ML19320D169
| ML19320D169 | |
| Person / Time | |
|---|---|
| Site: | Vermont Yankee File:NorthStar Vermont Yankee icon.png |
| Issue date: | 07/03/1980 |
| From: | Ippolito T Office of Nuclear Reactor Regulation |
| To: | Rich Smith VERMONT YANKEE NUCLEAR POWER CORP. |
| References | |
| NUDOCS 8007210049 | |
| Download: ML19320D169 (15) | |
Text
-.
tem
./.... rfg UNITED STATES NUCLEAR REGULATORY COMMISSION o
3 j
WASHINGTON,0. C. 20555
'%......o July 3, 1980 Docket No. 50-271 Mr. Robert L. Smith Licensing Engineer Vermont Yankee Nuclear Power Corporation 25 Research Drive Westboro, Massachusetts 01581
Dear Mr. Smith:
The Vermont Yankee fire 'rotection SER, issued January 13,15 8, accompany-ing License Amendment No. 43, indicated that you would provide the details of certain proposed modifications for our review.
In addition, certain issues were left open pending further staff review. summarizes the status of the open issues. provides our evaluation of the safe shutdown capability at Vermont Yankee facility following a fire in three plant areas. This issue was identified as item 3.2.8 " Shutdown Capa-bility" of the fire protection SER.
In the SER, we requested that an analysis be provided to demonstrate that adequate shutdown capability would exist after a fire in the switchgear room, cable. spreading room and control room.
You provided this information in a letter dated January 30, 1978. Our evaluation of the Vermont Yankee safe shutdown analysis concludes that adequate shutdown capability has not been demonstrated for fires in the areas of concern. describes our evaluation and the requirement for alternate shutdown capability to be independent of fire damage in the areas of concern. The criteria for the required alternate shutdown systems are provided in Enclosure 3.
Please modify your provision for adequate shutdown capability to meet the enclosed criteria, and provide your response within 30 days of receipt of this letter.
Sincerely, Thomas
' Ippolito, Chief Operating Reactors Branch #2 Division of Licensing
Enclosures:
As stated cc: See next page I
800.7210097
Mr.' Robert L. Smith July 3,1980 cc:
Ms. J. M. Abbey John R. Stanton, Director Vermont Yankee Nuclear Power.
Radiation Control Agency Corporation Hazen Drive 77 Grove Street Concord, New Hampshire 03301 Rutland,,Vemont 05701 John W. Stevens Mr. Louis H. Heider, Conservation Society of Vice President Southern Vermont Vermont Yankee Nuclear Power P. O. Box 256 Corporation Townshend, Vermont 05353 25 Research Drive Westboro, Massachusetts 01581 Dr. Mars Longley, Director Occupational & Radiological Health John A. Ritsher, Esquire 10 Baldwin Street Ropes & Gray Montpelier, Ver% nt 05602 223 Franklin Street Boston, Massachusetts 02110
'New England Coalition on Nuclear Pollution Laurie Burt Hill and Dale Farm Assistant Attorney, General West Hill - Faraway Road Environmental Protection Division Putney, Vemont 05346 Attorney General's Office One Ashburton Place, 19th Floor Public Service Bward Boston Massachusetts 02108 State of Vemont 120 State Street Ronald J. Wilson Montpelier, Vermont 05602 81018th Street, N. W.
Suite 802 W. P. Murphy, Plant Superintendent Washington, D. C.
20006 Vermont Yankee Nuclear Power Corporation Hono'rable M. Jerome Diamond P. O. Box 157 Attorney General Vernon, Vermont 05354 State of Vermont 109 State Street David White Pavilion Office Building Co-Director Montpelier, Vemont 05602 Vemont Public Interest Research Group, Inc.
Mr. J. E. Griffin, President 26 State Street Vemont Yankee Nuclear Power Montpelier, Vermont 05602 '
Corporation 77 Grove Street Brooks Memorial Library Rutland, Vermont 05701 224 Main Street Brattleboro, Vemont 05301 Vemont Yankee Decomissioning Alliance Vermont Yankee Decommissioning 127 Main Street Alliance i
Brattleboto, Vermoi t 05301 S State Street Box 1117 Montpelier, Vermont 05602 l
i,.
