ML20205C115
Jump to navigation
Jump to search
| ML20205C115 | |
| Person / Time | |
|---|---|
| Site: | FitzPatrick  |
| Issue date: | 03/26/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20205C110 | List: |
| References | |
| 50-333-99-02, 50-333-99-2, NUDOCS 9904010083 | |
| Download: ML20205C115 (29) | |
See also: IR 05000333/1999002
Text
{{#Wiki_filter:. e
U.S. NUCLEAR REGULATORY COMMISSION
REGION I
Docket No: 50-333
License No: DPR-59
Report No: .50-333/99-02
Licensee: New York Power Authority
Facility: James A. FitzPatrick Nuclear Power Plant
Location: Post Office Box 41
Scriba, New York 13093
Dates: January 25 - February 9,1999
Inspectors: A. Della Greca, Senior Reactor Engineer
B. Norris, Resident inspector
D. Dempsey. 9eactor Engineer
' C. Cahill, Reactor Engineer
Approved by: Laurence T. Doerflein, Chief
Engineering Programs Branch
Division of Reactor Safety
l
l
I
4
l
l
~~~
9904010083 990326
gDR ADOCK 05000333
PDR _
l
l
--
4 t
EXECUTIVE SUMMARY
Jtemes A. FitzPatrick Nuclear Power Plant
NRC Inspection Report 50-333/98-07 !
The primary objectives of this special team inspection, conducted during the period between
January 25 and February 5,1999, were to evaluate the cause or causes of the January 14,
1999, hydrogen fire, the licensee's response to the event, and the actions taken to understand i
!~
the event and prevent its recurrence.
Operations
l e Overall, the conduct of operations personnel during the H2 fire event was good.
Operations personnel were attentive, used good communications, and exhibited a
proactive questioning attitude. However, their failure to complete a surveillance test
! procedure and secure the emergency diesel generators, resulted in leaving the
emergency electrical system in an unanalyzed condition for 3.6 hours and the failure to
meet the requirements of the FitzPatrick Technical Specification regarding procedure
adherence. Based on the licensee's taking reasonable actions to address the violation
and prevent its recurrence, this violation was not cited consistent with the guidance of
l Appendix C of the NRC Enforcement Policy. (NCV 50-333/99 02-01) (01.1)
!
The licensee also initiated action to evaluata :md correct an apparent discrepancy
between Sections 7.3 and 7.4 of Administrative Procedure AP-02.06 regarding i
procedure adherence guidance.
e During the hydrogen fire of January 14,1999, the licensee operated both pairs of
emergency diesel generators (EDGs) unloaded with their respective tie breakers open
for 3.6 hours. Operation of :he EDGs in this alignment placed the electrical system e,d
the plant in an unanalyzed configuration that was not recognized by either the operating
l staff or by Engineering until approximate'y a week after the event. The consequences of l the licensee's actions were limited because of the short duration of the event and !
because the EDGc were available for manual loading on the emergency buses. Also the
licensee's probability risk assessment model indicated a low core damage frequency
value. Nonetheless, the licensee's decision to operate the plant in the above i
configuration increased the probebility of a station blackout and decreased their ability to
mitigate the consequences of an accident. (04.1]
e A design feature of the emergency electrical system permits leading only one EDG of the
pair on the emergency bus if the associated tie breaker is open. The licensee did not
take credit for this feature in their design and licensing bases of the plant. However, a
relay race in the control circuitry could prevent the EDGs to function as intended.
Therefore, this characteristic of the logic was considered a weakness of the design
(O4.1)
>
' ii
l 1 L
. i
* The operator who manipulated the hydrogen system was generally familiar with the
l i
system and the associated operatinc procedure as well as with the safety requirements
for handling industrial / compressed p ases. The training module, however, had not
specifically addressed the training recommendations of EPRI Report No. NP-5283-SR-A
regarding consequences of component malfunctions at the hydrogen supply facility and
the potential hazards of the hydrogen gas. (O5.1)
Enaineerina
e The temporary modification prepared to provide hydrogen makeup to the main generator i
was acceptably prepared and implemented. (E1.1]
e The oxygen facility was in good physical condition and the tank was adequately sited.
The operability determination prepared to justify the adequacy of the battery rooms air i
intake, located within the EPRI-specified unacceptable range, was reasonable. [E1.2)
l
e The response of the technical support team tc the event was prompt and guidance was i
provided as needed. Engineering, however, did not recognize the effect of leaving the
EDGs running unloaded and with the tie breaker open and were, therefore, not effective
in preventing Operations from operating the emergency electrical buses in an
unanalyzed condition. The licensee's evaluation of the event was ongoing, but planned
and completed activities appeared comprehensive, detailed, systematic, and a good
example of integrated departmental efforts. (E2.1]
* The use of a hydrogen delivery trailer as a third source of hydrogen did not conform to )
I
,
the design description for the facility in the UFSAR and did not meet all of the guidelines
specified in EPRI Report NP-5283-SR-A, as specified in the UFSAR. The impact of such
l deviations on the design and operation of the system as well as on the severity of the fire
event was being investigated by the licensee and the results of such review were still
incomplete. This is an apparent violation pending completion of the effort by licensee,
identification of corrective actions, and review by the NRC. (eel 50-333/99-02-03)
(E8.1)
* The licensee's preliminary evaluation of the ability of a single diesel to accelerate and
carry the design loads, in the event that the paralleling of a pair of emergency diesel
generators failed to take place, indicated the potential overloading of the diesel. Also,
the single EDG test conducted in December 1998 was not designed to demonstrate
'
single emergency diesel generator capability under accident conditiont,. The licensee
planned to develop formal calculations but the issue was not a concern during this
inspection because operatiori of the en ergency bus with a single diesel generator is not
within the design basis of the plant. (El'.2]
e The licensee had not previously verifiet proper operation of the EDG pair loading
sharing circuits. The licensee revised ihe testing procedure to verify proper circuit
operation in the future. This minor violation was not subject to formal enforcement
action.
1
iii
J
. ,
i l l )
Plant Support
,
o The overall emergency preparedness response to the Hydrogen fire was good.
l Especially noteworthy was the ability to implement alternate locations for the emergency
response facilities and still have them activated and functional within an hour. [P1.1]
e The training provided to the fire brigade to combat the hydrogen fire was appropriate. In
addition, the quick request by the Fire Brigade Leader for off-site assistance was
instrumental in minimizing the damage to other equipment in the area. [F5.1] 1
l
l
l
!
l
l
l
l
iv
l
p.- . l l l 1
1
!
L '
TABLE OF CONTENTS I
I
PAGE
. EXECUTIVE SUMMARY ....................................................ii
TABLE OF CONTENTS . .....................................................v 3
I
1. O P E RATI O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 l
1
1
O1 Cond uct of 0pe ratio n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 j
O1.1 Operations Response to the Hydrogen Fire . . . . . . . . . . . . . . . . . . . . . . . . . 1 !
1
!
