ML20205C115
| ML20205C115 | |
| Person / Time | |
|---|---|
| Site: | FitzPatrick  |
| Issue date: | 03/26/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20205C110 | List: |
| References | |
| 50-333-99-02, 50-333-99-2, NUDOCS 9904010083 | |
| Download: ML20205C115 (29) | |
See also: IR 05000333/1999002
Text
{{#Wiki_filter:. e U.S. NUCLEAR REGULATORY COMMISSION REGION I Docket No: 50-333 License No: DPR-59 Report No: .50-333/99-02 Licensee: New York Power Authority Facility: James A. FitzPatrick Nuclear Power Plant Location: Post Office Box 41 Scriba, New York 13093 Dates: January 25 - February 9,1999 Inspectors: A. Della Greca, Senior Reactor Engineer B. Norris, Resident inspector D. Dempsey. 9eactor Engineer ' C. Cahill, Reactor Engineer Approved by: Laurence T. Doerflein, Chief Engineering Programs Branch Division of Reactor Safety l 4 l 9904010083 990326 ~~~ gDR ADOCK 05000333 PDR _ l l
-- 4 t EXECUTIVE SUMMARY Jtemes A. FitzPatrick Nuclear Power Plant NRC Inspection Report 50-333/98-07 The primary objectives of this special team inspection, conducted during the period between January 25 and February 5,1999, were to evaluate the cause or causes of the January 14, 1999, hydrogen fire, the licensee's response to the event, and the actions taken to understand i ! ~ the event and prevent its recurrence. Operations l Overall, the conduct of operations personnel during the H fire event was good. e 2 Operations personnel were attentive, used good communications, and exhibited a proactive questioning attitude. However, their failure to complete a surveillance test ! procedure and secure the emergency diesel generators, resulted in leaving the emergency electrical system in an unanalyzed condition for 3.6 hours and the failure to meet the requirements of the FitzPatrick Technical Specification regarding procedure adherence. Based on the licensee's taking reasonable actions to address the violation and prevent its recurrence, this violation was not cited consistent with the guidance of l Appendix C of the NRC Enforcement Policy. (NCV 50-333/99 02-01) (01.1) The licensee also initiated action to evaluata :md correct an apparent discrepancy between Sections 7.3 and 7.4 of Administrative Procedure AP-02.06 regarding i procedure adherence guidance. During the hydrogen fire of January 14,1999, the licensee operated both pairs of e emergency diesel generators (EDGs) unloaded with their respective tie breakers open for 3.6 hours. Operation of :he EDGs in this alignment placed the electrical system e,d the plant in an unanalyzed configuration that was not recognized by either the operating l staff or by Engineering until approximate'y a week after the event. The consequences of l the licensee's actions were limited because of the short duration of the event and because the EDGc were available for manual loading on the emergency buses. Also the licensee's probability risk assessment model indicated a low core damage frequency value. Nonetheless, the licensee's decision to operate the plant in the above i configuration increased the probebility of a station blackout and decreased their ability to mitigate the consequences of an accident. (04.1] A design feature of the emergency electrical system permits leading only one EDG of the e pair on the emergency bus if the associated tie breaker is open. The licensee did not take credit for this feature in their design and licensing bases of the plant. However, a relay race in the control circuitry could prevent the EDGs to function as intended. Therefore, this characteristic of the logic was considered a weakness of the design (O4.1) > ' ii l 1 L
. i l The operator who manipulated the hydrogen system was generally familiar with the
i system and the associated operatinc procedure as well as with the safety requirements for handling industrial / compressed p ases. The training module, however, had not specifically addressed the training recommendations of EPRI Report No. NP-5283-SR-A regarding consequences of component malfunctions at the hydrogen supply facility and the potential hazards of the hydrogen gas. (O5.1) Enaineerina The temporary modification prepared to provide hydrogen makeup to the main generator e i was acceptably prepared and implemented. (E1.1] The oxygen facility was in good physical condition and the tank was adequately sited. e The operability determination prepared to justify the adequacy of the battery rooms air i intake, located within the EPRI-specified unacceptable range, was reasonable. [E1.2) The response of the technical support team tc the event was prompt and guidance was e i provided as needed. Engineering, however, did not recognize the effect of leaving the EDGs running unloaded and with the tie breaker open and were, therefore, not effective in preventing Operations from operating the emergency electrical buses in an unanalyzed condition. The licensee's evaluation of the event was ongoing, but planned and completed activities appeared comprehensive, detailed, systematic, and a good example of integrated departmental efforts. (E2.1] The use of a hydrogen delivery trailer as a third source of hydrogen did not conform to )
I the design description for the facility in the UFSAR and did not meet all of the guidelines , specified in EPRI Report NP-5283-SR-A, as specified in the UFSAR. The impact of such l deviations on the design and operation of the system as well as on the severity of the fire event was being investigated by the licensee and the results of such review were still incomplete. This is an apparent violation pending completion of the effort by licensee, identification of corrective actions, and review by the NRC. (eel 50-333/99-02-03) (E8.1)
The licensee's preliminary evaluation of the ability of a single diesel to accelerate and carry the design loads, in the event that the paralleling of a pair of emergency diesel generators failed to take place, indicated the potential overloading of the diesel. Also, the single EDG test conducted in December 1998 was not designed to demonstrate single emergency diesel generator capability under accident conditiont,. The licensee ' planned to develop formal calculations but the issue was not a concern during this inspection because operatiori of the en ergency bus with a single diesel generator is not within the design basis of the plant. (El'.2] e The licensee had not previously verifiet proper operation of the EDG pair loading sharing circuits. The licensee revised ihe testing procedure to verify proper circuit operation in the future. This minor violation was not subject to formal enforcement action. 1 iii J
. , i l l ) Plant Support The overall emergency preparedness response to the Hydrogen fire was good. o , l Especially noteworthy was the ability to implement alternate locations for the emergency response facilities and still have them activated and functional within an hour. [P1.1] The training provided to the fire brigade to combat the hydrogen fire was appropriate. In e addition, the quick request by the Fire Brigade Leader for off-site assistance was instrumental in minimizing the damage to other equipment in the area. [F5.1] l l l iv l
p. - . l l 1 ! L TABLE OF CONTENTS ' PAGE . EXECUTIVE SUMMARY ....................................................ii TABLE OF CONTENTS . .....................................................v 3 I 1. O P E RATI O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 O1 Cond uct of 0pe ratio n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 j O1.1 Operations Response to the Hydrogen Fire . . . . . . . . . . . . . . . . . . . . . . . . . 1 ! O.4 Operator Knowledge and Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 04.1 Emergency Diesel Generator Design Basis and Operation . . . . . . . . . . . . . 4 i 05 Operator Training and Qualification . . . . . . . . . . . . . . . . . . . . . . . . . ...........8 ' 05.1 System Operating Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 111. Engineering . . . . . .... 9 ................. .. ..................... ...... E1 Conduct of Engineering . . . . . . . . . . . . . . . . .................. .... .. ..... 9 E1.1 Makeup Hydrogen for Main Generator . 9 ................. ........... E1.2 Bulk Oxygen Tank Storage Siting . . . ..........................10 1 E2 Engineering Support of Facilities and Equipment . . . . . . . . . . . . . . . . . . .........11 E2.1 Engineering Support of the Hydrogen Fire Event and Root Cause Analysis . 11 E8 Miscellaneous Engineering issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,12 E8.1 Post-fire Hydrogen Storage Facility inspection . . . . . . ................12 E8.2 Emergency Diesel Generator Capability . . . . . . . . . . . ...............13 E8.3 Emergency Diesel Generator Load Sharing . . . . . . . . . . . . . . . . . . . . . . . . . 14 < IV Plant Support Activities . ... 16 ... ................... .... ... .... P1 Conduct of EP Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. ...... 16 ... P1.1 Implementation of Emergency Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 F5 Fire Protection Staff Training and Qualification . . . . . . . . . . .................16 F5.1 Firs Brigade Training Related to Flammable Gases . . . . . . . . . . . . . . . . . . . . 16 ' V. M anagement Meetings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 X1 Exit Meeting Summary . . . . . . . . . . . . . . . . . . ......... ... 17 ..............
