ML18152A327
| ML18152A327 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 07/23/1992 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML18152A328 | List: |
| References | |
| NUDOCS 9207280320 | |
| Download: ML18152A327 (14) | |
Text
e e
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SURRY POWER STATION. UNITS 1 AND 2 POST-FIRE SAFE SHUTDOWN EVALUATION. APPENDIX R
1.0 INTRODUCTION
The licensee has provided a discussion of shutdown system availability in the event of a fire as part of the fire protection evaluation for Surry Power Station, Units 1 and 2 by a submittal, "Surry Power Station, Units 1 and 2, 10 CFR 50, Appendix R Report" Rev. 4, dated April 1987 (Ref. 1). This submittal supersedes previous submittals.
The scope of the technical evaluation was limited, with the emphasis on apparent changes to the licensee evaluation from previous submittals which have already undergone staff review (Ref. 2). Topics considered in this review include the systems used to achieve safe shutdown in the event of a fire, the associated circuit analysis, instrumentation requirements, ventilation systems, communication requirements, and the isolation of high/low pressure interfaces at the reactor vessel boundary in the event of a fire.
During the review several questions about the submittal were sent to the licensee for further clarification. Information in response to these questions was supplied by letters dated January 22, 1988 (Ref. 3), July 26, 1990 (Ref. 4), December 19, 1990 (Ref. 5), and December 19, 1991 (Ref. 6).
2.0 EVALUATION Shutdown Capability In this analysis, the licensee has divided the Surry Power Station, Units 1 and 2 into 12 fire areas where alternate shutdown capability is required.
(Other fire areas are identified but normal shutdown procedures can be used after fires in those areas.) The alternative shutdown methods use the same systems as are used in normal shutdown procedures.
However, system operation has been degraded in some way for fires in the areas requiring use of these alternative shutdown methods.
The systems used are intended to fulfill four functions after a fire-induced shutdown.
Following control rod insertion (which will be unaffected by any plant fire), the chemical and volume control system (CVCS) will be used to maintain an adequate shutdown margin by injecting borated water into the reactor coolant system from the refueling water storage tank.
The eves (including ihe letdown paths) is also used to provide the reactor coolant inventory function and the reactor coolant pressure control function.
Primary pressure control also requires the use of the atmospheric steam dump valves or the pressurizer power operated relief valves (PORVs).
The final function required is the residual heat removal function.
One system used to provide
-- ~-
-,,.,~-------,------.,,_
l
~2072S0320 920723
- 1 PDR ADOCK 05000280
~
PDR I
e this function is the auxiliary feedwater system (AFWS), which draws water from the emergency condensate storage tank, in conjunction with the main or auxiliary steam systems or the residual heat removal (RHR) system.
The AFWS is also used in maintaining hot shutdown, while the RHR system is used to achieve cold shutdown.
These systems are the same as those identified in earlier submittals which have been approved by the staff. Additional information has been included for the support systems required to ensure operability of these systems.
The support systems considered in the analysis include the following.
Electric Power (including vital AC and DC)
Ventilation Systems Charging Pump Service Water System Component Cooling Water System Service Water System Circulating Water System Emergency Lighting and Communications The licensee identified the equipment potentially failed after a fire in each of the 12 fire areas requiring alternative shutdown methods.
The following paragraphs identify the mitigating features used to provide the necessary safe shutdown capability after a fire.
A fire in Fire Area 1, the Unit 1 cable vault and tunnel, requires that the charging pump discharge from Unit 2 be cross-connected to the discharge of the Unit 1 charging pumps.
The operators must take local manual control of the turbine-driven AFWS pump since the motor-driven AFWS pumps are not available.
The operators must also isolate the steam generator PORVs and manually line up the auxiliary steam system.
Emergency AC power will be supplied by a diesel generator via Unit 2 emergency buses to equipment sufficient to shut down Unit 1.
A spare antenna and cabling are available to reestablish communica-tion in the containment if necessary.
