ML18102A915

Forwards Safe Shutdown Capability Reassessment for Plant Units 1 & 2 & Technical Evaluation Rept

ML18102A915
Person / Time
Site:	Salem
Issue date:	03/17/1997
From:	Stolz J NRC (Affiliation Not Assigned)
To:	Eliason L Public Service Enterprise Group
Shared Package
ML18102A916	List: ML18102A915 ML18102A918
References
TAC-M87879, TAC-M87880, NUDOCS 9703210005
Download: ML18102A915 (18)

Text

,P'

~o~Wfl('L UNITED STATES

o~ J.-7

J../o 1 \\

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555--0001 March 17, 1997 Mr. Leon R.

Elia~on Chief Nuclear O_fficer & President Nuclear Business Unit Public Service Electric and Gas Company Post Office Box 236 Hancocks Bridge, NJ 08038

SUBJECT:

SAFE SHUTDOWN CAPABILITY REASSESSMENT FOR SALEM NUCLEAR GENERATING STATION, UNITS 1 AND 2 (TAC NOS. M87879 AND M87880)

Dear Mr. Eliason:

Over the past several years, the staff has conducted inspections, meetings, and corresponded with Public Service Electric and Gas Company (PSE&G) on the subject of Safe Shutdown capability. Examination of a staff endorsed Technical Evaluation Reportj dated January 25, 1996, identifies that the subject of Safe Shutdown capability has received considerable attention since original licensing. Notwithstanding the history of this matter, it is appropriate to communicate the staff's position and bring issues associated with Safe Shutdown to closure prior to restart of the Salem plant.

NRC Region I requested that the Office of Nuclear Reactor Regulation (NRR) provide technical assistance with the resolution of two issues identified during the fire protection and post-fire safe-shutdown inspection at Salem on May 17-21, 1993 and July 19, 1993.

The following summarizes the two issues:

1.

During the 1993 inspection, the NRC staff found that the Salem alternative shutdown methodology (used in the event of a fire that causes the evacuation of the control room) relied on repairs to provide electrical independence from the affected fire area (e.g., the control room or the cable spreading room) and to restore the operability of equipment needed to achieve hot shutdown.

2.

In its associated circuit analysis, PSE&G evaluated spurious signals and equipment operations.

However, it is the NRC staff's understanding that Salem assumed that only one spurious operation could result from a fire in any fire area, regardle~s of the number of u~protected circuits present in the area.

During the 1993 inspection PSE&G indicated that the analysis was consistent with the guidance provided in Generic Letter (GL) 86-10, "Implementation of Fire Protection Requirements," dated April 24, 1986.

During the May 1993 inspection, the NRC questioned PSE&G's interpretation of the GL 86-10 guidance.

From its review, the staff concluded that the alternative shutdown system design at Salem does not meet the requirements of Section III.G.3 and.

Section III.L of Appendix R to 10 CFR Part 50 in that it relies on procedures that direct operators to perform numerous complex repair activities, such as lifting and cutting electrical leads, installing electrical jumpers, and removing fuses in order to isolate potentially fire-affected circuits and 9703210005 970317 PDR ADOCK 05000272 P

PDR

\\

,L L. Eli as on regain control of post-fire hot shutdown equipment.

In addition,-certain safe shutdown equipment used by the alternative shutdown system was not adequately isolated from the associated circuits in the fire area. Fire-induced hot shorts, open circuits, or shorts to ground in these circuits could have prevented the operation of required safe-shutdown equipment.

The staff also concluded that because of these design weaknesses, there is not reasonable assurance that the minimum and limited shutdown functions controlled by the alternative shutdown system can be performed as required by Section III.L, paragraphs 1 and 2, of Appendix R.

Therefore, the staff finds that the Salem Nuclear Generating Station, Unit 1, is not in compliance with the alternative shutdown system requirement of Appendix R and Unit 2 is not in compliance with its Operating License, Condition 2.C.10.

In addition, in a letter to PSE&G dated January 25, 1996, the staff concluded that Salem does not satisfy the requirements of Section 111.G of Appendix R.

Enclosed is the staff~s evaluation of the above issues and its conclusions regarding Salem's compliance with NRC fire protection regulatory requirements.

Brookhaven Natfonal Laboratory (BNL), the staff's technical assistance contractor, reviewed PSE&G's submittals associated with the actions taken to resolve these iss~es. BNL's Technical Evaluation Report, Revision 1, dated January 23, 1997, is appended to the staff report.

The staff concurs with BNL's conclusions.

The modifications described in PSE&G's.letters dated June 19 and December 2, 1996, were relied upon by the staff during our review.

PSE&G committed to implement certain modifications to resolve the post-fire alternative shutdown system design concerns.

PSE&G committed to install isolation transf~r switches for the required safe-shutdown functions controlled by the alternative shutdown system and to modify the control circuits for certain motor-operated valves (MOVs) in order to eliminate the concern about hot-short spurious operation damage.

For Unit 2, PSE&G committed to complete MOV circuit modifications for 20 hot-standby valves and to install the remaining service water system isolation transfer switches during the next refueling outage (refueling outage 10). The subsequent letter of February 18, 1997, proposed compensatory measures for Unit 2 until modifications could be implemented by the next refueling outage.

The staff had concerns regarding the proposed compensatory measures.

However, it is our current understanding, based on discussions between senior PSE&G staff and NRC management, that PSE&G now intends to implement the above necessary modifications prior to restart of either unit.

