NSD-NRC-97-5166, Resubmits AP600 Design Certification Fire Protection Open Items,Marked Up to Reflect Resolution of Comments Received from NRC During Joint Fire Protection Meetings

Resubmits AP600 Design Certification Fire Protection Open Items,Marked Up to Reflect Resolution of Comments Received from NRC During Joint Fire Protection Meetings

ML20140C958
Person / Time
Site:	05200003
Issue date:	06/04/1997
From:	Mcintyre B WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:	Quay T NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NSD-NRC-97-5166, NUDOCS 9706100154
Download: ML20140C958 (15)

Text

,

I I

t w:,

,. Westinghouse Energy Systems hx355 Pittsburgh Pennsylvania 15230-0355 Electric Corporhtion

( NSD-NRC-97-5166 l l DCP/NRC0899 j Docket No.: STN-52-003 '

June 4,1997 j i

1 Document Control Desk '

U.S. Nuclear Regulatory Commission Washington, DC 20555 l

ATTENTION: T. R. QUAY ,

l.

SUBJECT:

AP600 DESIGN CERTIFICATION; FIRE PROTECTION OPEN ITEMS; RESUBMITTAL OF INFORMATION  :

Dear Mr. Quay:

As requested by NRC, this provides a resubmittal of fire protection open items resolution information.

The information was originally provided by a March 20,1997 fax. The attachment to this letter is that .

l provided by the fax, marked up to reflect resolution of comments received from NRC during our joint t fue protection meetings.

1 if you have any questions, please call J. W. Winters (412-374-5290).

l 0:~/#h'.L.

Brian A. McIntyre, h anager Advanced Plant Safety and Licensmg jml i l

Attachment:

Markup of March 20,1997 fax (14 pages) )

cc: N. J. Liparulo, Westinghouse (w/o Attachment) l g

9706100154 970604 c 00'

.~

i

!- DR ADOCK 05200003 -

t PDR

, ,$ h 100002

_ , _ - . - _ _ _ - - , - - I

l

)

01306. NRC's concerns regarding AP600 safe shutdown capabilities during and/or after a design basis fire.

L AP600 Compliance with Regulations for Passive ALWRs A. Compliance with HTP CMEB 9.5-1 1

SSAR Table 9.5.1-1, note the following: 1 Item 16 AP600 uses two levels of damage limits: safe shutdown and design  !

basis accidents (in contrast to three in App. R: hot shutdown, cold shutdown, and DBAs). Safe shutdown capability is protected from damage caused by a single fire.

1. acci mb b (AP600 " safe shutdown" is dee"'ed q"M--: deold shutdown'.'in SECY 94-084, it is recognized that Passive ALWR designs are limited by the inherent ability of the j' passive heat removal processes. EPRI's position is that safe stable shutdown condition is at 420 *F, and that passive safety systems need not be capable of achieving cold

{

shutdown, based on the belief that the passive decay heat removal systems have  ;

inherently high long-term reliability, i

The NRC Staff position is that an RHR system be able to bring the plant to cold l shutdown conditions (with reference to GDC 34 and RG 1.139) was established to enable the licensee to perform inspection and repair at the plant. The Staff believes l that other plant conditions may constitute a safe shutdown state as long as reactor  !

suberiticality, decay heat removal, and radioactive materials containment are properly maintained for the long term.

The Staff recommends that the Commission approve the EPRI's proposed 420 degrees F or below, rather than the cold shutdown condition reauired by RG 1.139, as a safe stable condition which the passive decay heat removal systems must be capable of achieving and maintainine following non-LOCA events. This recommendation is oredicated on an acceptable passive safety system performance and an acceptable resolution of the issue of regulatory treatment of non safety systems.)

The Commission has made determinations on the Staff's recommendations (SECY-94-084) regarding Safe Shutdown Requirements (item C)in the memorandum of June  !

30,1994 from John C. Hoyle to James M. Taylor.

I

1 l

( + ,

\

f \

Item 25 Safe shutdown systems are protected such that reliance on alternative or j;

l' dedicated shutdown capability is not necessary (in contrast with App. R allowed Alternative or Dedicated Shutdown). '

i-I i

P600 safe shutdown capabilities include methods for using safety related systems only, safety-related and nonsafety related systems, or nonsafety-related systems only, i

The safe shutdown capabilities 'using safety related systems are fully protected to I i .

ensure that at least one safe shutdown capability is available in the event of a single I fire, without taking any credit for repairs or operator actions in the fire-affected area, l

)

and all equipment within the fire area is rendered inoperable by the fire..AP600 does

_ not rely on an alternative or dedicated shutdown capability. T W a g oacA a s< ~l*< 1 e & + u n .f L A > " , o.,

au. L w w / .Jun,-J byt wh mb. f i

i 1 l

I i

4 i

3 i

3 l

i k

1 i

i i

i-b

)l 4 .