ENCLOSURE 1 VERMONT YANKEE RESOLUTION OF INCOMPLETE ITEMS - STATUS
.St'ff Licensee Item Evaluation Response Due 3.1.3 ' Hose Station Calculations Complete 3.1.5 Foam Suppression Systems Complete 3.1.6 Gas Suppression Systems Complete 3.1.13 Portable Ventilation Equipment Complete 3.2.1 Protection of Essential Power Sources Complete 3.2.2 Flame Retardant Coatings Complete 3.2.5 Gas Suppression Systems Complete i
3.2.6 Radiological Consequences of Fires Complete 3.1.4 Water Suppression Systems Requirement 3.1.14 Air Breathing Apparatus Requirement 3.2.3 Fire Water Loop Requirement 3.2.4 Primary Containment Analysis Requirement 3.2.7 Administrative Controls Requirenent 3.2.8 Shutdown Capability Requirement 30 days 3.1.1 In-Situ Tests Ongoing a) Acceptance Criteria b) Bench Tests 3.1.8 ~ Fire Barrier Penetrations Ongoing 1
i 1
l l
j 1
4 l
ENCLOSURE 2 VERMONT YANKEE FIRE PROTECTION REVIEW EVALUATION OF INCOMPLEIt ITEMS 3.0 EVALUATION Thefollowingprohidesourehaluationoftheincompleteitems. Numbers in parenthesas following each heading refer to the sections of our pre-hiouslyissuedSERwhichaddressedtheseincompleteitems.
3.1 Shutdown Capability (3.2.8, 4.1)
The fire protection SER for Vermont Yankee was transmitted to the licensee by letter dated January 13, 1978. Section 4.1 of the SER noted that there are three areas of the plant wherein the physical separation between re-dundant dihisions of shutdown systems..S the fire protection for these systemsdonotprohideassurancethatredundant afe shutdown systems would not be damaged by a fire. These areas are the control room, cable spreading room and switchgear room. As noted in Section 3.2.8 of the SER, the licensee agreedtoprohideasummaryofananalysisdemonstratingthatsafeshutdown systems can be placed in operation independent of fire damage to electrical circuits in any of these three areas. The procedures for local operation ofhalhesandequipment,includingtheuseofanymeasurementsrequiredto effectlocalmanualsafeshutdownwouldbeprohidedforstaffrehiew.
By letter dated January 30, 1978, thelicenseeprohidedtheiranalysisofthe safeshutdowncapabilityahailableafterafireintheswitchgearroom. Their
. analysis showed that core. damage could be
'abntedaftersuchanehent. An analysiswasnotprohidedfortheothertwoareasofthecontrolbuilding, i.e., cable spreading room and control room, because: " Fires in any other areas of the control building can be considered less damaging because of their early discovery and prompt suppression and because the ability to manually operate equipment is not impaired."
i.
2 We have ehaluated the licensee's safe shutdown analysis for the switch-gear room and find that the following assumptions which form the basis of the licensee's analysis are unacceptable and/or unsupported:
1.
Thelicenseeassumesthatalloperationssuchaschangingvalheposi-tions, closing electrical circuit breakers, etc. can be accomplished locally and manual'y. Because the analysis does not identify the circuits located in the "witchgear room, and whether redundant control cables are also located tnere, we infer that the licensee only considered damage to pump power cables in their analysis.
The licensee has not demon-stratedthattherewouldbetimeandmanpowerahailableforthemanual operationsnecessitatedbyfiredamagetocontrolandhalhemotorcables.
NRC requirements for acceptable alternate shutdown methods specify that safe hot shutdown operations must be performed by the minimum required numberofonsitepersonnelexclusiheoffirebrigademembers. Where fire damage precludes control of safe hot shutdown operations from the controlroom,sufficienttimeandmanpowermustbeahailabletoperform hot shutdown operations manually outside the control room.
2.
The licensee assumes that no cable damage will occur to prehent safe shutdown for the first 30 minutes of a fire in the ssitchgear room.
Itisfurtherassumedthat30 minutes'afterdiscoheryofthefire,all functions will be lost whose power supply is routed through the room.
The first of these assumptions is unsupported and, therefore, unaccept-able; the licensee has not demonstrated that functions could not be lost in the first 30 minutes of the fire. Where cables for redundant safe shutdown systems are located in the same fire area, it should be
. assumed that loss of function occurs at the inception of the fire unless it can be de;nonstrated that adequate separation and fire protectionfeaturesexisttoprehentlossofredundantdihisionsor systems. Further, damage effects should consider loss of control cables andhalhemotorcablesaswellaspumpmotorcables.
3.
Local manual control of the reactor core isolation cooling (RCIC) pump is assumed by the licensee to demonstrate safe shutdown capability.
This assumption is unsupported; the licensee has not demonstrated that sufficienttimeandmanpowerareahailabletoaccomplishthisoperation.