Ventilation capabilities are supplied by components located outside the cable vault area.
Process monitoring is available in the cable spreading room for Unit 1 on the remote monitoring panels which can be powered from either unit.
(Control room process monitoring is lost due to this fire.)
Fire Area 2 is the Unit 2 cable vault and tunnel.
The necessary alternative shutdown capabilities are equivalent to those for Fire Area 1.
Fire Area 3 is the Unit 1 emergency switchgear and relay room.
The actions necessary to safely shut down the plant after a fire in this area are the same as those described for Fire Area 1.
In addition, a fire in this area may damage communication equipment and require the use of backup equipment located in a separate fire area. Also, the emergency switchgear and relay room ventilation system may partially fail. Alternative chillers and air handling units (located in mechanical equipment room no. 3 and the control room, respectively) are available for use as well as Unit 2 chillers.
e Fire Area 4 is the Unit 2 emergency switchgear and relay room.
The necessary alternative shutdown capabilities are equivalent to those for Fire Area 3.
Fire Area 5 is the main control room.
For a fire in this area, control of the eves and AFWS is transferred to the auxiliary shutdown panels and all necessary process monitoring capabilities are transferred to the remote monitoring panels.
The operators must take local manual control of both the charging pump cooling water pumps and the charging pump service water pumps.
Charging pump suction from the RWST is provided by operating the valve breakers locally.
The operators must isolate the steam generator PORVs and subsequently manually line up the auxiliary steam system.
Emergency AC power is available once the operator isolates the diesel generators from the control room using the local isolation switches.
Local control of the control room ventilation system is also required. Alternative communication capability is provided by equipment located outside of the-control room.
Fire Area 15 is the Unit 1 reactor containment.
A fire in this area could damage the RHR pump motor cables. Since the RHR system is used for cold shutdown only, these cables can be repaired prior to system use.
Some component cooling water valves may also be damaged.
Again, since these components are only required for cold shutdown they can be repaired.
(These repair actions have been accepted in previous staff reviews of the Surry Appendix R submittals.)
Several process monitoring functions can be affected by a containment fire.
Modifications have been made to ensure that redundant signals do not fail as a result of a single fire.
The letdown line isolation valves in the eves will be operated manually, locally. These valves are located in the fire area but their operation is not required for approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the fire-induced plant trip.
Fire Area 6 is the Unit 2 reactor containment.
The necessary alternative shutdown capabilities are equivalent to those for Fire Area 15.
Fire Area 17 is the auxiliary, fuel, and decontamination building. A fire in this area will require the operators to cross connect the discharge of both units' charging pumps by local manual action. This initially required that the operator enter Fire Area 17 within 30 minutes of the fire. This fire area has been separated into four fire zones.
The operator will not be required to enter the zone where the fire is located. Subsequently, by submittal dated July 26, 1991 (Ref. 4), the licensee stated that operator entry is not required within 60 minutes of the fire.
Based on the information provided in the licensee's evaluation of operator access to the charging pump cubicles, there is reasonable assurance that an operator could perform the required manual actions based on a reentry time of 60 minutes.
The operator will also have to trip the main turbine using the main steam trip bypass v~lves since the main steam trip valves may not be available.
The component cooling water system may be damaged to the point of needing repair due to a fire in this area.
Since this system is required only for cold shutdown, repairs are allowed.
The licensee has indicated that spare cable and two spare pump motors (with other material needed for pump motor
e e installation) are stored on site. Repair procedures are in place.
Local operation of the area fan dampers will be'required and power to operate the ventilation dampers will be available.
Some communications system equipment will be lost due to a fire in this fire area.
However, a redundant paging system has been installed that will provide communication capability for safe shutdown operations.
Fire Area 19 is the Unit 1 safeguards area. A fire in this area requires that the Unit 2 AFWS be cross,connected to the Unit 1 AFWS, a remote manual operation.
Steam generator pressure indication would be available at the remote monitoring panel but not in the control room.