I, L. El i as on If our understanding is incorrect please contact our project manager, Mr. Leonard Olshan on (301) 415-1419.

Sincerely,

/S/

John F. Stolz, Director Project Directorate 1-2 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation Docket Nos. 50-272/311

Enclosure:

As stated cc w/enclosure:

See next page DISTRIBUTION:

JStolz SVarga LMarsh RZimmerman Docket File MO'Brien JZwolsinki PMadden PUBLIC LOlshan ACRS, TWF PDI-2 Reading OGC, 0-15818 WPasciak, RI LNicholson, RGN-1 Jlieberman

• SEE PREVIOUS CONCURRENCE Lqh f:.1Kri_f;}--;-/17 OFFICE '-i'.PDl-2/PM d~iM fJh

,P~/ 1vl~

NAME Yl ~LOlshan:cw Ud;a~/e(r/

DATE 3 I P*\\;97 1

'J'A~97 OFFICE P,OJ-2/D DRPE/Db*

NAME J~ JZwolinski DATE

. ~/I~ /97 03/12/97 OFFICIAL RECOR~ COPY DOCUMENT NAME:* SA87879.LTR o~

/

Jli~man

/; /9]\\

DRPE/D*

SVarga 02/28/97 SPLB RGN-:-1

• 11 LMarsh

~--

n ')

02/27/97 ADP*

RZimmerman 03/13/97 3 j( 4;97 v

C.o!J t,tJ'T( Kf-o'.V 81 '@

blf 9 orJfl

?:>/1rrl~1

Mr. Leon R. Eliason e Public Service Electric & Gas Company cc:

Mark J. Wetterhahn, Esquire Winston & Strawn 1400 L Street NW Washington, DC 20005-3502 Richard Fryling, Jr., Esquire Law Department ~ Tower SE 80 Park Place Newark, NJ 07101 Mr. D. F. Garchow General Manager - Salem Operations Salem Generating Station P.O. Box 236 Hancocks Bridge, NJ 08038 Mr. Louis Storz Sr~ Vice President - Nuclear Operations Nuclear Department P.O. Box 236 Hancocks Bridge~ New Jersey 08038 Mr. Charles S. Marschall, Senior Resident Inspector Salem Generating Station U.S. Nuclear Regulatory Commission Drawer 0509 Hancocks Bridge, NJ 08038 Dr. Jill Lipoti, Asst. Director Radiation Protection Programs NJ Department of Environmental Protection and Energy

.CN 415 Trenton, NJ 08625-0415 Maryland Office of People's Counsel 6 St. Paul Street, 21st Floor Suite 2102 Baltimore, Maryland 21202 Ms. R. A. Kankus Joint Owner Affairs PECO Energy Company 965 Chesterbrook Blvd., 63C-5 Wayne, PA 19087 Mr. Elbert Simpson Salem Nuclea~enerating Station, Units 1 and 2 Richard Hartung Electric Service Evaluation Board of Regulatory Commissioners 2 G~teway Center, Tenth Floor Newark, NJ 07102 Regional Administrator, Region I U. S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 Lower Alloways Creek Township c/o Mary 0. Henderson, Clerk Municipal Building, P.O. Box 157 Hancocks Bridge, NJ 08038 Mr. David R. Powell, Manager Licensing and Regulation Nuclear Business Unit P.O. Box 236 Hancocks Bridge, NJ 08038 Mr. David Wersan Assistant Consumer Advocate Office of Consumer Advocate 1425 Strawberry Square Harrisburg, PA 17120 P. M. Goetz MGR. Joint Generation Atlantic Energy 6801 Black Horse Pike Egg Harbor Twp., NJ 08234-4130 Carl D. Schaefer External Operations - Nuclear Delmarva Power & Light Company P.O. Box 231 Wilmington, DE 19899

_ Public Service Commission of Maryl and Engineering Division Chief Engineer 6 St. Paul Centre Baltimore, MD 21202-6806 Senior Vice President - Nuclear Engineering Nuclear Department P.O. Box 236 Hancocks Bridge, New Jersey 08038

t *.

0.

L. Eli as on If our understanding is incorrect please contact our project manager, Mr. Leonard Olshan on (301) 415-1419.

Docket Nos. 50-272/311

Enclosure:

As stated cc w/enclosure: See next page Sincerely, 7/d Stolz~~'Jr J t Directorate I-2 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation

EVALUATION OF TECHNICAL ISSUES RELATED TO THE POST-FIRE SAFE-SHUTDOWN CAPABILITY OF THE SALEM NUCLEAR GENERATING STATION, UNITS 1 AND 2 FIRE PROTECTION ENGINEERING SECTION

1.0 BACKGROUND

PLANT SYSTEMS BRANCH DIVISION OF SYSTEMS SAFETY AND ANALYSIS OFFICE OF NUCLEAR REACTOR REGULATION On May 17-21, 1993. U.S. Nuclear Regulatory Commission (NRC) Region I conducted a fire protection and post-fire safe shutdown inspection at Salem Nuclear Generating Station. Units 1 and 2 (Salem).

The Office of Nuclear Reactor Regulation CNRR) participated in the inspection.

In a memorandum to Steven Varga, Director. Division of Reactor Projects I/II.

NRR. dated October 5. 1993. Richard W. Cooper. Director. Division of Reactor Projects. Region I. submitted a proposed Task Interface Agreement (TIA) and requested that NRR help resolve two alternative shutdown system issues i dent i fi ed during the inspection. The fo 11 owing summarizes the two issues:

a.