. . l l Report Details l Summary of Plant Status During the period between January 25 and February 5,1999, the NRC conducted a special team inspection at the James A FitzPatrick Nuclear Power Plant as a result of a hydrogen fire ,
esvent on January 14,1999. The objectives of the inspection were to: evaluate the cause or ! causes of the fire; assess the fire damage and its impact to safety-related structures, components, and systems; determine the response of protective equipment (if any); and evaluate the licensee's response to the event and their actions to understand the event and i prevant its recurrence. The plant remained at or near full power throughout the inspection . period. 1. Operations .01 Conduct of Operations 01.1 Operations Response tcpe Hydroaen Fire a. Insoection Scooe On January 14,1999, a fire started in the control cabinet of the hydrogen (H ) addition 2 system at the James A. FitzPatrick Nuclear Power Plant. The facility entered the Emergency Plan and requested offsite fire department assistance. A detailed description of the event and a time line are included as Attachment 3 to this report. The team evaluated the response of the operations personnel during the H fire. The 2 evaluation included observations of activities in the control room and in plant by the resident inspectors during the event, discussions with the operations crew and station management, and a review of applicable portions of the Technical Specification (TS) and plant procedures, b. Observations and Findinas , When the control room operators received the report of the H fire, their actions were < 2 quick and decisive. They promptly sounded the site alann, announced the emergency, and dispatched the fire brigade to the scene of the fire. After the Fire Brigade Leader . (FBL) reported the magnitude of the fire, the Shift Manager (SM) directed the evacuation of the general area and all buildings near the H tank-farm. In accordance with the 2 Emergency Plan, the SM assumed the duties of Emergency Director and declared an Unusual Evant, the lowest of four possible emergency action levels (EALs). The team independently reviewed the EALs and considered the classification to be appropriate. The Control Room Supervisor (CRS) conducted a precautionary brief of the shift l personnel, including concems of a reactor scram and/or a loss of offsite power, in l addition, a reactor operator was directed to continuously monitor the reactor parameters during the fire. Overall, the conduct of the operating staff during the event was very ' good. Operations personnel were attentive, knowledgeable of procedural requirements, used good communications, and exhibited a proactive questioning attitude. l
. . 2 Due to the proximity of the 115KV switchyard to the H tank-farm, the FBL requested 2 that the switchyard be de-energized for the safety of the fire fighters. Two 115KV electrical lines supply offsite ac power to the plant's emergency buses. The CRS r3 viewed the precautions associated with the loss of the offsite emergency ac power, briefed the operators, and directed that the 115KV switchyard be de-energized. The team considered the actions of the CRS to be proactive in anticipating the "what if" scenarios related to the loss of 115KV power. Section 3.9.B of the FitzPatrick TS requires that all four emergency diesel generators (EDGs) and both 115KV lines remain operable during power operation. If one or both the 115KV line3 are not available, limiting condition for operation (TS Section 3.9.9.2) allows the reactor to remain in operation for up to seven days, provided that all EDGs and emergency core cooling systems are operable. TS Surveillance Requirement (TSSR) 4.9.B.5 states that, if the emergency ac power supply is degraded, the availability of the operable EDGs shall be demonstrated by manual starting and force paralleling each set of EDGs. The surveillance test procedure developed by the licensee to meet the requirements of the above section of the TSSR is ST-9D, "EOG,115KV Reserve Power, Station Battery, or ESW [ emergency service water] System inoperable Test." Section 1.1.2 of this ' procedure stated, in part, that, "If both reserve [115 KV offsite power] sources ... are inoperable, then the following is per'ormed: Subsection 8.1 and 8.2 (EDG Test) within 1 j hour and at least once per 24 hours thereafter." j The steps of subsections 8.1 and 8.2 for testing the availability of the 'A and C' and the 'B and D' EDGs, respectively, required manually starting the EDGs, verifying that the forced-parallel tie-breakers automatically close, manually opening the tie-breakers, and stopping the EDGs and returning them to the standby condition. Specifically, subsections 8.1.7, for the 'A and C' EDGs, and 8.2.7, for the 'B and D' EDGs, directed that the control switches for the EDGs be placed in "STOP." Within one hour from the de-energization of the 115KV switchyard, the CRS initiated action to test the EDGs. If properly implemented, as required by the TSSR, the procedure would have permitted the sequential verification of the availability of the two sets of EDGs and their subsequent placement in the standby Mode. Instead, as a precaution, the SM directed the operating staff not to complete sections 8.1 and 8.2 of the procedure and leave all four EDGs running unloaded, with the respective tie- breakers open. The four EDGs were left rJnning in that condition for 3.6 hours. The licensee's failure to complete the steps of the procedure subsections and return the EDGs to the standby mode immediately following the opening of the tie breakers resulted in placing the plant in an unanalyzed condition for the period when the EDGs were left running. The licensee discovered the condition a week later, as described further in section 04.1 of this report. In failing to complete the steps of the surveillance test procedure, the licensee failed to meet the conditions of section 8.8(A) of the Technical Specification which requires that written procedures be established and implemented. if the conditions did not permit the use of the procedure as written, the licensee could have alternatively implemented the procedure change process, as allowed by TS sections 6.8(B) and (C) for permanent and
F . , 3 temporary changes, respectively, in an emergency, i.e., when actions are required to protect the public health and safety, and there was not sufficient time to implement the change process, the licensee can invoke the latitude allowed by 10CFR50.54(x). The licensee did not implement the procedure change process and did nct invoke the latitude allowed by 10 CFR 50.54(x). The requirements of 10 CFR 50.54(x) regarding procedure adherence were included and paraphrased in section 7.4 of the licensee's administrative procedure AP-2.06, " Procedure Use and Adherence." During discussions with the SM regarding the concern that not completing the surveillance test procedure was not consistent with the requirements of TS 6.8(A), the team determined that another section (7.3) of procedure AP-2.06 also addressed procedure adherence. This section, which states, in part, that, "In an emergency, operations personnel are authorized to depart from procedures where necessary to protect personnel, the public, or prevent damage to the facility..." is derived from section 5 of ANSI Standard 18.7 -1972 which is referenced in section 6.8 (A) 1. of the FitzPatrick TS. The team believed that section 7.3 of AP-2.06 might allow some latitude which is in addition to that allowed by 10 CFR 50.54(x) and section 7.4 of the same procedure. The team discussed this concern with the licensee who indicated that they would evaluate the guidance provided in the two sections and determine whether a procedure revision or a Technical Specification amendment was required to render the two documents consistent. On March 23,1999, they formalized this understanding by initiating a commitment action item, ACT-99-40532, with a completion schedule of April 30,1999. The licensee's failure to complete the surveillance procedure step and placement of the electrical system in an unanalyzed condition constituted a violation of the Technical Specification (TS) section 6.8(A) requirements regarding procedure implementation. However, because: (1) the violation was not willful; (2) no previous examples of similar violations were identified by the team; (3) the licensee issued a night order and revised applicable operating and surveillance procedures to caution against future operations of the di9sels in the unanalyzed condition; (4) the licensee initiated action to provide training to the operating and technical staff regarding the issue; and (5) the licensee initiated an action item to evaluate the discrepancy between the guidance of AP-02.06 and the requirements of the FitzPatrick TS and 10 CFR 50.54(x) regarding procedure implementation; this violation is not being cited in accordance with the guidance of Appendix C of the NRC Enforcement Policy. (NCV 50-244/99-02-01) c. Conclusion Overall, the conduct of operations personnel during the H fire event was good. 2 Operations personnel were attentive, used good communications, and exhibited a proactive questioning attitude. However, their failure to complete a surveillance test procedure and secure the emergency diesel generators, resulted in leaving the emergency electrical system in an unanalyzed condition for 3.6 hours and the failure to meet the requlrements of the FitzPatrick Technical Specification regarding procedure adherence. Based on the licensee's taking reasonable actions to address the violation and prevent its recurrence, this violation was not cited consistent with the guidance of Appendix C of the NRC Enforcement Policy.
