ML20151Z564
| ML20151Z564 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 09/16/1998 |
| From: | Grobe J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | Kingsley O COMMONWEALTH EDISON CO. |
| References | |
| 50-254-98-11, 50-265-98-11, NUDOCS 9809220024 | |
| Download: ML20151Z564 (2) | |
See also: IR 05000254/1998001
Text
{-
,
'
September 16, 1998
,
Mr. Oliver D. Kingsley
President, Nuclear Generation Group
Commonwealth Edison Company
ATTN: Regulatory Services
Executive Towers West lli
1400 Opus Place, Suite 500
Downers Grove, IL 60515
i
SUBJECT:
RESPONSE TO UNRESOLVED ITEM IN INSPECTION REPORT
50-254/98011(DRS); 50-265/98011(DRS)
Dear Mr. Kingsley:
l
This will acknowledge receipt of your letter dated August 31,1998, in response to our
letter dated July 2,1998, in which the NRC requested additional information needed to resolve
identified concerns regarding your safe shutdown methodologies at the Quad Cities Nuclear
i
Power Plant. These concems dealt with the potential loss of 125 Vdc control power, the effects
of fire damage to non-safe-shutdown equipment, the acceptabliity of crediting automatic closure
of the main steam line isC!ation valves, the acceptability of assuming a single spurious operation
in any fire area, and a lack of fire protection features over oil filled transformers. These issues
are the subject of ongoing discussions between Commonwealth Edison Company and the NRC.
Sincerely,
Original /s/ S. A. Reynolds for
John A. Grobe, Director
{
Division of Reactor Safety
I
Docket Nos.: 50-254;50-265
Enclosure:
Lir dtd 8/31/98 from J. Dimmette, Jr.,
Comed to USNRC
See Attached Distribution
9809220024 980916
i
ADOCK 05000254
G
.
DOCUMENT NAME: G:DRS\\QUA98011.TY
To ,oceive a copy of this document, and6cato in the boa: "C" * Copy wthout attachenant/ enclosure
"E= a Copy wth attachment / enclosure 4f" a No copy
OFFICE
Rlli
lC
Rill
d
Rill
A/ Rill
/v
,
NAME
Chyu:sd pb
Gardner P
RingM'L-
Grobe . ki
DATE
09/l/2/98
09/l(,/98
09f4/98
09//6/98
OFFICIAL RECORD COPY
I
, *-
t
.
1-
[
O. Kingsley
-2-
j
,
l.
,
.
I
I
i
l
cc w/o end:
M. Wallace, Senior Vice President
D. Helwig, Senior Vice President-
G. Stanley, PWR Vice President
J. Perry, BWR Vice President
D. Farrar, Regulatory Services Manager
1. Johnson, Licensing Director -
DCD - Licensing
.
_
l]
J. Dimmette, Jr., Site Vice President
!
W. Pearce, Quad Cities Station Manager
C. Peterson, Regulatory Affairs Manager
i
cc w/end:
R. Hubbard
i
N. Schloss, Economist
,
Office of the Attomey General
State Liaison Officer
Chairman, Illinois Commerce Commission
' W. Leech, Manager of Nuclear
MidAmerican Energy Company
Distnbution:
SAR (E-Mail)
..
Project Mgr., NRR w/enci
J. Caldwell, Rlli w/end
C. Pederson, Rlll w/end.
B. Clayton, Rlli w/end
SRI Quad Cities w/end
DRP w/enci
TSS w/end .
'
DRS (2) w/enci
Rlli PRR w/end
M UBLI IE-01 w/enci
,
D
REENS
LEO (E-Mail)
L
DOCDESK (E-Mail)
i
.
-
fy,034
'
L
)
!
,,
_
_
_ . - . _
..
_
_
,
_
'
. . .mm. s.m raili i c.. .n i . .mp..m
I,hilsl ( 1110% ( sCth fJ1tfJ kl lli. iti
jj"111 jtKit11 \\%C11ur b erllt
,
.-ri..o n<,iz,2.
,o
i
l
w v.na . :: , s
.
SVP 98-273
Aueust 31.1998
U. S. Nuclear Regulatory Commission
'
Washington. D. C. 20555
Attention:
Document Control Desk
Subject:
Quad Cities Nuclear Power Station. Units 1 and 2
Facility Operating License Numbers DPR-29 and DPR-30
NRC Docket Numbers 50-254 and 50-265
Response to NRC Inspection Report Numbers 50-254/9801I
i
and 50-265/98011
Reference: (1) J. A. Grobe (NRC) letter to O. D. Kingsley (Comed). dated July 2.
1998. "NRC Inspection Repon 50-254/98011 (DRS). 50-265/98011
,
(DRS)"
j
(2) J. P. Dimmette, Jr. (Comed) letter to USNRC, dated May 22,1998
(SVP-98-203)," Response to Questions Raised During Confinnatory
i
Action Letter Closure inspection and Summary of Fire Protection
Compensatory Actions
Enclosed is Commonwealth Edison's (Comed's) response to the request conceming
Unresolved issue (URI) 50-254/265-98011-01, transmitted in the subject repon.
Attachment A contains the response to the five-pan URI which penains to: (a) loss of
125 Vdc breaker control. (b) fire induced failure of non-safe-shutdown equipment. (c)
automatic closure of Main Steam Isolation Valves (MSIVs) (d) single spurious
operation, including the effect of Automatic Depressurization System ( ADS) failures on
the time line and (e) adequacy of fire detection and suppression in fire area TB-ll.