O.4 Operator Knowledge and Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1
04.1 Emergency Diesel Generator Design Basis and Operation . . . . . . . . . . . . . 4
i'
05 Operator Training and Qualification . . . . . . . . . . . . . . . . . . . . . . . . . ...........8
05.1 System Operating Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
111. Engineering . . . . . ................. .. ..................... ...... .... 9
E1 Conduct of Engineering . . . . . . . . . . . . . . . . .................. .... .. ..... 9
E1.1 Makeup Hydrogen for Main Generator . ................. ........... 9
E1.2 Bulk Oxygen Tank Storage Siting . . . ..........................10
1
E2 Engineering Support of Facilities and Equipment . . . . . . . . . . . . . . . . . . .........11 l
E2.1 Engineering Support of the Hydrogen Fire Event and Root Cause Analysis . 11
E8 Miscellaneous Engineering issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,12
E8.1 Post-fire Hydrogen Storage Facility inspection . . . . . . ................12
E8.2 Emergency Diesel Generator Capability . . . . . . . . . . . ...............13
E8.3 Emergency Diesel Generator Load Sharing . . . . . . . . . . . . . . . . . . . . . . . . . 14 )
<
IV Plant Support Activities . ... ................... .... ... .... ... 16
P1 Conduct of EP Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ... .. ...... 16
P1.1 Implementation of Emergency Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
F5 Fire Protection Staff Training and Qualification . . . . . . . . . . .................16 l
'
F5.1 Firs Brigade Training Related to Flammable Gases . . . . . . . . . . . . . . . . . . . . 16
V. M anagement Meetings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
X1 Exit Meeting Summary . . . . . . . . . . . . . . . . . . .............. ......... ... 17
. . l
l
Report Details
l
Summary of Plant Status
l
During the period between January 25 and February 5,1999, the NRC conducted a special
team inspection at the James A FitzPatrick Nuclear Power Plant as a result of a hydrogen fire ,
- esvent on January 14,1999. The objectives of the inspection were to
- evaluate the cause or l
! causes of the fire; assess the fire damage and its impact to safety-related structures, I
components, and systems; determine the response of protective equipment (if any); and
evaluate the licensee's response to the event and their actions to understand the event and ;
i prevant its recurrence. The plant remained at or near full power throughout the inspection .
period. I
l
1. Operations I
.01 Conduct of Operations
01.1 Operations Response tcpe Hydroaen Fire I
I
a. Insoection Scooe
On January 14,1999, a fire started in the control cabinet of the hydrogen (H2 ) addition
system at the James A. FitzPatrick Nuclear Power Plant. The facility entered the
Emergency Plan and requested offsite fire department assistance. A detailed description I
of the event and a time line are included as Attachment 3 to this report.
The team evaluated the response of the operations personnel during the H 2 fire. The
evaluation included observations of activities in the control room and in plant by the
resident inspectors during the event, discussions with the operations crew and station
management, and a review of applicable portions of the Technical Specification (TS) and
plant procedures,
b. Observations and Findinas ,
!
<
When the control room operators received the report of the H2 fire, their actions were
quick and decisive. They promptly sounded the site alann, announced the emergency,
and dispatched the fire brigade to the scene of the fire. After the Fire Brigade Leader
. (FBL) reported the magnitude of the fire, the Shift Manager (SM) directed the evacuation
of the general area and all buildings near the H2 tank-farm. In accordance with the
Emergency Plan, the SM assumed the duties of Emergency Director and declared an
Unusual Evant, the lowest of four possible emergency action levels (EALs). The team
independently reviewed the EALs and considered the classification to be appropriate.
The Control Room Supervisor (CRS) conducted a precautionary brief of the shift
l personnel, including concems of a reactor scram and/or a loss of offsite power, in l addition, a reactor operator was directed to continuously monitor the reactor parameters '
during the fire. Overall, the conduct of the operating staff during the event was very
good. Operations personnel were attentive, knowledgeable of procedural requirements,
used good communications, and exhibited a proactive questioning attitude.
l
. .
2
Due to the proximity of the 115KV switchyard to the H2tank-farm, the FBL requested
that the switchyard be de-energized for the safety of the fire fighters. Two 115KV
electrical lines supply offsite ac power to the plant's emergency buses. The CRS
r3 viewed the precautions associated with the loss of the offsite emergency ac power,
briefed the operators, and directed that the 115KV switchyard be de-energized. The
team considered the actions of the CRS to be proactive in anticipating the "what if"
scenarios related to the loss of 115KV power.
Section 3.9.B of the FitzPatrick TS requires that all four emergency diesel generators
(EDGs) and both 115KV lines remain operable during power operation. If one or both
the 115KV line3 are not available, limiting condition for operation (TS Section 3.9.9.2)
allows the reactor to remain in operation for up to seven days, provided that all EDGs
and emergency core cooling systems are operable. TS Surveillance Requirement
(TSSR) 4.9.B.5 states that, if the emergency ac power supply is degraded, the
availability of the operable EDGs shall be demonstrated by manual starting and force
paralleling each set of EDGs.
The surveillance test procedure developed by the licensee to meet the requirements of
the above section of the TSSR is ST-9D, "EOG,115KV Reserve Power, Station Battery,
or ESW [ emergency service water] System inoperable Test." Section 1.1.2 of this '
procedure stated, in part, that, "If both reserve [115 KV offsite power] sources ... are
inoperable, then the following is per'ormed: Subsection 8.1 and 8.2 (EDG Test) within 1 j
hour and at least once per 24 hours thereafter."
j
The steps of subsections 8.1 and 8.2 for testing the availability of the 'A and C' and the
'B and D' EDGs, respectively, required manually starting the EDGs, verifying that the
forced-parallel tie-breakers automatically close, manually opening the tie-breakers, and
stopping the EDGs and returning them to the standby condition. Specifically,
subsections 8.1.7, for the 'A and C' EDGs, and 8.2.7, for the 'B and D' EDGs, directed
that the control switches for the EDGs be placed in "STOP."
Within one hour from the de-energization of the 115KV switchyard, the CRS initiated
action to test the EDGs. If properly implemented, as required by the TSSR, the
procedure would have permitted the sequential verification of the availability of the two
sets of EDGs and their subsequent placement in the standby Mode. Instead, as a
precaution, the SM directed the operating staff not to complete sections 8.1 and 8.2 of
the procedure and leave all four EDGs running unloaded, with the respective tie-
breakers open. The four EDGs were left rJnning in that condition for 3.6 hours. The
licensee's failure to complete the steps of the procedure subsections and return the
EDGs to the standby mode immediately following the opening of the tie breakers resulted
in placing the plant in an unanalyzed condition for the period when the EDGs were left
running. The licensee discovered the condition a week later, as described further in
section 04.1 of this report.
In failing to complete the steps of the surveillance test procedure, the licensee failed to
meet the conditions of section 8.8(A) of the Technical Specification which requires that
written procedures be established and implemented. if the conditions did not permit the
use of the procedure as written, the licensee could have alternatively implemented the
procedure change process, as allowed by TS sections 6.8(B) and (C) for permanent and
F
. ,
3
temporary changes, respectively, in an emergency, i.e., when actions are required to
protect the public health and safety, and there was not sufficient time to implement the
change process, the licensee can invoke the latitude allowed by 10CFR50.54(x). The
licensee did not implement the procedure change process and did nct invoke the latitude
allowed by 10 CFR 50.54(x).
The requirements of 10 CFR 50.54(x) regarding procedure adherence were included and
paraphrased in section 7.4 of the licensee's administrative procedure AP-2.06,
" Procedure Use and Adherence." During discussions with the SM regarding the concern
that not completing the surveillance test procedure was not consistent with the
requirements of TS 6.8(A), the team determined that another section (7.3) of procedure
AP-2.06 also addressed procedure adherence. This section, which states, in part, that,
"In an emergency, operations personnel are authorized to depart from procedures where
necessary to protect personnel, the public, or prevent damage to the facility..." is derived
from section 5 of ANSI Standard 18.7 -1972 which is referenced in section 6.8 (A) 1. of
the FitzPatrick TS. The team believed that section 7.3 of AP-2.06 might allow some
latitude which is in addition to that allowed by 10 CFR 50.54(x) and section 7.4 of the
same procedure. The team discussed this concern with the licensee who indicated that
they would evaluate the guidance provided in the two sections and determine whether a
procedure revision or a Technical Specification amendment was required to render the
two documents consistent. On March 23,1999, they formalized this understanding by
initiating a commitment action item, ACT-99-40532, with a completion schedule of April
30,1999.