1 H. SECY-90 016 Evolutionary I WR Certification Issues Gan. 12, 1990)

(re-iterated in SECY-93-087)

"D. Fire Protection" The evolutionary ALWR desinners must ensure that AP600 complies. At least safe shutdown can be achieved, assuming that all one of safe shutdown equipment in any one fire area will be rendered capability using safety-i inoperable by the fire and that re-entry into the fire related systems (SSAR area for repairs and operator actions is not oossible.

7.4.1.1) is available in the The control room is excluded from this approach. event of a single fire, provided an independent alternative shutdown without requiring repairs capability that is physically and electrically or operator actions in the

independent of the control room is included in the fire-affected area.

design.

4 Evolutionary ALWRs must provide fire protection for AP600 complies. SSAR redundant shutdown systems in the reactor containment 9A.3.1.1 provides the

• building that will ensure. to the extent practicable, that FHA and Safe Shutdown  !

one shutdown division will be free of fire damage. Analysis.

Additionajiv, the evolutionary ALWR designers must AP600 compiles.1 tre-ensure that smoke, hot eases, or the fire suppressant smoke dampers are l w not migrate into other fire areas to the extent that

_j!!

utilized to minimize they could adversely affect safe shutdown capabilities. migration of the effects of including operator aStions. fire through the shared HVAC. (See attached sketch and response to 01-323 located elsewhere in this letter.)

C. April 26,1990 Staff Letter to the Commission, Re. Evolutionary LWR Certification Issues and Their Relationship to Current Regulatory Requirements "6 Fire Protection" Proposed enhancements that represent a significant AP600 complies. Fire-improvement in physical separation requirements and smoke dampers are in the need to consider the effects of smoke, heat, and utilized to minimize fire suppressant migration into other areas. In migration of the effects of particular, redundant train separation is likely to be the fire through the shared most significant feature leading to reduced fire risk. HVAC.

'. 3'

\

l

. i

' D. Additionally, in the NRC Request for Additional Information. RAI 2X0.12 it i

was stated that .........." based on its review of Section 7.4, the staff has determined that safe shutdown as defined above can be achieved within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following a fire event using only safety-related equipment and can be maintained long term (i.e., beyond 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after it has been achieved) provided: (1) the safety related passive systems used for safe shutdown perform their intended function: (2) nonsafety-related equipment are available for long-term maintenance of safe-shutdown; and (3) all staff's concerns identified in the following sections are resolved. For the above reasons, consistent with SECY-94 084 (approved by Commission, see SRMs dated June 30,1994 and June 28, 1995) position on safe shutdown requirements for passive plant designs the staff accepts safe shutdown as defined above as a safe stable condition for AP600, subject to an acceptable passive . system performance and an acceptable resolution of the issue of regulatory treatment of non-safety systems (RTNSS).

" Response:

Westinghouse concurs with the definition of safe shutdown presented in this Request for Additional Information."

l l

I

\

i l

4

~

)

For discussion purposes only, the followine AP600 comparison with App. R and s other reculations/cuidelines for I,WRs is presented. No regulations require such  !

comparison as App. R is not applicable to AP600.

1 A. AP600 short term safe shutdown capability (:c S: 9!2 d 5_.!ce 5; 2 dedge -

MN Re-evegwhen using safety-related systems eludes onlyd:e maintaining l the reactor subcritical, the reactor coolant average temperature less than or I equal to no load temperature, and adequate coolant inventory and core cooling.

]

The long term safe shutdown conditions are the same as the short-term safe shutdown conditions except that the coolant temperature shall be less than  !

i 420 *F. This long-term condition must be achieved (using safety related

' j equipment) within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> and maintained indefinitely. (SSAR 7.4) i Based on the ab' ove:

44 (1) AP600 long-term safe shutdown condition shall b: I::=deqwda::c ,

cold shutdown discussed in Appendix R of 10CFR50. SECY-94-084 j confirms +!: eq &ncy.O uwMdd/ rI do ypmc4.