In concert with the ongoing fire protection program at Quad Cities Nuclear Power
Station and the Unresolved issues identified in the subject NRC Inspection Repon.
Comed has initiated the Fire Protection improvement Program. The Program
objectives consist of: 1) reducing the conditions leading to control room evacuation. 2)
eliminating post-restart compensatory measures. 3) reducing inter-unit dependencies.
.
-
-
l
l
ji -
SEP04 W
Mb$b\\d[O\\
g(
'
. - - - - . -
-
- . - -
- _ . - . . . - .-
.'
, , . .
l
SVP 98 273
2
August 31.1998
i
!
.
..
4) assuring the availability of 125 Vde. 5) reducing exemptions. 6) resolving
commitments to NRC. 7) developing an improved risk model and 8) improving the Gre
protection program. Elements of this Program include: 1) performing necessary
studies. 21 completing Gre protectior; improvement efforts. and 3) performing necessary
modifications. All studies. including the identification of potential improvement
changes.are scheduled to be co'mpleted by mid December.1998.
The identified potential changes from the improvement Program will be assessed using
-
the revised fire risk model. Insights identified during this assessment will be reviewed
for potential plant changes (modifications, procedure changes, etc.) and prioritized
based on enhanced compliance with regulations, risk significance, and cost-benefit.
,
As described in Reference 2, compensatory measures were taken (i.e.. once per hour fire
[
watches) for two issues (loss of 125 Vdc and multiple spurious operation of components
i
within the Residual Heat Removal and Reactor Core Isolation Cooling systems) that
!
were identified by the NRC. These two issues were subsequently encompassed within
,
two of the elements of the URI of the subject inspection Repon.
As pan of Comed's ongoing efforts under the Fire Protection improvement Program.
periodic status meetings with the NRC are planned. Comed will discuss results ofits
evaluations relative to the URis and planned activities at the next meeting.
If there are any questions or comments concerning this letter, please refer them to
Mr. Charles Peterson. Regulatory Affairs Manager, at (309) 654-2241. ext. 3609.
Sincerely.
t
(jk(.2/ pt)
b.
,
.
Joel P. Dimmette. Jr.
Site Vice President
Quad Cities Station
,
L
Attachment A: " Response to URI Regarding Appendix R Inspection Repon 98-01I"
J. L Caldwell. Acting Regional Administrator. Region 111
cc:
'
R. M. Pulsifer. Project Manager, NRR
C. G. Miller. Senior Resident inspector. Quad Cities
l
W. D. Leech. MidAmerican Energy Company
D. C. Tubbs. MidAmerican Energy Company
Office of Nuclear Facility Safety. IDNS
,
INPO Records Center
l
l
.
-
.
.
e
-
i
.
ATTACHMENT A
i
'
.,
Resp =se to URI Reg:rding Appe:: dix R Itspectirs Reprrt 98-011
SVP-98-273
,
(Page 1 of 17)
1. N R C l'R I 98-011-01(a):
. .
The 125 Vdc control power system was not shown to be free of fire damage for the
turbine building fire areas. When 125 Vdc is not available to the switchgear. fire induced
faults are cleared by upstream breakers to isolate the fault. These concerns are discussed
in Sections E.1.3 (b) and E.1.4 (b) of the inspection report.
Comed Resnonse to l'RI 98-011-01(a):
Inspection Repon 50-245/265 98-011 identified a specific weakness in the 125 Vdc
system described as " inadequate evaluation of, and level of protection for,125 Vdc
control power to 4 kv switchgear" that does not satisfy the technical requirements of 10
CFR p' art 50. Appendix R.
Regulatory Requirements
The applicable sections of 10 CFR part 50 Appendix R are III.G.3, III.L3 and Ill.L7.
Section 111.G.3 states "Altemative or dedicated shutdown capability and its associated
circuits. independent of cables. systems or components in the area, room or zone under
consideration shall be provided:
Where the protection of systems whose function is required for hot shutdown does
a.
not satisfy the requirement of paragraph G.2, of this section; or
,
b.
Where redundant trains of systems required for hot shutdown located in the same
fire area may be subject to damage from fire suppression activities or from the
rupture or inadvertent operation of fire suppression systems.
In addition. fire detection and a fixed fire suppression system shall be installed in the
area, room. or zone under consideration."
'
Altemative shutdown capability is provided because the requirements ofIII.G.2 are not
met at Quad Cities Station .
Section Ill.L.3 states. -The shutdown capability for specific fire areas may be unique for
cach such area. or it may be one unique combination of systems for all such areas. In
either case. the alternative shutdown capability shall be independent of the specific fire
area (s) and shall accommodate posttire conditions where offsite power is available and
where offsite power is not assilable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in effect to
-
implement this capability."
-
.
l
-
c
.
ATTACHMENT A
'
, ,
Respo se t) URI R:g:rding Apperdix R InspIcti:s R: port 98-011
'
SVP-98-273
(Page 2 of 17) .
Section Ill.L.7 states. "The safe sliutdown equipment and systems for each tire area shall
be known to be isolated from associated non-safety circuits in the tire area so that hot
shons.open circuits. or shorts to ground in the associated circuits will not prevent
operation of the safe shutdown equipment. The separation and barriers between tray s and
conduits containing associated circuits of one safe shutdown division and trays and
conduits containing associated circuits or safe shutdown cables from the redimdant
'
division.or the isolation of these associated circuits from the safe shutdown equipment.
shall be such that a postulated fire involving associated circuits will not prevent safe
shutdown."
