PLA-4505, Provides Util Interpretation & Application of App R,Spurious Operations Criteria at Susquehanna Ses.Closure of Listed Issues Re App R Safe Shutdown for Sses,Requested to Satisfy Remaining Issues
| ML18026A467 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 12/06/1996 |
| From: | Byram R PENNSYLVANIA POWER & LIGHT CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML18026A281 | List: |
| References | |
| PLA-4505, NUDOCS 9612160348 | |
| Download: ML18026A467 (43) | |
Text
CATEGORY j.
REGULA%I INPORMATION DISTRIBUTIONYSTEM (RTDS)
ACCESSION NBR:,9612160348 DOC.DATE: 96/12/06 NOTARIZED: NO DOCKET FACIL:50-387 Susquehanna Steam Electric Station, Unit 1, Pennsylva 05000387
~
~
~
50-388 Susquehanna Steam Electric Station, Unit 2, Pennsylva 05000388 AUTH.NAME AUTHOR AFFILIATION BYRAM,R.G.
pennsylvania power 6 Light Co.
RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)
SUBJECT:
Provides util interpretation 6 application of App R,Spurious Operations Criteria at Susquehanna SES.Closure of listed issues re App R Safe Shutdown for SSES,requested to satisfy remaining is'sues.
DISTRIBUTION CODE:
AOOSD COPIES RECEIVED:LTR i ENCL
(
SIZE'(
TITLE: OR/Licensing Submittal: Fire Protection App R GL-88-12 NOTES:
E 05000387
~
RECIPIENT ID CODE/NAME PDl-2 LA POSLUSNYPC COPIES LTTR ENCL 1
0 1
l.
RECIPIENT ID CODE/NAME PD1-2 PD COPIES LTTR ENCL 1
1 INTERNAL: ACRS NRR/DRPM/PECB NUDOCS-ABSTRACT 1
1 1
1 1
1 FILE CENTER 0
2 2
NRR/DSSAT/SPLB 1
1 OGC/HDS2 1
0 ERNAL: NOAC NOTES:
1 1
1 1
NRC PDR 1
1 D
U E
N NOTE TO ALL "RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTE!
CONTACT THE DOCUMENT CONTROL DESKs ROOM OWFN 5D-5(EXT. 415-2083)
TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!
TOTAL NUMBER OF COPIES REQUIRED:
LTTR 13 ENCL ll
'I P
V
Pennsylvania Power 8 Light Company Two North Ninth Street ~Allentown, PA 18101-1179 ~ 610/774-5151 Robert G. Byram Senior Vice President-Nuclear 610/774-7502 Fax: 610/774-5019 DFC 06 1996 U.S. Nuclear Regulatory Commission Attn.: Document Control Desk Mail Station P 1-137 Washington, D. C.
20555 SUSQUEHANNA STEAM ELECTRIC STATION APPENDIXR, SECTION III.GANDIII.L SPURIOUS OPE<RATIONS CRITE<RIA Docket Nos. 50-387 and 50-3SS This letter provides PPEcL's interpretation and application of Appendix R, Spurious Operations Criteria at Susquehanna SES.
The criteria employed for the analysis of Associated Circuits-Spurious Operations to address Appendix R,Section III.G~n III.Lis documented in Attachment A hereto.
The attached criteria encompasses the criteria defined in Attachment A to PLA-4442 and includes the provisions for addressing fires governed by Appendix R,Section III.L.
Compliance with the attached criteria for fires in the Control Room required revisions to calculations previously submitted to the staff under PLA-4442. Our revised calculations (see the listing below) are submitted herewith to assist the staff in understanding our approach.
Please note that the revised portions ofCalculation EC-013-0859 and its Appendix C are marked with a vertical line in the right hand margin.
Calculation EC-013-0788 is essentially a complete revision. This calculation contains no revision marks.
EC-01 3-0788 EC-01 3-0859 2
Inadvertent HPCI or RCIC Initiation 4
Control Room Fire Analysis Upfront text Upfront text EC-01 3-0859 Appendix C 4
Control Room Fire Analysis - Appendix to Complete Appendix address NRC IN 92-18 To fully comply with this revised spurious operations criteria for fires inside and outside of the main Control Room and to address the concerns ofNRC IN 92-18 related to MOV Hot Shorts, completion ofthe following changes willbe made.
9hi2160348,96i206 PDR ADOCK'5000387 F
0 V
/'1 ('
FILE R41-2 PLA-4505 Document Control Desk
,'.::';.":; Iss'ue',::Bein'g'Addr'e'ss'ed,:::,.':i::,::,,::::,',"gy.",:D'es'c'r'ip'tion','of,;:,: :Ch'an'g'e",:",:,',:'.":
1.
Modifications to 24 valves to prevent valve damage as a result of Hot Shorts.
2.
Add a procedural action to close a valve in the suppression pool clean-up line to prevent a drain down of the suppression pool.
3.
Perform a modification to prevent inadvertent HPCI initiation.
4.
Add the procedural actions described below for preventing spurious feedwater injection.
5.
