ML20216D356

Discusses non-cited Violation Identified in Insp Rept 50-313/98-21,involving Failure to Have Acceptable Alternative Shutdown Capability for ANO-1

ML20216D356
Person / Time
Site:	Arkansas Nuclear
Issue date:	07/23/1999
From:	Vandergrift J ENTERGY OPERATIONS, INC.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
50-313-98-21, NUDOCS 9907270245
Download: ML20216D356 (10)

Text

4 O Ent:rgy operctions,Inc.

1448 S.R. 333 ResdMio, AR 72801

. . Td 501858-5000 July 23,1999 ICAN079905 U. S. Nuclear Pam A*ary Commission Dm*=rd Control Desk Mail Station OPI-17 Washington, DC 20555

Subject:

Arkansas Nuclear One - Unit 1 Docket No. 50-313 License No. DPR-51 Response to IR 98-21 Gentlemen-Inspection Report (IR) 50-313/98-21 identified a non-cited violation (50-313/9821-01) of 10 CFR Part 50, Appendix R that involved the failure to have an acceptab;e alternative shutdown capability for ANO-1. The scenario postulated is a fire in the ANO-1 control room or cabic spreading room causing hot shorts of all eight High Pressure Injection (HPI) valves. These hot shorts are postulated to cause mechanical damage, rendering all eight valves incapable of being opened. To achieve safe shutdown of ANO-1 only one of the HPI valves is required to be capable of being manually repositioned. Therefore, seven valves can suffer simultaneous mechanical damage due to a control room or cable spreading room fire and the ANO-1 safe shutdown capability would not be impacted.

The IR discussion of the non-cited violation included a reference to the March 11,1997, letter from Mr. Samuel J. Collins, Director, Office of Nuclear Reactor Regulation to Mr. Ralph Beedle, Senior Vice President and Chief Nuclear Officer, Nuclear Energy Institute (NEI).

This letter provided the current NRC interpretation of GL 86-10, Implementation of Fire Protection Requirements and Information Notice 92-18 Potential for Loss of Remote Shutdown Cqpability During a Control Room Fire, with respect to the evaluation of multiple spurious actuations caused by fire-induced hot shorts, shorts to ground, or open circuits.

The March 11, 1997, NRC letter to NEl (discussed above) focused on the direct interpretation of the requirements of GL 86-10 and it's relationship to IN 92-18 regarding the evaluation of fire-induced hot shorts. EOI believes that pertinent NRC documents that supported the development of GL 86-10 and the requirements for the evaluation of hot shorts should be considered in evaluating compliance with Appendix R.

Attachment I contains a detailed discussion of the ANO licensing basis, NRC and industry document history with respect to alternate shutdown capability. These documents include GL

\

9907270245 9907 Pt>h k ADOCK 0 13 PDR a POR / [n/ \

(

4 if U. S. NRC July 23,1999 1CAN079905 Page 2 85-01, SECY 85-306, NRC Ina,= don Module 64100, a Brookhaven National Laboratory Technical Evaluation for the Salem Plant and meeting minutes from Callaway/ Wolf Creek concerning the analysis of hot shorts.

Based on our review of GL 86-10, and the regulatory correspondence used on its development, we believe the original intent of the GL, with regards to the alternate shutdown capability, requires only one hot short be considered in the analysis for non-high/ low pressure interface valves. Thus, EOI denies that a violation of 10 CFR Part 50, Appendix R has occurred and requests that the non-cited violation with respect to the requirement that ANO must assume that eight HPI valves all suffer simultaneous multiple spurious hot shorts and damage during a control room or cable spreading room fire be withdrawn.

Additionally, IN 99-17, Problems Associated with Post-Fire Safe-Shutdown Circuit Analysis describes a number ofindustry reports of circuit analysis problems and states that the NRC staffis treating the post fire circuit analysis issue generically. There are two industry groups (Boiling Water Reactor Owners Group and NEI) who are working with the Staff to resolve issues associated with post-fire safe shutdown and to develop a risk based methodology for addressing fire-induced circuit failures among others. These issues should be resolved generically without pursuing individual enforcement actions.

l As stated in IR 98-21 compensatory measures in the form of an hourly roving fire watch in the ANO-1 control room and cable spreading room will be maintained until this issue is resolved.

Additionally, on June 22,1999, Mr. Phil Harrell of the NRC Region IV staff verbally granted a 30 day extension for submittal of this response.

