ML20206F907

Safety Evaluation Supporting Util Request for Exemption from Requirements of 10CFR50,App R,Subsection Iii.L Re Capability to Achieve Cold Shutdown in 72 H

ML20206F907
Person / Time
Site:	Rancho Seco
Issue date:	05/19/1986
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20206F869	List: ML20206F865 ML20206F880 ML20206F907
References
TAC-53444, NUDOCS 8606250029
Download: ML20206F907 (11)

Text

_ - _ _

e  !. UNITED STATES Enclosure 2 S* "1 NUCLEAR REGULATORY COMMISSION

$ ,I WASHINGTON, D. C. 20555

,, * ._. . /

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION APPENDIX R TO 10 CFR 50, ITEMS III.G.3 and III.L POST-FIRE ALTERNATE SHUTDOWN CAPABILITY SACRAMENTO MUNICIPAL UTILITY DISTRICT RANCHO SECO NUCLEAR GENEPATING STATION DOCKET N0. 50-312

1. INTRODUCTION

i By letters dated November 30, 1983, April 5, 1985, July 12, 1985, September 27, 1985, and October 30, 1985, Sacramento Municipal Utility District (SMUD), the licartaa for Rancho Seco Nuclear Generating Station, proposed alternate shutdown capability for the computer and control room (control room), control room corridor, and auxiliary building roof area in the vicinity of essential HVAC equipment for the control room in order to meet the requirements of Appendix R to 10 CFR 50. By letters dated February 28, 1985, and November 7, 1985, the licensee also requested'an exemption from the Appendix R >

requirement for achieving cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The alternate shutdown system is designed to provide a safe shutdown capability which is independent of the fire areas for which it is required. In the event

.f . firc in either the control room corridor or the auxiliary building roof area, redundant essential control room HVAC equipment trains may be disabled,

! resulting in evacuation of the control room. Therefore, because a fire results in a similar situation to that for a control room fire, the alternate shut-down capability provided for the control room itself can be utilized for plant shutdown given a fire in the above mentioned areas. The licensee has provided a safe shutdown analysis which demonstrates that adequate alternate shutdown methods exist for those areas required in order to assure safe shutdown capa-bility. The licensee indicates that the maximum time to achieve cold shutdown is approximately 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />. This exceeds the 72-hour requirement of Appendix I

R but is considered adequate in that the reactor vendor, B & W has analyzed 8606250029 860519 PDR ADOCK 05000312

. F PDR ,

the post-fire shutdown capability under conservative conditions assuming loss of offsite power. This is discussed further subsequently in this SE.

j . II. POST-FIRE SAFE AND ALTERNATE SHUTDOWN CAPABILITY A. Systems Required For Safe Shutdown 4

) In the event of a control room fire and a loss of offsite power, once the decision to evacuate the control room has been made, the operators will trip the reactor by a manual scram of the control rods, if an automatic scram has I not occurrea. Reactor coolant system (RCS) inventory, reactivity and pressure i ,

control in hot shutdown will be maintained by one makeup /high pressure injec- '

l tion pump (MU/HPI) taking suction from the borated water storage tank. The MU/HPI oump will also provide reactor coolant pump seal injection flow.

Overpressure protection for the RCS will be provided by pressurizer safety l

valves. Cooldown will be achieved by control of RCS temperature. The auxilia-ry feedwater (AFW) system, main steam safety valves and atmospheric dump valves function in hot shutdown to furnish an emergency feedwater supply to the steam generators for removing heat from the RCS in natural circulation, and rejecting the haat from the secondary system to the atmosphere. To commence cooldown from hot shutdown, the atmospheric dump valves will be used in place of the main steam safety valves. A motor driven AFW pump will deliver water from the condensatestoragetank(CST)tooneorbothsteamgenerators. The decay heat removal system will be initiated at a primary pressure and temperature below

! 'cc r t and 290*F respectively to establish cold shutdown. If the CST has haan avnanded prior to initiating the decay heat removal system, a gravity back-up system for supply to the AFW pump suction from the site reservoir will be available. Transfer from the CST to the reservoir will be accomplished manually.