Perform an analysis to demonstrate that inadvertent condensate injection will not impact safe shutdown.
6.
Add a procedural caution to prevent the effects of spurious RCIC injection foi fires outside of the Control Room.
NRC IN 92-18 5 Revised Spurious Operations Criteria NRC IN 92-18 & Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria The valves required to be modified are listed in Table 4 of Appendix C to Cele. EC-01 3-0859.
The procedural action to be performed is described in Gale.
EC-013-0859 under section 7.
The modification is described in Attachment B to this letter.
The procedural actions required are described in Cele.
EC-01 3-0859.
The analyses to be performed is described in Gale. EC-013-0859.
The procedural caution to be performed is described in Cele.
EC-01 3-0788.
The analysis ofthe inadvertent condensate event and all ofthe permanent procedure changes for the procedural actions identified above willbe completed by the end of the next refueling outage scheduled for the spring of 1997, except the action to trip the feedwater pump turbines as an immediate operator action for Control Room fires requiring evacuation which willbe completed within one month of receiving NRC approval to use this action for the Appendix R Control Room fire.
With respect to the analysis of the condensate event, should the results not be favorable and additional analyses. be required, we willnotify you.
Allof the modifications listed above will be completed by the end of the Unit 1 10RIO (May 1998) and the Unit 2 9RIO (May 1999). Attachment C to this letter describes the compensatory actions currently in place for addressing these issues.
With respect to the MOV hot short issue, we are presently reviewing the plant procedures affected by this issue to determine if more definitive procedural guidance is required until the permanent plant or procedure changes are made.
With respect to the inadvertent vessel overfill concerns, we are presently addressing this issue as a part of our deficiency management process.
Any additional procedural enhancements required to address the MOV hot short issue willbe completed by the end of the next refueling outage.
FILE R41-2 FLA-4505 Document Control Desk Completion of the circuit modifications for the twenty-four MOV's referenced in item 1 in the table above willaddress the concerns identified in NRC IN 92-18.
As described in Appendix C to Calculation EC-013-0859, this will assure that the low pressure RHR LPCI system will be available to perform its function in the alternate shutdown cooling mode of operation.
Since 3 SRV's are assured to be available at the Remote Shutdown Panel, reactor pressure can be reduced to the level where RHR LPCI can be used to accomplish the other required safe shutdown functions ofinventory make-up and decay heat removal.
In addition, we have elected to modify the circuits for two additional valves per unit: the RHR F028 and F006 valves.
Although performing modifications to these two additional valves is not required based on the spurious operation criteria contained in Attachment A and the evaluation performed in Appendix C to Calculation EC-013-0859, by doing so, we can preserve the ability to operate one valve in each ofthe two potential flow diversion paths offof the main RHR LPCI flowpath. Therefore, in addition to the valves required to be modified as described in Appendix C to Calculation EC-013-0859, we will also modify circuits for the 1F028B, 1F006B, 2F028A and the 2F006A valves.
To satisfy remaining issues, PP8'cL requests closure ofthe following issues related to Appendix R Safe Shutdown for SSES:
1.
Agreement on the spurious operation criteria contained in Attachment A to this letter.
2.
In the event of a Control Room fire, in addition to a manual SCRAM, credit be given for the followingoperator actions:
~
Closure ofthe MSIVs prior to leaving the Control Room.
~
Closure of the feedwater discharge valves and tripping of the feedwater turbine prior to leaving the Control Room to prevent a vessel overfill condition caused by the spurious operation of the feedwater flow controller during feedwater system coastdown.
Demonstration ofcompliance with the requirements of Generic Letter 86-10 section 3.8.4 for these actions is contained in Calculation EC-013-0859 in section 7 under MSIVs and Feedwater. Allof these actions, including the manual scram action currently allowed, can be accomplished in rapid succession by a single operator from his/her normal position in the Control Room.
3.
Resolution ofNRC IN 92-18 concerns for SSES.
Our approach is documented in Appendix C to Calculation EC-013-0859, Revision 4.
4 FILE R41-2 PLA-4505 Document Control Desk 4.
Acceptance of PP&L's positions on the credibility of the inadvertent HPCI initiations as described in Attachment B to this Letter and the feedwater spurious operation as described in Calculation EC-013-0859, Section 7.
Upon receipt ofyour concurrence with the above, PP&L willrevise the SSES FPRR to document the final agreed upon positions on the issues described in this letter.
If you have any questions on any of the issues addressed in this letter, please contact Mr. W.W. Williams at (610) 774-7742.
Very truly yours, R..
yr m Attac ents copy:
Regional Administrator - Region I Mr. K. M. Jenison, NRC Sr. Resident Inspector Mr. C. Poslusny, NRC Sr. Project Manager
Attachment A to PLA-4505 Page 1
Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L ck r 10CFR50 Appendix R, Sections III.G.2 and III.L.7require that the impact ofassociated circuits on safe shutdown be addressed.
