appendix R. This means that they are identified as associated circuits so that they can be evaluated; and that they are isolated from alternative shutdown systems by the fire protection means listed in Section IIl.G.2 or by suitable *isolation devices."

b. Enclosure 2, paragraph 1: "The licensee's alternative shutdown procedure requires installation of electrical jumpers and pneumatic bypasses. It is our position that systems and components used to achieve and maintain hot standby 11

conditions must be free of fire damage and capable to maintain such conditions for the duration of the hot standby conclition. Systems and components used to achieve and maintain cold shutdown should be either free of fire damage or the fire damage to such system should be limited such that repairs can be made and cold shutdown achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Repair procedures for cold shutdown systems must be developed and material for repair maintained onsite. It is our position that electrical or pneumatic jumpers are not a suitable method of repair

. for cold shutdown."

c. Enclosure 3, Clarification of Generic Letter, Attachment 2, Safe Shutdown Capability, page 2, included: "Alternative shutdown equipment m~ be independent of the cables, equipment and associated circuits of the redundant systems damaged by the fire."

14. PSE&G letter to the,NRC dated June 16, 1982 (Appendix A, document 26) provided a response to the NRC's letter of April 20, 1982 (Appendix A, document 24) and supplemented PSE&G's September 1981 Safe Shutdown and Analyses Report. The following responses were reviewed:

• a. NRC Item 4, page 5: "We are concerned that non-safety related associated circuits can sustain fire damage that can affect alternative shutdown circuits and thereby prevent post-fire alternative safe shutdown. Our concern includes power, control and instrumentation alternative safe shutdown circuits. The licensee should analyze all non-safecy related associated power, control and instrumentation circuits to see that they meet the requirements of Section III.L of Appendix R. This means that they are identified as associated circuits so that they can be evaluated; and that they are isolated from alternative shutdown systems by the fire protection means listed in Section 111.G.2 or by suitable isolation devices."

• PSE&G Response, pages 5 and 6: "During the May 14 meeting, PSE&G representatives reviewed information related to the Salem plant electrical system design and identification of associated circuits. Tlie stated concern for power, control, and instrumentation safe shutdown circuits has been considered in the origllial interaction analysis. All circuits, including non-safety related associated circuits, have been identified and evaluated for potential affects of fire damage to determine compliance with Appendix R, Section IIl.L as appropriate.

Cabling external to the relay room and control room which was determined to be necessary for shutdown was identified and analyzed for compliance with Section 111.G.2 of Appendix Ras described in report Sections III - V. Cable block diagrams, tables, and physical cable routing drawings include identification of the 12

~ .......... '

j*

-=--

associated circuits. The Salem design uses a suffix in the cable identification to indicate the channel separation for Class IE and associated circuits. The IE suffixes are A, B, C and D. Their respective associated circuits are H, E, F and G.

During the May 14 meeting, PSE&G personnel also described the circuit breaker provisions included in the Salem electrical distribution system. All associated control and instrumentation circuits are protected by at least three coordinated circuit breakers. There are no associated power circuits.

These provisions had been previolisly accepted by the NRC Staff as isolation devices which comply with Section 111.G.2 *of Appendix R."

b. NRC Item 1, page 8: "The licensee's alternative shutdown procedure requires installation of electrical jumpers and pneumatic bypasses. It is our position that systems and components used to achieve and maintain hot standby conditions must be free of fire damage and capable to maintain such conditions for the duration of the hot standby condition. Systems and components used to achieve and maintain cold shutdown should be either free of fire damage or the fire damage to such systems should be limited such that repairs can be made and cold shutdown achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Repair procedures for cold shutdown systems must be developed and material for repair maintained onsite. It is our position that electrical or pneumatic jumpers are not a suitable method of repair for cold shutdown."

PSE&G Response, pages 8 and 9: "The alternative shutdown procedures used at Salem do not require the use of electrical jumpers or pneumatic bypasses to achieve hot shutdown conditiollS. Manual operation of the steam-driven auxiliary feedwater pumps, associated valves, and the steam generator relief valves provides hot shutdown capability for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Seal inje~tion flow is established automatically by operation of any one of three charging pumps.

After approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the plant can _be maintained in a hot shutdown condition even if spurious operations of equipment occur since the alternate shutdown procedures provide a mechanism to disconnect control circuits from

• -potential fire induced damage at any time during the shutdown is necessary.