Should you have questions or comments, please contact me at 501-858-4601.

Ve ruly yours,

~

}

D. Vander

• Dir tor, Nuclear Safety JDV/RMC Attachments

l U. S. NRC July 23,1999 1CAN079905 Page 3 l

' cc: ' Mr. Ellis W. Merschoff Regional Administrator ,

U. S. Nuclear Regulatory Commission )

RegionIV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 NRC Senior Resident Inspector Arkansas Nuclear One P.O. Box 310 London, AR 72847 l Mr. Nick Hilton NRR Project Manager Region IV/ANO-1 U. S. Nuclear Regulatory Commission NRR Mail Stop 13-D-18 One White Flint Nonh 11555 Rockville Pike

Rockville, MD 20852 l

l MR. James Liberman Director, Office ofEnforcement U. S. Nuclear Regulatory Commission NRR Mail Stop 7-H-5 One White Flint North 11555 Rockville Pike 1 Rockville, MD 20852 I

l l

1

AM=aat to

- ICAN079905 y Pag) 1 of 7 p

, . Attachment 1 i Arkansas Nuclear One Licensing Basis l

l l

Licensing Basis - Multiple / Simultaneous Spurious Signals l In the early 1980s ANO, along with other licensees, submitted documentation (in accordance with Generic Letter 81-12, Fire Protection Rule) specifying the Safe Shutdown (SSD) and Alternate Shutdown (ASD) methodology that would demonstrate compliance with 10CFR Part 50, Appendix R. As a result of the reviews of various l licensee submittals and individual plant inspections, it became clear that certain licensees l interpreted the regulation in a different manner - than the Staff. To facilitate an l understanding of the requirements of Appendix R, the Nuclear Utility Fire Protection l Group (NUFPG) was formed During this same timeframe, the NRC established the Fire Protection Policy Steering Committee with the goal of providing consistent guidance to the industry and their interpretation of Appendix R requirements. One notable product of NUFPG was a list of questions from the industry concerning compliance with Appendix R.

l In April 1984, ANO personnel attended a Region IV workshop in which these questions l and the NRC responses were reviewed and discussions held on the basis for the responses.

l In January 1985, the NRC issued GL 85-01, Fire Protection Policy Steering Committee l Report, (which included the series of questions and answers) for public review and  ;

comment. In September 1985, the NRC issued SECY 85-306, Staf Recommendations I that again included the series of questions and answers along with submitted comments / resolutions. No disputing comments were noted as to the intent of GL 86-10, ,

paragraph 5.3.10, Design Basis Plant Transients. In April 1986, the NRC issued GL 86-

10. The content of Section of 5.3.10 was unchanged from the original issue of the series of questions and answers. IR 98-21 states that Entergy has misinterpreted the response to this section of GL 86-10 with regards to the number of spurious signals that must be assumed. However, as discussed in the following documentation, the Entergy interpretation is consistent with the NRCs generic and plant specific guidance issued l during the implementation phase of Appendix R as well as a recent plant specific l inspection.

In order to comply with the requirements of 10CFR50 Appendix R, the effect of any I possible spurious operation for any unprotected circuit in the fire area must be evaluated.

The concept for evaluating multiple spurious operations was formally introduced in GL 81-12. However, the evaluation was initially focused on the effects on High-Low pressure  ;

boundary valves. Enclosure 2, Item 2 of the GL states:

"It is our concern that this sir.gle fire could cause the two valves to open resuhing in a fire-initiated LOCA through the subject high-low pressure system interface. To assure that this interface and other high-low pressure interfaces are adequately protected from i the effects of a single fire, we require the following information.

i l

Attachment ts

. ICAN079905 l

Page 2 of 7

, The document continued by specifying what information needed to be provided such that the staff could perform an adequate review of the subject scenario. This position was reiterated in the subsequent clarification letter to GL 81-12.