The licensee's failure to complete the surveillance procedure step and placement of the
electrical system in an unanalyzed condition constituted a violation of the Technical
Specification (TS) section 6.8(A) requirements regarding procedure implementation.
However, because: (1) the violation was not willful; (2) no previous examples of similar
violations were identified by the team; (3) the licensee issued a night order and revised
applicable operating and surveillance procedures to caution against future operations of
the di9sels in the unanalyzed condition; (4) the licensee initiated action to provide
training to the operating and technical staff regarding the issue; and (5) the licensee
initiated an action item to evaluate the discrepancy between the guidance of AP-02.06
and the requirements of the FitzPatrick TS and 10 CFR 50.54(x) regarding procedure
implementation; this violation is not being cited in accordance with the guidance of
Appendix C of the NRC Enforcement Policy. (NCV 50-244/99-02-01)
c. Conclusion
Overall, the conduct of operations personnel during the H2 fire event was good.
Operations personnel were attentive, used good communications, and exhibited a
proactive questioning attitude. However, their failure to complete a surveillance test
procedure and secure the emergency diesel generators, resulted in leaving the
emergency electrical system in an unanalyzed condition for 3.6 hours and the failure to
meet the requlrements of the FitzPatrick Technical Specification regarding procedure
adherence. Based on the licensee's taking reasonable actions to address the violation
and prevent its recurrence, this violation was not cited consistent with the guidance of
Appendix C of the NRC Enforcement Policy.
F ! . . l l
4
'
The licensee also initiated action to evaluate and correct an apparent discrepancy
between Sections 7.3 and 7.4 of Administrative Procedure AP-02.06 regarding
procedure adherence guidance.
O.4 Operator Knowledge and Performance
i 04.1 Emeroency Diesel Generator Desian Basis and Operation
a. Inspection Scope (93702)
During the January 14,1999, hydrogen fire at FitzPatrick, the licensee operated the two I
pairs of emergency diesel generators (EDGs) unloaded and unparalleled for 3.6 hours. ]
The team assessed the acceptability of the EDGs operating in this mode and its impact
on the operability of the emergency buses. The assessment included reviews of the
FitzPatrick technical specifications, Updated Final Safety Analysis Report, emergency
power system logic diagrams, and operating and surveillance procedures, The team also
reviewed applicable portions of the EDG load calculations and discussed the event with
licensee operators and engineers,
b. Observations and Findinas
Desian and Licensino Basis
The design of the FitzPatrick onsite 4 KV emergency power system consists of two
independent and redundant emergency buses (Division I bus 10500 and Division 11 bus
10600). Each bus is supplied by a pair of EDGs that operate in parallel to meet the
minimum emergency load requirements. Each EDG, rated to carry a continuous load of
2600kW, has sufficient capacity to supply power to the loads needed (less than 1400kW)
to safely shut down the reactor following a transient involving a loss of offsite power
(LOOP). The EDGs also have sufficient capacity that, as a pair (5200 kW), can supply
the engineering safeguards feature (ESF) loads needed (approximately 4000 kW) to
shutdown the reactor, maintain safe shutdown conditions, and mitigate the
consequences of a loss of coolant accident (LOCA) coincident with a LOOP.
Each pair of EDGs is supplied with three circuit breakers, one to tie the output of the
generators together and the other two to connect the output of the individual generators
to the emergency bus. On a s' art demand signal, both pairs of EDGs start automatically.
When they reach 200 revolutions per minute (rpm), the tie circuit breakers close and ;
'
force-parallel the outputs of the generator pairs while the engines are still t celerating if
normal voltage is present on the emergency buses, the EDG output break , remain
open and the EDGs continue to run, in their standby mode, unloaded and .. parallel. If
voltage is not present on the buses, the system logic causes all loads (except the 600
Vac emergency substations) to be stripped from tneir respective buses, the EDG output
breakers to close, and the ESF loads to be connected to their buses according to a pre-
f ! l l
s. ,
l
,
l
4
5
programmed start sequence. If either EDG fails to start or the associated tie breaker
fails to close, only one EDG is allowed to supply the emergency bus. In this case, if a
l LOCA signal is present, one of the two residual heat removal (RHR) pumps is inhibited '
from starting.
i l The FitzPatrick safety analyses assume that one pair of EDGs is available, as a ! minimum, to supply the associated emergency bus,
i
'
Event Descriotion
! As described in Section 01.1 of this report, during the January 14,1999, hydrogen fire,
the operators de-energized both 115KV offsite power lines at the request of the fire l
brigade. This action resulted in the operators entering TS limiting condition for operation
(LCO) 3.9.B.2 for unavailability of both reserve (115 KV) station transformers. This
condition required that operators verify the ability of both EDG pairs to manually start and !
force parallel per TS 4.9.B.5 and surveillance procedure ST-9D, "EDG,115KV, Reserve !
l Power, Station Battery or ESW System inoperability Test." Following the successful l demonstration of the EDGs availability, as a precautionary measure, the SM decided to
leave the EDGs running unloaded. Tie breakers 10504 and 10604 had been opened per i
ST-9D procedure steps 8.1.6 and 8.2.6, respectively. The decision not to secure the i
EDGs was noted in the remarks section of the surveillance procedure. The EDGs were
secured after 3.6 hours of operation. Later in the day, after the fire was out and the
115KV lines were restored, the licensee performed a regularly scheduled monthly
surveillance test of the Division 11 EDGs. During this test the output breaker (10312) of
l
the "D" EDG failed to close. Operators performed the correct compensatory measures i
'
for this occurrence.
Emeroency Diesel Generator Control Loaic
Following the event, on January 21,1990, the licensee informed the NRC that a later
review of the emergency diesel generator protective scheme indicated the possibility that
one or more of the EDGs may have failed to energize the emergency buses in the event
of a main generator trip with the 115KV supply out of service. The licensee's original
concern was thst, with the EDGs running, a loss of the main generator would result in the
EDG output breakers closing on to the emergency bus. However, because the tie l
breakers were open, the EDGs would be unsynchronized and the simultaneous closure
of the output breakers of each EDG pair could result in the loss of one or more EDGs on
overcurrent. Subsequent review of the breaker control logic by the licensee determined
that their original concern was unfounded and that only one EDG would load on each
bus.
J
To verify the licensee's conclusions, the team reviewed the EDG load breaker control l
l logic. The inspectors determined that the automatic closing circuit included two parallel I l - paths, one for the condition when the tie breaker is closed (normal condition following a . l LOCA/ LOOP start signal), and one for the condition when the tie breaker is open (failed !
force paralleling). The team identified no concerns with the breaker " normal" closing j
path. However, they did observe the following weakness in the closing circuit for the j
open tie condition.
l
l
I
. ,
6
As stated above, if the tie breaker is open only one EDG is allowed to load on the
emergency bus. This is accomplished through an auxiliary circuit that evaluates the
readiness of each EDG (in the EDG pair) and allows the loading of only the first EDG to
reach readiness. Specifically, with the tie breaker open, when the output voltage of each
EDG ( e.g., B and D) reaches its pre-established setpoint (90%), it energizes the
associated voltage relay (27B and 27D, respectively). The first of the two relays to
energize (e.g.,27B) energizes, in turn, an auxiliary relay (27XB). A contact from this
relay, after a 0.8 second time delay, permits closure of the associated EDG ("B") load
breaker. A second contact from the same auxiliary relay blocks the energization of the
other auxiliary relay (27XD) and the closure of the associated EDG ("D") load breaker.