Local manual operation is required to ensure adequate ventilation in the area.
The operator must also isolate the steam generator PORVs and manually line up the auxiliary steam system.
Fire Area 20 is the Unit 2 safeguards area.
The necessary alternative shutdown capabilities are equivalent to those for Fire Area 19.
Fire Area 45 is mechanical equipment room no. 3.
A fire in this area does not directly affect any shutdown systems.
It does, however, damage all but one charging pump service water pump.
This operable pump cools the Unit 1 charging pumps which would then be used to bring Units 1 and 2 to shutdown condition.
The operators must cross connect the charging pump discharge of the two units. A fire in this area necessitates the use of a central chilled water system cross connect to provide control room and emergency switchgear and relay room chilled ventilation. The operator must align one central chiller and chilled water pump to a Unit 1 emergency bus.
Two of the three diesel generators may suffer cable damage.
Diesel Generator 1 is the only diesel generator available to provide power to the required safe shutdown systems.
The final fire area requiring alternative shutdown capability is Fire Area 54, the charging pump service water pump room.
A.'fire in this area leaves only one operable charging pump service water pump.
This pump cools the Unit 2 charging pumps which would be used to bring Units 1 and 2 to shutdown conditions.
The operators must cross connect the two units charging pump discharges which is done outside of the fire area.
Associated Circuits The licensee performed an associated circuit analysis for circuits with physical separation less than that prescribed in Appendix R Section 111.G.2 and associated with safe shutdown circuits in one of three ways:
common bus, common enclosures and spurious signals.
The review of circuits to be examined for associated circuit failures included power, control and instrumentation circuits.
Two items of concern were addressed in the associated circuit analysis for circuits linked by a common bus:
breaker coordination and multiple high impedance faults (faults below the trip point for individual breakers).
e The breaker coordination study for the 4160V, 480V, 120V AC and 125V DC power supplies was reviewed.
The licensee has already made some modifications to the power systems in response to the results of the original breaker coordination study.
The study reviewed here was based on the modified power supply systems.
In all cases sampled, proper breaker coordination did exist between the breakers in the area of the fire and the feeder breaker (provided the feeder breaker was not also located in the area of the fire) for the damaged bus.
Based on this review, the Surry Power Station Units I and 2 power supply systems meet the breaker coordination criteria of Generic Letter 81-12 (Ref. 7).
Potential associated circuit problems due to common enclosures are handled in one of two ways.
Cables which share a common enclosure with safe shutdown related cables are electrically protected by circuit breakers, fuses or similar devices. That is, adequate electrical protection is provided.
For common enclosures that could potentially allow propagation of the fire into a common enclosure, fire stops and penetration fire seals equivalent to the fire rating of the wall have been provided.
These barriers should provide sufficient protection to meet the criteria outlined in Generic Letter 81-12.
Spurious operation of various equipment has been addressed in one of three ways.
Some equipment (not required to function during normal operation or during a fire-related shutdown) is isolated before a fire by opening designated breakers prior to the fire event. 'Equipment isolated in this manner includes reactor coolant loop inlet and outlet valves and RHR suction isolation valves. Other equipment is isolated by transfer or isolation switches.
Equipment in this category includes the pressurizer PORVs and vents.
For equipment required to function during normal operation where spurious operation has already occurred, procedures are established to mitigate the misoperation of the equipment.
Of special interest for the spurious operation of equipment is the operation of equipment that could result in the failure of an isolation device between the reactor vessel and a low pressure system.
The licensee identified those components whose failure could cause a loss or diversion of reactor inventory if not isolated.
The components identified include the following:
Pressurizer PORV Pressurizer Block Valve RHR Suction Isolation Letdown Isolation Valves Excess Letdown Isolation Valves Reactor Vessel Head Vents Pressurizer Vents The pressurizer PORVs are normally shut while the block valves are normally open but can be closed to isolate flow through the PORVs.