(2) App.R III.G.I.b. " Systems necessary to achieve and maintain cold 4 shutdown from either the control room or emergency control station (s) l can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />"is not applicable to AP600. I (3) App.R III.G.3 that provides "Altemate or dedicated shutdown capability"is also not needed for AP600, because on AP600 none of the l

following App.R conditions exist; a) protection of systems whose function is required for hot shutdown does not satisfy the requirement of III.G.2, and b) where redundant trains of systems required for hot shutdown located in the same fire area may be subject to damage from the suppression activities or from the rupture or inadvertent operation of fire suppression systems. However, the App.R requirement of"In addition, fire detection and a fixed fire suppression system shall be installed in the area, room, or zone under consideration" has been comhd imp!ecntd for AP600 Containment fire area. Fire detectors and standpipe and hose coverage are provided.

See also AP600 SSAR Table 9.5.1 1 (Comparison with BTP CMEB 9.5-1 Guidelines) Item 25. Remarks: " Safe shutdown systems are protected such that reliance on alternative or dedicated shutdown capability is not necessary".

GL 86-10 that provides interpretations of App. R regarding the Alternative or Dedicated Shutdown is also not applicable on AP600.

And the interpretation of App. R " free of fire damage" is not applicable, because on AP600, all equipment within the fire area rendered inoperable by the fire, in compliance with SECY-90-016.

" %.1 g 5

3 1

(4) App.R.Ill.L. detailing the requirements of Alternative and dedicated l shutdown capability provided for a specific fire area is not applicable to AP600. Item (3) above confinns that AP600 does not require an Alternative or dedicated shutdown capability.

B. App.R Fire Damage Limits for hot shutdown safety function is "One train of equipment necessary to achieve hot shutdown from either the control room or emergency control station (s) must be maintained free of fir- damage by a single fire, including an exposure fire", and for cold shutdown is "Both trains of equipment necessary to achieve cold shutdown may be damaged by a single fire, including an exposure fire, but damage must be limited so that at least one train can be repaired or made operable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using onsite capability" l

AP600 complies with the fire damage limits for hot shutdown safety function, i and even better for cold shutdown function, because AP600 safe shutdown i systems (using safety related systems) are fully protected such that reliance on repairs of fire-damaged equipment within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is not necessary. See also l AP600 SSAR Table 9.5.1-1 (Comparison with BTP CMEB 9.5-1 Guidelines)

Item 16 Remarks: "AP600 uses two levels of damage limits: safe shutdown l and design basis accidents. Safe shutdown capability is protected from damage i caused by a single fire."

Also, GL 8610 that provides interpretations of App. R regarding the allowed repair of cold shutdown equipment is also not applicable on AP600.

l C,

Based on the discussions above, a major fire involving the Turbine Building with its potential consequences of loss of the nonsafety related RHR systems should not be a nuclear safety issue on AP600. It may become a property loss prevention issue, especially from the plant underwriter's perspective. However, AP600 turbine building fire protection is consistent with the current industry standards, such as, NFPA 803,804,850 and EPRI NP-4144 (July 1985).

6

J 01314. AP600 Fire Detection and Alarm System

1. Compliance with BTP CMEB 9.51 (see SSAR Table 9.5.1 I) 112. Fire detection systems should be AP600 complies.

provided for areas that contain or present a fire exposure to safety-related equipment.

' 113. Fire detection systems should AP600 complies, no exception to NFPA

, comply with the requirements of Class A 70 & 72D is identified.

systems as defined in NFPA 72D and Class I circuits as defined in NFPA 70.

I14. Fire detectors should be selected and AP600 complies, no exception to NFPA installed in accordance with NFPA 72E. 72 is identified.

I15. Testing of pulsed line-type heat AP600 complies.

detectors should demonstrate that the frequencies used will not affect the actuation of protective relays in other plant systems.

I16. Fire detection systems should give AP600 complies.

audible and visual alarm and annunciation in the main control room.

I17. Where zoned detection systems are AP600 complies.

used in a given area, local means should be provided to identify which zone has actuated.

I18. Local audible alarms should sound AP600 complies.

in the fire area.

l 119. Fire alarms should be distinctive and AP600 complies.

unique so they will not be confused with any other plant system alarms.