Seeitem1abohe.
4.
Thelicenseeassumesthatintheehentofaswitchgearfire,theplant could be controlled during safe hot shutdown operations by the use of non-electrical indications located outside the room. This assumption is unsupported; the licensee has not demonstrated that plant control couldbeaccomplishedbytheahailablemanpoweronlossofreactor pressureandlehelinthecontrolroom. Also,theahailabilityof suppression pool temperature indication was not addressed.
It is un-acceptable to rely on instrumentation readout at locations outside the control room, unless it is demonstrated that sufficient time and man-powerareahailabletoperformhotshutdownfunctionswiththeminimum onsiteshiftpersonnel,exclusiheoffirebrigademembers.
As noted abohe, assumptions used in the licensee's analysis did not support the conclusion that. adequate alternate shutdown capability exists.
In addition,thelicenseeproposestoachiehesafeshutdown,intheehentof a switchgear room fire, using. methods which we find unacceptable. A
}
1 switchgear room fire could damage cables for redundant residual heat remohal(RHR)pumpsandredundantRHRserhicewaterpumps. The RHR and RHR serhicewatersystemsarerequiredtoremoheheatfromthesuppressionpool during hot shutdown. In the ehent of fire damage to redundant dihisions of RHR pump cables, the licensee would replace the cables before suppression pool cooling is required. Thelicenseestates,withoutherification,that 48hourswouldbeahailableafterscrambeforesuppressionpoolcoolingis required.
IftheRHR_serhicewatercablesweredamagedbyfire,thelicensee proposes to use the fire water system to cool the RHR heat exchangers in placeoftheRHRserhicewatersystem. The shutdown cooling methods proposed as alternatihes for normal RHR and RHR serhice water system operation do not meet the NRC requirements for safe shutdown capability in theevent of a fire.
Thatis,at'leastonedihisionofsafehotshutdownsystemsshouldbeun-damaged after a fire in any one fire area; replacement of cables is only permitted for safe cold shutdown. Also, use of the fire water system for safe shutdown is not acceptable. The fire water system is not a normal shutdown system and cannot be relied upon for long-term suppression pool cooling.
As noted abohe, the licensee has not demonstrated that safe shutdown capability wouldbemaintainedintheehentofaf. ire-intheswitchgearroom. Although the licensee states that a fire in the control room or cable spreading room would be less damaging than a fire in the switchgear room, no basis has beenprohidedforthisassertion.
Therefore, we require that the licensee prohideanalternatemethodofsafeshutdownthatwouldbefreeofdamage intheehentofafireintheswitchgearroom,controlroomorcablespreading
4
. room. The criteria for the alternate shutdown system are provided in the enclosed staff position (Enclosure 3) and are partially addressed in ourcommentsabohe.
In addition, NRC requirements for Alternate Shutdown Capability is _ set forth in the proposed Appendix R to 10 CFR 50, Section II L.
.l I
f
l STAFFPOSITION ENCLOSURE 3 SAFE SHUTDOWN CAPABILITY Staff Concern J
I During the staff's evaluation of fire ' protection programs at operating plants, one or more specific plant areas may be identified in which the staff,4s not have adequate assurance that a postulated fire will not damage both redundant divisions of shutdown systems.
This lack of assurance in safe shutdown capability has resulted from one or both of the follcwing situations:
j Case A: The licensee has not adequately identified the systems and components required for safe shutdown and their location in specific fire areas.
Case B: The licensee has not demonstrated that the fire protection for specific plant areas will prevent damage to both redundant divisions of safe shutdown components identified in these areas.
For Case A, the staff has required that an adequate safe shutdown analysis be performed. This evaluation includes the identification of the systems required for safe shutdown and the location of the system components in the plant. Where it is determined by this evaluation that safe shutdown components of both redundant divisions are located in the same fire area, the licensee is required to demerstrate that a postulated fire will not damage both divisions or provide alternate shutdown capability as in Case B.
For Case B, the staff may have required that an alternate shutdown capability be provided with is independent of the area of concern or the licensee may have proposed such a capability in lieu of certain additional fire protection modifications in the area. The specific modifications associated with the area of concern alor.g with other systems and equipmerrt already independent of the area form the alternate shutdown capability.
For each plant, the modifications needed and the combinations of systems which provide the shutdown functions may be unique for each critical area; however, the sh0tdown functions provided should maintain plant parameters within the bounds of the limiting safety consequences deemed acceptable for the design basis event.