It has been postulated that a single fire could cause both the PORVs and the block valves to fail open, resulting in a fire-induced loss of primary coolant to the pressurizer relief tank.
The licensee has installed dedicated conduits from the PORVs to isolation switches located in the emergency switchgear room and in the control room.
The RHR suction valves are normally shut to isolate the* RHR system from the reactor coolant system.
Under normal operating conditions, the station procedures require that the breakers for each of the two isolation valves be open, precluding spurious operation and reactor coolant loss to the pressurizer relief tank.
The eves letdown line cannot be isolated during normal operation. Therefore, the same approach has been implemented for these four valves, three of which must fail open to fail reactor vessel isolation, as for the pressurizer PORVs.
Isolation switches in both the control room and the emergency switchgear room are provided to cut the power supply to one valve which is designed to fail closed on a loss of power.
An alternate letdown path exists from each of the loop cold legs through the excess letdown heat exchanger. A single fire could cause a failure of the inlet and outlet control valves for this heat exchanger.
As with the CVCS letdown line isolation valve, these valves fail shut on a loss of power or air.
An isolation switch has been installed in the emergency switchgear room and one was already located in the control room.
The final two high/low pressure interfaces are the reactor vessel head and pressurizer vents.
Each of the four vent lines (two reactor head vent lines and two pressurizer vent lines) contains two solenoid operated valves that fail closed on a loss of power.
Isolation switches have been installed in both the emergency switchgear room and the control room for one of the valves in the valve pairs on each vent line.
Power cables are routed in dedicated metal conduits.
Multiple High Impedance Faults for Associated Circuits The licensee indicated that the analysis for multiple high impedance faults shows that the loss of safe shutdown equipment is impossible in most cases and improbable in others due to system configurations, types of circuits used and other reasons. Additional effort was expended to expand and further review the analysis before it was submitted to the staff. This information was provided to the staff in a licensee submittal dated December 19, 1990.
The paragraphs below address the issue of multiple high impedance faults for associated circuits.
Generic Letter 86-10 "Implementation of Fire Protection Requirements" indicates that high impedance faults should be considered for all associated circuits located in the fire area of concern to meet the separation criteria of Sections III.G.2 and III.G.3 of Appendix R.
In this context, associated circuits are defined as circuits not required for safe shutdown but are powered by necessary Appendix R power supplies.
The concern is that a fire expected to result in the loss of an Appendix R power supply may also result in the loss of the redundant power supply as a result of simultaneous high impedance faults of associated circuits routed into the same fire area.
A high impedance fault is a circuit path that results in a larger than normal current flow value but lower than the current flow value necessary to trip the circuit protective device. Generic Letter 86-10 also indicates that the phenomenon should be considered for impact on the safe shutdown capability of a plant and addressed by either a circuit coordination study or by assuming the shutdown capability will be disabled and provide written procedures to clear the faults.
The Surry Power Station consists of two "mirror image" units.
For fire scenarios in critical plant areas, it is necessary to depend on mechanical cross connects to shut down both units with equipment from the opposite unit rather than from redundant trains.
Because both units contain similar power supplies, it is not typically necessary to route an abundance of Unit 1 cables into Unit 2 areas and vice versa. This is particularly true for the emergency electrical power distribution system used for safe shutdown.
This natural separation is used as a qualitative basis to indicate that a sufficient number of associated circuits are not routed into fire areas of concern.
This being the case, the potential for multiple high impedance faults of associated circuits resulting in the simultaneous loss of redundant Appendix R power supplies is limited.
Further, the licensee has performed an evaluation of each Appendix R power supply and has determined that the probability of loss due to simultaneous high impedance faults is either impossible in some cases or highly improbable in other cases.
The NRC evaluation of each type of Appendix R power supply as related to multiple simultaneous high impedance faults of associated circuits is described below.
4160 Vac Switchgear The 4160 Vac switchgear buses (two per unit) are not susceptible to tripping due to multiple high impedance faults.