120. Primary and secondary power AP600 complies, no exception to NFPA

supplies, which satisfy the provisions of 72D is identified.

section 2220 of NFPA 72D, should be l provided for the fire detection system and for electrically operated control valves for automatic suppression systems.

a l

l

]

9 1

.._-.--__...____._______-._._.____.____....____m_____.._.___

3' l

i . .

i L 2. Disposition of NRC concerns i

1. Fire detection in safety related areas is AP600 does not intend to have a seismically qualified, seismically qualified fire detection l system. The're is no requirement to make l

the fire detection system to withstand design basis earthquake, or to remain functional following a seismic event.

However, with microprocessor-based equipment and components the fire detection system can be expected to be unaffected by earthquakes, and the potential of spurious actuation should be minimal.

l 1 l

5 I

i I

l l

,-Q - - - -

. l 3!l 01-321. AP600 Fire Pumps I

1. Compliance with BTP CMEB 9.51 (see SSAR Table 9.5.1 1) 128. A sufficient number of pumps AP600 complies, one electric motor-

. should be provided so that 100 percent driven and one diesel-driven fire pump, 4 j capacity will be available assuming 100'7e capacity each, are provided.  ;

failure of the largest pump or loss of j offsite power.  !

l 129. Individual fire pump connections to AP600 complies. Fire pump discharge i the yard fire main loop should be lines are re-arranged so they are '

separated with sectionalizing valves individual connections to the yard fire i between connections. main, with sectionalizing valves between l connections. '

130. Each pump and its driver and AP600 complies.

controls should be separated from the Each fire pump and its controller are remaining fire pumps by a 3-hour rated located in a room enclosed by 3-hour fire fire wall. barrier.

131. The fuel for the diesel tire pump AP600 complies.

should be separated so that it does not Fuel oil day tank is in the diesel engine-provide a fire source exposing safety- driven fire pump room that is enclosed by related equipment. 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier. The fuel oil storage tank is located outdoor.

132. Alarms indicating pump running, AP600 complies.

driver availability, failure to start, and Refer to P&lD FPS M6-001.

Iow fire main pressure should be  :

provided in the main control room. j 133. The fire pump installation should AP600 complies. No excepuon to l conform to NFPA 20. NFPA20 is identified. (See Table 9.5.13.)

i i

i 9

3

' 2. Disposition of NRC concerns L. Can the yard fire main be supplied by Yes. The fire pumps can still supply the the fire pumps if there is fire damage to yard main and the yard main extension the yard main extension inside the can be isolated if it is damaged by the Turbine Building? fire.

2.Will the air intake of the diesel tire No. The fire pump diesel-engine driver pump be affected by the turbine building outside air intake is located at the same fire? side of the building with the other HVAC outside air intakes, remote from the discharge points including smoke relief i

through the roof. Additionally, the intake i is located within the envelope of the fire pump fire area.

3. Will the power supply of the electrical Fire pump motor supply is designed and motor-driven fire pump survive a fire in routed in conformance with NFPA 20 and the Turbine Building? NFPA 70.

Since routing from the non-diesel bus is less susceptible to a turbine building fire and a diesel back fire pump is not required if a diesel fire pump is installed, the present SSAR 9.5.1.2.3 wording "The motor-driven fire pump is supplied with power from the. diesel backed non Class lE switchgear", will be revised in SSAR I Rev.12 to indicate the motor-driven fire  !

pump is not on the plant diesels.

4. Are the fire tanks too close to the 4. As noted in meetings with the NKC, Turbine Building? Could they be this is not a licensing issue but an damaged by a turbine building fire? insurance issue. Westinghouse is presently reviewing its design in this area to determine its insurance liabilites.

10

S 1

01322. AP600 Basis for Selecting NFPA 14, Class II, Standpipe and Hose Stations l

BTP 9.5-1 guidelines recommend installation of standpipe and hose stations that meets the requirements of NFPA 14, however, it does not call for a specific class of standpipe system per NFPA 14 to be provided. NFPA 14 provides three classes for a standpipe system based on its intended use (for the manual firefighting efforts),

however, it too does not specify specific applications, buildings or facilities where such classes of standpipe systems should be provided.

As stated in SSAR 9.5.1.2.1.5, the AP600 fire protection standpipe and hose systems are provided for each building, for Class 11 service in accordance with NFPA 14, i.e.,

primarily intended for use primarily by the building occupants or by the fire department (plant fire brigade) during initial response. Each hose reel or rack contains up to 100 ft. of 1-1/2 in. fire hose.

