ML20247N773

Supplemental Significant Deficiency Rept Re Safe Shutdown Analysis self-assessment

ML20247N773
Person / Time
Site:	Limerick
Issue date:	05/31/1989
From:	Kemper J PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 8906060022
Download: ML20247N773 (9)

Text

.._____z___

b t_..

A r.<

8.;

. PHILADELPHIA ELECTRIC COMPANY-2301 MARKET STREET P.O. BOX 8699 PHILADELPHIA A. PA.19101 (215)841 450o JOHN S. KEMPER 83NtOR VICE. PRESIDENT - NUCLE AR 10CFR50.55Ce)

May 31, 1989 U. S. Nuclear Regulatory Conmission Attn:- Docunent Control Desk Docket No.:

50-353 Washington, DC-20555 CPPR-107

SUBJECT:

Limerick. Generating Station, Unit 2 Supplemental Significant Deficiency Report, Safe Shutdown Analysis

REFERENCES:

See Enclosure 1 FILE:

. QUAL 2-10-2 (SDR-L2-88-07, SDR-L2-89-03,04,05,06,17, and SDR 249-2)

Gentlemen:

By those letters listed in Enclosure 1, we Indicated that.as

'part, of a self-assessment we were performing a root cause evaluation :

of the suspected deficiencies with the Limerick. safe shutdown analysis.

In each of the referenced letters, we further Indicated that we would provide a response discussing our assessment results and the proposed corrective actions. Enclosure 2 to this letter provides this' infonna-tion and closes.out that portion of each of the referenced significant deficiency letters concerning the safe shutdown self-assessment and corrective actions.

In addition, Enclosure 2' addresses the corrective-

. actions taken in response to SDRs L2-89-03, 04, and 05. This sup-plemental report represents PECo's final closure of those referenced SDRs related to safe shutdown analysis deficiencies.

If you have any further questions at this time, please contact us.

Since rel y, Y f /cgi -

7 Enclosures MAM/mv/05238901 cc:

W. T. Russell, USNRC, Administrator, Region I T. J. Kenny, USNRC, LGS Senior Resident Inspector R. J. Clark, USNRC, LGS Project Manager f

8906060022 890531 PDR ADOCK 05000353 S

PDC l g

_ = _ _ _ - - _

bec: S. J.'Kowalski G..M.

Leitch L. B. Pyrih

.R. J. Lees

.G. A. Hunger, Jr.

C. J. McDermott E. J. Bradley W. J. < Boye r, J r.

A. S. MacAinsh M. S. Iyer (Bechtel)

J. F. O'Rourke H. D. Honan G. J. Reid P. J. Duca M. A. Miller (TENERA)

N. Floravante (TENERA)

DAC (NG-8)

I m---------

f a.

REFERENCES 1)

Letter from S. J. Kowalski (PECo) to W. T. Russell (NRC) entitled,

" Interim Report [on] Nonavailability of Safe Shutdown Capabilities from Outside the Control Room in the Event of a Fire," dated February 1, 1989 (SDR-249-2) 2)

Letter from S. J. Kowalski (PECo) to W. T. Russo11 (NRC) entitled,

" Interim Significant Deficiency Report, Loss of the Emergency Diesel Generators Due to a Fire on the Control Complex," dated February 2, 1989 (SDR-L2-88-07) 3)

Letter from L. B. Pyrth (PECo) to W. T. Russell (NRC) entitled,

" Interim Significant Deficiency Report, Unavailability of the HPCI and RCIC Systems Due to an Appendix R Fire," dated February 17, 1989 (SDR-L2-89-03,04,05) 4)

Letter from S. J. Kowalski (PECo) to W. T. Russell (NRC) entitled,

" Interim Significant Deficiency Report, Unavailability of the Feedwater Maintenance Isolation Valve to Support RCIC Operation in the Event of an Appendix R Fire," dated April 3, 1989 (SDR-L2-89-17) 5)

Letter from S. J. Kowalski (PECo) to W. T. Russell (NRC) entitled, "Significant Deficiency Report, Unavailability of Suppression Pool Indication Due to an Appendix R Fire," dated May 8, 1989 (SDR-L2-89-06) i MAM/mv/05238902 4

1 i

1 _

LIMERICK SAFE SHUTDOWN ANALYSIS SELF-ASSESSMENT INTRODUCTION PECo's decision to initiate a self-assessment program of the Limerick safe shutdown (SSD) analysis was brought about by two concurrent events. First, Peach Bottom had reanalyzed its SSD analysis from which we obtained lessons learned and reviewed these lessons learned against the Limerick SSD analysis. Second, we conducted a series of reviews (not necessarily safe shutdown reviews) in preparation for Unit 2 startup which identified deficiencies. The Peach Bottom activity resulted in a bro der understanding of the fire protection requirements and the necessary supporting documentation. With the experience gained during these activities, a concern was raised with respect to root cause and adequacy of corrective actions. Thus, a Limerick self-assessment program was initiated in December 1988.