F ! . . l l 4 The licensee also initiated action to evaluate and correct an apparent discrepancy ' between Sections 7.3 and 7.4 of Administrative Procedure AP-02.06 regarding procedure adherence guidance. O.4 Operator Knowledge and Performance i 04.1 Emeroency Diesel Generator Desian Basis and Operation a. Inspection Scope (93702) I During the January 14,1999, hydrogen fire at FitzPatrick, the licensee operated the two ] pairs of emergency diesel generators (EDGs) unloaded and unparalleled for 3.6 hours. The team assessed the acceptability of the EDGs operating in this mode and its impact on the operability of the emergency buses. The assessment included reviews of the FitzPatrick technical specifications, Updated Final Safety Analysis Report, emergency power system logic diagrams, and operating and surveillance procedures, The team also reviewed applicable portions of the EDG load calculations and discussed the event with licensee operators and engineers, b. Observations and Findinas Desian and Licensino Basis The design of the FitzPatrick onsite 4 KV emergency power system consists of two independent and redundant emergency buses (Division I bus 10500 and Division 11 bus 10600). Each bus is supplied by a pair of EDGs that operate in parallel to meet the minimum emergency load requirements. Each EDG, rated to carry a continuous load of 2600kW, has sufficient capacity to supply power to the loads needed (less than 1400kW) to safely shut down the reactor following a transient involving a loss of offsite power (LOOP). The EDGs also have sufficient capacity that, as a pair (5200 kW), can supply the engineering safeguards feature (ESF) loads needed (approximately 4000 kW) to shutdown the reactor, maintain safe shutdown conditions, and mitigate the consequences of a loss of coolant accident (LOCA) coincident with a LOOP. Each pair of EDGs is supplied with three circuit breakers, one to tie the output of the generators together and the other two to connect the output of the individual generators to the emergency bus. On a s' art demand signal, both pairs of EDGs start automatically. When they reach 200 revolutions per minute (rpm), the tie circuit breakers close and force-parallel the outputs of the generator pairs while the engines are still t celerating if ' normal voltage is present on the emergency buses, the EDG output break , remain open and the EDGs continue to run, in their standby mode, unloaded and .. parallel. If voltage is not present on the buses, the system logic causes all loads (except the 600 Vac emergency substations) to be stripped from tneir respective buses, the EDG output breakers to close, and the ESF loads to be connected to their buses according to a pre- f ! l l
s. , l , l 4 5 programmed start sequence. If either EDG fails to start or the associated tie breaker fails to close, only one EDG is allowed to supply the emergency bus. In this case, if a l LOCA signal is present, one of the two residual heat removal (RHR) pumps is inhibited ' from starting. i The FitzPatrick safety analyses assume that one pair of EDGs is available, as a l ! minimum, to supply the associated emergency bus, i ' Event Descriotion ! As described in Section 01.1 of this report, during the January 14,1999, hydrogen fire, the operators de-energized both 115KV offsite power lines at the request of the fire brigade. This action resulted in the operators entering TS limiting condition for operation (LCO) 3.9.B.2 for unavailability of both reserve (115 KV) station transformers. This condition required that operators verify the ability of both EDG pairs to manually start and force parallel per TS 4.9.B.5 and surveillance procedure ST-9D, "EDG,115KV, Reserve l Power, Station Battery or ESW System inoperability Test." Following the successful l demonstration of the EDGs availability, as a precautionary measure, the SM decided to leave the EDGs running unloaded. Tie breakers 10504 and 10604 had been opened per ST-9D procedure steps 8.1.6 and 8.2.6, respectively. The decision not to secure the i EDGs was noted in the remarks section of the surveillance procedure. The EDGs were secured after 3.6 hours of operation. Later in the day, after the fire was out and the 115KV lines were restored, the licensee performed a regularly scheduled monthly surveillance test of the Division 11 EDGs. During this test the output breaker (10312) of l the "D" EDG failed to close. Operators performed the correct compensatory measures i' for this occurrence. Emeroency Diesel Generator Control Loaic Following the event, on January 21,1990, the licensee informed the NRC that a later review of the emergency diesel generator protective scheme indicated the possibility that one or more of the EDGs may have failed to energize the emergency buses in the event of a main generator trip with the 115KV supply out of service. The licensee's original concern was thst, with the EDGs running, a loss of the main generator would result in the EDG output breakers closing on to the emergency bus. However, because the tie breakers were open, the EDGs would be unsynchronized and the simultaneous closure of the output breakers of each EDG pair could result in the loss of one or more EDGs on overcurrent. Subsequent review of the breaker control logic by the licensee determined that their original concern was unfounded and that only one EDG would load on each bus. J To verify the licensee's conclusions, the team reviewed the EDG load breaker control l l logic. The inspectors determined that the automatic closing circuit included two parallel I l - paths, one for the condition when the tie breaker is closed (normal condition following a . l LOCA/ LOOP start signal), and one for the condition when the tie breaker is open (failed force paralleling). The team identified no concerns with the breaker " normal" closing j path. However, they did observe the following weakness in the closing circuit for the j open tie condition. l I
. , 6 As stated above, if the tie breaker is open only one EDG is allowed to load on the emergency bus. This is accomplished through an auxiliary circuit that evaluates the readiness of each EDG (in the EDG pair) and allows the loading of only the first EDG to reach readiness. Specifically, with the tie breaker open, when the output voltage of each EDG ( e.g., B and D) reaches its pre-established setpoint (90%), it energizes the associated voltage relay (27B and 27D, respectively). The first of the two relays to energize (e.g.,27B) energizes, in turn, an auxiliary relay (27XB). A contact from this relay, after a 0.8 second time delay, permits closure of the associated EDG ("B") load breaker. A second contact from the same auxiliary relay blocks the energization of the other auxiliary relay (27XD) and the closure of the associated EDG ("D") load breaker. Note that, although the example refers to EDGs B and D, the same is applicable to EDGs A and C. In the above description, the ability of the circuit to perform its function is based on the assumption that the two EDGs will not reach the voltage setpoint at the same instant. In fact several milliseconds (dependent on the response time of the individual relay) would suffice to make the circuit operate as intended. However, should the two voltage relays reach their setpoint at the same time, both auxiliary relays (27XB and 27XD) would continue to cycle off and on (energize and de-energize) until one relay fails or slows down sufficiently to allow the other relay to accomplish its intended function (close the associated EDG output breaker). Given the independence of the EDG starting circuits cnd the fact that