ML18139B219

Post Fire Shutdown Capability, Interim Rept

ML18139B219
Person / Time
Site:	Surry
Issue date:	03/18/1981
From:	Rich Smith BROOKHAVEN NATIONAL LABORATORY
To:
Shared Package
ML18139B218	List: ML18139B219
References
NUDOCS 8104020683
Download: ML18139B219 (5)

Text

• -~

e INTERIM REPORT PRINCIPAL (BNL) REVIEWER - R.O. SMITH POST FIRE SHUTDOWN CAPABILITY SURRY POWER STATION UNITS 1 &2 Section 3.2.3 A of the SER, Safe Shutdown. Evaluation states that the 1 icensee will reevaluate all plant areas to determine the potential effects of fire on safe shutdown capability. Section 3.2.3 B of the SER states that the 1 icensee will develop an alternate shutdown method or verify that alternate shutdown methods are not required in the event of fire damage to the systems

~nd tomponents detailed in this section of the SER.

The licensee has addressed these requirements in Attachments I and III of VEPCO letter Serial No. 885 dated October 31, 1980. The licensee, in his evaluation, demonstrates the operational procedures that would be used to bring the pl ant from power operation to safe hot and cold shutdo\'m under the following requirements :

Placing the reactor in a subcritical condition and maintaining the reactor subcritical indefinitely; Bringing the reactor to hot shutdown condition and maintaining it at hot shutdown for an extended period of time using only normal sources of cooling water; Maintaining the reactor coolant system inventory indefinitely using only normal sources of make up water; Bringing the*reactor to cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.*

The Surry program for safe shutdown relies on existing system equipment plus manual realignment of valves and local control of pumps and- circuit

• breakers to achieve hot and cold shutdown. The safe shutdown program relies considerably on proposed fire protection modifications.

. Reactivity control is provided by the control rod system which i*s of a .

fail-safe design and by the boron injection system which is activated 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a reactor trip. The reactor cool ant system water inventory is main-tained by the operation of the charging pumps which can take suction from the refueling water storage tank in the event of fire damage to* the boric acid transfer system which normally discharges to the charging pump suctions. Nor-mally .the condenser steam dump system bypasses steam to the condenser to re-move decay heat. If it is not available, as when off-site power is lost, automatically controlled steam dump valves can relieve main steam to the atmo-sphere. For the continued use of the steam generator for heat removal, auxiliary feed pumps are provided to deliver water to the steam generators.

Pressure control is maintained by the pressurizer heaters. The residual heat removal system is required to bring the plant to cold shutdown. It has been verified that damaged RHR pump, cables and breakers can be replaced in 72 s1e4020,s~--~-

• e hours. An auxiliary shutdown panel is located in each emergency switchgear room and has contro 1 switches for emergency bora ti on, auxi 1i ary .feedwater pumps and valves, charging pumps and flow control, and the pressurizer heaters.

We have evaluated the post fire shutdown capability using NRC guidelines in "Staff Position Safe Shutdown Capabil ity 11 dated June 19, 1979 and NRC requirements in Section III.L of Appendix R to 10 CFR Part 50. We have found that:

1. The post fire shutdown capability has not been shown to be isolated from nonsafety related associated circuits so that fire damage to the nonsafety related associated circuits in a fire area may not prevent the operation of shutdown equipment.

2. A design change package has been initiated to tie the station fire water into the charging pump service water supply header to provide an alternate means of cooling the charging pumps. The modification has not been implemented. However the licensee has stated that in the interim, fire water can be manually tied into the supply system utilizing jumper hoses and necessary connectors.

3. The post fire process monitoring function has not been shown to be capable of providing direct readings of the process variables neces-sary to perfo nn and control shutdown functions. The 1i censee has not stated that pressurizer temperature, steam generator pressure, auxiliary feed flow, condensate storage tank level, or radiation level would be provided.

4. The licensee has not as yet demonstrated that repair procedures for cold shutdown systems are fully developed and material for repairs is maintained on site.

5. In the event that a fire disables the cooling water pumps, the 1icensee proposes to operate the charging pumps in an "on-off 11 mode consistent with reactor coolant system makeup requirements and to alternate available charging pumps to maintain seal cooling tem-perature below its maximum value.

6. All hot and cold shutdown procedures have not been prepared.

7. The submittal is not clear as to whether all of the required support functions can be maintained without off-site power.

8. The post fire shutdown capability depends on fire protection measures in the following areas:

Emergency Switchgear and Relay Rooms Outside Containment Penetration Vaults, Cable Tunnels and Service Building Cable Vaults Auxiliary Building - Elev. 2 ft Auxiliary Building - Elev. 13 ft

e Auxiliary Building - Elev. 27 ft 6 in Auxiliary Building - Elev. 45 ft 6 in Reactor Containment Buildings Containment Spray Pump and Auxiliary Feedwater Pump Buildings Intake Structure Turbine Building These protection features should meet the NRC requirements of Section III.G of Appendix R to 10 CFR 50.