It should be noted that the term "electrical jumpers" as used in this response, .

refers to a hard-wired connection of spade lugs to teriillnals which is tantamount to a permanent installation until such time as any damaged equipment can be replaced.

As stated above, neither electrical jumpers nor pneumatic bypasses are required to

• 13

J_,

....

• 1

.I-')

achieve and maintain hot shutdown for approximately eight hours.

On May 14, 1982, the NRC Project Manager verbally requested additional information related to this topic. A list identifying all valves required for hot and cold shutdown conditions, and the valves' backup operating mechanisms were requested. The following lists identify valves associated with the shutdown conditions. No more than a limited number of valves can be affected by a given fire and require the use of alternate shutdown procedures. The valves' functions can be reviewed by consulting Section Ill.C of the "Safe Shutdown and Interaction Analyses" report. All motor operated valves are equipped With handwheels, but the existing alternate shutdown procedures indicate a preference for the use of electricaljumpers."

15. NRC letter to PSE&G dated May 31, 1983 (Appendix A, document 33) forwarded Salem Generating Station Units 1 and 2 Safety Evaluation Report For Appendix R To 10 CFR 50, Items 111.G.3 and Ill.L. The following excerpts from the SER were included in the evaluation:

a. SER pages 1 and 2: "The licensee has described the post fire shutdown capabilitt for the Salem facility in submittals dated September 1981 and in letters dated {

March 19, August 4~ and December 4, 1981. The September 1981 submittal alsd addressed the Staffs concerns engendered by the NRC site audit and SER of May 1981. Additional information and clarification was obtained from a June 16, 1982 a

response to staff request for additional information, through telephone conferences of December 16, 1981 and October 20, 1982, and a May 14, 1982 meeting With the licensee.

The licensee has provided a safe shutdown analysis for a fire event, and has demonstrated that adequate redundancy and/or an alternative safe shutdown method exist for those systems required to assure safe shutdown. No repairs or modifications are required to effect hot or cold shutdown utilizing the alternate shutdown methods."

b. SER pages 3 and 4: "The alternate shutdown method will be accomplished by procedural means, with actions performed at local shutdown stations or locaily at the equipment. The licensee has also provided a summary of the functions for which alternate shutdown methods may be needed, and the manual actions required to accomplish each of the identified functions have been described."

c. SER page 5: "The alternate shutdown methods have the capability of achieving cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a fire event and no repairs are planned in 14

order to achieve cold shutdown cor1ditions."

d. SER page 7: "The devices whose inadvertent operation- by spurious signals could adversely affect safe shutdown have been identified. Methods of protecting the safe shutdown capability are consistent with the severity of tb:eir effects. The licensee has evaluated the effects of the spurious operation of reactor coolant pressure boundary valves and has provided assurance that either the power to the valves will be removed during normal plant operations to prevent _spurious -

operation, (i.e., at the RHR system hi/low pressure interface) or that operator intervention of a spurious operation which can cause delayed effects, can be performed within a time frame which does not compromise safe shutdown capability."

16. NRC letter to PSE&G dated March 2, 1984 (Appendix A, document 44) reported the results of an inspection with respect to compliance with the requirements of Appendix R, Section IIl.G. The inspection report contained the. following information related to hot_ ,~

shutdown repairs and fire induced spurious signals (operations):  ;

a. Pages 16 and 17 of the Inspection Report: "The scope of the review was to ascertain that the alternate shutdown could be attained in a safe and orderly manner, to determine the level of difficulty involved in operating equipment, and to verify that there was no dependence on repairs for achieving hot shutdown. For purpose of the review, a repair would include installing electrical or pneumatic*

jumpers, wires or fuses to perform an action required for hot shutdown. As a:

result of the review, the following items related to repairs for hot shutdown were identified:

The procedure for local start-of any of the three diesel generators requires many _

manipulations at terminal boards within various cabinets., The inanipulations include removing wires from terminal points and reconnecting to other terminal points. Since the diesel generators are required to maintain hot standby, the team concludes that the procedures for local start of diesel generators are unacceptable since the procedures include what the NRC considers repairs. Since only one diesel generator is required to maintain hot standby conditions, more than likely the use of repairs could be avoided. However, since the equipment required for a normal local or remote start of all three diesel generators is located within one fire area (relay room), local start of at least one diesel generator independent of the _

relay room and without repairs must be provided."

b. - Page 18 of the Inspection Report: "This item relates to the inabilJ.ty of the 15

_,.fl

-~

procedures to ensure that support systems, mainly CCW to the charging pumps and senice water to th~ cliesel gen~rators would be locally operated by the emergency procedures if the system requiring support had to be locally started.