Note that, although the example refers to EDGs B and D, the same is applicable to
EDGs A and C.
In the above description, the ability of the circuit to perform its function is based on the
assumption that the two EDGs will not reach the voltage setpoint at the same instant. In
fact several milliseconds (dependent on the response time of the individual relay) would
suffice to make the circuit operate as intended. However, should the two voltage relays
reach their setpoint at the same time, both auxiliary relays (27XB and 27XD) would
continue to cycle off and on (energize and de-energize) until one relay fails or slows
down sufficiently to allow the other relay to accomplish its intended function (close the
associated EDG output breaker).
Given the independence of the EDG starting circuits cnd the fact that the tie breaker
would have to fail to close for the condition to exist, the team did not believe the above
scenario to be likely to occur normally. As a result, the team believed this circuit
characteristic to be a weakness rather than a deficiency of the design. During the event,
however, the opening of the tie breakers rendered the condition likely to occur.
During the event, the EDGs were started manually and, according to procedure ST-9D,
they were not loaded on the bus. When the EDG output voltages reached their
I
respective setpoints, the voltage relays energized, but no breaker actuation occurred
because the emergency buses were powered by the normal supply. Later, when the
licensee opened the tie circuit breakers, both auxiliary relays (27XB and 27XD) were
l armed (ready to energize), waiting for a loss of the normal power to occur. Had that ,
occurred, both auxiliary relays (27XB and 27XD) would have energized concurrently and
l
their cycling would have begun. l
As the licensee concluded, the circuit would have not allowed the simultaneous loading
of the unsynchronized EDG pairs on the emergency buses and, hence, the potential loss
on overcurrent of both emergency buses. However, the loading of a single EDG on the !
each emergency bus would have been highly dependent on the individual response time
of the relays involved and potentially might have not occurred without manual
intervention by the operating staff. The licensee recognized the existence of a relay
'
" race,". but believed that one of the relays would have energized and prevented the other
from actuating, thereby allowing a single EDG to load on each emergency bus. ;
l
l
l
I
. .
7
The team reviewed the design logic and confirmed that, during LOCA load sequencing,
closure of only one EDG output breaker inhibits the automatic start of one of the two
RHR pumps. The team also confirmed through a review of surveillance procedure ST-
9C, " Emergency Ac Power Load Sequencing and 4KV Emergency Power System
Voltage Relays Instrument Functional Test," that this logic feature had been tested
satisfactorily in December 1998.
Assessment of the Event
As stated previously, the onsite emergency power system includes two emergency
buses, each designed to be powered by two EDGs operating in parallel. This design
represents the analyzed configuration of the plant electrical system and satisfies the
single failure criterion. With the tie circuit breakers intentionally left open, if the logic
performed as intended, only one EDG would load on each bus. This configuration is not
within the design basis of the plant, was not analyzed by the licensee, and does not
satisfy the single failure criterion. Licensee operations and engineering personnel did
not recognize the implications of their decision to open the tie breakers until a week later,
during their analysis of the event.
During the event, the unit remained in operation and continued to supply the design
loads. Therefore, no adverse effect was experienced by the plant. However, because of
the fire fighting activities in the proximity of the switchyard, the probability for a loss of the
main generator increased and with it the temporary loss of all ac power. Complicating
factors were provided by: (1) the relay race that could have prevented all EDGs from
loading on the emergency buses; (2) one EDG load breaker that failed to close when
tested following the event; and (3) the ability of one EDG to accelerate the loads
scheduled to be sequenced on the bus (see Section E8.1). The consequences of the
licensee's decision were mitigated by the short duration of the event, the availability of at
least three EDGs for immediate manual loading on the emergency buses, and the
availability of the offsite sources to power the buses within a short time.
Risk Analysis
A turbine trip with the power conversion system available has the highest initiating
frequency of 3.45 times per year. This transient was used by the licensee in their
evaluation of the incident. As stated above, even if it is assumed no automatic loading of
the diesel generators, they were available for manual start and loading. The same was
true for both offsite power sources. I
in the event of a station blackout (SBO), caused by a load rejection and failure of the -
I
onsite as well as of the offsite sources, the facility would rely on the high pressure core
injection, the reactor core isolation cooling, and the automatic depressurization systems.
The facility can cope for eight hours with this equipment and the de power supply
system. In addition, it would take five more nours before core uncovering. The
lic3nsee's probability risk assessment (PRA) shows that the limiting case for a SBO is
!
i
l
l
J
. .
8 ;
bounded by a large break LOCA and a portion of the intermediate break LOCAs. Using 3
the licensee's PRA model, the total probability for these LOCAs is 1.8E-7. This value
indicates that the risk of the H2 event was low. This value would have been even lower if
l the model had considered recovery of the ac sources in a timely manner, as would have
beers expected.
l
c. Conclusions
l i '
During the hydrogen fire of January 14,1999, the licensee operated both pairs of
emergency diesel generators (EDGs) unloaded with their respective tie breakers open
for 3.6 hours. Operation of the EDGs in this alignment placed the electrical system and
,
the plant in an unanalyzed configuration that was not recognized by either the operating j
l staff or by Engineering until approximately a week after the event. The consequences of l the licensee's actions were limited because of the short duration of the event and l because the EDGs were available for manual loading on the emergency buses. Also the
licensee's probability risk assessment modelindicated a low core damage frequency
value. Nonetheless, the licensee's decision to operate the plant in the above
l configuration increased the probability of a station blackout and decreased their ability to !
mitigate the consequences of an accident.
'
A design feature of the emergency electrical system permits loading only one EDG of the
l pair on the emergency bus if the associated tie breaker is open. The licensee did not
take credit for this feature in their design and licensing bases of the plant. Therefore,
this characteristic of the logic was considered a weakness of the design, not a
deficiency. However, a relay race in the control circuitry could prevent the EDGs to
function as intended.
05 Operator Training and Qualification l
05.1 System Ooeratina Procedures
a. Insoection Scooe (93704)
,
The team interviewed the operator who manipulated the hydrogen system at the time of
hydrogen fire, reviewed the system training module and material safety data sheet for
hydrogen, and compared the licensee's training module to the training guidelines
provided in the applicable Electric Power Research Institute (EPRI) Report to assess the
adequacy of the licensee's hydrogen system train.. g.
, b. Observations and Findinas
The team found that the licensee's hydrogen addition system training module, SDLP-
89A, adequately addressed the basic operation of the system, particularly the portion of
the system located downstream of the hydrogen farm. The training module, however,
did not fully address all of the training areas recommended in section 6.3 of EPRI Report
,
No. NP-5283-SR-A, Guidelines for Permanent BWR [ Boiling Water Reactor) Hydrogen
Water Chemistry Installations - 1987 Revision. For instance, module SDLP-89A did not
address the consequences of component malfunctions at the hydrogen supply facility
and the potential hazards of the hydrogen gas.
o
. .