We conclude that the proposed alternative shutdown capabil ty for Surry Power Units 1 and 2 does not confonn with NRC guidelines and requirements and, therefore, is unacceptable. We reccmmend the following:

A. The alternative shutdown capability should be modified to meet the requirements of Section III.L of Appendix R to 10 CFR Part 50, tak-ing into consideration the above findings.

B. The process monitoring should be shown to be capable of providing direct readings of the process variables necessary to perform and control reactivity, reactor cool ant makeup, and reactor heat re-moval. We recommend that permanently installed instruments be used to provide capability for reading: pressurizer pressure, temperature and level; reactor coolant loop temperature; steam generator level and pressurer; auxi 1 i ary feed water fl ow; condensate storage tank level and radiation levels.

• C. All repair procedures for cold shutdown should be fully developed and it should be demonstrated that the materials for the repairs are maintained on site.

The manpower for these procedures should be shown to be available on site and the work to be perfonned should be reasonable in light of the manpower available.

D. *Firefighting water shall be dedicated to fire fighting to insure its availability during a fire emergency and fire pumps shall not be used for purposes other than fire fighting.

E. An alternative method for maintaining the seal cooling temperature below its maximum value be provided other than operating the charg-ing pumps in an "on-off" mode.

F. Procedures that are to be used to provide cold shutdown capability should put such systems back into their original condition prior to post fire start-up. These procedures should include all operational steps such as quality control review as required for long tenn operation.

e G. The supporting functions should be capable of providing the process cooling, lubrication, heat tracing, etc.. necessary to pennit the operation of the equipment used for safe shutdown by the systems identified as part of the alternate shutdown capability. All of the support functions should be available for the equipment used in the alternative shutdown capabi 1ity.

H.Section III.G of Appendix R to.CFR Part 50 requires cabling for or associated with redundant safe shutdown systems necessary to achieve and maintain hot shutdown conditions be separated by fire barriers having a three hour fire rating or equivalent protection {see Sec-tion III.G.2 of Appendix R). Therefore, if option III.G.3 is chosen for the protection of shutdown capability cabling required for or associated with the alternative method of hot shutdown for each fire area, must be physically separated by the equivalent of a three-hour rated fire barrier from the fire area.

In evaluating an alternative shutdown method, associated circuits are circuits that could prevent operation or cause malfunction of the alternative train which is used to achieve and maintain hot shutdown conditions due to fire induced hot shorts, open circuits, or shorts to ground.

Safety related and nonsafety related cables that are associated with the equipment and cables of the alternative or dedicated method of shutdown are those that have a separation from the fire area less than that required by Section III.G.2 of Appendix R to 10 CFR 50 and have either {1) a common power source with the alternative shutdown equipment and the power source is not electrically protected from the post fire shutdown circuit of concern by coordinated circuit breakers, fuses, or similar devices, (2) a connection to circuits of equipment whose spurious operation will adversely effect the shut-down capability, e.g., RHR/RCS isolation valves or (3) a ccmmon en-closure, e.g., raceway, panel, junction box with alternative shut-down cables and are not electrically protected from the post fire shutdown circuits of concern by circuit breakers, fuses, or similar devices.

For each fire area where an alternative or dedicated shutdown method, in accordance with Section III.G.3 of Appendix R 10 CFR Part 50 is provided by proposed modifications, the fo 11 owing i nfonnation is required to demonstrate that associated circuits will not prevent operation or cause malfunction of the alternative or dedicated shut-down method.

(1) Provide a table that lists all equipment including instrmenta-tion and support system equipment that are required by the alternative or dedicated method of achieving and maintaining hot shutdown.

( 2) For each alternative shutdown equipment 1 i sted in ( 1) above, provide a table that lists the essential cable (instrumenta-tion, control and power) that are located in the fire area.

r e

(3) Provide a table that lists safety related and nonsafety related cables associated with the equipment in cables constituting the alternative or dedicated method of shutdown that are located in the fire area.

(4) Show that fire induced failures of the cables listed in (2) and (3) above will not prevent operation or cause malfunction of the alternative or dedicated shutdown method.

(5) For each cable listed in (2) above provide a detailed elec-trical schematic drawing that shows how each cable is isolated from the fire area.

I. The residual heat removal system is generally a low pressure systen that interfaces with the high pressure primary coolant system. To preclude a LOCA through this interface, we require compliance with the recommendations of Banch Technical Position RSB 5-1. Thus, this interface most likely consists of two redundant and independent motor operated valves. These two motor operated valves and their associated cable may be subject to a single fire hazard. It is our concern that this single fire could cause the two valves to open resulting in a fire-initiated LOCA through the subject high-low pressure system interface. To assure that this interface and other high-low pressure interfaces are adequately protected from the ef-fects of a single fire, we require the following information:

Identify each high-low pressure interface that uses redundant electrically controlled devices (such as two series motor oper-ated valves) to isolate or preclude rupture of any primary cool-ant boundary.

Identify the device I s es sen ti al cab 1i ng ( power and contro 1) and describe the cable routing (by fire area) from source to tennina-.

tion.

Identify each location where the identified cables are separated by less than a wall having a three-hour fire rating from cables for the redundant device.

For the areas identified in the above paragraph, provide the bases and justification as to the acceptability of the existing design or any proposed modifications.