ML20126A608
| ML20126A608 | |
| Person / Time | |
|---|---|
| Site: | Zion File:ZionSolutions icon.png |
| Issue date: | 01/28/1980 |
| From: | Lainas G Office of Nuclear Reactor Regulation |
| To: | Schwencer A Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8002150214 | |
| Download: ML20126A608 (12) | |
Text
'
}b]?,' IVO }~
, ~.
[yanuou %, UNITED STATES ;
- y - y 3 5,( 3 g NUCLEAR REGULATORY COMMISSION
- i E WASHINGTON, D. C. 20565
. ;/
s e g . .v ..*
f JAN 2 81980 i
l MEMORANDUM FOR: A. Schwencer, Chief Operating Reactors Branch #1 Division of Operating Reactors i
i FROM: G. Lainas, Chief Plant Systems Branch Division of Operating Reactors
SUBJECT:
SAFETY EVALUATION REPORT, FIRE PROTECTION '
. PROGRAM REVIEW - ZION (TAC 11071)
Plant Name: Zion 1 and 2 i Licensee: Commonwealth Edison Company Docket Nos.: 50-295/30/ 4 Project Manager: E. Reeves
- Responsible Branch
- Plant Systems i Requested Completion Date:
Status: See Enclosure 1 4
- Our initial Safety Evaluation Report dealing with fire protection at the Zion facility was issued on March 10, 1979. In Section 3 of the SER, certain items were identified as incomplete and requiring further information from the licensee and evaluation by the staff. We have completed our review of information dealing with these incomplete items i as provided in the licensee's responses of April 14, 1978, May 1 and
- , 17, 1978, July 11, 1978, September 8 and 29,1978,- April 9, June 29, and
- August 31, 1979. The results of our review are described in our enclosed 4
evaluation.
! We have also enclosed a status sheet to reflect the present status of each fire protection open item. For items 3.1.1, Fire Detection System Tests, our response to the licensee of February 14, 1979, indicated the licensee's committment to do the tests was acceptable. We have informed the licensee of our intent to review the findings of any test program he conducts to comply with this request. For items 3.1.3 and
' 3.1.4, the asterisked indication was inadvertently missing from the original SER. This has been corrected on the enclosed status sheet and the licensee has been informed via telecon.
i i
i 1
8 0 0 215 0 2-l ef
- _ _ - _ __ _ _ _ , , ,.,,s , .y. ,..%,,, ,,-m.,, ., ,ww,.__w.r.----,,
A. Schwencer - 2- JAN 2 8 [990 Enclosure 2 contains requirements that should be sent to the licensee promptly with a request for a commitment within 30 days. If the licensee chooses not to meet these requirements, a meeting should be arranged within the same 30 days with appropriate management officials,
~ ()hb G. Lainas, Chief Plant Systems Branch Division of Operating Reactors e
9 0
0 0
9 e
O Q g
a
. . Enclosure 1 l
l l
ZION UNITS 1 AND 2 l
_ RESOLUTION OF INCOMPLETE ITEMS - STATUS Licensee Licensee Evaluation i S_taff Evaluation Response Due Due !
3.1.1 Smoke Detection Systems Infomation -(test None provided results) 3.1. 3 Gas Suppression System (1) inner and Outer Cable ,
Spreading Areas Information None provided j (2) Containment Penetration l Cable Vaults Complete l l
(3) Auto gas suppression for diesel driven containment spray pumps Information None provided 3.1. 4 Water Suppression Systems (a) Automatic water curtain for diesel generator air intakes Information None provided .;
(b) Automatic directed water )
suppression over diesel j fire pump and day tank Information None provided '
i 3.1.5 Fire Water System (a) Leakage detection of failures - in fire water system Complete 3.1.10 Portable Ventilation Equipment Complete 3.1.18 Reactor Coolant Pump Complete 3.2.1 Administrative Controls Incomplete None 3/10/80T 3.2.2 Electrical Cable Tests Complete 1 3.2.3 Tests of Typical Electrical ,
Penetrations Complete l
Licensee Staff Evaluation Response Due 3.2.4 Physical Separation Tests Requirement 30 days 3.2.5 Control Room Analysis Requirement 30 days 3.2.6 Containment Penetration Vaults Analysis Complete 3.2.7 Auxiliary Electrical Equipment Room Analysis Requi rement 30 days 3.2.8 Alternate Shutdown Capability Requirement 30 days
Enclosure 2 I
ZION UNITS 1 AND 2 -
FIRE PROTECTION EVALUATION ITEMS 3.0 EVALUATION The following provides our evaluation of the incomplete items.
