ML20149L268

Forwards RAI to Complete Insp Activities Identified During Fire Protection Functional Insp at Plant

ML20149L268
Person / Time
Site:	River Bend
Issue date:	07/29/1997
From:	Wigginton D NRC (Affiliation Not Assigned)
To:	Mcgaha J ENTERGY OPERATIONS, INC.
References
NUDOCS 9707310238
Download: ML20149L268 (9)

Text

... -. -

- ~. - - -

7._--.-_...

July 29,1997 Mr.. John R. McGaha, Jr.

Vice President - Operations

.Entergy Operations, Inc.

River Bend Station i

P. O. Box 220 1

St. Francisv111e, LA 70775 i

SUBJECT:

RIVER BENO STATION, UNIT 1 - REQUEST FOR ADDITIONAL INFORMATION SUPPORTING FIRE PROTECTION FUNCTIONAL INSPECTION

Dear Mr.-McGaha:

t During July 1997, the Nuclear Regulatory Commission (NRC) staff conducted a

. fire protection functional inspection at the River Bend Station. During that inspection, we identified information that we will need in order to complete the inspection activities. Our list of questions are enclosed.

It is requested that Entergy Operations, Inc. (E01) be. prepared to discuss your responses at the meeting now scheduled for August 19, 1997. At that time, we can determine which of the questions, if any,.may need to be submitted,in a formal response.

In our questions, we requested you identify the current licensing basis for several items.

Please identify the appropriate documents prior to the meeting or provide copies at the meeting j

for our use.

If there are any questions in this matter, please let.us know.

Sincerely, Dav k'L Nikon,SeniorProjectManager i

Project Directorate IV-1 Division of Reactor Projects III/IV Office of Nuclear Reactor Regulation Docket No. 50-458

Enclosure:

Request for Additional Information cc w/ enc 1: See next page DISTRIBUTION:

Docket File.

PUBLIC PD4-1 r/f C. Hawes~

J. Roe D. Wigginton T. Gwynn, RIV ACRS OGC (15818)

E. Adensam (EGAl)

J. Clifford f.

Ol Document Name:

RBFPFI.LTR See Previous Concurrence.

0FC PM/PD4-h///

LA/PD4-l' SPLB*

NAME DWiggiNn/ww CHawes R/7)d SWest DATE 4/2M97 7/M/97 7/27/97 COPY kS)NO kNO h/N0 0FFICIAL RECORD EDPY W nan 37,oA EC FR.E CEMER COPY G

PDft

- -.... -. -. ~ - _. _

l aurg

?

g t

UNITED STATES l

g j

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. ta==a %

s...../

July 29,1997 Mr. John R. McGaha, Jr.

Vice President - Operations Entergy Operations, Inc.

River Bend Station P. O. Box 220 St. Francisville, LA 70775

SUBJECT:

RIVER BEND STATION, UNIT 1 - REQUEST FOR ADDITIONAL INFORMATION SUPPORTING FIRE PROTECTION FUNCTIONAL INSPECTION

Dear Mr. McGaha:

During July 1997, the Nuclear Regulatory Commission (NRC) staff conducted a fire protection functional inspection at the River Bend Station. During that-inspection, we identified information that we will need in order to complete the inspection activities. Our list of questions are enclosed.

It is requested that Entergy Operations, Inc. (E01) be prepared to discuss your responses at the meeting now scheduled for August 19, 1997. At that time, we can determine which of the questions, if any, may need to be submitted in a formal response.

In our questions, we requested you identify the current licensing basis for several items. Please identify the appropriate documents prior to the meeting or provide copies at the meeting for our use.

If there are any questions in this matter, please let us know.

Sincerely, David L.

gginton, Senior Project Manager Project Directorate IV-1 Division of Reactor Projects III/IV Office of Nuclear Reactor Regulation Docket No. 50-458

Enclosure:

Request for Additional Information cc w/ enc 1: See next page i

Z- -

~~

1 --.