This conclusion follows since the sum of all overcurrent relay trip device settings (phase and ground) for each bus is lower than that of the bus associated main offsite supply circuit breaker settings. The same conclusion applies when the 4160 Vac switchgear buses are supplied by their respective emergency diesel generators (EDGs) (phase-to-phase faults are the only concern since the EDGs are ungrounded) due to load shedding of a stub bus which supplies component cooling and residual heat removal pump motors.
Load shedding the stub bus from the main bus reduces the sum of all overcurrent relay trip device settings for the main bus load feeders to less than that of the main bus feeder overcurrent trip device setting.
The stub bus would be returned to service later to achieve cold shutdown but this should be after clearing any potentially faulted circuits on the bus.
By that time, any other 4160 Vac high impedance fault would be expected to have developed into a lower impedance fault and as such be selectively cleared.
480 Vac Switchgear Load Centers The 480 Vac switchgear load center buses (two per unit) are not subject to tripping due to multiple high impedance faults on associated circuits. This conclusion is supported by the following items.
Each 480 Vac load center consists of one feeder breaker and typically six load circuit breakers.
Of the six load circuit breakers, two supply Appendix R required motor control centers, with the remaining serving as spares or providing only contingency service. Therefore, there are very few energized associated circuits originating from each Appendix R required 480 Vac load center.
As a result, the sum of the overcurrent trip device settings for the Appendix R 480 Vac load center associated circuits, including back-up contingency circuit
e e breakers, is less than the feeder device trip setting. Thus, multiple high impedance faults of Appendix R 480 Vac load center associated circuits will not result in tripping the load center feeder device with subsequent loss of this power supply.
480 Vac Motor Control Centers (MCCs)
Numerous 480 Vac MCCs are required for Appendix R.
The required MCCs are located in either the emergency switchgear rooms or the cable vaults and tunnels of the respective unit.
In general, in the event of a fire in any of.
these areas of either unit, the electrical distribution system for the other unit is used for safe shutdown of both units.
The MCCs supply a great diversity of loads located in various plant locations.
For this reason, the information submitted by the licensee indicates it is difficult to ascertain the exact physical locations of all MCC circuits.
Consequently, the staff expressed concern that a sufficient number of energized associated circuits may exist in a given fire area such that if a fire were to occur, multiple high impedance faults could result in the simultaneous loss of Appendix R power supplies.
In response to this concern, the licensee provided additional information in its December 19, 1991 submittal (Ref. 6), which shows that Unit 1 and 2 MCCs predominantly supply like unit loads which are typically located in different plant areas. This physical arrangement for MCCs and their loads suggests that there are few Unit 1 and 2 MCC associated circuits within a common area.
The additional information also shows that MCC loads vary in frequency of operation and that a majority of the associated circuits are normally de-energized.
De-energized associated circuits reduce the extent of concern for high impedance faults by limiting the locations on interconnecting hardware between MCCs and their loads where the occurrence of such faults are of concern.
Further, only fires local to MCCs are expected to spuriously operate motor operated valves, that is, energize 480 Vac power cables. This further limits the number of plant areas where a sufficient number of associated circuits with high impedance faults are of concern.
In addition, this reasoning applies equally to other de-energized loads supplied by motor starter/contactors. Thus, with a relatively large number of de-energized associated circuits spuriously energized only by fires local to MCCs and the low trip *setpoints (50 amperes or less) of a majority of the associated circuit MCC breakers, MCC feeder breaker trip potential due to multiple high impedance faults is unlikely.
In addition to the above, the ungrounded 480 Vac system at Surry requires shorting two different phase conductors or shorting two phases to ground (as a minimum) to produce fault current. A single conductor in contact with a grounded object, such as a conduit or cable tray, would not result in a high fault current.
Two or three phase conductors are routed to each load and in many cases, multiconductor or triplexed cables are used.
To avoid severely derating power circuits, these circuits are sometimes routed in dedicated conduit.