Staff Position Safe shutdown capability should be demonstrated (Case A) or alternate shutdown capability provided (Case B) in accordance with the guidelines provided below:
- 1. Desien Basis Event The design basis event for considering the need for alternate shutdown is a postulated fire in a specific fire area containing redundant safe shutdown cables / equipment in close proximity where it has been determined that fire protection means cannot assure that safe shut::own capability will be preserved.
Two cases should be considered:
(1) offsite power is available; and (2) offsite power is not available.
4
. 2. Limiting Safety Consecuences and Required Shutdown Functions 2.1 No fission product boundary in'tegrity shall be affected:
a.
No fuel clad damage; b.
No rupture of any primary coolant boundary; c.
No rupture of the containment boundary.
2.2 The reactor coolant system process variables shall be within those predicted for a loss of normal ac power.
2.3 The alternate shutdown capability shall be able to achieve and maintain suberitical conditions in the reactor, maintain reactor coolant inventory, achieve and maintain het standby
- conditions (hot shutdown
- for a BWR) for an extended
)
period of time, achieve cold shutdown
- conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown conditions thereafter.
As defined in the Standard Technical Specifications.
- 3. performance Goals i
3.1 The reactivity control function shall be capable of achieving and maintaining cold shutdown reactivity conditions.
3.2 The reactor coolant makeup function shall be capable of maintaining the reactor coplant level above the top of the core for BWR's and in the pressurizer for PWR's.
3.3 The reactor heat removal function shall be capable of achieving and maintaining decay heat removal.
3.4 The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.
3.5 The supporting function shall be capable of providing th's process cooling, lubrication, etc. necessary to perinit the operation of the equipment used for safe shutdown by the systems identified in 3.1 - 3.4.
3.5 The equipment and systems used to achieve and maintain hot standby conditions (hot shutdown for a BWR). should be (1) free of fire damage; (2) capable of maintaining such conditions for an extended time period longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the equipment required to achieve and maintain cold shutdown is not available due to fire damage; and (3) capable of being powered by an onsite emergency power system.
3.7 The equipment and systems used to achieve and maintain cold shutdown conditions should be either free of fire damage or the fire damage to such systems should be limited such that recairs can be'made and cold snutdown conditions achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Equipment and systems used prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire should be capable of being powered by an onsite emergency power system; those used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be powered by
i
,. offsite power.
3.8 These systems need not be designed to (1) seismic category I criteria; (2) single failure criteria; or (3) cope with other plant accidents such as pipe breaks or stuck valves (Appendix A BTP 9.5-1), except those portions of these systems which interface with or impact existing safe.y systems.
t
- 4. PWR Ecuiement Generally Necessary For Het Standby (1) Reactivity Control Reactor *: rip capability (scram). Beratien capability e.g.,
charging pump, makeup pump or high pressure injection pump taking suction from concentrated borated water supplies, and letdown system if required.
(2) Raatter Coolant Makeue Reactor coolant makeup capability, e.g., charging pumps or the high pressure injection pu=ps. Power operated relief valves may be required to reduce pressure to allow use of the high pressure injection pumps.
(3) Reactor Coolant System Pressure Control _
Reactor pressure control capability, e.g., charging pumos or pressurizer heaters and use of the letdown systems if required.
(4) Deca'y Heat Removal Decay heat removal capability, e.g., power operated relief valves (steam generator) or safety relief valves for heat removal with a water supply and emergency or auxiliary feedwater pumps for makeup to the steam generator. Service water or other pumps may be requintd to provide water for auxiliary feed pump suction if the condensate storage tank capacity is not adequate for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
(5) Process Monitoring Instrumentatier, Process monitoring capability e.g., pressurizer pressure and level, steam generator level.
(5) Suecort.
The equipment required to support operation of the above described snutdown equipment e.g., component cooling water service water, etc. and ensite power sources (AC, DC) with their associated electrical distribution system.
-4
- 5. PWR Equiement Generally Necessary For Cold Shutdown *
(1) Reactor Coolant System Pressure Reduction to Residual Heat Removal System (RHR) Capaollity Reactor coolant system pressure reduc' tion by cooldewn using steam generator power operated miief valves or atmospheric dump valves.
(2) Decay Heat Removal Decay heat removal capability e.g., residual heat removal system, component cooling water system and service water system to removal heat and maintain cold shutdown.
(3) Suceert Support tapability e.g., onsite power sources (AC & DC) or offsite after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and the associated electrical distribution system to supply the above equipment.
- Equipment necessary in addition to that already provided to maintain het standby.