The specific shutdown systems and their support systems required to reach cold shutdown with a loss of offsite power are:

e S

c .-c _ . , . . _ _ _ . - , _ _ - . , - _ . , _ , _ . _ . .__ , , , . - , , _ _ _ . _ _ _ . _.,w___ .. . - , . ,_..,,.,_ e-

1. Seal injection and makeup system included borated water storage tank

2. Decay heat removal system

3. Reactor coolant system

4. Auxiliary feedwater system including condensate storage tank

5. Nuclear raw water system

6. Nuclear service water system

7. Emergency power generating and electrical distribution system

8. Heating ventilation and air conditioning system (containment. air coolers and makeup /HPI pump room cooler)

9. Backup nitrogen for atmospheric dump valves

10. Selected instrumentation

11. Main steam system including safety valves and atmospheric dump valves.

B. Areas Where Alternate Shutdown Is Required The licensee has provided alternate shutdown capability for the control /

computer (control room), control room corridor, and auxiliary building roof (where essential HVAC for the control room is located). As discussed in the introduction, the control room fire event bounds the design of the alternate shutdown capablity. The licensee has described a control room fire event which damages the normal controls and instrument indications of both trains (A & B) of the systems required to reach cold shutdown. The post-fire alternative shutdown system consists of 1) a remote emergency shutdown panel located in the west 4160 volt switchgear room with controls for a number of train A valves of the required systems and an alternate set of instrumentation to monitor the necessary plant parameters, and 2) local stations for control of required pumps and remaining valves. The licensee tabulated the components and circuitry for the required train A equipment located in the control room in order to assure independent control at the panel. This also included an assessment of train B valves when in series with train A valves in a required flow path to verify that the loss of train B would not affect operation of necessary shutdown systems.

C _ _--._ . _

- = - - _ - - __ - ..

The licensee stated tht' the alternative shutdown capability will not require any new systems. Existing plant equipment will be isolated from the control room by means of transfer switches located at the emergency shutdown panel and appropriate local switchgear. Pumps will be controlled from their associated switchgear and valves will be throttled utilizing controls on the emergency shutdown panel and local stations. The instrumentation on the emergency shutdown panel will be sufficient to monitor those parameters necessary to achieve and maintain natural circulation.

The licensee identified those modifications and components added to the exist-ing emergency shutdown panel in order to comply with Appendix R, Subsection III.G.3 and III.L criteria. New isolation switches were also installed on the required switchgear. Modification for operation of the atmospheric dump valves *

~

from the emergency shutdown panel has not been provided. These valves may be operated manually, locally. Preferred operation, however, is via the pneumatic operatcr from a remote station in the turbine building. Therefore, the licensee has provided repair procedures to cover the loss of air to assure their remote operability. See Section III.D. of this SE for further discussion.

C. Remaining Plant Areas All other areas of the plant not required to have an alternate shutdown capa-bility will comply with the requiremeats of _ Subsection. III.G 2 of Appendix R, In addition, unless an exemption request has been approved by the NRC staff.

certain circuits associated with the high-low pressure interfaces do not meet the Subsection" III.G.2 separation requirements. This is discussed further in .

Section III.E.2 of this evaluation.

s n . _ - - - - _ _ , - - - . - - . -

III. EVALUATION A. Performance Goals The performance goals for post-fire safe shutdown for reactivity control, j inventory control, reactor pressure and decay heat removal will be met using the existing systems and equipment indicated in Section II.A above. The l control of these functions can be accomplished using the alternate shutdown j method described for the control room fire. The licensee's alternate shutdown method relies on procedures and actions at the emergency shutdown panel, other loccl shutdown stations, and at required equipment.

The process monitoring capability provided at the existing emergency shutdown .

~

panel (H2SD) located in the west 4160 volt switchgear room is as follows:

S.;; " :r? Steam GeneIator (OTSG)

"A" level wide range LT-20501A l l OTSG "B" level wide range LT-20502A Pressurizer level LT-21503B LT-21503D Makeup tank level LT-23502C OTSG "A" Pressure, Wide Range PT-20543C OTSb 4" Pressure, Wide Range PT-20543D Reactor Coolant System (RCS) Pressure Wide Range PT-21050 PT-21051 RCS Temp, cold leg "A" TE-21025C RCS Temp, hot leg "A" TE-21031C

l RCS Temp, hot ~1eg "B" TE-21032C l TE-21024C l RCS Temp, cold leg "B" The above instrumentation is electrically independent of the control room.

A portable source range neutron flux monitor will be provided for temporary connection to cabling at the reactor building penetration in order to provide reactivity indication independent of the control room. It will include a high voltage power supply module, count rate amplifier module, source range test modu.le, and low voltage power supply. Refer to Section III.D of this SE for further discussion.