For such cases, the close proximity of the phase conductors would reduce the likelihood of high impedance faults because the small amount of insulating material existing between conductors would burn away quickly producing a lower impedance high current fault.
The 480 Vac MCCs at Surry have three-phase fault currents of 15,000 to 19,000 amperes available at the buses.
Thus, some margin typically exists between the available fault current at the end of a circuit and the breaker overcurrent/trip setting. This suggests that a high impedance fault located at the end of a circuit would typically develop into a lower impedance high current fault since sufficient current is available at the end of the circuit to burn away insulating material.
Because of the strong sources and low MCC breaker trip setpoints, there should be adequate current margin to selectively operate, without incident, breakers supplying either low or high impedance faults.
Additionally, for motor loads, the contactor overload heaters are sized based on motor nameplate full load current and will interrupt for values of load or fault current lower than that required to operate the magnetic/instantaneous trip of the breakers.
These additional reasons further support the conclusion that it is unlikely that a sufficient number of high impedance faults with current values lower than the individual trip settings or motor contactor overloads will exist which would cause tripping of the MCC feeder breakers.
125 Vdc Distribution System The 125 Vdc distribution system at Surry is an ungrounded system requ1r1ng both a positive and negative conductor from the same bus to produce fault current.
Faults on this system differ from alternating current faults in that the voltage difference between the two involved conductors is constant rather than cyclic and, therefore, direct current faults would tend to be uninterrupted allowing a larger than normal current value to burn away materials between the two conductors.
This would either clear the fault or more likely create a low impedance fault that could be selectively cleared.
Each direct current bus is simultaneously supplied by both a battery and a battery charger.
The battery chargers supply limited fault current and as such most of the fault current would be supplied by the batteries. A circuit breaker between the battery charger and the bus will open for an overcurrent condition but the batteries are connected directly to the bus.
Thus, the absence of a main bus breaker precludes the possibility of loss of power to the bus.
Power will continue to be served and the fault or faults would be expected to be cleared.
The diversity of direct current-provided equipment and locations suggests that it is unlikely that a substantial number of circuits are routed together such that redundant Appendix R power supplies are lost.
The direct current distribution cabinets are further limited in exposure to faults because numerous circuits supply other panels or cabinets.
The limited exposure is because of the additional levels of protection provided at these points for circuits originating from these panels or cabinets. These additional levels of protection limit distribution cabinet exposure to faults by providing downstream circuit elements which are likely to isolate for lower energy level faults.
120 Vac Vital Bus System The 120 Vac vital buses are normally supplied by current limiting inverters and alternately by current limiting voltage regulating transformers.
The vital buses supply a limited number of loads, most of which are located in the control room and emergency switchgear room (including the instrument rack room).
The initial submittal dated December 19, 1990, provided by the licensee indicated that though there are a number of vital bus associated circuits, there are expected to be few of these circuits not directly unit
~ related and as such routed into common areas.
In view of the lack of supporting information for this expectation, the staff requested the licensee to provide additional information.
In response to this request, the licensee provided documented information on December 19, 1991, which shows the fire zone associated with each vital bus panel and most of the individual panel loads. This information was provided based on a review of controlled plant physical arrangement drawings and interviews with personnel familiar with plant arrangement.
The documented information also identified each Appendix R required circuit based on a review of Appendix R block diagrams and 11448/11548-FE-90 series drawings.
This information shows that a majority of loads for each vital bus are located in the same fire area as the bus.
This.
strongly suggests that a fire in a vital bus fire area will likely result in the loss of the vital bus and its loads.
In addition, the Unit 1 side of the control room is adjacent to and directly above the Unit 1 emergency switchgear room with this same arrangement for Unit 2.
Power cables between the control room and emergency switchgear rooms are typically routed through floor sleeves directly between the areas, thus requiring no routing into other plant fire areas.
The above information provides support for the conclusion that few circuits for redundant Appendix R required vital buses are routed into common fire areas.