the tie breaker would have to fail to close for the condition to exist, the team did not believe the above scenario to be likely to occur normally. As a result, the team believed this circuit characteristic to be a weakness rather than a deficiency of the design. During the event, however, the opening of the tie breakers rendered the condition likely to occur. During the event, the EDGs were started manually and, according to procedure ST-9D, they were not loaded on the bus. When the EDG output voltages reached their I respective setpoints, the voltage relays energized, but no breaker actuation occurred because the emergency buses were powered by the normal supply. Later, when the licensee opened the tie circuit breakers, both auxiliary relays (27XB and 27XD) were l armed (ready to energize), waiting for a loss of the normal power to occur. Had that , occurred, both auxiliary relays (27XB and 27XD) would have energized concurrently and l their cycling would have begun. l As the licensee concluded, the circuit would have not allowed the simultaneous loading of the unsynchronized EDG pairs on the emergency buses and, hence, the potential loss on overcurrent of both emergency buses. However, the loading of a single EDG on the each emergency bus would have been highly dependent on the individual response time of the relays involved and potentially might have not occurred without manual intervention by the operating staff. The licensee recognized the existence of a relay ' " race,". but believed that one of the relays would have energized and prevented the other from actuating, thereby allowing a single EDG to load on each emergency bus. l l I
. . 7 The team reviewed the design logic and confirmed that, during LOCA load sequencing, closure of only one EDG output breaker inhibits the automatic start of one of the two RHR pumps. The team also confirmed through a review of surveillance procedure ST- 9C, " Emergency Ac Power Load Sequencing and 4KV Emergency Power System Voltage Relays Instrument Functional Test," that this logic feature had been tested satisfactorily in December 1998. Assessment of the Event As stated previously, the onsite emergency power system includes two emergency buses, each designed to be powered by two EDGs operating in parallel. This design represents the analyzed configuration of the plant electrical system and satisfies the single failure criterion. With the tie circuit breakers intentionally left open, if the logic performed as intended, only one EDG would load on each bus. This configuration is not within the design basis of the plant, was not analyzed by the licensee, and does not satisfy the single failure criterion. Licensee operations and engineering personnel did not recognize the implications of their decision to open the tie breakers until a week later, during their analysis of the event. During the event, the unit remained in operation and continued to supply the design loads. Therefore, no adverse effect was experienced by the plant. However, because of the fire fighting activities in the proximity of the switchyard, the probability for a loss of the main generator increased and with it the temporary loss of all ac power. Complicating factors were provided by: (1) the relay race that could have prevented all EDGs from loading on the emergency buses; (2) one EDG load breaker that failed to close when tested following the event; and (3) the ability of one EDG to accelerate the loads scheduled to be sequenced on the bus (see Section E8.1). The consequences of the licensee's decision were mitigated by the short duration of the event, the availability of at least three EDGs for immediate manual loading on the emergency buses, and the availability of the offsite sources to power the buses within a short time. Risk Analysis A turbine trip with the power conversion system available has the highest initiating frequency of 3.45 times per year. This transient was used by the licensee in their evaluation of the incident. As stated above, even if it is assumed no automatic loading of the diesel generators, they were available for manual start and loading. The same was true for both offsite power sources. I in the event of a station blackout (SBO), caused by a load rejection and failure of the - I onsite as well as of the offsite sources, the facility would rely on the high pressure core injection, the reactor core isolation cooling, and the automatic depressurization systems. The facility can cope for eight hours with this equipment and the de power supply system. In addition, it would take five more nours before core uncovering. The lic3nsee's probability risk assessment (PRA) shows that the limiting case for a SBO is i l l J
. . 8
bounded by a large break LOCA and a portion of the intermediate break LOCAs. Using 3 the licensee's PRA model, the total probability for these LOCAs is 1.8E-7. This value indicates that the risk of the H event was low. This value would have been even lower if 2 l the model had considered recovery of the ac sources in a timely manner, as would have beers expected. l l c. Conclusions i ' During the hydrogen fire of January 14,1999, the licensee operated both pairs of emergency diesel generators (EDGs) unloaded with their respective tie breakers open for 3.6 hours. Operation of the EDGs in this alignment placed the electrical system and the plant in an unanalyzed configuration that was not recognized by either the operating j , l staff or by Engineering until approximately a week after the event. The consequences of l the licensee's actions were limited because of the short duration of the event and l because the EDGs were available for manual loading on the emergency buses. Also the licensee's probability risk assessment modelindicated a low core damage frequency value. Nonetheless, the licensee's decision to operate the plant in the above l configuration increased the probability of a station blackout and decreased their ability to ! mitigate the consequences of an accident. A design feature of the emergency electrical system permits loading only one EDG of the ' l pair on the emergency bus if the associated tie breaker is open. The licensee did not take credit for this feature in their design and licensing bases of the plant. Therefore, this characteristic of the logic was considered a weakness of the design, not a deficiency. However, a relay race in the control circuitry could prevent the EDGs to function as intended. 05 Operator Training and Qualification 05.1 System Ooeratina Procedures a. Insoection Scooe (93704) , The team interviewed the operator who manipulated the hydrogen system at the time of hydrogen fire, reviewed the system training module and material safety data sheet for hydrogen, and compared the licensee's training module to the training guidelines provided in the applicable Electric Power Research Institute (EPRI) Report to assess the adequacy of the licensee's hydrogen system train.. g. b. Observations and Findinas , The team found that the licensee's hydrogen addition system training module, SDLP- 89A, adequately addressed the basic operation of the system, particularly the portion of the system located downstream of the hydrogen farm. The training module, however, did not fully address all of the training areas recommended in section 6.3 of EPRI Report No. NP-5283-SR-A, Guidelines for Permanent BWR [ Boiling Water Reactor) Hydrogen , Water Chemistry Installations - 1987 Revision. For instance, module SDLP-89A did not address the consequences of component malfunctions at the hydrogen supply facility and the potential hazards of the hydrogen gas.