Compliance Assessment
The equipment and associated circuits used to achieve safe shutdown are independent of
the specific fire area (s) and accommodate postfire conditions where offsite power is
available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. QCARPs have been
written for this requirement providing detailed instructions to implement this capability
with both otTsite power available and offsite power not available.
1
Safe shutdown equipment and systems are not damaged by fire and for each fire area are
known to be isolated from associated non-safety circuits in the fire area prior to use so
that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent
operation of the safe shutdown equipment. Coordination ofload breakers with upstream
breakers is provided. He attemate power supply is the SBO diesel generator. This power
supply as well as offsite power will provide the necessary fault current for a sufficient
time to ensure proper coordination without loss of function of safe shutdown loads. The
power supply and safe shutdown loads are isolated from the fire area. Electrical isolation
is provided to prevent spurious operation. The altemate power supply is available in
sufficient time to supply safe shutdown loads. Procedures ensure isolation of these
associated circuits from the safe shutdown equipment such that a postulated fire
involving associated circuits will not prevent safe shutdown.
Here is no self-induced LOOP in order to align safe shutdown buses or loads. Offsite
power is utilized if available. If 125 Vdc control power is available, it is used prior to
)
isolation. The actions required to isolate and manually align the electrical distribution
system in the es ent of a fire induced loss of 125 Vdc control power and a loss of offsite
power are contained in the procedures and the time to carry out these actions is accounted
for in the timeline.
l
,
.
'
,
'
.
l
ATTACIIMENT A
'
, ' .
Response to URI Regardi g App: dix R Itsp:cti:a Report 98-011
' *
SVP-98-273
(Page 3 of 17)
Compensatory measures (including. periodic fire watches). howeser, are in place to
address this issue by eliminating or minimizing the possibility of a tire that could
adversely affect the 125Vdc and 4KV equipment at the same time.
Related Enhancements
Codrdination has been achieved to the individual contr51 circuit level by replacement of
molded case circuit breakers and the individual control circuit trip fuses. These
,
replacements were completed prior to the recent restart. This reduces potential loss of
125 Vdc control power.
The safe shutdown analysis and implementing procedures are in compliance with
Appendix R Ill.L. As stated in our May 22,1998 letter (Reference 2), a study of possible
enhancements to the 125 Vdc system has been undenaken. The objectives of this study
are to determine modifications which will prevent simultaneous loss of control power to
both ECCS division switchgear given a fire in any area; preventing loss of control power
to the remaining (unaffected) division Emergency Diesel Generator; and preventing loss
of 125 Vdc control power from fires in opposite unit fire areas. The implementation of
the study has the potential to reduce local manual actions.
As stated in our May 22.1998 letter (Reference 2), compensatory measures have also
been implemented on an interim basis.
Conclusion
.
Compensatory measures are currently in place that eliminate or minimize the possibility
of a fire that could adversely affect 125Vdc and 4KV equipment simultaneously. An
evaluation of actions that can be taken to ensure the availability of 125Vdc power is in
progress.
.
%
%
-
-
. _ .
~
.
. _ .
.
..
.
,
'
ATTACHMENT A
.,
R:sponse is URI Reg :rdi g Appndix R Ins;nctics R: port 98-011
SVP-98-273
(Page 4 of 17)
i
.
\\
2. N RC URI 98-Oll-01(h):
NRC Inspection Report 98-011 requested a response concerning the effect of fire damage
to non-safe shutdown equipment on the ability to achieve and maintain safe shutdown
conditions. Section El.3 of the inspection report discusses how a loss of the 125 Vdc
created a potential for secondary fires due to overloaded and faulted conditions on the
!
EDGs. This in tum would create hazardous conditions for operators implementing the
alternate shutdown capability as well as for the fire brigade members attempting to
extinguish the fire.
J
Comed Response to URI 98-011-01(b):
-
The Inspection Report states that the evaluation performed to address the inspectors
concern of a faulted EDG " ..did not address: (a) the impact that faulted cables in
unknown locations of TB-Il might have on the fire brigade's ability to extinguish the fire:
(b) the potential for secondary fires to occur in areas other than the bus duct. switchgear
and cable and the impact this additional fire may have on the safe shutdown capability:
(c) the effect that a corresponding degraded bus voltage condition (i.e.. reduced voltage
resulting from the faulted condition) would have on the operability of shutdown loads
that might have been automatically loaded onto the faulted bus; or (d) the length of time
before shutdown procedures directed operators to trip the EDG output breaker."
Regulatory Requirements
.
Appendix R,Section III.L.3 states "He shutdown capability for specific fire areas may
be unique for each such area. or it may be one unique combination of systems for all such
areas. In either case, the alternative shutdown capability shall be independent of the
specific fire area (s) and shall accommodate postfire conditions where offsite power is
available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in
effect to implement this capability."
ComplianceAssessment
The Safe Shutdown Report (SSR). Section 5.1.1 indicates that a fire in Fire Areas TB-1.
TB-ll and TB-lli could result in the upstream switchyard breakers clearing faults on safe
l
shutdown buses. which could result in the loss of offsite power (LOOP). This could lead
to the automatic stan of the emergency diesel generators (EDG) and. assuming the EDGs
,
L
are connected to the bus prior to the loss of 125 Vdc control power. the EDGs would be
operating connected to the bus without protective relays. Therefore the faults would
only be limited by the capability of the EDGs to supply the fault current until the
~
-
generator winding fails or the diesel engine stalls (i.e. the engine can no longer turn the
'
e
t
,
._ _
_
. . _ _ _ _
_
.
_ _ _ _
. .