During the May 1993 inspection. the NRC staff found that the Salem alternative shutdown methodology (used in the event of a fire that causes the evacuation of the control room) relied on repairs to provide electrical independence from the affected fire area (e.g.. the control room or the cable spreading room) and to restore the operability of equipment needed to achieve hot shutdown.

b.

In its associated circuit analysis. Public Service Electric & Gas Company (PSE&G). the licensee for Salem. evaluated spurious signals and equipment operations. However. the licensee assumed that only one spurious operation could result from a fire in any fire area. regardless of the number of unprotected circuits present in the area. The licensee claimed that its analysis was consistent with the guidance provided in Generic Letter (GL) 86-10. "Implementation of Fire Protection Requirements." dated April 24. 1986. During the May 1993 inspection.

the NRC questioned the licensee's interpretation of the GL 86-10 guidance.

By letters dated August 2 and October 26. 1993. the licensee submitted

_additional information regarding the unresolved inspection items and its review of Information Notice ON) 92-18. "Potential for Loss of Remote Shutdown Capability During a Control Room Fire." for staff review.

In these submittals. the licensee stated its position that the technical concerns identified by IN 92-18 exceeded the original Salem design requirements for -

post-fire safe-shutdown capability.

In res-ponse to the Region I TIA. the NRR staff reviewed Sa 1 em* s 1 i cens i ng basis as it relates to post-fire alternative shutdown capability and the associated analysis.

By letter dated January 25. 1996. NRR forwarded its report "Safe Shutdown Capability Reassessment for Salem Nuclear Generating Station. Units 1 and 2" to the licensee. This was a Technical Evaluation

.\\

Report CTER) prepared by Brookhaven National Laboratory CBNL). the staff's technical assistance contractor.

On the basis of this TER. the staff concluded that the.Salem alternative shutdown system and methodology did not satisfy the regulatory requirements of Sections III.G and III.L of Appendix R to 10 CFR Part 50.

On February 7. 1996. the staff met with the licensee to discuss its concerns about the alternative shutdown system and the licensee's reliance on plant repairs in order to achieve and maintain hot shutdown.

By letter dated June 19. 1996. the licensee submitted a formal response to the staff's letter of January 25. 1996. and the meeting on February 7. 1996.

By letter dated October 30. 1996. the staff requested the licensee to provide certain clarifications and additional information relating to the elimination of hot shutdown repairs. fire-induced spurious signals; and the assurance that equipment or components needed for post-fire safe shutdown are not adversely affected by fire-induced circuit failures.

By letter dated December 2. 1996. the licensee committed to install isolation transfer switches which will eliminate the use of electrical jumpers. the lifting leads and the replacement of fuses as a method for achieving post-fire safe shutdown.

For Unit 1. the licensee committed to complete MOV circuit modifications and to install isolation transfer switches prior to restart.

For Unit 2. the licensee committed to complete MOV circuit modifications for 20 hot-standby valves and to install the remaining service water system isolation transfer switches during the next refueling outage (refueling outage 10). The licensee did not propose interim compensatory measures for the Unit 2 alternative shutdown design weaknesses nor did it describe how it will mitigate the potential adverse consequences of fire-induced hot shorts on the MOVs in question.

BNL. the staff's technical assistance contractor. reviewed the licensee's submittal dated December 2. 1996.

BNL's reviewed the technical adequacy of the actions the licensee took to resolve the TIA issues.

BNL's TER is included as an appendix to this report. The staff concurs with BNL's conclusions.

2.0 EVALUATION OF UNRESOLVED TECHNICAL ISSUES 2.1 Alternative Shutdown System Design Reliance on the Use of Repairs To Achieve and Maintain Hot Shutdown and its Related Licensing History Section III.G.l.a to Appendix R of 10 CFR Part 50 requires that fire protection features be provided for structures. systems. and components important to safe shutdown. These features shall be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot-shutdown conditions from either the control room or emergency control station(s) is free of fire damage.

In addition. Sections III.G.l.b and III.L.5 of Appendix R to 10 CFR Part 50 establish the criteria for cold-shutdown system repairs. Repairs (e.g.. cutting or lifting leads. installing jumpers or new wires. pulling and replacing fuses) of post-fire safe-shutdown systems required for achieving and maintaining hot-shutdown or hot-standby are not allowed.

In addition. the licensee would have to demonstrate that fire-induced faults in electrical circuits such.as hot shorts. shorts to ground. or open circuits would not cause maloperation or prevent the operation of a required safe-shutdown component.

In the event the licensee's analysis cannot demonstrate that one -train of systems necessary to achieve and maintain hot shutdown remains free of fire damage (e.g.. a fire in the control room). the provisions of Sections III.G.3 and III.L of Appendix R would be imposed.Section III.G.3. states:

"Alternative or Dedicated shutdown capability and its associated circuits independent of cables. system. or components in the area. room. or zone under consideration shall be provided: (a) Where the protection of systems whose function is required for hot shutdown does not satisfy the requirement of paragraph G.2 of this sections." Appendix R.Section III.L.. "Alternative or Dedicated Shutdown." paragraph 3. requires that the equipment and components that comprise the alternative shutdown system be both physically and electrically independent of the area of concern (e.g.. the control room and the cable spreading room).

In addition. Appendix R.Section III.L.7. requires that the associated circuits in the fire-affected area of concern be isolated from safe-shutdown equipment and systems so that hot shorts. shorts to ground.

or open circuits in the associated circuit will not prevent the operation of the shutdown equipment.