Mr. John R. McGaha Entergy Operations, Inc.

River Bend Station CC*

Winston & Strawn Executive Vice President and 1400 L Street, N.W.

Chief Operating Officer Washington, DC 20005-3502 Entergy Operations, Inc.

P. O. Box 31995 Manager - Licensing Jackson, MS. 39286 Entergy Operations, Inc.

River Bend Station General Manager - Plant Operations P. O. Box 220 Entergy Operations, Inc.

1 St. Francisville, LA 70775

-River Bend Station l

P. O. Box 220 Director St. Francisville, LA 70775 Joint Operations Cajun 10719 Airline Highway Director - Nuclear Safety P. O. Box 15540 Entergy Operations, Inc.

Baton Rouge, LA 70895 River Bend Station i

P. O. Box 220 Senior Resident Inspector St. Francisville, LA 70775 P. O. Box 1050 St. Francisville, LA 70775 Vice President - Operations Support Entergy Operations, Inc.

President of West Feliciana P. O. Box 31995 Police Jury Jackson, MS 39286-1995 P. O. Box 1921 St. Francisville, LA 70775 Attorney General State of Louisiana Regional Administrator, Region IV P. O. Box 94095 U.S. Nuclear Regulatory Commission Baton Rouge, LA 70804-9095 611 Ryan Plaza Drive, Suite 1000 Arlington, TX 76011 Wise, Carter,. Child & Caraway P. O. Box 651 Ms. H. Anne Plettinger Jackson, MS 39205 3456 Villa Rose Drive Baton Rouge, LA 70806 Vice President & Controller Cajun Electric Power Cooperative Administrator 10719 Airline Highway Louisiana Radiation Protection Division P.O. Box 15540 P. O. Box 82135.

Baton Rouge, LA 70895 Baton Rouge, LA 70884-2135 t

(

I I

RIVER BEND STATION j

QUESTIONS RELATED TO THE ADEQUACY OF POST-FIRE SAFE SHUTDOWN CAPABILITY During July 1997, the Nuclear Regulatory Comission (NRC) staff conducted a l

fire protection functional inspection at River Bend Station (RBS).

In 2

continued support of the inspection, the following additional information is needed to resolve questions regarding the RBS post-fire safe shutdown capability.

Licensing and Design Bases for the Protection of Safe Shutdown capability I

1.

Operating Licensee NPF-47,-Condition 2.C.10, requires that the licensee i

implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report 4

through Amendment 22 and as approved in the SER dated May 1984 and Supplement 3 dated August 1985. As stated in the SER dated May 1984, the licensee committed to evaluate RBS against the technical requirements of Appendix R.-

In SER Supplement 3 dated August 1985, the NRC concluded that the RBS was in conformance with BTP CMEB 9.5-1, Sections III.G, III.J, and III.0 of Appendix R to 10 CFR Part 50, and GDC 3.

Identify the specific submittals and other documents that constitute the fire protection licensing and design bases for RBS.

In addition, describe how these documents established compliance with Section III.G. and III.L for those areas of the plant requiring the use of alternative post-fire safe shutdown capability.

Finally, describe any changes to the RBS fire protection licensing and design bases since the staff issued the aforementioned license condition.

2.

USAR Appendix 9A, " Fire Protection Program Evaluation Report,"

Section 9A.2.1.1, " Methodology," states that the methodology for the safe shutdown analysis is given in Figure 9A.2-II. According to this figure the fire protection separation design of the plant does not require safety related divisional equipment or systems to comply with the protection criteria established by Table 9A.2-35, " Fire Hazards Analysis Results." The figure specifies that all cables, components and systems required for safe shutdown (outside containment) will be identified and that one shutdown method will be protected by classical Ap.tendix R protection schemes. This safe shutdown methodology would treat cables and components that could cause the maloperation or prevent the operation of the safe shutdown function as required and would protect them i

appropriately.