Numbers in parentheses following each heading refer to the sections of our previously issued SER which address these incomplete items.
3.1 Electrical Cable Tests (3.2.2) l Our SER noted that control and instrument cables manufactured by the Boston Insulated Wire and Cable Company would be ,
tested to the flame test requirement of IEEE Std. 383-1974. '
By letters dated May 17, 1978 and July 11, 1978, the licensee provided a summary of the test results and their conclusion that the cable had passed the test.
1 We have reviewed the test results. We find that the electrical cables are acceptable.
i 3.2 Electrical Penetration Fire Tests (3.2.3) !
Our SER noted that tests or typical electrical penetration seals would be conducted to determine their fire resistance rating.
By letters dated April 14,1979, June 29,1979, and l September 29, 1979, the licensee provided a description of the fire test procedures, a summary of the test results, and a third party evaluation of the test results.
We have reviewed the test procedure and results. Our i consultant has witnessed the fire barrier tests conducted i at the U.S. Gypsum facility. We find that the cable penetration fire barriers seals constructed in accordance i with those tests are acceptable. 1 3.3 Control Room Analysis (3 2.5)
Our SER noted that an analysis of safety related shutdown systems would be conducted to demonstrate the fire related damage in the control room would not inhibit the capability to safely shutdown.
w -
I By letter dated June 26, 1978, we asked the licensee to veri fy:
(a) that the controls located at the remote shutdown panel are wired in such a manner that it was possible to override the main control board and take control at these local panels, (b) that the capability for local indication of essential parameters is provided which is either independent of fire damage in the control room or can be restored by the use of transfer switches, if a portion of the indication circuit is damaged by a control room fire, (c) that fuses and procedures be readily available for operations required to achieve and maintain hot shutdown conditions, and (d) the operability of diesel generator units and the capability to supply power to the ESF buses independent of fire damage to circuits located in the control room.
Our concern was raised over the licensee's statement contained in his May 1,1978 letter that "all equip-ment required to perform functions needed to achieve and maintain hot shutdown are powered from the ESF buses and are, therefore, available under loss of offsite power conditions."
Our criteria stipulates that safe shutdown must be achievable assuming the loss of offsite power and a fire. The licensee analysis therefore does not make the necessary assumptions to comply with our criteria; it assumes that a fire cannot affect equipment required for safe shutdown.
In response to the concerns of our June 26, 1978 letter, the licensee provided responses dated April 9, September 8, August 31, and September 29, 1978. The licensee's responses
, do not permit an adequate conclusion with respect to safe shutdcwn in two respects as follows:
(a) In the April 9, 1979 submittal, the licensee agreed to install test switches in each essential indication circuit to provide for isolation from the control room in the event of fire damage. ,
l.
~
The design that has been presented by the licensee does not permit a conclusion on two counts. First the sketches presented in a supplemental August 31, 1979 submittal contradicts information presented in the September 8,1978 submittal . The result is that the technical details of how circuit. isolation is to be accomplished is unknown; e.g., it is not clear if we are dealing with current loops or voltage loops.
Secondly, cables to the safe shutdown panel room pass through the control room. The details of how these cables are to be protected from exposure fires in the control room have not been provided by the licensee.
The configuration of combustibles and redundant systems in each area must be evaluated to demonstrate that adequate shutdown capability will survive a postulated fi re .
(b) In response to our concerns on the operability of the diesel generator units, the licensee responded by letter dated September 29, 1978. We have reviewed the licensee's response and we find the following:
(1) it is not clear that products of combustion will not propogate from the Reactor and Safeguards (R&S)
Control boards to the Auxiliary Power Control Boards via the two open channels connecting them. Therefore, it would be 3rudent to provide an appropriately rated fire <
barrier in tie open channel between the two panels; i
(2) the licensee stated that a fire could cause a shift in the diesel generator voltage, but he has not addressed whether this shift would result in a reduction of capacity such that essential shutdown loads would be affected; and (3) the local-remote transfer switch for the diesel generator governor is presently wired in such a way that it is not possible to isolate the main control board. The licensee has indicated he intends to provide isolation capability, to allow complete isolation of the main control board diesel generator governor control switch, from the main control room, We find this acceptable in concept pending our review of the verifications required by our guidance in Staff Position - Safe Shutdown dated June 9, 1979 Section 8b thru 1.