To provide reasonable assurance that the cabling required for or associated with the alternative shutdown capability is physically and electrically separated from (i.e.. independent of) the effects of fire in either the control room or the cable spreading room. alternative shutdown system designs incorporate the use of isolation/transfer switches. These devices enable the plant operators to manually and systematically transfer control and/or monitoring of-required shutdown equipment and functions to an area of the plant that is physically and electrically independent of the fire-affected area of concern.

The original alternative shutdown system design at Salem did not incorporate the use of isolation/transfer switches. Rather. the licensee's shutdown methodology relied on abnormal operating procedures that directed operators to perform repairs as necessary to isolate potentially affected circuits and to establish local control and monitoring capability for required shutdown systems.

During the initial licensing of Salem Unit 2. the staff had accepted the use of repairs on an interim basis during the plant's startup testing program.

In its May 1981 safety evaluation report CNUREG-0517. Supplement No. 6. "Safety Evaluation Report Related to the Operation of Salem Nuclear Generating Station. Unit No. 2." and its Report on PSE&G Cable Separation Study, which was included as Attachment G to the May 1981 SER). the staff approved this approach as a short-term temporary measure. with long-term compliance pending future staff review.

-In a memorandum dated June 4. 1981. a copy of which was forwarded to the licensee. the staff summarized the meeting held on April 13. 1981. with the licensee to discuss the design of its alternative shutdown capability. The staff in this memorandum stated that the installed alternative shutdown system does not satisfy the designs that were approved by the staff. The staff requested the licensee to submit a more detailed description of this system ----I

and indicated that this response should justify the acceptability of substituting manual actions and repair procedures for a hard-wired control system with transfer switches.

In its submittal of July 17. 1981. the

• licensee provided its response to this request and indicated that its alternative shutdown design did not use transfer switches. that some physical modifications may be required to restore equipment circuitry to its original condition. and that these actions are administratively controlled.

On September 18. 1981. the licensee submitted its final interim fire protection program safe-shutdown and interaction report to the staff for review. The staff completed its review of this report and documented its results in its letter to the licensee dated April 20. 1982. The staff concluded that the licensee should analyze all non-safety-related associated power. control. and instrumentation circuits to ensure that they meet the requirements of Section III.L of Appendix R and that they are isolated from the alternative shutdown systems by the fire protection measures listed in Section III.G.2 or by suitable isolation devices.

In its letter. the staff also indicated that the licensee's alternative shutdown procedure requires

• installation of electrical jumpers and pneumatic bypasses and that these repair actions were not acceptable. It was the staff's position that systems and components used to achieve and maintain hot-standby conditions must be free of fire damage.

In addition. the staff stated its position regarding alterative shutdown equipment and the necessity for this equipment to be independent of the cables. equipment. and associated circuits of the redundant systems damaged by the fire.

In its submittal of June 16. 1982. the licensee informed the staff that its alternative shutdown procedures for Salem did not require the use of electrical jumpers or pneumatic bypasses.

On the basis of this submittal. the staff stated in its SER of May 31. 1983. that "no repairs or modifications are required to effect hot or cold shutdown utilizing the alternate shutdown methods."

In addition. in its SER. the staff recognized that the alternative shutdown method used would be accomplished by procedural means. with actions being performed at local control stations or locally at the equipment.

The staff also noted that this method could achieve cold-shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire without the need for plant repairs.

By letter dated March 2. 1984, the NRC staff provided the results of its Appendix R compliance inspection of Salem Unit 1. During this inspection. the NRC staff concentrated on determining the overall acceptability of* the alternative shutdown capability design by conducting a sample audit of the design and related procedures. This audit included verification that there was no dependency on repairs for achieving hot shutdown. This inspection revealed that hot-shutdown repairs were required for local start of the emergency diesel generator. The staff concluded that these repairs were unacceptable.

In a letter dated January 26. 1988. the NRC-staff provided the*

licensee with the results of its Appendix R compliance inspection of Salem Units 2.

During this inspection. the NRC inspection team observed the operators performing some of the steps in.the alternative shutdown procedure_

and determined that some of the operator actions involved repairs. The repairs involved the use of pneumatic jumpers to prevent spurious actuations of valves. The acceptability of hot-shutdown repair activities was an unresolved item.

The staff. in its letter dated January 25. 1996, provided the licensee with BNL's TER which addressed the technical issues associated with this unresolved item.

During the May 17-21. 1993. NRC Appendix R compliance inspection of Salem Units 1 and 2. the NRC staff confirmed that in lieu of providing an isolation transfer switch capability.in the design of the alternative shutdown system.

Salem operators are procedurally directed to perform numerous complex repair activities. These included lifting and cutting electrical leads. installing electrical jumpers and removing fuses in order to isolate potentially fire-affected circuits and to regain control of post-fire safe-shutdown equipment.

The inspection team considered this inspection item to be unresolved.

By letters dated August 2 and October 26. 1993. the licensee submitted additional information regarding the unresolved items from the May 1993 inspection and its review of IN 92-18. "Potential for Loss of Remote Shutdown Capability During a Control Room Fire." for staff review.

In response to the Region I TIA. the Fire Protection Engineering Section (FPES). Plant_Systems Branch. Division of Systems Safety and Analysis. NRR.

reviewed Salem's licensing basis as it relates to the post-fire alternative shutdown capability and the associated analyses.