Condensate storage tank level indication is measured locally at the tank and is ;

independent of the control room.

B. /2-Hour Requirement By letter dated February 28, 1985, the licensee requested an exemption from the requirements of Appendix R, Subsection III.L, which state that the alternative shutdown system shall_have the capability to achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with loss of offsite power. With the absence of offsite power, the reactor coolant system (RCS) cooldown rate in natural circulation is limited by heat loss from the pressurizer. The reactor vendor, B & W, has analyzed the Rancho Seco RCS per the criteria of Appendix R (B & W Report No.

51-1152713-00). This analysis indicates that in the most conservative case (low pressurizer heat loss) two hundred and five (205) hours are needed to reach a cold shutdown condition. This calculated time is based on reaching 300 psig in the RCS before the decay heat removal system is actuated.

In addition, the licensee stated that onsite diesel fuel transfer capabilities  !

will provide a diesel fuel supply of between 350 to 500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br />. Subsequently, i by letter dated November 7,1985, the licensee revised the original exemption request as follows:

. . - ~ ~ - - - - - - -- , .n - _

, .- r - ,- e

1. The decay heat removal system cut in pressure is 255 psig rather than 300 psig.

2. The onsite diesel fuel capacity is between 175 to 250 hours0.00289 days <br />0.0694 hours <br />4.133598e-4 weeks <br />9.5125e-5 months <br /> rather ao than 350 to 500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br />.

The licensee stated that the lower decay heat removal cut in pressure will not Further, the change the time (205 hours0.00237 days <br />0.0569 hours <br />3.38955e-4 weeks <br />7.80025e-5 months <br />) required to achieve cold shutdown.

licensee stated that additional supplies of diesel fuel oil can be brought g ensite by tanker trucks from local supplies to supplement the onsite capacity in order to support an extended loss of offsite power if necessary.

Because one primary concern with regard to post-fire alternative shutdown capability is assuring plant safety assuming loss of offsite power and not the actual time required to achieve cold shutdown, we conclude that the licensee's justification for the requested exemption to the 72-hour requirement of Appen-aix r , +.wi. uon III.L. is acceptable, and therefore the exemption should be granted.

C. Ptactivit.v Control Reactivity control is achieved using borated water frnm the borated water storage tank. The licensee stated in its October 30, 1985, letter, however, that with more than 310 effective full power days of operation durino one cycle, additional concentrated boron from a concentrated ec9eca will be required to maint'ain a proper shutdown margin through cold s . n : rm . To achieve this, the licensee will modify Procedure C.13.B.

~

v;o a wn From Hot Shutdown to Cold Shutdown with a Fire in Control Room",

to require the pressurizer level to be . increased to 225 inches when the RCS temperature is below 400 F.

D. Repairs Pcst-fire repair of certain systems necessary to achieve alternate cold shutdown i,s required following a fire in the control room as discussed below:

s,

1. Tetnporary Atmospheric Dump Valve (ADV) Nitrogen System lhe ADVs are used to control the cooldown process following a control room fire. If plant air is lost, a temporary supply of nitrogen will be installed to pennit remote manual operation of the ADVs . Sufficient time is available to accomplish this repair by maintaining hot shutdown conditions using the main steam safety valves.

2. Decay Heat Removal System (DHS) Return Temperature Monitoring During Loss of Non-Nuclear Instrumentation During decay heat removal system operation, the temperature of the water injected into the reactor vessel must be maintained so as not to exceed the brittle fracture temperature limits of the vessel.

A control room fire could destroy the non-nuclear instrumentation cabinets causing loss of all remote decay heat removal system indications. Therefore, DHS return temperature indication will be determined at RTD TE-26043 using a volt ohmmeter and a calibration wi w.

3. Portable Source Range Neutron Flux Indicator A control room fire could damage the nuclear instrumentation cabinets which supply the source range neutron count rate to the indicator l'ocated at the emergency shutdown panel. A portable source range neutron flux indicator will be provided for temporary connection to the existing detector cabling at the reactor building penetration.

4. Loss of Switchgear Ventilation A loss of offsite power could cause an excessive heat buildup in the safe shutdown switchgear rooms after two hours. A procedure has been written for adequate ventilation of the four switchgear rooms via portable fans and flexible ducting. Installation and operation of this equipment will take approximately one hour. Therefore, adequate time is available for this repair to be made prior to an unsatisfac-tory condition occurring.