o . . 9 The team's interview of the operator determined that he was familiar with the system and l the system operating procedure, including manipulation precautions. The operator had also received general industrial / compressed gas safety training. However, consistent witn the content of the training module, he had not been given specific training on the j hazards of hydrogen. Because the licensee's root cause analysis had not been j completed, the team was unable to ascertain whether the training of the operator contributed to or could have prevented the hydrogen fire event. { l c. Conclusions i The operator who manipulated the hydrogen system was generally familiar with the system and the associated operating procedure as well as with the safety requirements I for handling industrial / compressed gases. The training module, however, had not specifically addressed the training recommendations of EPRI Report No. NP-5283-SR-A regarding consequences of component malfunctions at the hydrogen supply facility and the potential hazards of the hydrogen gas. Ill. Enaineering E1 Conduct of Engineering E1.1 M.jgtu; Hydroaen for Main Generator a a. Inspection Scope (64704) The team reviewed and physically inspected a temporary modification installed to provide makeup hydrogen to the main generator. The inspection addressed the quality of the design as well as the adequacy of the fire protection program with respect to the handling of high pressure hydrogen cylinders. b. Observations and Findinos
The fire on January 14,1999, disabled the normal hydrogen supply to the main generator. To maintain plant operation, the licensee initiated Temporary Modification No. 99-006, Alternate Hydrogen Makeup to the Main Generator. The team found that the modification and the supporting procedural changes had been acceptably completed. During the physicalinspection of the modification, the team found that three discharged hydrogen cylinders had been stored at elevation 272 of the turbine building. The cylinders, although discharged, contained hydrogen at a residual pressure of approximately 65 psig. Discussions with the licensee determined that the area had been evaluated (JDED-97-0370) and approved fc7 storage of acetylene. However, the licensee had not prepared a safety evaluation for the storage of hydrogen in this area l and had not obtained a combustion control permit (CCP), as required by section 8.1.1 of l procedure AP-14.04, " Combustible and Flammable Material Contiol." As stated in this section of the procedure, a CCP is required for the use of a flammable gas in any i quantity in nonsafety-related areas.
. . 10 Because the cylinders contained on'y residual hydrogen and had been stored in the area for approximately only two days, they represented only limited hazard. Furthermore, when the team notified the licensee of the discrepancy, they promptly removed the cylinders. The failure to properly control combustibles, as required by plant procedure 'AP-14.04, constitutes a violation of minor significance of 10 CFR 50, Appendix B, Criterion V, and is not subject to formal enforcement action. c. Conclusions The temporary modification prepared to provide hydrogen makeup to the main generator was acceptably prepared and implemented. E1.2 Bulk Oxvoen Tank Storaae Sitina a. Insoection Scooe (93704) The team conducted a physical inspection of the oxygen tank storage facility and reviewed the siting design criteria to determine whether the design of the facility conformed to the licensing commitments and regulatory requirements. b. Observations and Findinos The oxygen storage facility consists of a 3000-gallon liquid oxygen cryogenic tank, ambient air vaporizers, and a pressure / temperature control station. The facility is located approximately 130 feet West of the diesel generator building. The team found the physical condition of the facility to be satisfactory. , l Section 9.20.3 of the updated final safety analysis report (UFSAR) states that the facility j is designed and constructed in accordance with EPRI Report No. NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations - 1987 Revision. The team compared the siting of the facility to the requirements in the EPRI report. L They found that the licensee could not show that all of the safety-related air intakes were j
located at an acceptable distance from the oxygen tank in accordance with figure 4-8 of ' the report. The licensee conducted a survey of the facility and found that the battery rooms air , l intake fell within the unacceptable range specified in figure 4-8. To document and track
l the discrepancy, the licensee initiated DER-99-00172. They also prepared an operability l determination (JDED-99-0038) and found the condition acceptable. The licensee based ' this determinat!on on the fact that the air intakes were approximately 500 feet from the oxygen storage tank, on the opposite side of the turbine building, and that the building shielding would prevent tne development of an oxygen enriched environment. The team j found this determination to be reasonable. L
u v9 , 11 c. pgnclusions The team concluded that the oxygen facility was in good physical condition and that the tank was adequately sited. The nperability determination prepared to justify the adequacy of the battery rooms e intake, located within the EPRl-specified unacceptable range, was reasonable. E2 Engineering Support of Feds'.ies and Equipment E2.1 Enaineerina Sucoort of the Hydroaen Fire Event and Root Cause Analysis a.' Insoection Scope (93794) The team evaluated the involvement of the engineering staff in the resolution of the fire event and the root cause analysis prepared to evaluate underlying design and - performance issues and to initiate appropriate corrective actions. b. Cbservations and Findinas Based on concems with the size of the fire and potential exposure of the old administration building to the effects of the fire, as stated in section P1.1 of this report, the Emergency Director ordered the Miocation of the Technical Support Center to the main library. The response of engineering personnel was prompt and relocation of the facility took place in an orderly and timely manner. Engineering monitored the event and provided the needed guidance. However, as also stated in section O4.1, they were unaware of the consequences of operating the EDGs unloaded and with the tie circuit breaker open. Therefore, they were not effective in preventing Operations from operating the emergency electrical buses in an unanalyzed condition. Regarding the analysis of the event, the licensee promptly assembled three multi- discipline teams, one to evaluete the root cause of the event, one to assess the plant ' response, and one to address recovery from the eunt. By the end of the inspection the efforts of all three teams were ongoing and incomplete. The NRC inspection team, nonetheless, reviewed tha methodology and status of the root cause analysis. The team determined that the licensee had nearly completed their collection of evidente and the development of potential scenarios leading to fire initiation. The licensee p;anned to construct from these a credible scenario by systematically comparing the effects of the < gathered evidence to those postulated in the various scenarios. The licensee also planned to support their conclusions with metallurgical analyses of the failed components. The team's review of the ongoing and completed activities found them to be comprehensive, detailed, systematic, and a good example of integrated departmental efforts. The team also found that the results of the investigation were integrated in the repair and redesign of the new hydrogen supply facility. The NRC inspectors will review the results of the completed investigation at a later date. (IFl 50-333/99-02-02) t -
F= -
- ,
3 12 c. Conclusions The response of the technical support team in the event was prompt and guidance was provided as needed. Engineering, however, did not recognize the effect of leaving the EDGs running unloaded and with the tie breaker open and were, therefore, not effective in preventing OMrations from operating ihe emergency electrical buses in an unanalyzed conostion. The licensee's evaluation of the event was ongoing, but planned and completed activities appeared comprehensive, detailed, systematic, and a good example of integrated deparlental efforts. E8 Miscellaneous Engineering issues E8.1 Post-fire Hydrooen Storaae Facility Insoection a. Inspection Scope (93704) The team inspected the hydrogen storage facility to determine the extent of the damage caused by the fire. The team also reviewed the system design and installation and interviewed operators to evaluate whether the design and operation of the facility conformed to the 8Leensing comm tments and regulatory requirements. j b. Observations and Findinas , The hydrogen storage facility includes two high pressure gas storage banks, a pressure control station, an excess flow control check valve and a gas discharge stanchion. This equipment is located on a concrete foundation, enclosed by a fence and surrounded with vehicle guard posts. Each of the two high pressure gas storage banks contains 15 storage vessels. Adjacent to this installation and perpendicular to the longitudinal direction of the storage vessels, a hydrogen delivery trailer was apparently being used as a third source of hydrogen, w confirmed by the licensee. The team's review of the post-fire condition of the installation found that most of the damage was confined to the pressure control station, where the fire apparently initiated. The panel, housing two piessure controllers and a number of valves and pressure gauges (see Attachment 2), had received extensive damage, with fallen components at the bottom of the panel, broken pipe joints, and burst pipes and components. The flames and intense heat emanating from the panel had burned two large holes in the chain-link fence surrounding the installation and damaged the suppert structure of the storage bank closest to the panel. The delivery trailer also was damaged and one of the t;res was destroyed by the Re. The storage bank farthest from the fire appeared to be _ generally sound as did most of the storage vessels in the storage bank closest to the fire. To address the design of the hydrogen system, the team reviewed the UFSAR as well as portions of the modification package that installed the system in its current configuration, No. JAF-SE-87-087. Tht., team found that neither the UFSAR, nor the safety evaluation of the modified facility specifically addressed operation of the system with a hydragen delivery trailer acting as a third bank. This mode of operation was also not addrused in 'the hydrogen addition system training module SDLP-89A. The team discussed the observation with the system engineer and other licensee personnel and found that the L , _ .-