GL 86-10, Enclosure 2, Question 5.3.10 provides m ' sight as to the number of spurious l actuation signals required to be postulated for a fire in an area requiring alternate shutdown (ASD). Question 5.3.10, Design Bases Plant Tressients, asks:

"What plant transients should be considered in the design of the alternative or dedicated I

shutdown systems?"

l The response stated:

l "Per the criteria of Sectior III.L of Appendix R a loss of offsite power shall be i assumed for a fire in any fire area concurrent with the following assumptions: a.The l safe shutdown capability should not be adversely affected by any onc [ emphasis added]

l spurious actuation or signal resulting from a fire in any plant area; and b. The safe l shutdown capability should not be adversely affected by a fire in any plant area which

! results in the loss of all automatic function (signals, logic) from the circuits located irt the area in conjunction with onc [ emphasis added] worst case spurious actuation or signal resulting from the fire; and c. The safe shutdown capability should not be adversely affected by a fire in any plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line."

l To gain understanding as to the intent of this statement a review of related NRC documents was performed. Enclosure 7 to GL 85-01 contained minutes from the third meeting of the Fire Protection Policy Steering Committee. A discussion concerning the l scope of review for alternate shutdowns was led by a representative of the Auxdiary i Systems Branch and yielded the following:

"With respect to the associated circuits analysis [ emphasis added] it was indicated that the evaluation assured, assuming offsite power loss, that safety could be demonstrated assuming one sourious sinnal [ emphasis added), a loss of all automatic signals, and spurious operation of motor operated valves in the high/ low pressure interface."

l From the above Generic Letters, it can be readily seen that multiple spurious operations should be considered for high-low pressure interface valves. It is understandable to consider such a scenario since the consequences of a fire induced LOCA are severe. Even then, the design assumptions are that the spurious operations only occur in a single higMow pressure line. For non high-low pressure interface concerns, only one spurious signal was required to be assumed.

On August 31, 1984, the NRC issued minutes from a meeting with personnel from Callaway/ Wolf Creek power plants. Included was a clarification of Staff positions which stated, " Associated Circuit - Spurious signal failures must meet the following conditions: >

7-.

[ftas4triment gg ICAN079905 Page 3 of 7 '

1. o automatic function from the circuits in the fire area - in conjunction with one

! worst case spurious signal; l 2. Any one spurious signal and; .

3. Spurious operation of all motor operated valves in-series for higMow pressure interfaces" Considering the effects of multiple spurious operations complicates the analyses of the ASD capability. It is evident that limits were intended to be placed on the number of l assumed spurious operations.

This is supported by the minutes of a May 7,1986, NRC staff meeting that discussed ,

SECY-85-306. The published meeting minutes stated:

"It was noted that the three assumptions of Question and Answer 5.3.10 are meant for independent use (that is, only one assumption applies for any given configuration in a reactor plant). These assumptions are therefore consistent with the established NRR ,

review practice of requiring licensees to analyze for any and all spurious actuations or failures where no two much sourious actuations or failures acar aimultanevalv"

[ emphasis added by NRC).

This position is also reflected in NRC Inspection Procedure 64100, Part Fire Safe Shutdown, Emergency Lighting, and Oil Collection Copability at Operating and Near Term Operating Reactor Facilities, Paragraph 03.01.e.2.f. Specifically emphasizes the fact that:

"These assumptions [from GL 86-10, Question 5.3.10] are therefore consistent with the established NRR review practice of requiring licensees to analyze for any and all spurious actuations or failures where no such spurious actantions or failures ocnr simultaneousiv" [ emphasis added by NRC).

l Obviously, a fire allowed to burn for an extended period without mitigating actions could I create multiple spurious operations. GL 86-10, Enclosure 2, Section 5.3.1 reflects this possibility. However, section 5.3.10 indicates in an ASD scenario, only one spurious signal need be considered to affect non-higMow pressure interface devices. Although not clearly stated in generic Staff guidance, it appears that in the ASD scenario, credit is given to mitigating actions (i.e. activation ofisolation devices) to limit the number of spurious operations.

This is supported by Brookhaven National Laboratory Technical Evaluation Report on the Salem Nuclear Power Station dated November 1995, and provides additional insight to the NRC's response to this question. According to this document, which received NRC concurrence (NRC letter dated January 25,1996, from L4onard Olshan to Leon Eliason, PSE&G), the following position was taken:

(

l I

Attachment to ICAN079905 Page 4 of 7 "If the alternate shutdown capability relies on the use ofisolation/ transfer switches to provide neccesary degree of electrical isolation from the fire affected ares (s), there is a potential for spurious operations to occur prior to actuation of the isolating device.

Therefore, response (a) to Question 5.3.10 indicates that the licensee must consider the occurrence ofeng [ emphasis added] spurious operation orior to [ emphasis added by Brookhaven) isolation of potentially affected circuits."