9-l The above repairs are associated with the post-fire alternate shutdown capability. In addition, the licensee has also considered a fire event in i which common air hose manifold to the positioners on the ADVs are damaged by a fire at the hose location. The damaged hoses can be repaired and remote operability for the ADVs from the control room restored within a satisfactory time-frame. .

Procedures will be available for accomplishing the above repairs. The necessary repair materials are stored onsite in locations independent of the fire areas of concern.

E. Associated Circuits Protection To assure the availability of the required shutdown systems following a fire in the control room, the licensee identified associated circuits that could prevent operation or cause maloperation of these systems and equipment. This included the following categories.

1.) Cables in the fire area of concern which are connected to the same power supply as the alternative shutdown equipment cabling.

2.) Cables to equipment in the fire area of concern whose spurious operation could adversely affect shutdown.

3.) Cables in the fire area of concern that share a commorthclosure with circuits of the alternative shutdown system.

1 For identifieN associated circuits, protection of the safe shutdown systems was provided in accordance with NRC staff guidelines as outlined in the following paragraphs.

i 1

1. Common Power Supply -

The licensee stated that common power supply sources of associated circuits i

l have overcurrent trip characteristics that cause the interrupting device (fuse

! or circuit breaker) to interrupt the fault current prior to initiating a trip The

. of an upstream device which could cause loss of the common power source.

ir,terrupting devices have proper coordination to assure that loss of the l

i required alternate shutdown power source will not occur.

j 2. Spurious Operation i

m, ucJ uclation capability will be provided for circuits of equipment not required for safe shutdown but whose spurious operation could affect the 2 capability to safely shutdown. This will be accomplished by opening the power supply breaker and manually aligning the valves in the required position once the control room is evacuated. The licensee indicated that sufficient instru-mentation exists at the emergency shutdown panel to detect spurious operation.

With regard to isolation of high-low pressure interfaces for fire events, the licensee has identified each interface that uses electrically controlled l f devices for isolation.

! l For the cases where adequate separation is not provided, per the criteria of 1

1 Subsection III.G.2 of Appendix R. spurious operation is prevented by racking out i

the supply breakers during normal plant operation such as for a decay heat removal system suction line valve or tripping the supply breaker such as for l

the block valve for the pressurizer power operated relief valve (PORV) and i

letdown line isolation valve. The circuit breakers for the above valves are l located in areas independent of the fire areas of concern.

I i

- . , , , - - - , - . - - - , - - - - - - - - - - , , , , - - - - - , - - . - . , . ~ - . , - , . - - - - - - - , , , - , - , - - , ~ ~ . , , . , ,,---.r...-, . . . - - , - -

3. Common Enclosure The licensee's analysis of common enclosures identified two associated circuits of concerr. where a fire could propagate via a common enclosure from one fire area to another, or where electrical protection was not provided. These cables were routed separately in conduits during the 1985 outage. Thus, common, enclosure of concerns have been eliminated.

4. Safe Shutdown Procedures and Manpower The li:ersee has developed procedures for performing alternate shutdown in the event of a control room fire. The procedures encompass shutdown with and

- without offsite power. The procedures have been finalized and approved and ,

operator training has been conducted. The objectives of the procedure are to prevent overcooling of the RCS, establish inventory control, establish primary t- eccandarv heat transfer and achieve cold shutdown.

Nine operations personnel are required on shift for reactor modes other than cold shutdown. In the event of a fire which requires evacuation of the control room, three of the personnel will report to the fire brigade, one will assume tiie position and responsibility of Emergency Coordinator. The remaining five personnel are sufficient manpower to perform the required functions in the limiting scenario alternate of hot shutdown and control room evacuation.

IV. CONCLUSION Eu.tJ s eur review, we conclude that the Rancho Seco post-fire alter-nate shutdown design provides one train of systems necessary to achieve and maintain safe shutdown conditions independent of the fire areas of concern.  ;

We, therefore, conclude that it meets the requirements of Appendix R to 10 CFR 50, Subsections III.G.3 and III.L, with respect to safe shutdown in the event of a '

fire, and is acceptable. This conclusion is also based on our recommendation that the licensee's request for exemption to the Subsection III.L requirement for achieving cold shutdown in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> be granted.

Dated: May 19,1986 .

9W '

_. - _ . . - _