During a previous Appendix R post-fire safe shutdown compliance inspection, the NRC staff confirmed that cables that could cause safety related equipment or non-safety related equipment to spuriously operate in a manner which could prevent the accomplishment of a required safe shutdown function were protected in accordance with Section III.G.2. of Appendix R (refer to NRC Inspection Report 93-09). Therefore, the ENCLOSURE

1 l

licensee addressed the potential for fire initiated spurious actuations and circuit failures by meeting the protection criteria of Appendix R.

This appears to meet the original licensing and design bases.

i program is based on an analytical circuit analysis approach to address A Thermo-Lag' reduction program was recently set into motion at RBS. This I

conditions that could prevent the operation or cause the maloperation of i

safe shutdown functions rather than the previous approach of providing i

fire protection features (primarily Thermo-Lag fire barriers) for required post-fire safe shutdown systems and associated circuits.

p Discuss the basis for this change in approach.

In addition, describe how the analytical approach meets the licensing and design bases that were previously reviewed and approved by the NRC staff.

Finally, describe why the analytical approach does not decrease the level fire protection that I

was previously approved by the NRC staff.

i 3.

USAR Appendix 7.4, " Systems Required For Safe Shutdown," does not recognize the use of ECCS as an assured shutdown method. USAR Section 7.4.1.4, " Remote Shutdown System (RSS)," states that the " initiating event that causes the main control room to become inaccessible could be a large transient fire that includes shorts and or spurious signals i

producing potential LOCA pathways and or incorrect system lineup for i

shutdown." This indicates that multiple fire-induced shorts, circuit j

faults, and spurious signals that could cause a LOCA were considered in the design of the RSS and that the RSS has the capability to meet the i

reactor performance criteria specified by Section III.L of Appendix R.

Discuss, in the context of main control room initiating event, how the current design of the RSS is capable of mitigating the LOCA pathway created by the fire-induced faults (including shorts) and spurious j

signals that could result in the opening of all 16 SRVs and meet the reactor performance criteria established by Section III.L of Appendix R.

I j

4.

USAR Appendix 9A, " Fire Protection Program Evaluation Report,"

i Section 9A.2.1.3, " Safety Relief Valve Spurious Operation," addressed inadvertent SRV opening and is analyzed in USAR Section 15.1.4 and discussed the separation of the control cables for the SRV solenoids.

The USAR Section 15.1.4 analysis addresses the opening of one SRV.

i Therefore, the discovery of a postulated fire which has the potential to 1

i cause all 16 SRVs to open appears to place the plant in a condition which is outside its post-fire safe shutdown design basis and in a condition l

not covered by its post-fire safe shutdown abnormal operating procedures.

Discuss how the fire induced opening of all 16 SRVs and its mitigation is bounded by the fire protection program and post-fire safe shutdown i

analysis. Verify the plant systems described by USAR Section 7.4,

" Systems Required For Safe Shutdown," would be free of fire damage and available to achieve and maintain post-fire safe shutdown.

!~

l !

i Fire-induced Circuit Failures and Compliance NRC Fire Protection Guidance i

5.

Section III.G.2 of Appendix R specifies that cables or equipment that can l

adversely affect the ability to achieve and maintain safe shutdown be free of fire damage. With respect to circuit failures (hot shorts, shorts to ground, open circuits), in Generic Letter (GL) 86-10, the NRC staff stated its position with regard to the circuit failure modes that need to be considered when identifying circuits that could be adversely i

j affected by spurious actuations. The response to Question 5.3.1 provided guidance for identifying those safe shutdown circuits that could be adversely affected by spurious actuation. Specifically, this guidance was intended to be used to define those circuits that can cause the maloperation or prevent the operation of safe shutdown functions by one or more of the circuit failure modes as specified by Section III.G.2 and III.L.7 of Appendix R.