,
ATTACHMENT A
'
Respo se ts URI Regarding Appe dix R Irsp:ctirn Rep:rt 98-011
'
SVP-98-273
(Page 5 of 17)
t
.
generator). The EDGs are not credited for use in safe shutdown. The Station Blackout
'
'
Diesel Generators (SBO DG) are credited for use in safe shutdown.
l
1
The specific inspection Report issues (a)-(d). on the previous page. are not considered
to be of concem for the following reasons and are addressed as follows:
l
(a)
Nozzles on fire hoses used in areas which have electrical equipment are required
l
to be rated for use on energized electrical equipment with a voltage rating
-
appropriate for the hazard in the area. The fire brigade is trained for fighting fires
involving energized electrical equipment as well as other expected hazards.
.
(b)
Secondary fires would not occur due to the low magnitude of the fault current and
expected duration of the fault. The theoretical maximum fault current from the
EDGs is approximately 1700 amperes. Further, the EDG would not be expected
)
l
to run for an extended time because the generator winding will fail or the diesel
engine will stall due to the fault, as explained below. Therefore, secondary fires
would not occur and would not have an impact on safe shutdown capability.
(c)
On an automatic start of the EDG without a LOCA signal present. only the
associated 480 Volt Unit Substation transformer would be energized; all 4 kV
loads are automatically tripped. Degraded voltage can only be a concern for safe
shutdown loads if a specific sequence of events occur; For example, in Fire Area
TB-II (per Eigure TB-II-AC, Rev. 2 of the SSR), Buses 14 and 14-1 could lose
control power and are relied upon for safe shutdown. The RHR service water
pumps, which are fed from Bus 14, are independent of Fire Area TB-Il and would
not spuriously start. Therefore, these pumps will be free of fire damage and
available when Bus 14 is realigned for safe shutdown. Bus 14-1 feeds the RHR
pumps credited for a fire in this area. The following sequence of events must
occur for damage of the motors, due to degraded voltage, to be a concem:
1. The loss of offsite power (LOOP) must occur prior to the loss of 125 Vdc
control power, which will result in the automatic stan and connection of the
EDG to the bus.
2. The breaker for the unit tie to Bus 24-1 or the feed to Bus 31 must spuriousls
close.
3. One of the RHR pumps must spuriously start.
l
4.
125 Vdc control power must be lost and then a fault must occur on the feed to
,
either the unit tie or Bus 31. whichever is connected to the bus.
!
,
_
_
_
_
_
_
.
_ _ . _ _ _ _
_ _
_ _
,
ATTACHMENT A
'
,
,
Resp:ns ta URI Regardi g Appedix R Inspretim R1 port 98-011
SVP-98-273
(Page 6 of 17)
,
-
This sequence of es ents is highly unlikely to occur; however. as described below.
the EDG will not be able to sustain voltage under a faulted condition. Therefore.
I
the safe shutdown loads will not be damage by degraded voltage.
(d)
EDG runtime would be of a very short duration. The loss of 125 Vdc is due to the
)
'
power feed cables from the battery bus to the downstream buses being damaged:
-
both the 4 kV switchgear and the EDG would lose control power. The EDG
automatic controls would be lost. preventing the governor from increasing output.
With a fault on the generator output. the generator winding would fail open in a
~
few seconds or the diesel engine would be expected to stall. Commercial industry
events (per discussion with our EDG vendor] have shown that the generator
winding usually fails open in a few seconds. Therefore. the EDG would not be
expected to run until shutdown procedures directed operators to trip the EDG
output breaker.
Rela:cd Enhancements
The concern with damage to safe shutdown equipment and secondary fires due to the
automatic start and loading of the EDGs is related to the loss 125 Vdc control power. As
stated in our May 22,1998, letter (Reference 2), a study of possible enhancements to the
125 Vdc system has been undertaken. The objectives of this study are to determine
improvements which will prevent simultaneous loss of control power to both ECCS
division switchgear given a fire in any area; preventing loss of control power to the
i
.
'
remaining (unaffected) division Emergency Diesel Generator; and preventing loss of 125
Vdc control power from fires in opposite unit fire areas. The implementation of the study
has the potential to reduce local manual actions during postulated fire events and reduce
the time required to achieve safe shutdown. The extent ofimplementation will depend on
j
the CDF reduction.
As stated in our May 22.1998, letter (Reference 2), compensatory measures have also
been implemented on an interim basis.
Conclusion
Campensatory measures are currently in place that eliminate or minimize the possibility
of a fire that could ads ersely affect 125Vdc and 4KV equipment simultaneously. An
evaluation of actions that can be taken to ensure the availability of 125Vdc power is in
progress.
.
%
6
M
.
ATTACHMENT A
.,
l
Respo;se t2 URI RegardiYg Appendix R Inspecti:n Rep:rt 98-011
l
SVP-98-273
(Page 7 of 17)
.
3. NRC URI 98-Oll 01(c):
The NRC Inspection Report requested a response te the acceptability of crediting
automatic closure of the Main Steam Line Isolation Valves (MSIVsi. The inspection
Report provided that Generic Letter 86-10. " Implementation of Fire Protection
Requirements." Question 5.3.10. provided the NRC's guidance regarding plant transients
that should be considered in the design of an altemate shutdown system. This guidance
specified that the shutdown capability should not be adversely affected by a fire which
results in the loss of all automatic function (signals, logic) from the circuits located in the
area in conjunction with one worst case spurious actuation or signal resulting from the
fire. Furthermore, the inspection Report provided that at Quad Cities, credit for
automatic actions were taken in the'part of time line analysis for the thermal hydraulic
response of the plant.