A number of safe shutdown analysis deficiencies were identified and reported under 10CFR50.55Ce) for Unit 2.

In each deficiency report IIsted in Enclosure 1, we Indicated that as part of a self-assessment we were performing a root cause evaluation of Limerick SSD analysis deficiencies. Upon completion of the analysis we would provide a response discussing assessment results and the proposed corrective actions. The discussion in the following sections provides this Information as corrmitted.

The status of the ongoing effort portion of the improvement program which will be complete prior to Unit 2 licensing is also provided.

LIMERICK SAFE SHUTDOWN ANALYSIS SELF-ASSESSMENT PROGRAM The self-assessment was conducted in two parts.

First, Bechtel, the architect / engineer for the project, performed an internal review.

This review included a progrartmatic and documentation overview of the safe shutdown analysis and a review of the documentation and evaluation of a sample fire area. Second, PECo performed a programmatic overview of the safe shutdown analysis. This two-part assessment program resulted in the determination of the overall root cause of the various deviations identified and specified the scope and schedule for corrective actions.

The topics evaluated by the self-assessment were as follows:

shutdown model/ assumptions, shutdown systems, shutdown components, shutdown circuits, shutdown procedures, and fire area evaluations and deviations from NUREG-0800 guidelines related to the post-fire shutdown capability.

The self-assessment efforts identified issues for correction and showed that the root cause of the SSD analysis deviations was two-fold:

(1) a lack of detailed procedures utilized in performing the safe shutdown analysis and (2~) a misunderstanding and misapplication of the detailed regulatory requirements, due in part to the changes in Interpretations over the course of IIcensing the Limerick Generating Station.

To address the root cause and assessment results, PECo initiated an improvement program for the Limerick safe shutdown analysis: the Limerick Safe Shutdown Analysis Improvement Program. The improvement program addresses the root cause through studies which broaden the evaluation of specific issues identified in the self-assessment. This improvement program also addresses the root cause through studies which provide a reverification of key aspects of the safe shutdown analysis. Upon completion of this program, detailed procedures for performing a safe shutdown analysis will be in place to prevent recurrence of similar SSD analysis concerns. The improvement program consists of an ongoing effort and an enhancement effort.

The root cause and the project plan for the Limerick Safe Shutdown Analysis Improvement Program were presented to the NRC in a meeting on January 23, 1989. The results of the assessmc t and the scope of the improvement program were discussed in subsequent meetings with the NRC on March 15, and April 6, 1989.

ONGOING EFFORT OF THE SSD ANALYSIS IMPROVEMENT PROGRAM The ongoing effort includes studies, modifications, and evaluations with the objective of providing verification of compliance to safe shutdown requirements and increasing the overall confidence in the program.

The ongoing effort is comprised of completed and ongoing studies, completed and ongoing modifications, and completed and ongoing evaluations to resolve concerns. Each aspect is discussed below.

Completed Studies Breaker Coordination Study - provided the calculation to support the Fire Protection Evaluation Report (FPER) statements that associated circuits which share a cormon power source were protected by coordination.

Procedure /Timelines Study (Preliminary) - provided preliminary (a) time-lines which dennnstrated that operator staffing and response times are appropriate for the safe shutdown procedure and (b) plant transient information to support the shutdown methodology.

High/ Low Pressure Interface Study - provided a re-identification and assessment of interfaces with the reactor coolant system.

Multiple High Impedance Faults Study (Restoration Procedures) - provided Identification of the breakers that would need to be restored in the event a fire that resulted in multiple faults on safe shutdown power supplies.

I Safe Shutdown Component Selection Criteria Study - provided a verification of the safe shutdown components.

Unit 2 Startup Interaction on Unit 1 Operation Evaluation - evaluated shared system interfaces between the two units with respect to the i

capability of shutting down Unit 1 in the interim period before Unit 2 I

operation.

L--_

Remote Shutdown Panel (RSP) Halon System Evaluation - evaluated the effects of fire-induced spurious actuation of "ie Halon systen in the floor section of the RSP roan.