By letter dated January 25. 1996. NRR forwarded the BNL TER. "Safe Shutdown Capability Reassessment for Salem Nuclear Generating Station. Units 1 and 2." to the licensee. The TER included a review of Salem's licensing basis with respect to Sections III.G and III.L of Appendix R to 10 CFR Part 50.

On the basis of this review. the staff concluded that the Salem alternative shutdown system and methodology did not satisfy the regulatory requirements of Sections III.G and III.L of Appendix R to 10 CFR Part 50. Specifically, the staff concluded that: (1) the staff did not accept as permanent compliance strategy the post-fire alternative shutdown system design reliance on repairs to achieve and maintain hot-standby conditions: (2) the licensee's assumption of one spurious operation per fire event is not consistent with established staff guidance and does not satisfy the regulatory requirements of Sections III.G and III.L of Appendix R to 10 CFR Part 50. and (3) the licensee's evaluation and disposition of staff concerns described in IN 92-18 are not consistent with established staff guidance and do not satisfy the regulatory requirements of Sections III.G and III.L of Appendix R to 10 CFR Part 50.

On February 7. 1996. the staff met with the licensee to discuss the three issues described above.

At this meeting. the licensee characterized its perspective of the above issues and described evaluations and design changes being implemented at Salem to address these concerns.

By letter dated June 19. 1996. the licensee submitted a formal response to the staff's letter of January 25. 1996. and the meeting on February 7. 1996. The staff reviewed this response and determined that clarifications were needed before it could complete its review.

By letter dated October 30. 1996. the NRC staff requested additional information concerning the licensee's actions to eliminate the use of repairs to achieve and maintain hot standby: the plant's ability to cope with and mitigate fire-induced spurious signals: and the plant's ability to ensure that equipment or components needed for post-fire safe shutdown are not adversely affected by fire-induced hot shorts.

By letter dated December 2. 1996. the licensee provided its response to the request for additional information. The licensee has committed to ensure electrical independence of the post-fire alternative safe-shutdown functions from the control room and to eliminate the need to perform post-fire safe-shutdown repairs by installing isolation transfer switches for the required alternative shutdown equipment and components.

In addition. the licensee has evaluated the adverse impact fire-indu~ed hot shorts could have on the plant's post-fire alternative shutdown capability to perform its intended function.

The licensee has determined that the thermal overload protection CTOL) was adequate for certain shutdown-related MOVs to protect them against mechanical valve damage, thus maintaining their ability to be manually manipulated by plant operators. The licensee determined that other MOVs could be damaged by a fire-induced hot short. The licensee committed to perform wiring/control circuit logic modifications for these valves. These modifications will preclude fire-induced hot shorts from initiating a spurious signal that would initiate valve movement and bypass the valve's torque and limit switches. thus preventing mechanical valve damage.

2.2 Analysis Assumptions Pertaining to the Plant's Ability to Cope With Fire-Induced Spurious Signals During the May 1993 inspection. the NRC staff concluded that the licensee's associated circuit analysis did not adequately consider *the potential adverse affects of fire-initiated spurious signals caused by hot shorts. shorts to ground. or open circuits on the plant's ability to achieve and maintain safe shutdown.

Appendix R.Section III.G. "Fi're Protection of Safe Shutdown Capability,"

paragraph 1.a. requires that "one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) [be] free of fire damage."

In addition.Section III.G.

paragraph 2, requires that "where cables or equipment. including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts. open circuits. or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area." a means be provided for ensuring that one train of the redundant safe shutdown trains is free of fire damage.

The safety concerns associated with fire-induced hot shorts. open circuits. or shorts to ground in safe shutdown and associated circuits. which could prevent operation or cause maloperation of redundant shutdown trains. were predicated on the conditions that occurred during the Browns Ferry fire of March 25. 1975. (

Reference:

NUREG-0050. "Recommendations Related to Browns Ferry Fire," February 1976.)

Generic Letter (GL) 86-10, "Implementation of Fire Protection Requirements,"

dated April 24. 1986, provided an interpretation of the term free of fire damage.

Interpretation 3. "Fire Damage.-" of Enclosure 1: *"Interpretations *of Appendix R," of GL 86-10, states: "the Commission has provided methods acceptable for assuring that necessary structures. systems and components are.

free of fire damage (see Sections III.G.2.a. b, and c). that is. the structure. system. or component under consideration is capable of performing its intended function during and after the postulated fire as needed."

Where redundant safe-shutdown trains are susceptible to fire damage.

Appendix R.Section III.G. paragraph 3. states that "alternative or dedicated shutdown capability and its associated circuits. independent of cables.

systems. or*components in the area. room. or zone under consideration shall be provided." Appendix R.Section III.L. "Alternative or Dedicated Shutdown Capability," paragraph 1. specifies that "the alternative and dedicated shutdown capability provided for a specific fire area shall be able to (a) achieve and maintain subcritical reactivity conditions in the reactor:

(b) maintain reactor coolant inventory: (c) achieve and maintain hot standby for a PWR [pressurized-water reactor] (hot shutdown for a BWR [boiling-water reactor]): (d) achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. and (e) maintain cold shutdown conditions thereafter."