Comed Response to URI 98-011-01(c):
Regulatory Requirements
10CFR50 Appendix R. Section ll!.L7 requires that. "The safe shutdowri equipment and
systems for each fire area shall be known to be isolated from associated non-safety
circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the
associated circuits will not prevent operation of the safe shutdown equipment. The
separation and barriers between trays and conduits containing associated circuits of one
safe shutdown division and trays and conduits containing associated circuits or safe
shutdown cables from the redundant division, or the isolation of these associated circuits
from the safe shutdown equipment, shall be such that a postulated fire involving
associated circuits will not prevent safe shutdown."
Compliance Assessment
The safe shutdown analysis credits the closure of the MSIVs to terminate vessel
inventory loss. For all fire areas, except the control room (SB-1), this is achieved by
giving the MSIVs a closed signal from the control room prior to evacuation. A circuit
analysis was performed for the MSIVs. to determine if any circuit failure. (i.e.. shorts.
grounds. opens. and hot shorts) could cause the MSIVs to open or prevent them from
closing. Since the control switches were assumed to have been closed from the control
room. no review was performed on the circuitry upstream of the control switch contacts.
The circuit analysis determined that no single spurious operation caused by fire induced
circuit failures could prevent both the inboard and outboard MSIVs on a given steamline
from closing. In addition. the circuit analysis identified no sincle fire induced failure that
-
,.
-.
.. - - -.- ...
_.- - - ..
,
.
ATTACHMENT A
'
.
l'
Resposse ta URI RegardiIg App:xdix R Irsp;etisa Report 98-011
i
SVP-98-273
I.
,
(Page 8 of 17)
!
could reopen both the inboard anbutboard MSIVs on a given steamline once they were
l
,
closed.
!
For the case where the fire is in SB-1 (control room, cable spreading room & auxiliary
electrical equipment room). use of the control switches was not credited. This is
'
conservative since with the exception of a fire in contro1 room panels 901(2)-3. 55. or 56.
the control switches for the MSIVs will be accessible prior to evacuation. The QCARPs
!
direct the operator to close the MSIVs from the control room switches if possible prior.to
1
evacuation. Actions are also taken to close the MSIVs from outside the control room by
l
, deenergizing both the AC and DC solenoids on both inboard and outboard valves. These
l
actions are taken within 10 minutes of the start of the transient and assure that the valves
are closed.
The Safe Shutdown Report (SSR), Section 5.2.1.5.1. provides a discussion of the effect of
having the MSIVs open for the initial ten minutes of the event and comparing it to the
effect on inventory loss of a single fire induced spuriously open relief valve. In the case
where the turbine bypass valves fail in the open position. the inventory loss would exceed
the amount through a single open relief valve. Closure of the MSIVs from the Group 1
Primary Containment isolation (PCI) logic (!ow main steamline pressure with the mode
switch in RUN)is credited for terminating the reactor inventory loss. Analysis by GE
determined that the MSIVs would close within 16 seconds. The amount ofinventory loss
'
in 16 seconds through the main steamlines would be less than the loss through one relief
valve open for ten minutes.
,
The original circuit analysis for the MSIVs was limited due to the assumption that the
control switches would be placed in the closed position. Further review of the MSIV
control circuitry has been performed to determine if there were any other fire induced
circuit failures that could have caused the MSIVs or the PCI Group 1 logic maloperation
to prevent closure of the MSIVs. The standard circuit failures (i.e., shorts, grounds.
. opens.and hot shorts) were postulated and reviewed for their effects on the MSIVs. This
review included cables from the pressure sensors for the main steamlines through the PCI
Group i logic to the MSIVs control circuits.
y
The results of the review indicate that no single fire induced failure can occur that will
cause both MSIVs in a given line to fail open. Fire induced failures in at least two of the
four instrument channels are needed to prevent the main steamline low pressure isolation
from being sensed by the PCI Group i logic system. The failures would have to be in
i
two separate cables and would have to be a specific set of cables to prevent the MSIVs
from closing. The same reasoning applies to the PCI Groupt logic. Two specific cables
-!
must fail to prevent the isolation signal from being sent to the MSIVs and closing all the
MSIVs. The PCI Group i logic is normally energized and will close the MSIVs when
,
.
- - .
. , . . , - .
-
. .
--.
-
_.
-
=
. -
-
,.
. . - .
. . - -
.
. -.
--
_ -
.
.- -.
. . _ .
. . . ..-
.
,
'
ATTACHMENT A
..,
Respo se is URI Reg:rdi g Appe: dix R I:specrim Rep:rt 98-011
SVP-98-273
(Page 9 of 17)
l
deenergized. therefore, there are no adverse consequences due to circuit failures which
open the circuit. No single fire induced cable failure in the PCI Group 1 logic will cause
both the inboard and outboard MSIVs to reopen once they are closed.
Hot shorts on the cable between the PCI Group I trip relays and the actual MSIV
solenoids could cause four MSIV's to be held open by energizing either the AC or OC
,
solenoids. However, the MSIV logic is divided such that the inboard and outboard
MSIVs do not share any cables. Therefore one cable failure would not affect both the
inboard and outboard MSIVs. This assures at least one MSIV on each steamline will be
closed.
Conclusion
Based on the above analysis of fire induced circuit failures. no one fire induced spurious
operation could prevent both inboard and outboard MSIVs from closing.
.
j
i
1
.
-
1
i
_
.
-.
g
.