AP600 fire hazard and prctection analyses (SSAR section 9A) showed that in the nuclear island the postulated fires are primarily fires involving electrical equipment and cables or ordinary class A combustibles such as paper or trash. There are no insitu ,

Dammable liquids or gases expected to be present within the nuclear island. Consistent I with the postulated fire characteristics and manual extinguishing techniques, plus the AP600 fire areas compartmentalization and configurations, a Class 11 standpipe with I-1/2" hoses is deemed most practical as it can be safely used by the plant fire brigade without undue damages to nonfire affected facilities and equipment.

In the Turbine Building, recognizing that the postulated fires may involve Hammable liquids or gases, such as, lubricating fluid, hydraulic Guid, hydrogen, etc., the hose stations are provided with a 2-1/2 in. angle valve. A 2-1/2 to 1-1/2 hose coupling is installed at the hose rack, together with the up to 100 ft, of I-12 in. fire hose. Hence the fire brigade has the option to breakaway the hose coupling, and attached their portable 2-1/2 in, hoseline in order to obtain a greater now rate.

In either case, the fire brigade can also supplement the interior hosestreams by using the additional 2-1/2 inch hoses that are connected to the nearest hydrant (s), should it become necessary.

g g 4. -tt. Abd I , d9 7 6, u/ 94 ch.it  %,g c 4 g i

s patu clus zc yJ.,, A~cw+.

r l

1 ful

. j 1 .

01323. AP600 Protection from Smoke Spread

1. Compliance with BTP CMEB 9.51 (see SSAR Table 9.5.1 1)

99. Smoke and corrosive gases should be AP600 complies. smoke exhaust outlets discharged directly outside to an area that are located remote from outside air intake  !

will not affect safety related plant areas. openings to preclude recirculation of smoke into the buildings.

100. To facilitate manual firefighting. AP600 complies. smoke and heat venting '

separate smoke and heat vents should be capability is provided as described in provided in certain areas. App.9A. Fire Protection Analysis.

101. Release of smoke and gases AP600 complies.

containing radioactive materials to the environment should be monitored.

2. Compliance with SECY-90-16, Evolutionary LWR Certification Issues I (Jan.12,1990)

Additionally, the evolutionary ALWR AP600 complies. Fire-smoke dampers are designers must ensure that smoke, hot utilized to minimize migration of the gases, or the fire suporessant will not effects of fire (smoke and hot gases) migrate into other fire areas to the extent through the shared HVAC ductwork that that they could adversely affect safe- serves a single train of safety-related shutdown capabilities, including operator equipment rooms (Div. A&C, or actions. Div. B&D).

12

J i

b'1 1

3. Disposition of NRC concerns

l. Define the detector to smoke damper Opening and closing of the combination logic. fire / smoke dampers will be controlled by

) the fire detection system that comprises

) of area detectors and in-duct detectors.

The area smoke detectors will initiate the.

closing of the fire / smoke dampers. A high i

temperature override will close the damper when the in-duct secondary high j

temperature sensor senses a temperature higher than the fire damper's fusible link

, rating.

l 2. Detine the location of smoke detectors Area smoke detectors will be used for

} used for damper control, controlling the opening / closing of the combination fire / smoke dampers. The t

concept is to close the smoke damper and l

)

to isolate the fire-affected room at the early stage of the fire, and as soon as j

smoke is developed and detected by the area detector (s), while allowing the

! HVAC system to continue running and I

providing pressurization of the non-affected rooms.

4

3. Describe overall smoke control Smoke control logic will be integrated l philosophy, logic and implementation. with the corresponding HVAC control 4 logic.

Upon detection of smoke in a room, that

room will be immediately isolated by

using the combination fire / smoke

! dampers. Meanwhile, the HVAC is i designed to continue running to serve the other non-affected rooms and to provide ambient pressurization that will help l,

, confine smoke and hot gases within the fire-affected room. For post fire recovery the fire / smoke damper will be reopened and smoke removal will be accomplished by running the HVAC system in a once-through mode.

13

. )

1

4. Describe in details the re-opening of Reopening the combination fire / smoke 1 fire and smoke dampers. dampers can be accomplished from a  !

remote location, i.e. from the fire alarm i

< and control panells). However, when the damper is closed due to high temperature.  :

resetting the high temperature sensor  :

needs to be made at the damper.

l Therefore, on AP600 the damper actuators and controller will be located  !

outside of the fire-affected areas, either in j the corridor ceiling or in the mechanical  ;

equipment room s

I 4

I i

e a 0

, __,.,,_-,_.-,--r ._,. . . ma - _ _ _ M