Appendix R.Section II I. L. paragraph 3. states: "The shutdown capability for specific fire areas may be unique for each such area. or it may be one unique combination of systems for all such areas." In addition. this paragraph specifies in pa rt that "the a 1 ternat i ve shutdown capability sha 11 be independent of the specific fire area(s)."Section III.L. paragraph 7.

states. "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts. open circuits. or shorts to ground in the associated circuits wi 11 not prevent the operation of the safe shutdown equipment,"

In Enclosure 3 of GL 81-12, "Fire Protection Rule." dated February 20. 1981.

the staff stated. "In evaluating alternative shutdown methods. associated circuits are circuits that could prevent the operation or cause the maloperation of the alternative train which is used to achieve and maintain hot shutdown conditions due to the fire-induced hot shorts. open circuits. or shorts to ground." The guidance of GL 81-12 recognized that a fire is capable of inducing multiple hot shorts. shorts to ground. or open circuits.

Therefore. in order for the alternative shutdown capability to perform its intended function. the equipment that it relies on must be capable of performing its functions after it has been electrically isolated from the fire area of concern (e.g., the control room and the cable spreading room). If there is a potential for required post-fire safe-shutdown components to be damaged by fire-induced faults before electrical isolation at local control stations outside the control room. then there is not reasonable assurance that the alternative shutdown capability would be able to perform its intended function.

In its original post-fire safe-shutdown methodology analysis for Salem. the licensee assumed only one spurious actuation as a result of fire in any area.

regardless of the number of unprotected circuits that may be susceptible to fire damage and the potential for this damage to cause spurious operation or maloperation of safe-shutdown equipment. This assumption is not supported by either engineering judgement or the requirements Sections III.G or I1I.L of_

Appendix R.

To the contrary. Appendix R requires that: (1) any and all hot shorts. open circuits. shorts to ground in cables that could prevent operation or cause maloperation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions within the same fire area be identified and the appropriate fire protection be provided such that one train of hot shutdown systems remains free of fire damage, or (2) the safe shutdown J

equipment and systems for each fire area be isolated from associated non-safety circuits so that hot shorts.. open circuits. or shorts to ground will not prevent operation of the safe shutdown equipment.

• The licensee based its single spurious actuation or signal assumption on its interpretation of the NRC staff response provided to Question 5.3.10. "Design Basis Plant Transient." of GL 86-10.

To limit the scope of the equipment needed to meet the reactor performance goals of Section IIl.L of Appendix R.

this guidance specified the plant transient that should be considered in determining the design capacity and the capabilities of the alternative or dedicated shutdown system and established the design input limits for the reactor coolant inventory loss. flow diversion affecting systems needed to perform the reactor coolant makeup function. and onsite power sequencing logic. The plant transient specified in GL 86-10 was as follows:

Loss of offsite power shall be assumed for a fire in any fire area concurrent with the following assumptions:

a.

The safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area: and

b.

The safe shutdown capability should not be adversely affected by a fire in any fire area which results in the loss of all automatic function (signals. logic) from the circuits located in the area in conjunction with one worst case spurious actuation or signal resulting from the fire: and.

c. The safe shutdown capability should not be adversely affected by a fire in any plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line.

The staff intended that licensees would use this guidance to determine the capacity and capability of the alternative or dedicated safe-shutdown system (e.g.. sizing of pumps and the support systems needed to maintain reactor coolant inventory, define the scope of onsite electrical power distribution and power needs. establish an operational baseline and a set of plant conditions that would define the scope of initial manual actions needed to restore those systems necessary to accomplish the required reactor performance goals). Application of this staff guidance is based on the alternative -

• shutdown system: (1) being physically and electrically independent of the fire area of concern: and (2) being isolated from associated circuits so that hot

$harts. shorts to ground. and open circuits in these circuits will not prevent the operation of safe shutdown equipment or components.

The ability to isolate fire-damaged circuits from the control room. mitigate spurious actuations. and ensure functionality of safe-shutdown equipment after its transfer of control to the remote shutdown stations and emergency control stations is also supported by the responses the staff made to other Gl 86-10 questions.

In its response to Question 3.8.4. "Control Room Fire Considerations." the staff provided guidance regarding the level of control room damage conditions and the capability to ensure that safe shutdown can be J

maintained from outside the main control room.

The staff stated: "The damage to the systems in the control room cannot be predicted. A bounding analysis should be. made to assure that safe shutdown conditions can be maintained from outside the control room." In addition. this response stated: "The analysis should demonstrate that.the capability exists_ to manually achieve safe shutdown conditions from outside the control room by restoring ac power to designated pump~. assuring that valve lineup~ are correct. and assuming that any malfunction~ of valve~ that permit the loss of reactor coolant can be corrected before unrestorable conditions can occur" (emphasis added).

The staff's response to this question clearly acknowledged-that the fire will induce signals that will cause operational changes (e.g.. valves changing position) to the plant.

In its response to Question 5.2.1. "Shutdown and Repair Basis." of GL 86-10.

the staff addressed post-fire shutdown and repair procedures. The staff stated "Safe shutdown capabilities including alternative shutdown capabilities are all designed for some maximum level of fire damage (system unavailabilities. spurious actuations). Since the extent of the fire cannot be predicted. it seems prudent to have the post-fire shutdown procedures guide the operators from full system availability to the minimum shutdown capability." In this response. the staff indicated that fire damage can cause multiple system unavailabilities and spurious system or component actuations.

and that methods for restoring the needed system and mitigating spurious actuations should be documented in a procedure.

In its response to Question 5.3.1. "Circuit Failure Modes." of GL 86-10. the staff answered the following industry question:

"What circuit failure modes must be considered in identifying circuits associated by spurious actuations?"

The staff's response stated: "Sections III.G.2 and III.L.7 of Appendix R define the circuit failure modes as hot shorts. open circuits. and shorts to ground.