A review of the above documentation leads to the conclusion that multiple spurious actuations need not be assumed to occur simultaneously during the early stages of an ASD scenario. Given mitigating actions will be promptly taken, only one spurious operation need be assumed during any fire event requiring ASD with the exception of high/ low pressure interfaces where multiple spurious operations are evaluated within a single high/ low pressure interface line.

This is further substantiated on a generic basis by referring to the response of GL 86-10, Enclosure 2, Question 5.3.1 where the following is stated:

"For three-phase AC circuits, the probability ofgetting a hot short on all three phases in the proper sequence to cause spurious operation of a motor is considered sufficiently low as to not require evaluation except for any cases involving Hi/Lo pressure interfaces. For ungrounded DC circuits, ifit can be shown that only two hot shorts of the proper polarity without grounding could cause spurious operation, no further evaluation is necessary except for any cases involving Hi/Lo pressure interfaces."

These statements indicate the staff considered that with the exception of high-low pressure interfaces, three circuit frhres affecting a single component (or function) has such low probability of occurring as to not warrant analysis.

Current Staff Position The NRC issued EGM 98-002, Disposition of Violations of Appendix R, Sections III.G andIII.L Regarding Circuit Failures, to provide guidance concerning apparent violations of Appendix R. Included, as an attachment is correspondence from S. Collins (NRR) to R. Beedle (NEI) which provided the NRCs current position on circuit failures and spurious operations. In this documer.t, the staff quotes several sections of Appendix R and portions of GLs 81-12 and 86-10 as basis for their position, these sections are discussed below.

Appendix R,Section III.G.1 & 2 were utilized to emphasize that one safe shutdown train should remain " free of fire damage" GL 86-10 is referenced to clarify " free of fire damage" as ensuring that a component is capable of performing its intended function during and after the fire. The implication of these statements is that a valve that incurs whanical damage due to 92-18 type circuit failures and is required to be manually operated woul6not meet the definition of" free of fire damage".

E. .

l '

Attachment to ICAN079905 l

Page 5 of 7 h EGM then notes that Appendix R,Section III.G.3 allows for the development of an

-alternate shutdown capability for plant areas where both safe shutdown trains are subject to fire damage The EGM continues by referring to Appendix R,Section III.L concerning

the isolation of associated circuits such that fire damaged circuits will not prevent j operation of shutdown equipment. GLs 81-12 and 86-10 are quoted to illustrate that l multiple circuit failures could occur in an ASD scenario. IN 92-18 is noted as being an l example of the type of circuit failure that could occur prior to isolation of assoc'ated circuits. The implication is that multiple, 92-18 type circuit failures could occur affecting redundant safe shutdown components.

The EGM then refers to GL 86-10, Section 5.3.10 and states that the intent of this section l was to provide licensees with design limits for an ASD scenario (i.e. establish required l

capacity of pumps, etc.). The implication of this statement is that this section should not be utilized to de6ne a circuit analysis and that the limits only apply to the design of an l ASD system that is independent of the coneol room and isolated from associated circuits.

l Since all licensees who utilize transfer switches are subject to spurious operations prior to i performing the isolation, the staff has, in essence, limited the apphcation of this question l to those licensees who have installed a dedicated (i.e. bunkered) shutdown system.

l EOI agrees with the Staff that for non-ASD areas, Appendix R requires one train of l equipment to remain free from fire damage. Furthermore, EOI agrees that for ASD areas, circuitry for redundant safe shutdown equipment has the potential to be damaged by fire.

However, Entergy seeks to ' emphasize that the guidance from GL 81-12 provides measures for mitigating / preventing spurious operations, such as the isolation of potentially j fire-damaged circuits.

EOI agrees that the literal interpretation of Appendix R specifies that multiple circuit l failures can occur in a fire scenario. The Browns Ferry Nuclear Plant (BFNP) fire provides an example of multiple spurious signals occurring in an unmitigated fire. ANO also agrees that a 92-18 type circuit failure is theoretically possible although mechanistic type failures were typically not required to be assumed during the implementation of phase l of Appendix R.

l However, EOI disagrees with the current position that an infinite number of spurious operations are required to be assumed prior to performing timely mitigating actions.