Otherwise, the support system may be lost at a later time due to a fire progressing in the relay room resulting in damage to the system requiring support since the loss of the support system may go initially undetected."

c. Page 20 of the Irispection Repprt: "In general, the licensee relies on operating procedures to isolate circuits where spurious signals could cause false operations or give erroneous instrumentation readings. This was found to 1?e satisfactory exc~pt in the case of the diesel generator controls where inadequate isolation has been determined. Since the procedures provide the means of isolation of associated cifcuits, the unresolved items related to the procedures could have spurious signal concerns and should be analyzed for such concerns while

• resolving those items."

17. Inspection and Enforcement Manuat Inspection Procedure 64100, Issued March 16, 1987 (Appendix A, document 51 ), page 10, paragraph (f) reads: "The three assumptions of ;

Appendix R Question and Answer 5.3.10 are meant for independent use (that is, only one assumption applies for any given configuration in a reactor plant). These assumptions are therefor consistent with the established NRR review practice ofrequiring licensees to analyze for any and all spurious actuations or failures where no such spurious actuations or failures occur simultaneously."

The guidance contained in paragraph (f) is fundamental to the analysis of fire induced spurious signals (operations). Any fire may have multiple fire induced failure modes that may occur in a random manner. It is unreasonable to analyze for every feasible simultaneous combination of possible fire induced failures; likewise it is unreasonable to expect that a fire will induce only a single failure. The NRC's inspection procedure 64100 addresses the problem of multiple fire induced failures by requiring.protection for single fire induced failures one at a time (except for.the hi/low pressure interface concern), not simultaneously (i.e., a given fire scenario may have multiple failures .

considered one at a time).

18. NRC letter to PSE&G dated January 26, 1988 (Appendix A, document 52) reports an inspection conducted to verify compliance with the requirements of 10 CFR 50, Appendix R, Section IIl.G, J, Land 0 concerning fire protection features to ensure the ability to achieve and maintain safe shutdown in the event of fire. Page 11 of the inspection report contained the following: "The team in observing* the operators perform*

some steps in the procedure determined that some of the operator actions are repairs by NRC definition and, therefore, are not allowed during the hot shutdown phase. The 16

repairs in question involve the use of pneumatic jumpers to prevent spurious actuation of valves. The licensee explained that an alternative to the use of pneumatic jumpers exists in the procedure but using the jumpers is the preferred way. The licensee also explained that the NRC has specifically reviewed the use of jumpers and has found it acceptable."

19. NRC letter to PSE&G dated February 7, 1990 (Appendix A, document 54) contained the following information on page 7 of the enclosed inspection report:

"Pertaining to pertinent documentation confirming previous NRC approval of the use of jumpers in achieving a timely and orderly shutdown outside the control room.

• Documentation was provided confirming NRC review of the post-fire shutdown capability for the Salem facility. An NRC letter to the licensee, dated May 31 ~ 1982 addresses the additional information and clarification obtained in licensee letters to the NRC dated June 16, 1982 and December 22, 1982. The NRC determined that the licensee had demonstrated that adequate redundancy and/or an alternative safe shutdown method eXists for those systems required to assure safe shutdown.

Supplemental information was provided. by the licensee in the June 1982 safe shutdown~

• and interaction analysis included in enclosure 2 on the use of electrical and pneumatic :

jumpers in the licensee's alternate shutdown procedures. In addition, the licensee developed a valve list for long-term hot shutdown and/or preparation for cold shutdown (8 to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) which identifies the valve procedures* indicating a preference for the use of electrical jumpers. The lic.ensee's Procedure 1(2) AOP-EVAC-2 for "Abnormal Operating Procedures" addresses the use of individual valve procequres as applicable m

when maintaining the unit Hot Standby or taking the unit to cold shutdoWn due to a fire in the control room or a fire in the relay room."

• 17