For consideration of spurious actuations. all possible functional failure states must be evaluated. that is. the component could be energized or deenergized by one or more of the above failure modes. Therefore. valve~

could fail open or closed: pump~ could fail running or not running; electrical breaker~ could fail open or closed" (emphasis added).

In this response. the staff made it clear that multiple spurious actuations caused by fire-.induced hot shorts. shorts to ground. or open circuits must be considered and evaluated. The staff's response indicated that components could be energized or deenergized by hot shorts. shorts to ground or open circuits and could result in valves failing open or closed: pumps failing running or not running, and so on.

The intent of this staff response was to ensure that licensees performed analyses of sufficient depth to determine the adverse impacts of hot shorts. shorts to ground. or open circuits on safe-shutdown-related control circuits and their associated logic (e.g., spurious pump start without injection or minimum-flow path: spurious opening or closings of MOVs by signals that bypass the valve's pr~tective features).

In its letter of June 19. 1996. the licensee stated that it had reanalyzed all fire areas for which it applied the single spurious actuation assumption.

For areas other than those requiring alternative shutdown capability, the licensee concluded that the cabling in each application either met separation requirements. was adequately protected. or its function for the component(s) served would not lead to spurious actuations. and. therefore. dependence on the single spurious actuation assumption was not necessary.

With regard to its application of the single spurious actuation assumption in areas requiring an alternative shutdown capability, the licensee's position is that its interpretation of GL 86-10. Question 5.3.10. that is. that only one spurious operation needs to be assumed. is correct. For the reasons stated above. it is the staff's position that the licensee's interpretation is not correct.

Despite its stated position. the licensee has reevaluated the alternative shutdown systems needed to achieve and maintain hot-standby conditions.

In its letter of June 19. 1996. the licensee stated that it had developed a design change to install isolation/transfer switches.

By letter dated December 2. 1996, the licensee indicated that it had completed the isolation transfer switch modifications on Unit 2 for the hot standby equipment and that it would complete the Unit 1 modifications before restart. In addition. as a result of its spurious actuation reanalysis, the licensee committed to install isolation transfer switches for certain service water valves related to maintaining cooling water for the emergency diesel generator.

For Unit 2. the licensee committed to install the remaining service water system isolation transfer switches during the next refueling outage (refueling outage 10). The licensee did not propose interim compensatory measures for the Unit 2 alternative shutdown design weaknesses nor did it describe how it will mitigate the potential adverse consequences of fire-induced spurious operations of the service water MOVs in question.

2.3 Evaluation and Disposition of NRC Concerns Regarding the Potential for Loss of Remote Shutdown Capability Following a Control Room Fire (IN 92-18)

On February 28. 1992. the. NRC issued IN 92-18. "Potential for Loss of Remote Shutdown Capability During a Control Room Fire." to alert licensees of conditions that could result in a loss of ability to maintain the reactor in a safe-shutdown* condition in the event of a control room fire. Specifically, IN 92-18 alerted licensees to the potential for a control room fire to cause an electrical short circuit between normally energized conductors and conductors associated with the control circuitry of MOVs required to achieve and maintain post-fire safe-shutdown conditions from outside the main control room.

Such an event could cause the valve to spuriously actuate. Because of the location of the circuit fault. the MDV torque and limit switches could be ineffective in stopping valve operation. Additionally, TOL protection has been bypassed at some facilities. Given these conditions. there is a potential for a fire-initiated spurious valve actuation to result in mechanical damage sufficient to prevent reactor operators from manually operating the affected valve. Such fire-induced damage could adversely affect the ability to achieve and maintain safe shutdown.

During the May 1993 Appendix R inspection. the licensee stated that the conditions described in IN 92-18 were not credible. Therefore. it did not perform an evaluation.

By letter dated October 26. 1993. the licensee forwarded to the staff for review its response to IN 92-18 in a document titled: "Engineering Evaluation of Salem Generating Station. Units 1 and 2.

Control Room Evacuation for Fire-Induced MDV Hot Shorts as Discussed in NRC l

Information Notice 92-18," dated August 20. 1993. This evaluation identified 65 valves needed to support the control room evacuation procedure and the safe shutdown analysis.

As part of its evaluation. the licensee reviewed the schematics and wiring diagrams for the 65 valves to determine which cables associated with the valves were routed in areas in which control room evacuation may be required in the event of a fire.* Of the 65 valves. the licensee found that 51 were susceptible to the hot-short conditions described in IN 92-18.

However. the licensee concluded that "due to system/component redundancies at Salem Generating Station. Units 1 and 2. failure of any one of these valves would not preclude a post-fire safe-shutdown condition."

The licensee predicated its disposition of this concern on the basis of its interpretation of the staff guidance contained in GL 86-10.

As detailed in Section 2.2 above. the licensee had assumed that the evaluation of the post-fire alternative shutdown capability need only consider one spurious valve actuation. irrespective of the number or the post-fire shutdown significance of the potentially affected circuits. This interpretation of its evaluation of issues described in IN 92-18 led the licensee to conclude. without technical justification. that only 1 of the 51 potentially affected valves would spuriously actuate.

During the meeting of February 7. 1996. the licensee described a design change to prec 1 ude mechani ca 1. va 1 ve damage by rei nsta 11 i ng the previous 1 y bypassed TOL protection on certain MOVs. In its letter dated June 19. 1996. the licensee stated that this modification resolved for Salem the issues identified in IN 92-18. and that the TOL protection for these MOVs had been installed.