Therefore, in light of the inadequacies cited above, we will require a means to shut the plant down indeperdent of the control room. Refer to the reouirements stipulated under 3.6 herein.
O
3.4 Containment Penetration Vaults Analysis (3.2.6) i Our SER noted that an analysis of safety-related shutdown I systems would be conducted to demonstrate that fire related I damage in the containment penetration vaults would not I inhibit the capability to safely shutdown.
By letter dated May 1,1978, the licensee submitted an l analysis of the effects of a fire in the electrical pene-tration vaults. The analysis assumes the loss of the upper and lower cable vaults to fire. The licensee indicated that (a) the operability of pumps and valves required for safe shutdown Vould be unaffected; (b) a maximum of two of four channels of instrumentation may be affected; and (c) control would be maintained from the main control board for the postulated fire.
Because hot or cold shutdown conditions can be achieved and maintained in spite of the loss of all cables in these vaults, we find that fire related damage in this area will not prevent safe shutdown.
3.5 Auxiliary Electrical Eauipment Room Analysis (3.2.7)
Our SER noted that an analysis of safety-related shutdown systems would be conducted to demonstrate that fire related damage in the auxiliary electrical equipment room would not inhibit the capability to safely shutdown.
By letter dated May 1, 1979, the licensee provided an analysis of the effects of a fire in the auxiliary electrical equipment room. The analysis does not assume the complete loss of the auxiliary electrical equipment room because the licensee claims a 3' and 5' aisle spacing and enclosed metal control cabinets. However within a row, all adjacent cabinets are assumed lost and control would be maintained from the main control board. The licensee indicates that the capability to achieve and maintain het shutdown will l
l
I not be affected because (a) the operability of pumps and valves will be unaffected by a fire; and (b) a minimum of three separate channels of instrumentation are available, and a maximum of two out of the three channels may be affected by the postulated fires.
~
We have examined the drawings of the auxiliary electrical equipment room submitted by the licensee in his fire hazards analysis. These drawings indicate al' three divisions in one cabinet; and in another case, in a single row, all three divisions adjacent to one another.
The licensee cites the Sandia tests to conclude the acceptability of separation, however, we have found that j the separation for the divisions in the auxiliary electrical ;
equipment room is not adequate. The configurations of cables do not permit a direct comparison between the Sandia test configurations and the ones found in the Auxiliary Electrical Equipment Room at Zion. Because the Zion configurations are different and because our site visit identified large cable concentrations with geometries different from those used at the Sandia tests, we do not accept the Sandia tests as
- appropriate to these areas.
The licensee's analysis assumes a fire only in a row of panels and does not consider a fire in the overhead cabling.
The licensee has not identified which functions would be lost if a fire were to affect these panels.
We have reviewed the licensee's submittals and we find that the licensee has not provided sufficient justification for the following assumptions. The licensee: (a) has not assumed the coincident loss of offsite power, (b) has assun,ed limited fire damage, (c) has taken credit for manual operations without reference to the manpower required, (d) has not evaluated spurious activitation of components, and (e) has assumed that all equipment auxiliaries, pumps and valves are available.
We will require that the licensee provide an alternate shutdown system to shut the plant down independent of the auxiliary electrical equipment room, Refer to the requirements under Section 3.6 herein, 8
J t
3.6 Alternate Shutdown Capability (3.2.8)
Our SER noted that if the proposed test program for the physical separation of electrical cables or the analysis of critical areas does not demonstrate the capability to safely shutdown exists, an alternate means will be provided for safe shutdown which is independent of fire damage ir. such areas.