9
The team's interview of the operator determined that he was familiar with the system and
l
the system operating procedure, including manipulation precautions. The operator had
also received general industrial / compressed gas safety training. However, consistent
witn the content of the training module, he had not been given specific training on the j
hazards of hydrogen. Because the licensee's root cause analysis had not been j
completed, the team was unable to ascertain whether the training of the operator l
contributed to or could have prevented the hydrogen fire event. {
l
c. Conclusions !
i
The operator who manipulated the hydrogen system was generally familiar with the
system and the associated operating procedure as well as with the safety requirements
I
for handling industrial / compressed gases. The training module, however, had not
specifically addressed the training recommendations of EPRI Report No. NP-5283-SR-A
regarding consequences of component malfunctions at the hydrogen supply facility and
the potential hazards of the hydrogen gas.
Ill. Enaineering
E1 Conduct of Engineering
E1.1 M.jgtu;
a Hydroaen for Main Generator
a. Inspection Scope (64704)
The team reviewed and physically inspected a temporary modification installed to
provide makeup hydrogen to the main generator. The inspection addressed the quality l
of the design as well as the adequacy of the fire protection program with respect to the
handling of high pressure hydrogen cylinders.
b. Observations and Findinos
:
The fire on January 14,1999, disabled the normal hydrogen supply to the main
generator. To maintain plant operation, the licensee initiated Temporary Modification No.
99-006, Alternate Hydrogen Makeup to the Main Generator. The team found that the
modification and the supporting procedural changes had been acceptably completed.
During the physicalinspection of the modification, the team found that three discharged
hydrogen cylinders had been stored at elevation 272 of the turbine building. The
cylinders, although discharged, contained hydrogen at a residual pressure of
approximately 65 psig. Discussions with the licensee determined that the area had been
evaluated (JDED-97-0370) and approved fc7 storage of acetylene. However, the
licensee had not prepared a safety evaluation for the storage of hydrogen in this area
l and had not obtained a combustion control permit (CCP), as required by section 8.1.1 of
procedure AP-14.04, " Combustible and Flammable Material Contiol." As stated in this
l i section of the procedure, a CCP is required for the use of a flammable gas in any
quantity in nonsafety-related areas.
. .
10
Because the cylinders contained on'y residual hydrogen and had been stored in the area
for approximately only two days, they represented only limited hazard. Furthermore,
when the team notified the licensee of the discrepancy, they promptly removed the
cylinders. The failure to properly control combustibles, as required by plant procedure
'AP-14.04, constitutes a violation of minor significance of 10 CFR 50, Appendix B,
Criterion V, and is not subject to formal enforcement action.
c. Conclusions
The temporary modification prepared to provide hydrogen makeup to the main generator
was acceptably prepared and implemented.
E1.2 Bulk Oxvoen Tank Storaae Sitina
a. Insoection Scooe (93704)
The team conducted a physical inspection of the oxygen tank storage facility and
reviewed the siting design criteria to determine whether the design of the facility
conformed to the licensing commitments and regulatory requirements.
b. Observations and Findinos
The oxygen storage facility consists of a 3000-gallon liquid oxygen cryogenic tank,
ambient air vaporizers, and a pressure / temperature control station. The facility is located
approximately 130 feet West of the diesel generator building. The team found the
physical condition of the facility to be satisfactory. ,
l
Section 9.20.3 of the updated final safety analysis report (UFSAR) states that the facility j
is designed and constructed in accordance with EPRI Report No. NP-5283-SR-A,
Guidelines for Permanent BWR Hydrogen Water Chemistry Installations - 1987 Revision. i
L
The team compared the siting of the facility to the requirements in the EPRI report.
They found that the licensee could not show that all of the safety-related air intakes were j
'
located at an acceptable distance from the oxygen tank in accordance with figure 4-8 of
the report.
, The licensee conducted a survey of the facility and found that the battery rooms air l intake fell within the unacceptable range specified in figure 4-8. To document and track ; l the discrepancy, the licensee initiated DER-99-00172. They also prepared an operability l determination (JDED-99-0038) and found the condition acceptable. The licensee based '
this determinat!on on the fact that the air intakes were approximately 500 feet from the
oxygen storage tank, on the opposite side of the turbine building, and that the building
shielding would prevent tne development of an oxygen enriched environment. The team
j found this determination to be reasonable. L
u
v9 ,
11
c. pgnclusions
The team concluded that the oxygen facility was in good physical condition and that the
tank was adequately sited. The nperability determination prepared to justify the
adequacy of the battery rooms e intake, located within the EPRl-specified unacceptable
range, was reasonable.
E2 Engineering Support of Feds'.ies and Equipment
E2.1 Enaineerina Sucoort of the Hydroaen Fire Event and Root Cause Analysis
a.' Insoection Scope (93794)
The team evaluated the involvement of the engineering staff in the resolution of the fire
event and the root cause analysis prepared to evaluate underlying design and -
performance issues and to initiate appropriate corrective actions.
b. Cbservations and Findinas
Based on concems with the size of the fire and potential exposure of the old
administration building to the effects of the fire, as stated in section P1.1 of this report,
the Emergency Director ordered the Miocation of the Technical Support Center to the
main library. The response of engineering personnel was prompt and relocation of the
facility took place in an orderly and timely manner. Engineering monitored the event and
provided the needed guidance. However, as also stated in section O4.1, they were
unaware of the consequences of operating the EDGs unloaded and with the tie circuit
breaker open. Therefore, they were not effective in preventing Operations from
operating the emergency electrical buses in an unanalyzed condition.
Regarding the analysis of the event, the licensee promptly assembled three multi-
discipline teams, one to evaluete the root cause of the event, one to assess the plant '
response, and one to address recovery from the eunt. By the end of the inspection the
efforts of all three teams were ongoing and incomplete. The NRC inspection team,
nonetheless, reviewed tha methodology and status of the root cause analysis. The team
determined that the licensee had nearly completed their collection of evidente and the
development of potential scenarios leading to fire initiation. The licensee p;anned to
< construct from these a credible scenario by systematically comparing the effects of the
gathered evidence to those postulated in the various scenarios. The licensee also
planned to support their conclusions with metallurgical analyses of the failed
components.
The team's review of the ongoing and completed activities found them to be
comprehensive, detailed, systematic, and a good example of integrated departmental
efforts. The team also found that the results of the investigation were integrated in the
repair and redesign of the new hydrogen supply facility. The NRC inspectors will review
the results of the completed investigation at a later date. (IFl 50-333/99-02-02)
t
-
F= -
:,
3
12
c. Conclusions
The response of the technical support team in the event was prompt and guidance was
provided as needed. Engineering, however, did not recognize the effect of leaving the
EDGs running unloaded and with the tie breaker open and were, therefore, not effective
in preventing OMrations from operating ihe emergency electrical buses in an
unanalyzed conostion. The licensee's evaluation of the event was ongoing, but planned
and completed activities appeared comprehensive, detailed, systematic, and a good
example of integrated deparlental efforts.
E8 Miscellaneous Engineering issues
E8.1 Post-fire Hydrooen Storaae Facility Insoection
a. Inspection Scope (93704)
The team inspected the hydrogen storage facility to determine the extent of the damage
caused by the fire. The team also reviewed the system design and installation and
interviewed operators to evaluate whether the design and operation of the facility
conformed to the 8Leensing comm tments and regulatory requirements. j
l
b. Observations and Findinas ,
I
The hydrogen storage facility includes two high pressure gas storage banks, a pressure
control station, an excess flow control check valve and a gas discharge stanchion. This
equipment is located on a concrete foundation, enclosed by a fence and surrounded with
vehicle guard posts. Each of the two high pressure gas storage banks contains 15
storage vessels. Adjacent to this installation and perpendicular to the longitudinal
direction of the storage vessels, a hydrogen delivery trailer was apparently being used :
as a third source of hydrogen, w confirmed by the licensee.