By letter dated October 30. 1996. the staff requested that the licensee describe the methodology and criteria it used to ensure that the TOL protection was properly sized and that it would adequately protect the subject MOVs from mechanical damage.

The staff also asked the licensee to verify that tripping of the TOL protection devices would not render the subject MOVs inoperable. and that after the MOVs are electrically isolated. they can be operated remotely from emergency control stations located outside the control room.

In a letter dated December 2. 1996. the licensee provided the results of its MOV evaluation and confirmed that MOVs protected by TOLs can be reset (at their respective motor control centers [MCCsJ) and.controlled locally.(from their respective MCCs) after their control circuits have been isolated from the fire-affected area of concern by their isolation/transfer switches.

During its TOL review. the licensee identified 13 hot-standby valves that had marginal values for motor torque capability at full voltage versus the valve assembly torque limit and 7 valves whose TOLs do not fully provide motor

• protection.

In its letter of December 2. 1996. the licensee committed to modify the control circuits for these valves.

The proposed circuit modification will prevent a hot short from bypassing the limit and torque switches.

For Unit 1. the licensee committed to complete MOV circuit modifications and to install isolation transfer switches prior to restart. For Unit 2. the

_licensee committed to complete MDV circuit modifications for 20 hot-standby valves and to install the remaining service water system isolation transfer switches during the next refueling outage (refueling outage 10). The licensee did not propose interim compensatory measures for the Unit 2 alternative shutdown design weaknesses nor did it describe how it will mitigate the

. potential adverse consequences of fire-induced spurious operations of the MOVs in question.

3.0 CONCLUSION

Section 111.G.1.a of Appendix R to 10 CFR Part 50 requires that fire protection features be provided for structures. systems and components important to safe shutdown. It also requires that these features be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot-shutdown conditions from either the control room or emergency control station(s) is free of fire damage.

In the event that it cannot be demonstrated that one train of systems necessary to achieve and maintain hot shutdown remains free of fire damage, compliance with the provisions of Sections 111.G.-3 and 111.L *of Appendix R would be required.

In order to meet the requirements of Section 111.L of Appendix R. the alternative shutdown system and its post-fire hot-shutdown components must perform their intended function without reliance on repairs.

In addition.. fire-induced faults in electrical circuits. such as hot shorts. shorts to ground. or open circuits shall not cause the maloperation or prevent the operation of a required safe-shutdown component.

The regulatory requirements and the guidance of GL 81-12 and GL 86-10 recognize that it is necessary to provide electrical independence for the alternative shutdown system and its post-fire safe-shutdown components and that a fire is capable of inducing multiple hot shorts. shorts to ground. or open circuits. In addition. it is recognized that fire-induced faults in electrical circuits shall not prevent the)operation or cause the maloperation of required post-fire safe-shutdown components.

On the basis of its review of the regulatory documents and its evaluation of the alternative shutdown system at Salem as documented above. the staff concludes that the alternative shutdown system design at Salem does not provide the independence required by Section 111.L.3 of Appendix R in that it relies on procedures that direct operators to perform numerous complex repair activities. such as lifting and cutting electrical leads. installing electrical jumpers. and removing fuses in order to isolate potentially fire-affected circuits and regain control of post-fire hot shutdown equipment.

In addition. the staff concluded that in order for the alternative shutdown capability to perform its intended function. the shutdown equipment_ that it relies on must be capable of performing 1ts functions after it has been electrically isolated from the fire-affected area of concern. The staff found that certain safe-shutdown equipment used by the alternative shutdown system was not adequately isolated. as required by Section 111.L.7 of Appendix R.-

from the associated circuits in the fire area and that fire-induced hot shorts. open circuits. or shorts to ground in these circuits could have prevented the operation of this required safe-shutdown equipment.

On the basis -0f the findings it made during the May 1993 inspection. the staff also concludes that these design weaknesses do not provide reasonable assurance that the minimum and limited shutdown functions controlled by the alternative shutdown system can be performed as specified by Section III.L.

paragraphs 1 and 2 of Appendix R.

Therefore. the staff concluded that Salem Nuclear Generating Station Unit 1 is not in compliance with the alternative shutdown system requirements of Appendix R to 10 CFR Part 50 and Unit 2 is not in compliance with its Operating License. Condition 2.C.10.

The licensee committed to implement certain modifications to resolve the post-fire alternative shutdown system design concerns. The licensee has committed to install isolation transfer switches for the required safe-shutdown functions controlled by the alternative shutdown system and to modify the control circuits for certain MOVs in order to eliminate the concern about hot-short spurious operation damage.

For Unit 1. the licensee committed to complete MOV circuit modifications and to install isolation transfer switches prior to restart. For Unit 2. the licensee committed to complete MOV circuit modifications for 20 hot-standby valves and to install the remaining service water system isolation transfer switches during the next refueling outage (refueling outage 10). The staff finds the Unit 1 modification implementation schedule acceptable.

However.

the schedule for Unit 2 is not acceptable. The licensee did not propose interim compensatory measures for the Unit 2 alternative shutdown design weaknesses nor did it describe how it will mitigate the potential adverse consequences of fire-induced hot shorts on the MOVs in question. Therefore.

absent adequate interim compensatory measures. the staff has no basis for recommending that Unit 2 be allowed to restart prior to full implementation of the required post-fire safe-shutdown modifications.

Date: March 17, 1997 Appendix:

BNL Technical Evaluation. Rev. 1. January 23. 1997