Thus, the simultaneous loss of redundant Appendix R required vital buses due to multiple high impedance faults of associated circuits is extremely unlikely.
Numerous secondary circuits originate from the control room and emergency switchgear room circuits. These circuits may be routed into various plant areas but are typically protected from their origination point, thus limiting the required protective zone of the Appendix R protective devices.
In addition, non-safety related circuits entering potentially harsh environments are fused in accordance with 10 CFR 50.49(b)2. These additional protective devices tend to limit the required protective zone of the Appendix R protective devices by increasing the probability of interrupting a downstream lower energy level circuit fault.
The automatic transfer of electrical power output from an uninterruptible power supply inverter to an attendant regulating transformer will increase the available fault current from a vital bus by a factor of five.
This design feature is intended to clear faults and would tend to provide the current required to selectively trip faulted branch circuits. The above reasoning supports the conclusion that at 120 Vac, high impedance faults are not likely to be sustained and are, therefore, acceptable.
Miscellaneous Power Supplies In addition to the several categories of Appendix R power supplies discussed above, there are a number of other miscellaneous power supplies that do not fit into any of those categories. These other power supplies are addressed below.
A 120 Vac Appendix R distribution panel has been installed for each unit to supply the remote auxiliary monitoring panels.
These Appendix R supply panels are not subject to multiple high impedance faults because they lack a sufficient number of associated circuits.
e Appendix R supplies for communication equipment are a Unit 1 120/240 Vac semi-vital bus, two 120/240 Vac heat trace panels, and an unscheduled 120 Vac communications panel.
For these power supplies, the initial submittal provided by the licensee indicated that it was expected that many of the supplied associated circuits were local, while others enter various plant areas.
On the basis of this expectation, it was assumed in the initial submittal that a sufficient number of associated circuits from one supply did not enter another power supply fire area to warrant concern for multiple high impedance faults.
This being the case, the staff requested additional factual information to support the expectation and resulting assumption.
In response to this request, the licensee provided additional information, prepared from controlled station drawings, which shows that the Unit 1 semi-vital bus supplies loads predominantly located in the control room and the Unit 1 emergency switchgear room.
As provided in the vital bus section of this report, the Unit 1 portion of the control room is above and adjacent to the Unit 1 emergency switchgear room and cables routed between these two locations typically follow the shortest route through floor sleeves and into no other fire areas.
The additional information also documented licensee review results of the heat tracing conduit plans and Operating Procedure OP-27, "Heat Tracing".
These review results clearly indicate that the heat traced components are located in the auxiliary building and that there are very few loads (1 or 2 per panel) other than heat tracing, such as communications, powered by these panels.
For the unscheduled communications breaker panel the additional information documented that this panel is located in the Unit 1 cable spreading room and that it supplies no associated circuits. (It supplies only the communication equipment analyzed for Appendix R.)
Accordingly, the above information provides support for the conclusion that a sufficient number of associated circuits from one of these supplies does not enter another power supply fire area to warrant additional concern for multiple high impedance faults.
With these circuit arrangements and features, it is likely that most faults will either be cleared or develop into a lower impedance high current fault allowing proper selective tripping.
Communication A portable radio system is used for communications during and after a fire.
The Surry site now has four repeaters and antennae (including an antenna inside containment for each unit) to provide communication links to the entire site. The original (single) centrally located repeater and antenna could be disabled by a fire in the control room, emergency switchgear room, or cable spreading room.
To ensure that a single fire will not disable all backup communications systems, the "A" and "B" repeaters and associated equipment are located in separate fire areas.
Portable radios are located in the control room, security building, Appendix R locker and electric shop.
e Instrumentation Requirements The licensee has identified a set of parameters that it feels is adequate to ensure a safe shutdown in the event of a fire. These parameters are:
Pressurizer Level Reactor Coolant System Pressure Steam Generator Level Steam Generator Pressure Reactor Coolant Loop Th Reactor Coolant Loop T Source Range Neutron F1ux Indication Wide Range Neutron Flux Indication The parameters are all displayed in both the control room and on the remote monitoring panels which are powered by feeds from either unit separated in accordance with Appendix R requirements.