Furthermore, EOI disagrees that GL 86-10 Section 5.3.10 was not intended to be applied to circuit analysis. As stated above, the Staff has internally stated that Section 5.3.10 applies to the associated circuits analysis and provided both plant specific and generic guidance indicating that for non-higMow pressure interface components, a single spurious ,

signal should be assumed to occur in an ASD scenario prior to Control Room isolation. {

For high-low pressure interfaces, multiple spurious signals are required to be considered, j but the Staff has previously provided generic guidance indicating a realistic limit can be assumed. Mitigating actions (i.e. control room isolation) will limit the number of spurious l signals that occur. The ANO-1 ASD procedure directs personnel to deenergize the i associated Motor Control Centers prior to evacuating the Control Room. Follow-up  ;

L

1 1CAN079905 Page 6 of 7 actions are taken in a timely manner [i.e. feeder breakers veri 6ed 'open' within four minutes of Control Room evacuation (red train) and six minutes (green train)] to ensure that the HPI injection valves are no longer subject to spurious operation. Thus, there is a minimal time frame for even one spurious signal to occur.

The EGM also references GL 86-10 to indicate that the extent and damage of a control room fire is impossible to predict. The EGM notes that the timeliness of control room evacuation and implementation of control room isolation may be delayed for "a small fire".

The implication of these statements is that a fire could cause spurious signals that impair the credited safe shutdown function and damage the normal control systems, without being of such magnitude as to require timely control room evacuation / isolation.

During the development of the ASD strategy, EOI was consistent with the guidance of GL 86-10, Section 3.8.4.' This section indicates that the fire is of such magnitude, that the 1 only operator action typically assumed to occur is a reactor trip. Off-site power is l assumed to be lost as well as the automatic function of valves and pumps and the automatic start of the on-site power source. A fire that affects such a diverse group of equipment would be of significant magnitude to require immediate entry into the ASD procedure. In contrast, the NRC hypothai= a "small fire" that does not cause im=M6*e Control Room evacuation, but affects redundant safe shutdown equipment.

Implied in this scenario is that measures for suppression arem' effective. The Staff highlights the BFNP fire as an example. However, proper suppression was not utilized at BFNP until the fire had burned for over six hours and damaged over 1500 cables (Note:

Despite the large number of circuit failures, no valves suffered mechanical damage).

Typically, controls for redundant safe shutdown equipment are spatially separated and often in discrete cabinets. Specifically, the control circuits for the HPI valves are located .

in two separate cabinets and four separate conduits. This spatial separation enhances the )

ability to suppress a "small fire" prior to impacting redundant circuit y, whereas the ASD procedure provides for the timely isolation of control power to the subject valves.

The EGM concludes with the supposition that licensees may have dismissed the significance ofIN 92-18 based on guidance from NUMARC and reemphasizes the type of circuit failure identified by IN 92-18 is within the existing regulation. Contrary to the assumption of the EGM, ANO did not utilize guidance from NUMARC for disposition of IN 92-18. The initial evaluation reviewed the basis of the safe shutdown assessment and concluded that the assumption of all functional failure states (i.e. valves could fail open or closed; pumps could fail running or not running; electried distribution breakers could fail open or closed) would encompass the circuit failure identified by the IN. To follow-up, a circuit analysis was performed to determine the effects of a single, IN 92-18 type circuit failure on the capability to achieve safe shutdown. Since ANO utilizes redundant safe shutdown trains for the performance of ASD, a single, IN 92-18 type circuit failure will not impact the ability to achieve safe shutdown.

i

)

A**ehmaat to ICAN079905 Page 7 cf 7 CONCLUSION It is recognized that there are many variables to consider when analyzing the affects of hot shorts and other circuit failures. During the implementation phase of Appendix R, the Staff recognized this complexity. An attempt was made to limit the amount of circuit analysis that was required. Generic published guidance as well as face-to-face discussions formed the basis for the methodology utilized to develop both the alternate and the normal safe shutdown analyses. The basic assumptions of the methodology are:

1) In an ASD scenario, spurious signals need not be assumed to occur simultaneously.

Furthermore, only one spurious signal need be assumed prior to providing timely isolation of affected control circuits.

2) Due to the relative magnitude of the consequences, multiple spurious operations need to be evaluated for high-low pressure interfaces ,

Considering these conditions and the previously issued NRC position on the number of spurious operations that need be considered, EOI believes that analyzing for the occurrence of eight simultaneous damaging circuit failures prior to isolation of control room circuits during an ASD scenario is beyond the ANO licensing basis and beyond the requirements of Appendix R. The existing safe shutdown capability is not impacted by the occurrence of a single, IN 92-18 type circuit failure. Therefore, EOI concludes that ANO I has been and remains in compliance with 10CFR50 Appendix R.

i f

I

_