ATTACHMENT A
..,
' Respor.se to URI Reg rding Apperdix R Inspretirn Rep:rt 98-011
SVP-98-273
(Page 10 of 17)
.
4. NRC URI 98-011-01(d):
The NRC inspection team concluded that the Quad Cities associated circuits analysis did
not meet the requirements of 10CFR 50. Appendix R. Sections Ill.G and Ill.L. The
primary concem was the assumption that only a single spurious operation would occur as
a result of a fire in any given fire area. The team also expressed concern over the
,
potential for multiple fire-induced ADS actuations given that multiple ADS circuit cables
are routed through the same fire zones. _ Related to this issue. the NRC requested an
.
evaluation of the impact of multiple ADS actuations on the safe shutdown time line (the
minimum time required to establish injection).
The NRC also expressed concem with the design changes recently implemented to
protect the RHR and RCIC pumps during a fire. These design changes provide adequate
pump protection for a postulated single spurious operation, but may not provide
protection during multiple simultaneous spurious operations leading to both a pump start
- and concurrent minimum-flow valve closure (resulting in deadheading the pump).
Comed Resnonse to NRC URI 98-011-01(d):
Regulatory Rquirements
For Quad Cities Stadon, Appendix R to 10 CFR 50 provides the requirements for
ensuring adequate post fire safe shutdown capability. Regarding asso.ciated circuits,
,
'
Appendix R,Section III.L.7 states: "The safe shutdown equipment and systems for each
fire area shall be known to be isolated from associated non-safety circuits in the fire area
so that hot shorts, open circuits, or shorts to ground in the associated circuits will not
prevent operation of the safe shutdown equipment..."
For safe shutdown actions taken outside the main control room (e.g. control room fire),
Generic Letter 86-10, Section 3.8.4 states: "The analysis should demonstrate that
capability exists to manually achieve safe shutdown conditions from outside the control
room by restoring a.c. power to designated pumps, assuring that valve lineups are correct.
and assuming that any malfunctions of valves that permit the loss of reactor coolant can
be corrected before unrestorable conditions occur."
.
.
1
-
-
. . _ . _
_ _ _ __ _._._ _ _.___. _ ____ _ _ . _ _ _____
'
ATTACHMENT A
i
.,
Respuse to URI Reg:rdi:g App:ndix R Inspectics Repsrt 98-011
SVP-98-273-
(Page 11 of 17)
'
in addition. Generic Letter 86-10. Section 5.3.10 provides the performance requirements
for designing attemate safe shutdown: "Per the criteria of Section Ill.L of Appendix R a
loss of offsite power shall be assumed for a fire in any fire area concurrent with the
following assumptions:
a)
The safe shutdown capability should not be adversely affected by any one
'
spurious actuation or signal resulting from a fire in any plant area: and
b)
The safe shutdown capability should not be adversely affected by a fire in
any plant area which results in the loss of all automatic function (signals.
)
logic) from the circuits located in the area in conjunction with one worst
case spurious actuation or signal resulting from the fire: and
-
c)
The safe shutdown capability should not be adversely affected by a tire in
any plant area which results in spurious actuation of the redundant valves
in any one high-low pressure interface line."
l
ComplianceAssessment
he Safe Shutdown Repon (SSR) for Quad Cities describes the methodology used to
ensure that that fire induced failures of equipment and cables will not adversely impact
l
the post fire safe shutdown capability. The associated circuit analysis was not limited to
a single spurious operation for each fire area. Any system or component that either
interfaces with the primary system or a safe shutdown system was evaluated. Fire
induced spurious operations such as an uncontrolled pump / turbine staning, and valve or
breaker repositioning which could occur as a result of shon circuits. open circuits, or hot
shorts in control or power cables were identified and evaluated. The focus of the analysis
was to ensure:
- RCS inventory was maintained;
RCS makeup capability was provided;
e
Fire induced spurious operation of valves would not prevent system performance.
e
cause system damage or divert essential flow;
Fire induced spurious operation of pumps / turbine would not damage essential
e
equipment; and.
Fire induced spurious operation of electrical components uould not result in a loss of
power to essential equipment.
.
~
_,
-
.--
-
-
,
._
_
._.
. _ . _ _ _ . _ _ . -
_ _ . _
_ . _ . _ _ _ _ _ .
_ _ _ _ _
_._
_
l
ATTACHMENT A
'
.
'
'
Respmse to URI Regarding Appendix R I::sp:etim Rep:rt 98-011
l
SVP-98-273
i
(Page 12 of 17)
,
For the special case of valves that form the interface between the primary coolant
boundary and low-pressure piping ("high low interface") the evaluation included the
potential for sequential failure of redundant valves. The highilow pressure interface
valves are addressed in the SSR.
The results of the ass'ociated circuit analysis were used in the deselopment of the
.
implementing Safe Shutdown Procedures. As appropriate. specitic actions to address
each fire induced spurious operation have been incorporated into the safe shutdown
~
procedures. These actions include the alignment of power to designated pumps, assuring
that valve lineups are correct, and assuming that any malfunctions of valves are corrected
before unrestorable conditions occur. The transient analysis which determined the
timeline and overall effectiveness of the Safe Shutdown Analysis and implementing '
procedures considered a single fire induced spurious operations or signal. An adequate
level of safety is provided by implementing procedural requirements to address the
potential for fire-induced spurious operations, and by demonstrating that the performance
requirements for alternate safe shutdown are maintained during a bounding fire induced
single spurious operation. It is our understanding this approach demonstrates compliance
,
with the requirements of Appendix R in ensuring associated circuits will not prevent
operation of safe shutdown equipment.