Tank levels are not provided at the remote monitoring panels.
Emergency condensate storage tank level is available in the control room through two trains of level indication.
Tank level can also be read locally on a mechanical float-type gauge on the side of each tank.
The refueling water storage tank (RWST) does not have local instrumentation, only control room indication and alarms.
The licensee states that only a small fraction, less than 10%, of the RWST volume is required to provide makeup for use by the eves.
RWST minimum volumes are set by Technical Specification requirements and therefore a sufficient volume of borated water will be available.
Ventilation Systems Several areas of the plant require ventilation during safe shutdown operations to allow operator access and to protect equipment.
These areas are:
Control Room Emergency Switchgear Room Auxiliary Building Mechanical Equipment Room No. 3 Main Steam Valve House Cable Spreading Room The potential loss of some functionability of the ventilation systems is addressed for fires in each of the areas requiring an alternative shutdown capability.
The means provided to assure adequate ventilation has been discussed in the shutdown capabilities section of this report.
3.0 CONCLUSION
S The systems designated as safe shutdown systems and the instrumentation used for a post-fire environment have not been significantly modified since the last staff review of the Surry Power Station, Units 1 and 2 fire protection analysis.
The same systems (primarily eves, AFWS, and RHR systems) are being used to provide the means to maintain coolant inventory and to achieve hot and cold shutdown.
The major modifications to the analysis were more detailed
e e evaluations of support system requirements.
All required instrumentation is available in the post-fire environment.
The analysis performed by the licensee adequately addresses the major areas of concern for an alternate shutdown capability.
The associated circuit analysis identified areas where the existing design was not sufficient to meet Appendix R requirements. These deficiencies were corrected through several means, including installation of isolation switches and removal of power supplies to components whose spurious operation would lead to system damage or an interfacing systems LOCA.
In the analysis of system availability in a post-fire environment, support systems were included.
Power, cooling, and ventilation interactions were identified and proper operation verified when needed.
Communication capability is supplied for the response to fires in which the normal communication system may not be available.
The safe shutdown capability of Surry Power Station, Units I and 2, as described in the "IO CFR 50 Appendix R Report, Rev. 4" dated April 1987 (Ref. I) and the responses to questions, meets the intent of the requirements of Sections III.G.3 and III.L of Appendix Rand the criteria of Generic Letter 81-12 and is therefore acceptable.
Principal Contributors:
F. Ashe Date:
July 23, 1992 A. Singh B. Buckley N. Stinson
REFERENCES
- 1.
Surry Power Station, Units 1 and 2, 10CFRSO Appendix R Report," Rev. 4, April 1987.
- 2.
"Surry Power Station, Units 1 and 2, Safety Evaluation Reports for Appendix R to 10CFRSO," USNRC, December 4, 1981, and Supplements.
- 3.
W.L. Stewart to USNRC, "Virginia Electric & Power Company Surry Power Station: Additional Information on Appendix R Shutdown Analysis,"
January 22, 1988.
- 4.
W. L. Stewart to USNRC, "Virginia Electric and Power Company, Surry Power Station, Units 1 and 2, Appendix R Engineering Evaluations," July 26, 1990.
- 5.
W. L. Stewart to USNRC, "Virginia Electric and Power Company, Surry Power Station, Units 1 and 2, Appendix R Engineering Evaluations,"
December 19, 1990.
- 6.
W. L. Stewart to USNRC, "Virginia Electric and Power Company, Surry Power Station, Units 1 and 2, Appendix R Engineering Evaluations,"
December 19, 1991.
- 7.
"Fire Protection Rule (45 FR 76602, November 19, 1980) - Generic Letter 81-12," USNRC, February 20, 1981.