In order to satisfy the Section III.G.2 and III.L.7 of Appendix R, the GL 86-10 guidance specified that both singular as well multiple circuit faults (e.g., one or more of the electrical failure modes) needed to be considered and that circuits (except non-1 hi/ low pressure interfaces, three phase circuits, and certain ungrounded i

DC circuits) that could result in spurious actuations should to be l

protected in accordance with Appendix R.

j In a project instruction, associated with the Thermo-Lag reduction 4

program, dated August 16, 1995, the licensee provided technical direction for performing a spurious actuation analysis. The circuit analysis criteria limited the number of failure modes to one hot short, or one short to ground, or one open circuit on an individual device or component basis. Discuss how the guidance provided in this project instruction (1) j meets the RBS licensing and design bases and (2) either meets or provides f

an equivalent level of fire safety to that specified by the guidance of GL 86-10, and Sections III.G.2 'and III.L.7 of Appendix R.

i Spurious Actuation of Safety Relief Valves 6.

RBS Safe Shutdown Analysis (240.201A, Rev.2) Section 4.11, " Electrical Cable Fire Damage," indicated that the integrity of insulation and external jacket material for electrical cables is susceptible to fire l

damage. To accommodate cable failure uncertainties in a consistent and j

conservative.sanner, this analysis, except where fire protection features exist, assumed that the fire induce damage to all cables in the fire area i

would render the affected components inoperable or cause spurious actuation.

It also assumed (1) fire damage occurs throughout the area under consideration; (2) fire damage results in an unreliable cable with i

-regard to proper safe shutdown function; and (3) fire damaged cable conductors of unprotected cables will short to other conductors located in the same or adjacent cables.

For the case involving the potential for fire to cause the spurious opening of all 16 SRVs as a result of damage to either of two unprotected multi-conductor cables associated with RPV pressure transmitters, RBS

i 4

stated that only a single conductor-to-conductor short had been assumed to be credible.

The licensee's position that only a single short circuit i

will occur as a result of fire damage to unprotected cables is not only inconsistent with the guidance presented by the staff in response to l

Question 5.3.1 of GL 86-10, but is also contradictory to its analysis assumptions presented in Section 4.1.1 of Criterion 240.201A, Rev 2.

h Discuss the technical basis for the current position that only a single short will occur as result of fire damage in a given fire area.

In addition, discuss how this position (1) meets the RBS licensing and design bases and (2) and how it meets or provides an equivalent level of g

safety to that specified by the technical requirements of Section III.G of Appendix R.

With respect to the SRV cable, using a sample of the cable, the cable vendor's information and data (from fire tests and any j

other germane sources), and drawings describe the potential fire-induced j

failure modes and effects.

I 7.

GDC 23 states, in part, that the " protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on i

some other defined br. sis if conditions such as... postulated adverse environments (e.g.,... fire...) are experienced." Given that a fire can cause all 16 SRVs to simultaneously fail open, discuss how the current RPV pressure circuit meets GDC 23.

1

~

j 8.

For Fire Areas C2 and C6, the revised RBS safe shutdown analysis states j

that only one standby service water (SSW) pump will be available. This l

SSW pump is required for cooling ECCS pump seals, room coolers, and 1

l diesel generators. So that the pump will not reach runout conditions, the safe shutdown procedure for a fire in these areas includes manual 1

actions which must be made prior to starting the SSW pump. For a postulated fire in these areas, which could cause the SRVs to open,

)

discuss if an ESF would initiate and cause the ECCS pumps and diesel generators to start prior to taking the manual actions necessary to limit 4

SSW flow and what impact this may have on achieving and maintaining post-fire safe shutdown as specified by Section III.G.1 of Appendix R.

1 Alternative Safe Shutdown capability l

9.