Comed is sensitive to the issues raised by the NRC during the NRC inspection regarding
multiple fire induced spurious operations that could impact safe shutdown activities, such
as the start of an injection pump and subsequent closure ofits corresponding minimum
,
'
flow valve leading to pump damage. Because of the NRC concems. Comed completed a
multiple spurious operations study on July 31,1998. The results of this study are
currently being evaluated.
As stated in our May 22.1998 letter, interim compensatory measures have been initiated
to address this issue.
l
.
f
i
.,
. - . ,
. . ,
-
,
. - _ .
--
_
_
__
___
_ _ _
_.
-
.
._
_ _ _ _
___
l
ATTACHMENT A
'
.
Resp:nse to URI Regardi:g Apperdix R insp:ctim Report 98-011
SVP-98-273
(Page 13 of 17)
.tlultiple ADS Valve Actuations
I
The fire protection design basis at Quad Cities and Dresden stations was challenged by
the NRC during a 1988 Appendix R audit at Dresden Station. During that audit. a
specific concem was raised regarding the routing of several ADS conductors in the same
,
' cable. The NRC indicated that when evaluating spurious operations of the Automatic
-
Depressurization System multiple shorts do not need to be considered, but multiple
shorts within any given cable should be considered'. Based on this guidance, Comed '
proposed design changes to separate individual cables to preclude inultiple spurious
operations of the ADS valves at Quad Cities and Dresden Stations. These modifications
have been completed at Quad Cities Station. In a July 6,1989, NRC Safety Evaluation
'
Report for Dresden, the NRC reviewed the modifications and found them to be
acceptable to address the issue.
The cunrent SSR at Quad Cities considers a single ADS valve actuation in evaluating the
timeline requirements for establishing injection. He safe shutdown procedures also
require a 10-minute action to de-energize the ADS system. This action effectively closes
the single ADS valves assumed to be open. and prevents further spurious ADS actuations
from occurring. Considering only a single ADS actuation during the initial 10-minute
period provides an adequate level of safety in view of the low chance of multiple
actuations occuning during the initial 10-minute period.
Comed has performed a preliminary assessment of the impact of multiple spurious ADS
valve actuations. De evaluation determined that a total of two ADS valves has a
relatively minor impact on the time requirements for establishing RPV injection and does
not pose a significant safety issue. Considering more than two ADS valve actuations has
a greater impact on the time requirements for injection. However, Comed does not
consider this a significant safety issue because: 1) positive actions are taken within 10
minutes to de-energize the ADS valves, and 2) the low chance of occurrence of multiple
(more than two) ADS valve actuations to occur within the first 10 minutes.
i Comed lener to USNRC dated September 16,1988
-
-
_
,. _
._. .
.
.
. . _ . _ _ _ _ _ _ _ . . _ _ _ _ _ _ .
_ _ _ _ _ _ .
_ _ _
ATTACHMENT A
.,
Resp:nse to URI Regarding App = dix R Insprctias Rzport 98-011
SVP-98-273
(Page 14 of 17)
, .
Related Enhancements
Due to the NRC concems in th's area. Comed completed a study of fire induced multiple
spurious operations. This study identified combinations of spurious operations (with
l
panicular focus on redundant valves and pump / valve combinations) that could have an
l
adverse impact on post-tire safe shutdown capability. - A total of 78 combinations of
l
spurious operations have been identified that may have an adverse impact on post fire
safe shutdown. A systematic evaluation of the results of the study is underway which
I
!
will identify any necessary safe shutdown program enhancements including procedure
l
changes. revisions to the Safe Shutdown Repon, or plant design changes. Actions to
address this issue will enhance compliance with Appendix R and will be prioritized based
on risk benefit as determined by our enhanced fire risk model. The multiple spurious
i
operations study encompassed the RCIC and RHR pumps, which were identified by the
!
NRC as not potentially being protected during fire induced multiple spurious actuations.
As stated in our May 22,1998 letter (Reference 2), compensatory measures have also
been implemented on an interim basis.
Conclusion
Comed completed a study of fire induced multiple spurious operations. A systematic
evaluation of the results of the study is underway which will identify any necessary safe
shutdown program enhancements including procedure changes, revisions to the Safe
,
Shutdown Report, or plant design changes. Actions to address this issue will enhance
compliance with Appendix R and will be prioritized based on risk benefit as determined
by our enhanced fire risk model.
As stated in our May 22,1998 letter, Comed is committed to evaluate improvements to
strengthen the overall fire protection and safe shutdown capabilities at Quad Cities
Nuclear Power Station. Comed is also working closely with the BWR Owners Group
(BWROG) Appendix R-Fire Protection committee. The BWROG is in the process of
developing generic guidance on the implementation of Appendix R requirements.
l
,
-
i
.
e
ty-'
- - -
~
r
-
---
r
e
,.
-
-
-
-
--
ATTACHMENT A
..
Respo:ise to URI Reg:rdi:g Appe: dix R Inspectin Rep:rt 98-011
SVP-98-273
(Page 15 of 17)
,
.
5. NRC URI 98-011-01(c):
The NRC inspection team indicated that fire area TB-ll did not appear to have adequate
6te detection and suppression equipment to ensure compliance with Appendix R. Section
Ill.G.3. The inspection report noted that failure to properly identify the correct location
of a fire involving oil filled transformers could cause the Ope'rators to unnecessarily enter
safe shutdown procedures and evacuate the control room. causing an additional hazard to
the unit. and could delay proper fire brigade response.