The team's review of the post-fire condition of the installation found that most of the l
damage was confined to the pressure control station, where the fire apparently initiated.
The panel, housing two piessure controllers and a number of valves and pressure
gauges (see Attachment 2), had received extensive damage, with fallen components at
the bottom of the panel, broken pipe joints, and burst pipes and components. The
flames and intense heat emanating from the panel had burned two large holes in the
chain-link fence surrounding the installation and damaged the suppert structure of the
storage bank closest to the panel. The delivery trailer also was damaged and one of the
t;res was destroyed by the Re. The storage bank farthest from the fire appeared to be
_ generally sound as did most of the storage vessels in the storage bank closest to the fire.
To address the design of the hydrogen system, the team reviewed the UFSAR as well as
portions of the modification package that installed the system in its current configuration,
No. JAF-SE-87-087. Tht., team found that neither the UFSAR, nor the safety evaluation
of the modified facility specifically addressed operation of the system with a hydragen
delivery trailer acting as a third bank. This mode of operation was also not addrused in
'the hydrogen addition system training module SDLP-89A. The team discussed the
observation with the system engineer and other licensee personnel and found that the
L
,
_
.-
-.
.- .i
13
trailer was being used to increase the hydrogen storage capacity. The increased
capacity was required due to a larger than expected hydrogen demand. During the
hydrogen fire, the trailer accounted for approximately 30% of the available hydrogen.
Additionally, the proximity of the trailer to the fire resulted in the exposed side tires
igniting and contributing to the total combustibic load.
The team's review of UFSAR Section 9.20.3 also determined that the system was
designed and constructed in accordance with EPRI Report No. NP-5283-SR-A,
Guidelines for Permanent BWR Hydrogen Water Chemistry Installations - 1987 Revision.
However, the installation did not meet all of the recommendation specified in the EPRI
report. For instance, the hydrogen delivery f re. is a third source, had not been
analyzed for a design-basis tornado (section 4.1.2.2) and was not enclosed in fenced
area (section 4.1.1.2.2). Also, the facility did not incorporate security lighting to facilitate
night surveillance (section 4.1.1.2.2) and the trailer discharge stanchion was not
provided with e check valve (section 3.1.2.4). The licensee was evaluating the team's
observations as part of the fire root cause determination and wrs considering them in the
redesign of the hydrogen storage facility.
Because the delivery trailer acted as a hydrogen source, the team was concerned that
some of the piping and panel components might be exposed to a higher than planned
pressure. The team discussed the pressure rating of the panel components, but
because the panel was supplied by the vendor, the information was not immediately
available. The licensee believed that the pressure rating of piping and components was
well above that of the maximum pressure in the supply trailer. However, they did not
believe that the vendor supplied portion of the system w as designed to the requirements
of EPRI Report No. NP-5283-SR-A. A detailed review of the hydrogen control panel
design was ongoing, as part of the fire root cause evaluation, and results were not
l
available by the end of the inspection. 1
c. Conclusions
i
The use of a hydrogen delivery trailer as a third source of hydrogen did not conform to
the design description for the facility in the UFSAR and did not meet all of the guidelines
specified in EPRI Report NP-5283-SR-A for " Permanent BWR Hydrogen Water
Chemistry Installations," as specified in the UFSAR. The impact of such deviations on
the Gsign and operation of the system as well as on the severity of the fire event was
being investigated by the licensee and the results of such review were still incomplete. l
This is an apparent violation pending completion of the effort by licensee, identification of
corrective actions, and review by the NRC. (see r% item E2.1). (eel 50-333/99-02-03)
E8.2 Emeroency Diesel Generator Capability l
l
a. Insoection Scope (93702) . l
The team evaluated the ability of a single EDO to accelerate and carry accident loads in
the event of a loss of the offsite sources while the tie breaker between a pair of EDGs
was open. !
l
l
s
-. ..
14
b. Qhservations and Findinas
The design of the FitzPatrick emergency electrical buses allows the powering of the
buses with a single EDG if the other EDG in the pair fails to start or if the tie breaker
between each pair fails to close. In November 1998, the licensee evaluated the transient
loading of a single EDG to determine whetner the loading was within the machino's
capability. The licensee's preliminary calculations showed that with only one RHR pump
operating, per design, the total steady state load was slightly below the 30-minute rating
(3050 kW) of the diesel engine. Using reasonable rule of thumb assumptions, the
licensee also preliminarily concluded that the transient load (i.e. the load during the first
few seconds following closure of the motor supply breaker until the motor / pump is up to
speed) was not within the capability of a single EDG. Specifically, peak transient loading
due to the start of the last emergency core cooling pump (the core spray pump) wou!d be
approximately 1300 kW above the continuous rating of the EDG.
Limited single EDG testing was performed during the FitzPatrick pre-operational test
peogram. These records were not available for review during the inspection. However,
the team was informed that the tests may not have reflected actual emergency loads.
More recently (December 1998), single EDG tests were conducted successfully under
procedure ST-9C, " Emergency Ac Power Load Sequencing Test and 4KV Emergency
Power Systems Voltage Relays instrument Functional fest" However, the test was
designed only to verify proper logic system functionality, and significant design loaos
(approximately 800 kW from the 600 Vac emergency substations) were secured during
the test. Since the test did not reflect actual emergency loads, its value in demonstrating
single EDG design capability was limited. The licensee planned to develop formal
calculations in the future.
c. Conclusions
The licensee's preliminary evaluation of the ability of a single diesel to accelerate and
carry the design loads, in the event that the paralleling of a pair of emergency diesel
gererators failed to take place, indicated the potential overloading of the diesel. Also,
the single EDG test conducted in Decembe/1998 was not designed to demonstrate
single emergency diesel generator capabi..iy under accident conditions. The I;censee
planned to develop formal calculations, but the inspectors did not consider this issue is to
be a concern during this inspection because operation of the emergency bus with a
single diesel generator is not within the design basis of the plant.
E8.3 Emeroency Diesel Generator Load Sharina
a. Jngpection Scope (93702)
The team evaluated the ability of the EDG pairs to share the load following a design
basis accident.
I
_
t ..
15
b. Obsentations and Findinos
' The FitzPatrick onsite emergency system uses two sets of two EDGs in parallel to power
the emergency buses. As stated in section E1.1 of this report, each diesel has a
continuous rating of 2600 kW, whereas the calculated load on each of the two buses is
approximately 4000 kW. Therefore, two diesels are required to provide sufficient power
to power the dosQn accident loads. For proper parallel operation, a circuit must be
provided that monitors the load of each EDG and signals the individual govemors to
make necessary corrections in the control of the dieseis such that they share the load
equally.
The team discussed with the licensee the testing done to verify the ability of the diesels
to properly share the load. The inspectors determined that no specific test had been
developed to assure the integrity of the circuit interconnecting the two govemor
controllers and that the individual EDG loads were not recorded during the LOCA/ LOOP
test conducted each refueling outage. Discussions with the licensee determined that,-
during monthly tests, adjustments were made to the diesel controls to properly load tha
machines. However, during the monthly test, the EDGs are paralleled to the offsite
system and the governor controllers do not operate in the same mode as when the
diesel pairs operate independently from the system. Therefore, the monthly tests do not
specifically verify the integrity of the interlocking circuit and the adjustments made do not
assure the ability of the machines to share the bus load.