-. .- .i 13 trailer was being used to increase the hydrogen storage capacity. The increased capacity was required due to a larger than expected hydrogen demand. During the hydrogen fire, the trailer accounted for approximately 30% of the available hydrogen. Additionally, the proximity of the trailer to the fire resulted in the exposed side tires igniting and contributing to the total combustibic load. The team's review of UFSAR Section 9.20.3 also determined that the system was designed and constructed in accordance with EPRI Report No. NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations - 1987 Revision. However, the installation did not meet all of the recommendation specified in the EPRI report. For instance, the hydrogen delivery f re. is a third source, had not been analyzed for a design-basis tornado (section 4.1.2.2) and was not enclosed in fenced area (section 4.1.1.2.2). Also, the facility did not incorporate security lighting to facilitate night surveillance (section 4.1.1.2.2) and the trailer discharge stanchion was not provided with e check valve (section 3.1.2.4). The licensee was evaluating the team's observations as part of the fire root cause determination and wrs considering them in the redesign of the hydrogen storage facility. Because the delivery trailer acted as a hydrogen source, the team was concerned that some of the piping and panel components might be exposed to a higher than planned pressure. The team discussed the pressure rating of the panel components, but because the panel was supplied by the vendor, the information was not immediately available. The licensee believed that the pressure rating of piping and components was well above that of the maximum pressure in the supply trailer. However, they did not believe that the vendor supplied portion of the system w as designed to the requirements of EPRI Report No. NP-5283-SR-A. A detailed review of the hydrogen control panel design was ongoing, as part of the fire root cause evaluation, and results were not available by the end of the inspection. c. Conclusions i The use of a hydrogen delivery trailer as a third source of hydrogen did not conform to the design description for the facility in the UFSAR and did not meet all of the guidelines specified in EPRI Report NP-5283-SR-A for " Permanent BWR Hydrogen Water Chemistry Installations," as specified in the UFSAR. The impact of such deviations on the Gsign and operation of the system as well as on the severity of the fire event was being investigated by the licensee and the results of such review were still incomplete. This is an apparent violation pending completion of the effort by licensee, identification of corrective actions, and review by the NRC. (see r% item E2.1). (eel 50-333/99-02-03) E8.2 Emeroency Diesel Generator Capability l a. Insoection Scope (93702) . The team evaluated the ability of a single EDO to accelerate and carry accident loads in the event of a loss of the offsite sources while the tie breaker between a pair of EDGs was open. !
s -. .. 14 b. Qhservations and Findinas The design of the FitzPatrick emergency electrical buses allows the powering of the buses with a single EDG if the other EDG in the pair fails to start or if the tie breaker between each pair fails to close. In November 1998, the licensee evaluated the transient loading of a single EDG to determine whetner the loading was within the machino's capability. The licensee's preliminary calculations showed that with only one RHR pump operating, per design, the total steady state load was slightly below the 30-minute rating (3050 kW) of the diesel engine. Using reasonable rule of thumb assumptions, the licensee also preliminarily concluded that the transient load (i.e. the load during the first few seconds following closure of the motor supply breaker until the motor / pump is up to speed) was not within the capability of a single EDG. Specifically, peak transient loading due to the start of the last emergency core cooling pump (the core spray pump) wou!d be approximately 1300 kW above the continuous rating of the EDG. Limited single EDG testing was performed during the FitzPatrick pre-operational test peogram. These records were not available for review during the inspection. However, the team was informed that the tests may not have reflected actual emergency loads. More recently (December 1998), single EDG tests were conducted successfully under procedure ST-9C, " Emergency Ac Power Load Sequencing Test and 4KV Emergency Power Systems Voltage Relays instrument Functional fest" However, the test was designed only to verify proper logic system functionality, and significant design loaos (approximately 800 kW from the 600 Vac emergency substations) were secured during the test. Since the test did not reflect actual emergency loads, its value in demonstrating single EDG design capability was limited. The licensee planned to develop formal calculations in the future. c. Conclusions The licensee's preliminary evaluation of the ability of a single diesel to accelerate and carry the design loads, in the event that the paralleling of a pair of emergency diesel gererators failed to take place, indicated the potential overloading of the diesel. Also, the single EDG test conducted in Decembe/1998 was not designed to demonstrate single emergency diesel generator capabi..iy under accident conditions. The I;censee planned to develop formal calculations, but the inspectors did not consider this issue is to be a concern during this inspection because operation of the emergency bus with a single diesel generator is not within the design basis of the plant. E8.3 Emeroency Diesel Generator Load Sharina a. Jngpection Scope (93702) The team evaluated the ability of the EDG pairs to share the load following a design basis accident. I
t . . 15 b. Obsentations and Findinos ' The FitzPatrick onsite emergency system uses two sets of two EDGs in parallel to power the emergency buses. As stated in section E1.1 of this report, each diesel has a continuous rating of 2600 kW, whereas the calculated load on each of the two buses is approximately 4000 kW. Therefore, two diesels are required to provide sufficient power to power the dosQn accident loads. For proper parallel operation, a circuit must be provided that monitors the load of each EDG and signals the individual govemors to make necessary corrections in the control of the dieseis such that they share the load equally. The team discussed with the licensee the testing done to verify the ability of the diesels to properly share the load. The inspectors determined that no specific test had been developed to assure the integrity of the circuit interconnecting the two govemor controllers and that the individual EDG loads were not recorded during the LOCA/ LOOP test conducted each refueling outage. Discussions with the licensee determined that,- during monthly tests, adjustments were made to the diesel controls to properly load tha machines. However, during the monthly test, the EDGs are paralleled to the offsite system and the governor controllers do not operate in the same mode as when the diesel pairs operate independently from the system. Therefore, the monthly tests do not specifically verify the integrity of the interlocking circuit and the adjustments made do not assure the ability of the machines to share the bus load. Based on the above, the team discussed with the licensee the confidence they had regarding the ability of the diesel pairs to properly share the load. The licensee stated that, although the individual diesels loads were not specifically recorded during the refueling outage test, they were observed by the operators in the control room during the conduct of the tests. Therefore, they had no concern regarding the integrity of the load sharing circuit. Considering the size of the bus loads and the rating of each diesel, the team believed that a failure of the interlocking circuit would result in the overloading of one of the diesels with consequent supply breaker tripping. This event would attract the attentim of the operating staff. The licensee's review of recent tests identified no such occyrrence. Based on the licensee's review, the team concluded that sufficient confidence existed regarding the integrity of the load sharing circuit. Nonetheless, the licensee's failure to periodically verify the integrity of the govemor controller interlocking circuit is a violation of 10 CFR 50, Appendix B, Criterion XI, Test Control. This violation of the NRC requirements of minor significance and already corrected by the licensee is not subject to formal enforcement action. In response to the team's finding, the licensee immediately revised the test procedure to require recording of individual EDG loads during the refueling outage tests. c. Conclusions ] The licensee had not previously verified proper operation of the EDG pair loading sharing circuits. The licensee revised the testing procedure to verify proper circuit operation in the future. This minor violation was not subject to formal enforcement action.