,
Comed Response to URI 98-011-01(c):
Regulatory Requirements
The NRC inspection team reviewed whether the fire detection and suppression in fire area
TB ll complied with the requirements of Appendix R, Section Ill.G.3.
Section Ill.G.3 pertains to the use of an alternate shutdown strategy and requires that:
" Fire detection and a fixed fire suppression system be installed in the area. room.
or zone under consideration."
Additionally, Generic Letter 86-10 provides further guidance on the issue of area
detection and suppression. Enclosure I to GL 86-10, Section 5, states:
" Suppression and detection sufficient to protect against hazards of the area must
be installed. In this regard, detection and suppression providing less than full area
coverage may be adequate to comply with the regulation. Where full area
suppression and detection is not installed, licensees must perform an evaluation to
assess the adequacy of partial suppression and detection to protect against the
hazards in the area."
ComplianceAssessment
The area of concem identified by the inspection team is in the Turbine building central
group within fire zone 8.2.7.C. on the mezzanine level. As this zone does not have full
area detection and suppression. a fire protection engineering evaluation was prepared to
demonstrate that sufficient fire detection / suppression is installed to protect against the
hazards of the area.
l
l
l
.
-
,
__ .
__
_ _ _ _ _
_.
. . _
_
.
ATTACHMENT A
l ..,
Resp =se to URI Reg:rdi:g Appe: dix R I:sp:ctirn Rep:rt 98-011
l
SVP-98-273
l
(Page 16 of 17)
~
The inspection team did not concur with this evaluation noting the following issues:
1. The unprotected section of this fire area contains two transformers with
!
approximately 330 gallons of oil each.
'
2. A transformer oil fire would be unmiligated by an automatic suppression system and
give off a large quantity of smoke.
3. The smoke could be very heavy and obscure the location of the fire. '
4. Failure to identify the correct location of the fire could cause operators to
unnecessarily enter the safe shutdown procedures and evacuate the control room.
-
5. Fire brigade response could also be delayed if the correct location is not identified.
The inspection team did conclude, however, that the revised SSR did not affect the
technical basis for the exemptions previously granted in this fire area for complying with
Appendix R,Section III.G.2.(separatiori of redundant systems).
The technical basis for not providing full area fire detection or suppression in TB-II. fire
zone 8.2.7.C. is based on the following fire hazard analysis features:
(Issues 1 and 2)
The dielectric in the subject transformers (transformers for busses
.
.
17 and 27) is Pyranol, an askarel fluid, and not a combustible mineral oil. Askarel
has no fire point (the lowest temperature a liquid will burn continuously when ignited
by flame). It is a nonflammable fluid and indicative of a non-fire hazard. Therefore,
fire detection and a fixed suppression system are not warranted for this nonflammable
liquid filled transformer.
(Issues 3 and 5)
In the event of a catastrophic transformer failure or rupture. the
.
generation of a large quantity of smoke is prohibited due to the nonflammable
characteristics of the askarel. Although a high-energy arc or fault could result in a
flash of this dielectric fluid. automatic disconnects are provided to de-energize the
equipment. The elimination of the ignition source. via phase overcurrent and residual
ground fault protection on the high side of the transformer. further ensures that the
askarel fluid will not suppon continued combustion or result in a smoke-laden
environment. Therefore. smoke obscuration is prevented thereby allowing the
Operators. including the fire brigade to accurately identify the fire location and to
take appropriate actions to mitigate the consequences of a fire.
-
-
.
,
._.
_
.
.
ATTACHMENT A
Response to URI Regr_rdi:g Appe: dix R Inspection Rep::rt 98-01I
SVP-98-273
(Fage 17 of 17)
(Issue 4) The notification of a transformer failure incident is pros ided by multiple
e
alarms that annunciate in the main control room. The alarms include bus trips.
breaker feed trips. loss of control power. and the individual trips for the equipment
fed from these transformers. Therefore. multiple simultaneous alamis will annunciate
in & control room signifying a failure in the immediate area of the transformers.
T:
alarm notifications will promptly and accurately identify the' location in the
esem of a transformer failure. An operator or the fire brigade can also be summoned
. to the specific location to assess potential fire damage. Since this is not a severe
uncontrolled fire, normal and emergency operating procedures are sufficient to handle
this scenario, and since the transformers for busses 17 and 27 do not supply safe
shutdown equipment, prematurely entering the safe shutdown procedures or
evacuating the control room will not occur.
Fire protection features are provided for the hazards in the area. These features include:
Ceiling level automatic sprinklers in the center aisle area above the turbine lube
.
oil tanks and the MG set coolers.
Fixed automatic water spray systems for the turbine oil reservoirs.
.
Automatic sprinklers at floor level above the resin containers.
Automatic fire detection in the center aisle area above the oil hazards.
.
Curbing around the transformers to contain a fluid spill, in addition, floor drains
are provided immediately outside the curbs and throughout the area to handle any
fluid runoff.
-
Fire hose stations and portable fire fighting equipment throughout the area.
e
Steel beam fireproofing above the switchgear on Unit I and MCC on Unit 2.
Limited fixed combustibles, a cable tray above the transformer /switchgear. and no
.
permanent combustible storage area within 30 feet of the transformers.
Conclusion
Prompt notification via control room annunciation alarms will alen the Operators to the
fire location and the equipment affected. Fire and smoke development are significantly
reduced by the use of nonflammable dielectric fluid in the transformers. Adequate fire
protection equipment and measures are provided to ensure compliance with the
regulation.
-
.