Based on the above, the team discussed with the licensee the confidence they had
regarding the ability of the diesel pairs to properly share the load. The licensee stated
that, although the individual diesels loads were not specifically recorded during the
refueling outage test, they were observed by the operators in the control room during the
conduct of the tests. Therefore, they had no concern regarding the integrity of the load
sharing circuit.
Considering the size of the bus loads and the rating of each diesel, the team believed
that a failure of the interlocking circuit would result in the overloading of one of the
diesels with consequent supply breaker tripping. This event would attract the attentim of
the operating staff. The licensee's review of recent tests identified no such occyrrence.
Based on the licensee's review, the team concluded that sufficient confidence existed
regarding the integrity of the load sharing circuit. Nonetheless, the licensee's failure to
periodically verify the integrity of the govemor controller interlocking circuit is a violation
of 10 CFR 50, Appendix B, Criterion XI, Test Control. This violation of the NRC
requirements of minor significance and already corrected by the licensee is not subject to
formal enforcement action. In response to the team's finding, the licensee immediately
revised the test procedure to require recording of individual EDG loads during the
refueling outage tests.
c. Conclusions ]
The licensee had not previously verified proper operation of the EDG pair loading
sharing circuits. The licensee revised the testing procedure to verify proper circuit
operation in the future. This minor violation was not subject to formal enforcement
action.
_
r ,
!
16
l
IV. Plant Suonort
'P1- Conduct c,f EP Activities
>
- P1.1 ~ Imolementation of Emeroency Plan
)
a.: Insoection Scope
i
'
The team reviewed the actions taken by the New York Power Authority to execute the
Emergency Preparedness Plan and the associated Emergency Preparedness ,
implementation Procedures.. i
: b. Observations and Findinas
Tne normal locations of the Technical Support Center (TSC) and Operations Support ;
Center (OSC) are in the Old Administration Building. This was one of the buildings
evacuated due to the severity of the fire. Accordingly, the Emergency Director ordered
that the TSC and OSC be relocated to attemate locations. The TSC was moved to the
main library, and the OSC was moved to the cafeteria. The normal locations are pre-
staged with the necessary telephone communications, procedures, and computers
information to monitor plant parameters.
1
The emergency preparedness department facilitated the installation of adequate
telephone lines and nee'Jed administrative and technical support in a timely manner.
Both facilities were activated and functional within the required one hour. The team
considered the effort to relocate the emergency response facilities in a short time frame,
in the midst of an emergency, to be an example of a good Emergency Plan function.
The licensee's overall emergency response to the event wa= good.
c. Conclusion
The overall emergency preparedness response to the Hydrogen fire was good.
Especially noteworthy was the ability to implement alternate locations for the emergency
response facilities and still have them activated and functional within an hour.
F5 Fire Protection Staff Training and Qualification
F5.1 Fire Briaade Trainina Related to Flammable Gases
a. Inspection Scope
The team reviewed the training provided by the licensee to the fire brigade with respcct
to responding to a H2 fire.
w _.
,: .
l
17
b. Observations and Findinas
The team determined that the training provided to the fire brigade included both
classroom presentations and fighting of actual fires at the local fire fighting school. The
subjects covered included, amongst othars, the general duties and responsibilities of the
fire brigade, the chemistry of fires and methods of extinguishing a fire, the hazards of
flammable liquids and gases, the strategy of combating the various types of fires, and the
locations of the hazardous materials on site.
The lesson plans were detailed and included a discussion of fire incidents. In the case of
a gas fire, training lessons specified that it was not safe for a fire brigade to attempt to
put out the fire. Rather, the fire brigade should wait for offsite assistance, unless
immediate actions were needed to rescue personnel. Otherwise, the best strategy was
to let the fire bum itself out. Water should be applied only to cool the containers and
prevent tank failures which, in tum, could exasperate the condition and cause further
damage.
Overall, the inspectors considered the ability of the fire brigade to combat the H2 fire to
be appropriate. In addition, the quick response by the FBL to request off-site assistance
was instrumental in minimizing the damage to other equipment in the area.
)
c. - Conclusion
The inspectors considered the training provided to the fire brigade to combat the H2 fire
to be appropriate. In addition, the quick response by the FBL to request off-site
assistance was instrumental in minimizing the damage to other equipment in the area.
V. Manaaement Meetinos
X1 Exit Meeting Summary
The team presented the inspection results to members of licensee management at the
conclusion of the inspection in a telephone conference on February 9,1999. The licensee
acknowledged the findings presented during the meeting.
The licensee did not indicate that any of the information presented at the exit was proprietary.
. .
18-
PARTIAL LIST OF PERSONS CONTACTED
James A FitzPatrick
R. Baker Maintenance Department
W. Berzom Manager Communications .
G. Brownell Licensing Engineer
P. Brozenick Operations Manager
M. Bursztein - Acting Electrical Engineering Supervisor
M. Colomb Site Executive Officer
R. Converse General Manager Maintenance I
T. Dougherty Engineering
B. Drain Acting Director Design Engineering
F. Edler Acting Maintenance Manager
A. Ettinger Nuclear Engineering (FP) i
S. Kohr. Design Engineering Mechanical Supervisor
D. Lindsey - General Manager, Operations
J. Maurer General Manager, Support Services
R. Patch Director Quality Assurance
R. Plasse Acting Licensing Manager
M. Rastley Operations Training Coordinator
D. Ruddy Director, Design Engineering
P. Ryan Control Room Supervisor
T. Teifke Security / Safety Manager
G. Thomas Manager D & A Engineering
D. Wallace Design Engineering Manager Support
V.Walz Assistant Operations Support Manager
A. Zaremba Licensing Manager _,
l
NBL !
R. Barkley Project Engineer
L. Doerflein Chief, Engineering Programs Branch, DRS l
R. Rasmussen Senior Resident inspector - FitzPatrick !
INSPECTION PROCEDURES USED
IP 93702: Prompt Onsite Response to Events at Operating Power Reactors
<
-
.. .
19
ITEMS OPENED, CLOSED AND DISCUSSED
Opened
l
!
,50-333/99-02-01 NCV Failure to complete an EDG surveillance test procedure, I
resulting in the plant being in an unanalyzed condition.
50-333/99-02-02. 'IFl Review results of licensee investigation. 1
50-333/99-02-03 eel Us of Hydrogen delivery trailer as third source did not
conform to description in UFSAR.
I
Closed
1
50-333/99-02-01 NCV Failure to complete an EDG surveillance test procedure, -
resulting in the plant being in an unanalyzed condition. 1
Discussed
i
1
i [ None
]
l
l l
!