_ r , 16 l IV. Plant Suonort 'P1- Conduct c,f EP Activities > - P1.1 ~ Imolementation of Emeroency Plan ) a.: Insoection Scope i ' The team reviewed the actions taken by the New York Power Authority to execute the Emergency Preparedness Plan and the associated Emergency Preparedness , implementation Procedures.. i
- b.
Observations and Findinas Tne normal locations of the Technical Support Center (TSC) and Operations Support
Center (OSC) are in the Old Administration Building. This was one of the buildings evacuated due to the severity of the fire. Accordingly, the Emergency Director ordered that the TSC and OSC be relocated to attemate locations. The TSC was moved to the main library, and the OSC was moved to the cafeteria. The normal locations are pre- staged with the necessary telephone communications, procedures, and computers information to monitor plant parameters. 1 The emergency preparedness department facilitated the installation of adequate telephone lines and nee'Jed administrative and technical support in a timely manner. Both facilities were activated and functional within the required one hour. The team considered the effort to relocate the emergency response facilities in a short time frame, in the midst of an emergency, to be an example of a good Emergency Plan function. The licensee's overall emergency response to the event wa= good. c. Conclusion The overall emergency preparedness response to the Hydrogen fire was good. Especially noteworthy was the ability to implement alternate locations for the emergency response facilities and still have them activated and functional within an hour. F5 Fire Protection Staff Training and Qualification F5.1 Fire Briaade Trainina Related to Flammable Gases a. Inspection Scope The team reviewed the training provided by the licensee to the fire brigade with respcct to responding to a H fire. 2 w .
,: . 17 b. Observations and Findinas The team determined that the training provided to the fire brigade included both classroom presentations and fighting of actual fires at the local fire fighting school. The subjects covered included, amongst othars, the general duties and responsibilities of the fire brigade, the chemistry of fires and methods of extinguishing a fire, the hazards of flammable liquids and gases, the strategy of combating the various types of fires, and the locations of the hazardous materials on site. The lesson plans were detailed and included a discussion of fire incidents. In the case of a gas fire, training lessons specified that it was not safe for a fire brigade to attempt to put out the fire. Rather, the fire brigade should wait for offsite assistance, unless immediate actions were needed to rescue personnel. Otherwise, the best strategy was to let the fire bum itself out. Water should be applied only to cool the containers and prevent tank failures which, in tum, could exasperate the condition and cause further damage. Overall, the inspectors considered the ability of the fire brigade to combat the H fire to 2 be appropriate. In addition, the quick response by the FBL to request off-site assistance was instrumental in minimizing the damage to other equipment in the area. c. - Conclusion The inspectors considered the training provided to the fire brigade to combat the H fire 2 to be appropriate. In addition, the quick response by the FBL to request off-site assistance was instrumental in minimizing the damage to other equipment in the area. V. Manaaement Meetinos X1 Exit Meeting Summary The team presented the inspection results to members of licensee management at the conclusion of the inspection in a telephone conference on February 9,1999. The licensee acknowledged the findings presented during the meeting. The licensee did not indicate that any of the information presented at the exit was proprietary.
. . 18- PARTIAL LIST OF PERSONS CONTACTED James A FitzPatrick R. Baker Maintenance Department W. Berzom Manager Communications . G. Brownell Licensing Engineer P. Brozenick Operations Manager M. Bursztein - Acting Electrical Engineering Supervisor M. Colomb Site Executive Officer R. Converse General Manager Maintenance I T. Dougherty Engineering B. Drain Acting Director Design Engineering F. Edler Acting Maintenance Manager A. Ettinger Nuclear Engineering (FP) i S. Kohr. Design Engineering Mechanical Supervisor D. Lindsey - General Manager, Operations J. Maurer General Manager, Support Services R. Patch Director Quality Assurance R. Plasse Acting Licensing Manager M. Rastley Operations Training Coordinator D. Ruddy Director, Design Engineering P. Ryan Control Room Supervisor T. Teifke Security / Safety Manager G. Thomas Manager D & A Engineering D. Wallace Design Engineering Manager Support V.Walz Assistant Operations Support Manager A. Zaremba Licensing Manager _, l NBL R. Barkley Project Engineer L. Doerflein Chief, Engineering Programs Branch, DRS l R. Rasmussen Senior Resident inspector - FitzPatrick INSPECTION PROCEDURES USED IP 93702: Prompt Onsite Response to Events at Operating Power Reactors < -
.. . 19 ITEMS OPENED, CLOSED AND DISCUSSED Opened ,50-333/99-02-01 NCV Failure to complete an EDG surveillance test procedure, resulting in the plant being in an unanalyzed condition. 50-333/99-02-02. 'IFl Review results of licensee investigation. 1 50-333/99-02-03 eel Us of Hydrogen delivery trailer as third source did not conform to description in UFSAR. I Closed 1 50-333/99-02-01 NCV Failure to complete an EDG surveillance test procedure, - resulting in the plant being in an unanalyzed condition. 1 Discussed i i [ None ] l l , l l ._
J . e , 20 LIST OF ACRONYMS USED A Amperes i AC or ac Attemating Current ASME American Society of Mechanical Engineers BWR Boiling Water Reactor CARB Corrective Action Review Board CCP Combustion Contro' Permit CFR Code of Federal Regulations CR Condition Report udS Control Room Supervisor DBD Design Basis Document DC or de Direct Current DCP Design Change Package EAL Emergency Action Level EDG Emergency Diesel Generator ' EPRI Electric Power Research Institute ESF Engineered Safeguards Feature ESW Emergency Service Water FBL Fire Brigade Leader GL Generic Letter H2 Hydrogen HP Horsepower IEEE Institute of Electrical and Electronic Engineers KV Kilovolt KVA Kilovolt-ampere kW Kilowatt LCO Limiting Condition of Operation -LOCA Loss of Coolant Accident LOOP Loss of Offsite Power MWR Maintenance Work Request NCV Non-Cited Violation NRC Nuclear Regulatory Commission NRR Office of Nuclear Reactor Regulation OE Operating Experience OSC Operations Support Center OST Operating Surveillance Test PM Preventive Maintenance PRA Probabiltj Risk Assessment QA Quality Assurance RCS Reactor Coolant System RHR Residual heat removal rpm revolutions per minute SBO Station Blackout SM Shift Manager TER Temporary Evaluation Report TM Temporary Modification TS Technical Specification TSC Technical Support Center