Limerick Core Uncovery Analysis - provided evaluation of the core con-ditions for safe shutdown nethods that utilize rapid depressurization and low pressure injection systens.

Fuse Control Study (Procedure Revision) - provided a methodology to control replacement of the fuses which are relied upon in the

[

1 post-fire safe shutdown condition.

Fire Danage Prior to Transfer Evaluation - provided verification of the transfer switch designs with respect to the latest criteria.

Loss of Connunications Study - evaluates the ability of the existing connunication systen to address the needs of the post-fire safe shutdown procedures.

Ongoing Studies Procedures /Tinelines Study (Final) - provides final tinelines which demonstrate that operator staffing and response Lines are appropriate I

for the safe shutdown procedures and finalizes the plant transient Infonnation to support the shutdown methodology.

Valid Process Paraneters Study - evaluates the safe shutdown systens with respect to the plant's expected parameters (i.e.,

water level, j

pressure, and roan temperature).

l Ventilation Assessment - evaluates the temperature conditions for roons containing safe shutdown components.

Multiple High Impedance Faults Study (Final) - evaluates the effects of fire-induced, multiple high impedance faults on the safe shutdown power supplies.

Loss of Drywell Cooling Evaluation - evaluates the effects of a loss of the drywell cooling systems.

HPC1/RCIC Baronetric Condenser Evaluation - The original SSD analysis did not evaluate the HPCI/RCIC barometric condenser subsystens for safe shutdown.

Because of issues raised outside the scope of the SSD analysis, canponents are being re-evaluated for consideration in the SSD analysis.

The performance of these ongoing studies using the current interpreta-tions and appilcations of the regulatory reautrenents and guidance will result in the verification of Linerick regulatory compliance. As these studies and evaluations are completed, the potential exists to identify additional concerns with the Linerick design. These additional concerns would not necessarily represent deficiencies with respect to the fire pro-tection requirements.

Each additional concern has been or will be evaluated

c for deportability. These concerns nay require further evaluation and nay result in either modifications to the plant, procedural revisions, or updates to the supporting documentation. Any additional concerns will be addressed for safe shutdaan compliance prior to Unit 2 fuel load.

Completed Modification DC Power for RSP - The original safe shutdown analysis did not credit start of the diesel generators for some tine period following a fire-Initiated shutdown.

For this situation, poner for the reactor vessel level and pressure Indicators at the RSP would not have been available.

A modification has been completed to provide de power for this instrumentation.

(Modification Design Change Package (MDCP) 5950-2)

Ongoing Modifications RCIC Isolation Valve Closure - Division 3 powered RCIC steam containment isolation valve HV-49-12F007 can be closed by fire-caused danege to Division 3 steam leak detection circuits before these circuits are isolated by transfer switches at the RSP. Division 3 power is not available from the RSP. The RCIC steam containment isolation valve is being provided with an alternate Division 1 power supply which is available from the RSP. This modification corrects the deficiency identified in SDR L2-89-05.

(MDCP 5994-2) (Installation complete. Testing in progress.)

HPCI Trip Switch - Fire-caused start or valid process paraneter start of the HPCI could occur with fire danage to the HPCI trip circuits or

- unavailability of the HFe' trip switch.

If the autanatic trip on Level 8 does not stop the turbine, then HPCI would overfill the vessel to the nain steam lines. An electrical HPCI trip switch is being installed at the RSP which will pennit prompt operator action at Level 8.

This modification corrects the deficiency identified in SDR L2-89-04.

(MDCP 5995-2) (Installation in progress.)'

RCIC Flow Controller - Fire damage to circuits of the RCIC system prior to Isolation of these circuits by transfer switches at the RSP could result in danage to the RCIC speed controller and flow transmitter.

Thus, the RCIC systen vould not be controllable fran the RSP. Additional isolation for the RCIC circuitry is being provided.

(MDCP 5962-2)

(Installation conplete. Testing in progress.)

HPCI/ Core Spray Interface - Valve HV-52-12F037 was not included in the list of safe shutdown canponents. Spurious opening of the valve could affect the ability of HPCI to inject into the reactor vessel.

Cable protection is being provided to eliminate the possibility for fire-Induced spurious opening of the valve.

(MDCP 5989-2) (Installation complete. Testing in progress.)

RWCU Isolation - A fire in the control complex or Fire Area 70 East could result in spurious opening of the high-low pressure Interface j

valves located in the 4-inch RWCU blowdown line.