,
I
l
l
l
._
J
. , e 1
20
LIST OF ACRONYMS USED
A Amperes i
AC or ac Attemating Current
ASME American Society of Mechanical Engineers
BWR Boiling Water Reactor
CARB Corrective Action Review Board
CCP Combustion Contro' Permit
CFR Code of Federal Regulations
CR Condition Report
udS Control Room Supervisor
DBD Design Basis Document
DC or de Direct Current
DCP Design Change Package
EAL Emergency Action Level
'
EDG Emergency Diesel Generator
EPRI Electric Power Research Institute
ESF Engineered Safeguards Feature
ESW Emergency Service Water
FBL Fire Brigade Leader
GL Generic Letter
H2 Hydrogen
HP Horsepower
IEEE Institute of Electrical and Electronic Engineers l
KV Kilovolt
KVA Kilovolt-ampere
kW Kilowatt
LCO Limiting Condition of Operation l
-LOCA Loss of Coolant Accident
LOOP Loss of Offsite Power
MWR Maintenance Work Request
NCV Non-Cited Violation
NRC Nuclear Regulatory Commission
NRR Office of Nuclear Reactor Regulation
OE Operating Experience
OSC Operations Support Center
OST Operating Surveillance Test
PM Preventive Maintenance
PRA Probabiltj Risk Assessment
QA Quality Assurance
RCS Reactor Coolant System
RHR Residual heat removal
rpm revolutions per minute
SBO Station Blackout
SM Shift Manager
TER Temporary Evaluation Report
TM Temporary Modification
TS Technical Specification
TSC Technical Support Center
,
s , , e
21
TSSR Technical Specification Surveillance Requirement
UFSAR Updated Final Gafety Analysis Report
Vac Velts Altemating Current
Vdc Volts Direct Current
a
I l . . I
1
r. 1
< . , e !
!
22 )
ATTACHMENT 2 - J. A. FitzPatrick H2 Control System Cabinet l
l
n_701
i i
ixi
_
i I
JL I
truck ria
;
f 202
PI-1112 PI-1111
203
.
~{i g- Active Bank
I i
_.
207 206
-{ 208 Reserve Bank
p I @M i i l I
] l
i
k210 k212 ,
.
1
PCV-215 PCV-216
\
Fi-1113
209
~k.
211
i>< D I O i
213 _
Lsrcn
[
'
!
%,.
. ,
coes c 111
'h' EFV 112
To the Plant
r 1
* , . 8 i
l
23
I
ATTACHMENT 3
)
i
'
HYDROGEN FIRE - DESCRIPTION OF THE EVENTS
At 12:56 p.m., on January 14,1999, the FitzPatrick control room received a report of a iarge fire
at the H2" tank-farm" located in the north-west corner of the property, inside of the protected -
area fence. The fire was reported by an operator who had been manipulating valves inside the
H, tank-farm control cabinet in preparation for placino the H2 addition system in service, in
)
accordance with an approved operating procedure. The Control Room Supervisor (CRS) I
immediately dispatched the on-site fire brigade to the scene to investigate the fire; in addition, ;
buildings near the fire were evacuated. The fire brigade leader (FBL) determined that the fire
was beyond the capability of the fire brigade and requested off-site assistance from local fire !
departments. I
At 1:11 p.m., the Shift Manager (SM) entered the Emergency Plan, became the Emergency i
Director (ED), and classified the fire as an Unusual Event. The ED activated the techrdcal l
support center (TSC) and operations support center (OSC). The required event notifications
were made by NYPA to the county and state agencies, and to the NRC. Due to the proximity of
Nine Mile Point Units 1 & 2, Niagara Mohawk also declared an Unusual Event.
At 1:23 p.m., the FBL requested that the control room de-energize the 115KV switchyard due to
the closeness o'the switchyard to the H 2tank-farm. The request was quickly reviewed by the
control room staff and acted upon. The CRS briefed the crew on the potential affect on the plant
if the main generator were to trip; i.e., the EDGs would be the only source of electrical power for
the emergency buses. In addition, the CRS discussed the fact the plant was in an unusual
configuration with respect to the electricallineup. He had the operators review the appropriate
abnormal and emergency procedures for a reactor scram, a rapid power reduction, and a station
blackout. All four EDGs were subsequently started and left running unloaded for approximately
3.6 hours.
At 1:37 p.m., the first off-site fire truck was allowed on-site and applied water to the fire; the FBL
reported that extinguish:ng the fire was not viable. As additional off-site assistance arrived,
more water hoses were used. At one point, eight hoses were spraying water onto the fire to
maintain the H2 tanks cc:' 9nd to minimize the possibility of a tank failing. At 2:16 p.m., the FBL
reported the fire was under control. At 7:45 p.m., following closure of several valves, the FBL
reported that the fire was ou: and the H2 tank-farm was isolated. The 115KV switchyard was
restored at 9:02 p.m. and the Unusual Event was exited at 9:05 p.m..
EVENT TIME-LINE
January 14.1999-
12:56 p.m. Control room received a report of a fire at the hydrogen tank-farm Fire
i brigade dispatched
1:02 p.m. Sounded fire alarm. Fire brigade requested offsite assistance.
Evacuated nearest buildings.
1:08 p.m. Evacuated west side of site and calleo Mr additional offsite assistance
(' :,q , o
Attachment 3 24
1:11 p.m. Declared an Unusual Event. Technical Support Center (TSC) and
Operational Support Center (OSC) activated but relocated. The normal
location is in the Old Administration Building, which had been evacuated.
1:15 p.m. Fire brigade reported that the hydrogen trailer was also on fire
1:17 p.m. Control Room Supervisor (CRS) conducted a shift brief, including
reviewing procedures for a reactor scram or emergency power reduction,
! loss of 115KV offsite, and station blackout.
1:21 p.m. First two offsite fire trucks arrived, escorted to fire scene by recurity
l 1:23 p.m. Fire brigade requested that the 115KV switchyard be de-energized
1:26 p.m. First 115KV line de-energized (breaker 10022 opened)
l 1:28 p.m. Second 115KV line de-energized (breaker 10012 opened) !
1:29 p.m. Entered Limiting Condition for Operation (LCO) for 115KV de-energized
l (TS 3.9.B.2)
1:30 p.m. CRS held shift brief for 115KV de-energized and discussion to perform
the associated surveillance test (ST-9D) to test the EDGs. Shift Manager
l (SM) decision to leave the EDGs running unloaded (precautionary) with l the tie-breakers open. (ST-9D directs the EDGs be secured and retumed
to the standby condition.) ,
1:36 p.m. Started A & C EDGs, opened tie-breaker 10504
1:37 p.m. Water applied to the fire. Report from fire brigade that extinguishing the
fire was not a viable option.
1:39 p.m. OSC staffed and operational
1:40 p.m. Started B & D EDGs, opened tie-bredter 10604
1:55 p.m. TSC staffed and operational
1:58 p.m. Fire Brigade reported that the three hoses were being used on the fire.
2:07 p.m. SM directed that ST-9D be completed " SAT" with the EDGs uniraded.
SM directed the operators to review the normal operating preadure (OP-
22) with the intent of loading the EDGs.
2:16 p.m. Report from the fire brigade that the fire was under control with five hoses.
=2:30 p.m. With the fire under control, the SM decided to secure the EDGs, but left
them running while TSC evaluated the need to load EDGs prior to
securing them. TSC was concerned regarding oil and carbon buildup in
the exhaust system while the EDG were run unloaded for almost an hour.
5:07 p.m. Secured A & C EDGs
5:08 p.m. Secured B & D EDGs
7:35 p.m. Fire brigade suspended water spraying, but a two foot flame became
visib!e. They isolated that leak, and closed several other valves, including
the bottle isolation valves and the truck supply.
7:45 p.m. Report from the fire brigade that the fire was out and the hydrogen tank-
farm was isolated.
8:00 p.rn. Emergency Dirsctor formally declared the fire out.
9:02 p.m. The 115KV offsite lines were restored and the LCO was exited.
9:05 p.m. Exited the Unusual Event
i
i
}}