, s e , , 21 TSSR Technical Specification Surveillance Requirement UFSAR Updated Final Gafety Analysis Report Vac Velts Altemating Current Vdc Volts Direct Current a I l . . I 1
r. e < . , 22 ATTACHMENT 2 - J. A. FitzPatrick H Control System Cabinet 2 n_701 _ JL truck ria i i ixi i I I
f 202 PI-1112 PI-1111 203 . ~{ g- Active Bank i I i _. 207 206 -{ 208 Reserve Bank p I @M i i l I ] l k210 k212 , . PCV-215 PCV-216 \\ Fi-1113 209 211 213 _ [ ~k. i>< D I O i Lsrcn ' %,. . , coes c 111 'h' EFV 112 To the Plant
r 1
8 i , . 23 ATTACHMENT 3 i' HYDROGEN FIRE - DESCRIPTION OF THE EVENTS At 12:56 p.m., on January 14,1999, the FitzPatrick control room received a report of a iarge fire at the H " tank-farm" located in the north-west corner of the property, inside of the protected - 2 area fence. The fire was reported by an operator who had been manipulating valves inside the H, tank-farm control cabinet in preparation for placino the H addition system in service, in ) 2 accordance with an approved operating procedure. The Control Room Supervisor (CRS) immediately dispatched the on-site fire brigade to the scene to investigate the fire; in addition, buildings near the fire were evacuated. The fire brigade leader (FBL) determined that the fire was beyond the capability of the fire brigade and requested off-site assistance from local fire ! departments. At 1:11 p.m., the Shift Manager (SM) entered the Emergency Plan, became the Emergency l Director (ED), and classified the fire as an Unusual Event. The ED activated the techrdcal support center (TSC) and operations support center (OSC). The required event notifications were made by NYPA to the county and state agencies, and to the NRC. Due to the proximity of Nine Mile Point Units 1 & 2, Niagara Mohawk also declared an Unusual Event. At 1:23 p.m., the FBL requested that the control room de-energize the 115KV switchyard due to the closeness o'the switchyard to the H tank-farm. The request was quickly reviewed by the 2 control room staff and acted upon. The CRS briefed the crew on the potential affect on the plant if the main generator were to trip; i.e., the EDGs would be the only source of electrical power for the emergency buses. In addition, the CRS discussed the fact the plant was in an unusual configuration with respect to the electricallineup. He had the operators review the appropriate abnormal and emergency procedures for a reactor scram, a rapid power reduction, and a station blackout. All four EDGs were subsequently started and left running unloaded for approximately 3.6 hours. At 1:37 p.m., the first off-site fire truck was allowed on-site and applied water to the fire; the FBL reported that extinguish:ng the fire was not viable. As additional off-site assistance arrived, more water hoses were used. At one point, eight hoses were spraying water onto the fire to maintain the H tanks cc:' 9nd to minimize the possibility of a tank failing. At 2:16 p.m., the FBL 2 reported the fire was under control. At 7:45 p.m., following closure of several valves, the FBL reported that the fire was ou: and the H tank-farm was isolated. The 115KV switchyard was 2 restored at 9:02 p.m. and the Unusual Event was exited at 9:05 p.m.. EVENT TIME-LINE January 14.1999- 12:56 p.m. Control room received a report of a fire at the hydrogen tank-farm Fire
i brigade dispatched 1:02 p.m. Sounded fire alarm. Fire brigade requested offsite assistance. Evacuated nearest buildings. 1:08 p.m. Evacuated west side of site and calleo Mr additional offsite assistance
('
- ,q , o
Attachment 3 24 1:11 p.m. Declared an Unusual Event. Technical Support Center (TSC) and Operational Support Center (OSC) activated but relocated. The normal location is in the Old Administration Building, which had been evacuated. 1:15 p.m. Fire brigade reported that the hydrogen trailer was also on fire 1:17 p.m. Control Room Supervisor (CRS) conducted a shift brief, including reviewing procedures for a reactor scram or emergency power reduction, ! loss of 115KV offsite, and station blackout. 1:21 p.m. First two offsite fire trucks arrived, escorted to fire scene by recurity l 1:23 p.m. Fire brigade requested that the 115KV switchyard be de-energized 1:26 p.m. First 115KV line de-energized (breaker 10022 opened) l 1:28 p.m. Second 115KV line de-energized (breaker 10012 opened) ! 1:29 p.m. Entered Limiting Condition for Operation (LCO) for 115KV de-energized l (TS 3.9.B.2) 1:30 p.m. CRS held shift brief for 115KV de-energized and discussion to perform the associated surveillance test (ST-9D) to test the EDGs. Shift Manager l (SM) decision to leave the EDGs running unloaded (precautionary) with l the tie-breakers open. (ST-9D directs the EDGs be secured and retumed to the standby condition.) , 1:36 p.m. Started A & C EDGs, opened tie-breaker 10504 1:37 p.m. Water applied to the fire. Report from fire brigade that extinguishing the fire was not a viable option. 1:39 p.m. OSC staffed and operational 1:40 p.m. Started B & D EDGs, opened tie-bredter 10604 1:55 p.m. TSC staffed and operational 1:58 p.m. Fire Brigade reported that the three hoses were being used on the fire. 2:07 p.m. SM directed that ST-9D be completed " SAT" with the EDGs uniraded. SM directed the operators to review the normal operating preadure (OP- 22) with the intent of loading the EDGs. 2:16 p.m. Report from the fire brigade that the fire was under control with five hoses. =2:30 p.m. With the fire under control, the SM decided to secure the EDGs, but left them running while TSC evaluated the need to load EDGs prior to securing them. TSC was concerned regarding oil and carbon buildup in the exhaust system while the EDG were run unloaded for almost an hour. 5:07 p.m. Secured A & C EDGs 5:08 p.m. Secured B & D EDGs 7:35 p.m. Fire brigade suspended water spraying, but a two foot flame became visib!e. They isolated that leak, and closed several other valves, including the bottle isolation valves and the truck supply. 7:45 p.m. Report from the fire brigade that the fire was out and the hydrogen tank- farm was isolated. 8:00 p.rn. Emergency Dirsctor formally declared the fire out. 9:02 p.m. The 115KV offsite lines were restored and the LCO was exited. 9:05 p.m. Exited the Unusual Event i i }}