The guidance provided in GL 86-10. Question 3.8.4, Control Room Fire Considerations, states:

1 The damage to the system in the control room for a fire that causes evacuation of the control room cannot be predicted. A bounding analysis should be made to assure that safe conditions can be maintained from outside the control room. This analysis is 1

dependent to the specific design. The usual assumption are:

i 1.

The reactor is tripped in the control room.

i j

i l

i 1

[ :

2.

Offsite power is lost as well as automatic starting of the

)

onsite a.c generators and the automatic function of valves and I

pumps whose control circuits could be affected by a control j

room fire, i

The analysis should demonstrate that capability exists to manually l

achieve safe shutdown conditions from outside the control room by restoring a.c. power to designated pumps, assuring that valve lineup i

is correct, and assuming that any malfunctions of valves that permit the loss of reactor coolant can be corrected before unrestorable conditions occur.

1 Note that the only manual action in the control room prior to j

evacuation usually given credit for is the reactor trip.

For any additional control room actions deemed necessary prior to evacuation, a demonstration of the capability of perfonning such actions would have to be provided. Additionally, assurance would have to be provided that such actions could not be negated by subsequent spurious actuation signals resulting from the postulated fire.

For RBS, discuss what assumptions were used for a design basis control i

room fire and identify where in the licensing basis this was documented.

If the assumptions used are different from the guidance of GL 86-10, l

Question 3.8.4, identify the differences and describe their bases.

Using GL 86-10, Question 3.8.4 guidance, and the RBS systems that are

{

electrically independent from the effects of a control room fire, discuss j

the effects of the spurious opening of all $RVs due to a fire on (1) vessel level, (2) RCS pressure, (3) fuel cladding temperature, (4) suppression pool temperature, and (5) drywell temperature and pressure.

4 The safety assessment of CR 97-0991, appears to credit the availability of HPCS, LPCS, LPCI, and RCIC as necessary to mitigate the effects of spuriously opening all SRVs during a control room fire. Describe the licensing and design bases for assuming that these systems would remain available in the event of a postulated control room fire.

10. As specified in the guidance of GL 86-10, Question 5.3.10, the alternative safe shutdown system provided for the main control room should be designed to have sufficient capacity and capability to mitigate a design basis transient. This transient is based on the assumption that one worst case spurious operation and a loss of all automatic logic and signals occurs and is the entry point where the control room is evacuated and the alternative shutdown system is implemented. Discuss the RBS analysis that established the one worst case spurious actuation occurring from a main control room fire, the worst case spuricus actuation /

transient assumed as the entry condition, and associated plant response to the specific transient. Discuss the thermal hydraulic response n.

m w

3-l of the plant to this transient and how the mitigating operator actions and the implementation timeline provide reasonable assurance that the reactor performance criteria of Section III.L of Appendix R are satisfied.

11. At RBS, the steam driven' Reactor Core Isolation Cooling (RCIC) system is the only means assured to be available of injecting water into the RCS in the event of a design basis fire in the control room. Specifically, RCIC is the only RCS makeup capability which is electrically isolated from the effects of a postulated fire in the control room. The normal ECCS systems and reactor feedwater systems are not electrically isolated from the effects of a fire and, therefore, their availability or reliability to perform a RCS make-up function cannot be assured (e.g., fire damage to ECCS initiation logic, spurious closing of ECCS flow path valves, or spurious pump shutdowns).

Using the design basis plant transient specified by Question 5.3.10 of GL 86-10, assuming the opening of the SRVs is the worst case spurious actuation, and assuming the automatic initiation logic of ECCS is lost, it appears that a main control room fire could result in a severe plant transient that could adversely impact the ability of the alternative shutdown systems to perform their intended functions. Discuss the plant dynamics resulting from the postulated trantient (spurious opening of all SRVs) and how the systems that are electrically isolated from the control room and controlled from the RSS are capable of providing reasonable assurance that the reactor performance criteria of Section III.L of Appendix R are satisfied.

. -. - - - - - _ _ -. -