Spurious opening of

}.

three valves (HVC-44-2F033, HV-44-2F031, and either HV-44-2F034 or HV-44-2F035) would create a flow path from the pressurized reactor vessel to either the condenser or the radwaste equipnent drain

collection tank via low pressure piping. A disconnect switch will be provided to one of the three valves (HV-44-2F031), thereby ensuring that'a fire could not spuriously open all three valves. (MDCP 5998-2)

(Installation complete. Testing in progress.)

RSP Room Snoke Dampers - In accordance with the FPER, the supply and exhaust airflow rates for.the remote shutdown room are balanced so as to maintain a positive pressure with the room for both the nornal recircu-lation and outside air purge room. However, a fire to the auxiliary equipnent any render the ventilation systen inoperable, thereby allowing for the possibility of snoke infiltration into the renote shutdown panel roan.. The barriers, ducts, and doors between the auxiliary equipnent room and rennte shutdown panel are being nodified to restrict the passage of snoke. (MDCP 6007-0) (Installation in progress.)

Comro.'. cation Upgrade - In the event of a fire in one of several plant areas, the plant's connunication systens could be rendered inoperable.

The connunication system is being upgraded, including additional isolation cnd power supplies, to ensure its availability in the event of a fire.

(MDCPs 949 and 5993-0) (Installation in progress.)

Additional Energency Lighting - As part of the ongoing effort studies, the need for additional post-fire operator actions has been identified.

Energency lighting units are being provided for these actions, including the access and egress paths.

(Startup Change Request 2E5074)

(Installation in progress.)

Suppression Pool Instrumentation - In the event of a fire in the control complex, suppression pool level and temperature instrumentation ney not be available at the renote shutdown panel, The;e instruments are being provided at the remote st

.ch manel.

(Design Change Packages 2041 and 2043) (Installation complete. Testing in progress.)

Conpleted Evaluations The following concerns have been resolved without a plant modification.

HPCI Steam Leak Detection - Fire-caused danage prior to isolation of the steam leak detection circuits could cause the HPCI steam isolation valves to close.

For fire areas whe"e HPCI will be relied upon for safe shutdown, the procedures direct th'e operator to verify that the Isolation valve is open or to take action to open the valve. This evaluation resolves the deficiency identified in SDR L2-89-03.

Feedwater Isolation Valves - For post-fire safe shutdown, the credited

.flaa path for RCIC was through the noin feedwater lines. The feedaater isolation valves' circuits were not analyzed; therefore, a fire could potentially result in closure of these valves. Procedure GP-2 has been revised to remove power to these valves ducir.g power operation. Removing power to these valves precludes spurious operation.

i Ongoing Evaluations It is anticipated that the following concerns will be resolved without a plant modification.

RHR Pump Dead Heading - Valid process parameter start or spurious actuation of the RHR pump on reactor Level 1 in conjunction with fire-caused damage to the minimun flow valve circuits could lead to a situation where the punp is running without an open flow path (dead-headed).

Plant transient evaluations are being reviewed to determine if a fire would result in a Level 1 automatic start of the punp.

Currently, a safety evaluation is being developed to change the minimum flow valve from normally closed to normally open.

RHR Shutdown Cooling Valves - The RHR shutdown cooling suction valves HV-51-F008 and HV-51-F009 have been identified in the FPER as high/ low pressure interface valves. A safety evaluation is being developed to support removing power to one of the shutdown valves during paver operation. Removing power to one valve precludes spurious operation.

ENHANCEMENT EFFORT OF THE SSD ANALYSIS IMPROVEMENT PROGRAM The second step of the improvement program is a long-term enhancement program.

Immediately following completion of the ongoing studies, this enhancement program will be developed to reformat the safe shutdown analysis documentation and provide for long-term configuration management of the safe shutdown analysis. The enhancement effort is expected to provide:

Safe Shutdown Component Reverification Spurious Operation Reverification Safe Shutdown Cable Reverification Safe Shutdown Capability Reverification Part of the enhancement effort will be to format the safe shutdown analyses for Peach Bottom and Limerick into similar documentation.

Sunmary Due to an increasing incidence of reportable issues regarding the Limerick safe shutdown analysis, PECo conmitted to undertake an assessment of the root

'cause of these issues. We have identified the root cause and developed a two-phase program to ensure Limerick's compilance with applicable safe shutdown analysis requirements. The ongoing effort will ensure compliance at time of Unit 2 licensing. The enhancement effort will reverify aspects of the safe shutdown analysis and improve documentation to provide higher confidence in the analysis and better maintainability.

l I

MAM/mv/05238903

- _ _ _ _ _ _ _ _ _ _ _ _ - _ - - _ _ - - _ _ _ _ _