Our SER identified several areas where redundant cables or equipment necessary to achieve and maintain safe shutdown conditions could be damaged by an unmitigated fire. We noted in our SER that the licensee had not identified the systems, their associated electrical circuits and electrical cables to determine the consequences of fires on safety-related cables which are routed in close proximity. The separation of such cables and equipment and the rate at which fire could propagate throught the cable trays was not sufficiently defined to give the staff reasonable assurance that a fire would not degrade safe shutdown capability beyond acceptable levels. These areas are as follows :
5.1 Control Room 5.2 Cable Spreading Room 5.3 Containment Penetration Cable Vaults (acceptable) 5.4 Auxiliary Electrical Equipment Room 5.9 Auxiliary Building El 642' 5.10 Auxiliary Building El 617' 5.11 Auxiliary Building El 592' 5.12 Auxiliary Building El 579' 5.13 Auxiliary Building El 560' 5.14 Auxiliary Building El 543' 5.15 Reactor Containment 5.17 Crib House As discussed earlier, the licensee has promised an analysis that shows alternate shutdown capability is not required independent of the control room. With the exception of 5.3 Containment Penetration Cable Vaults, the staff does not have sufficient information to conclude that the separation is adequate for the fire areas 5.1 thru 5.17 above.
The licensee has not provided sufficient basis to assure that fire damage could not result in the loss of safe shutdown capability. We will require an alternate shutdown system independent of fire damage in areas identifed 'above as 5.1, 5.2, 5.4, 5.9, 5.10, 5.11, 5.12, 5.13, 5.14, 5.15. and 5.17.
l
4 7
If the combination of fire protection features required for safe shutdown includes alternate shutdown. capability indepen-dent of a specific fire area, both of the following design conditions shall be accommodated: (1) offsite power is available; and (2) offsite power is not available_.
If there are several such areas, the combinations of systens which provide the shutdown capability may be unique for each critical area. However, the shutdown capability provided for each such area shall be able to achieve and maintain subcritical reactivity conditions in the reactor, maintain reactor coolant inventory, achieve and maintain hot standby
- conditions for a PWR (hot shutdown
- for a BWR) for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, achieve cold shutdown
- conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown conditions thereafter. The reactor coolant system process variables shall be maintained within those predicted for a loss of normal ac power. The fission product boundary integrity shall not be affected; i.e., there shall not be fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary.
The performance goals for the shutdown functions shall be as follows:
- 1. The reactivity control function shall be capable of .
achieving and maintaining cold shutdown reactivity )
- conditions.
2 The reactor coolant makeup function shall be capable of maintaining the reactor coolant level above the top of the core for BWRs and in the pressurizer for PWRs. l
- 3. The reactor heat removal function shall be capable of-achieving and maintaining decay heat removal .
4 The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.
- 5. The supporting functions shall be capable of providing the process of cooling, lubrication, etc. necessary to pennit the operation of the equipment used for safe ,
shutdown functions.
- As defined in the Standard Technical Specifications. l M --W w- w q,gw y--ve % --s,- 9 -ymg m-qe -'nkg V -+-e+-n e,9-ps -- ryd
The equipment and systems used to achieve and maintain hot standby conditions (hot shutdown for a BWR) shall be (1) free of fire damage; (2) capable of maintaining such conditions for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the equipment required to achieve and maintain cold shutdown is not available due to fire damage; and (3) capable of being powered by both onsite and offsite electrical power systems or by onsite power systems that are independent of the onsite and offsite electrical power systems; and (4) the number of operating shift personnel exclusive of fire brigade members, required to operate the equipment and systems shall be onsite at all times.
The equipment and systems used to achieve and maintain cold shutdown conditions shall be either free of fire damage or the fire damage to such systems shall be limited such that repairs can be made and cold shutdown conditions achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Materials for such repairs shall be readily available onsite and procedures shall be in effect to implement such repairs. Equipment and systems used prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire shall be capable of being powered by both onsite and offsite electrical pcwer systems or by onsite power systems that are independent of the onsite and offsite electrical power systems; equipment and systems used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be powered by offsite power.
These shutdown systems need not be designed to (1) seismic l Category I criteria; (2) single failure criteria; or (3) cope with other plant accidents such as pipe breaks or j stuck valves except those portions of these systems which 1 interface with or impact existing safety systems.
All of the above requirements are now included in Appendix R to 10 CFR Part 50 which became effect on .
We, therefore, expect that the licensee will conform to these requirements. Subject to conformance to these requirements, these items are satisfactorily resolved.