- 6. BWR Ecuiement Generally Necessary For Hot Shutdown (1) Reactivity control Reactor trip capability (scram).
(2) Reactor Coolant Makeuo Reactor coolant inventory makeup capability e.g., reactor core isolation cooling (system (RCIC) or the high pressure coolant in.iection system HPCI).
(3) Reactor Pressure Control and Decay Heat Removal Depressurization system valves or safety relief valves for dump to the suppression pool. The residual heat removal l
1 system in steam condensing mode, and service water system may also be used for heat nmoval to the ultimate heat sink.
(4) Sucoression Pool Cooline Residual heat removal system (in suppression pool cooling mode) service water system to maintain hot shutdown.
(5) Process Monitorinc Process monitoring capability e.g., reactor vessel level and pressure and suporession pool temperature.
1
' (6) Support Support capability e.g., onsite power source (AC & CC) and j
their associated distribution systems to prt. Ide for the shutdown equipment.
- 7. BWR Ecutoment Generally Necessary For Cold Shutdown
- At this point the equipment necessary for hot shutdown has reduced the primary systeu pressure and temperature to where the RHR system may be placed in service in RHR cooling mode.
(1) Decay Heat Removal Residual heat removal system in the RHR cooling mode, service
~ ~ - -
~
water system.
i (2) Suceert Onsite sources (AC & DC) or offsite after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ano their associated distribution systems to provide for shutdown equipment.
Equipment provided in addition to that for achieving hot shutdown.
- 8. Infomation Recuired For Staff Review (a) Description of the systems' or portions thereof used to provide the shutdown capability and modifications required
, to achieve the alternate shutdown capability if required.
(b) Syst'em design by drawings which show nomal and alternate
. shutdown control and power circuits, location of components, and that wiring which is in the area and the wiring which is out of the area that required the alternate system.
(c) Verification that changes to safety systems will not degrade safety systems.
(e.g., new isolation switches and control switches should meet design criteria and standards in FSAR for electrical equipment in the system that the switch is to be installed; cabinets that the switches are to be mounted in should also meet the same criteria (FSAR) as other safety related cabinets and panels; to avoid inadvertent isolation from the control room, the isolation switches should be keylocked, or alamed in the control room if in the " local" or " isolated" position; periodic checks should be made to verify switch is in the procer position fer normal operation; and a single transfer switch or other new device should not be a source for a single failure to cause loss of redundant safety systems).
(d) Verification that wiring, including power sources for the control circuit and equipment operation for the alternate shutdewn method, is independent of equipment wiring in the area to be avoided.
.g:
(e) Verification that alternate shutdewn power sources, including all breakers, have isolation devices on control circuits that are muted through the area to be avoided, even if the breaker is to be or rated manually.
(f) Verification that licensee procedure (s) have been developed which describe the tasks to be perfomed to effect the shutdown me thod. A sumary of these procedures should be reviewed by the staff.
(9) Verification that spare fuses are available'fer control circuits where these fuses,may be required in supplying power to centrol circuits used for the shutdown method and may be blown by the effects of a cable spreading room fire. The spare fuses should be located convenient to the existing fuses. The shutdown procedure should l
inform the operator to check these fuses.
(h) Verification that the manpower required to perform the shutdown functions using the precedures of (f) as well as to provide fire brigade members to fight the fire is available as required by the fire brigade technical specifications.
(i) Verification that adequate acceptance tests are performed.
i These should verify that: equipment operates from the local control station when the transfer or isolation switch is placed in the " local" nosition and that the equipment cannot be operated from the control room; and that equip-ment operates fecm the control roem but cannot be operated at the local control station when the transfer or isolation switch is in the " remote" position.
(j) Technical Specifications of the surveillance requirements and limiting conditions for operatien for that equipment not a'iready covered by existing Tech. Specs. For example, if new isolation and control switches.are added to a service water system, the existing Tech. Spec. surveillance require-ments on the service water system should add a statement similar to the following:
"Every third pump test should also verify that the pump starts from the alternate shutdown station after moving all service water system isolation switches to the local centrol position."
(k) Verification that the systems available are adequate to perform the necessary shutdown functions. The functions required should be based on previous analyses, if pessible (e.g.,
in the FSAR), such as a loss of nomal a.c. power or shutdown en a Group I isolation (SWR). The equipment required for the alternate capability should be the same or ecuivalent to that relied en in the above analysis.
l l
1
_m.
7-(1) Verification that repair procedures for cold shutdown systems art deve oed and material for repairs is maintained en site.
s s
O e
i 4