NRC Generic Letter 81-12 defines three categories ofassociated circuits: Common Power Supply; Common Enclosure; Spurious Operation. As a part ofthe NRC's review ofRevision 4 to SSES's FPRR, questions arose concerning the criteria to be used at SSES to address Spurious Operations in accordance with the requirements cited above.
The criteria provided herein focuses on "hot short" cable faults. Appendix R also requires that redundant safe shutdown equipment be evaluated for impacts due to shorts to ground or open circuits that could result from a fire in each fire area. This criteria in no way attempts to place a limiton the number ofopen circuits or shorts to ground that must be considered in an Appendix R Safe Shutdown Analysis. In addition, this criteria in no way alters the positions described in NRC Generic Letter 86-10 paragraph 5.3.2 and 5.3.3 relative to the duration ofthe postulated hot shorts.
The basic philosophy behind this criteria is that fire induced damage to equipment required to support safe shutdown is highly unpredictable.
As a result, mitigating actions that bound the spectrum ofpotential damage states offire induced damage willenhance the operators ability to deal with the unexpected.
Cable faults induced by the fire can prevent safe shutdown equipment from performing its required function. The postulated cable faults are open circuits, shorts to ground and hot shorts. Ofthese three types ofcable faults, open circuits and shorts to ground could prevent equipment from operating. Hot shorts, conversely, can cause equipment that is not required for safe shutdown to operate spuriously in a way that could be detrimental to the safe shutdown train. It is this class ofcable fault that is the subject ofthis criteria.
Fire induced hot shorts although unlikely can cause the spurious operation ofequipment capable ofaffecting safe shutdown systems.
Due to the lower probability ofthese types ofcable faults, simultaneous spurious operation ofall potentially affected equipment is not required for cases other than the case oftwo valves in a Hi/LoPressure interface line. For spurious operation of equipment, other than Hi/Lopressure interface components, spurious operations are to be mitigated on a one-at-a-time basis.
0
Attachment A to PLA-4505 Page 2 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L To satisfy the criteria for spurious operation, all potential fire induced spurious operations must be identified and a mitigating action must be developed for each.
This mitigating action may be an action taken prior to the start ofthe fire event that precludes the condition &om occurring or a post fire action that mitigates the effects ofthe condition prior to itreaching an unrecoverable condition relative to safe shutdown.
In any case, the corresponding mitigating action for each potential spurious operation must be known and this action must be capable oflimitingthe potential adverse effects ofthe spurious operation without reliance on any other equipment that is also potentially susceptible to a spurious operation resulting from a fire in the same fire area.
For the SSES Control Room fire, evacuation ofthe Control Room is assumed.
The safe shutdown circuits that must function to achieve hot shutdown and to achieve and maintain cold shutdown can be isolated from the fire in the Control Room by isolation transfer switches at the Remote Shutdown Panel (RSP). Therefore, by using this set ofsystems, in the absence ofany postulated spurious operations, safe shutdown is assured upon actuation ofthe transfer switches at the RSP. In the time required for the operator to evacuate the Control Room and to assume control ofthe unit at the RSP, however, spurious equipment operation is possible.
As a result, this set ofcircuits must be evaluated under the same criteria as the rest ofthe plant prior to actuation ofthe transfer switches, i.e. on a one-at-a-time basis.
The difference for this set ofcircuits, however, is that actuation ofthe transfer switch is an acceptable mitigating action.
Therefore, for the set ofisolable circuits, the postulated spurious operations are evaluated on a one-at-a-time basis with the accepted mitigating action always being actuation ofthe transfer switch at the RSP.
Those circuits in the Control Room that are not isolable from the Control Room must be addressed in the same way as potential spurious operations in fire areas outside ofthe Control Room. Therefore, for each potential and credible spurious operation a mitigating action must be developed.
By assuming that spurious operations occur one-at-a-time prior to assuming control at the RSP, the operator is able to mitigate the effects ofpostulated fire scenarios requiring multiple spurious operations once he/she has taken control ofthe unit at the RSP.
Applying this criteria to the Control Room provides assurance that no spurious operation resulting from a fire induced hot short willimpact safe shutdown prior to the operator taking control ofthe unit at the RSP.
Once the operator has assumed control ofthe unit at the RSP, the equipment and controls available at that location allow for a controlled response in mitigating the even more unlikely effects ofsubsequent spurious operations affecting non-isolable circuits remaining in the Control Room that must combine to impact safe shutdown.
Attachment A to PLA-4505 Page 3 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L In summary, for a fire in any fire area, the ability to mitigate on a one-at-a-time basis any and all spurious operations with the potential to impact the safe shutdown train must be available. For the Control Room, safe shutdown cannot be impacted by any spurious operation caused by a hot short in the time frame required to evacuate the Control Room and to assume control ofthe unit at the RSP.
The criteria required to address the issue ofassociated circuits for spurious operation covers three distinct areas: Spurious Component Criteria: Criteria to determine the population of components whose spurious operation could potentially affect safe shutdown; Spurious Cable Criteria: Criteria to be applied to the cabling for this population ofcomponents to determine which cables have the potential to cause a spurious operation ofthe component; Spurious Operation Criteria: Criteria to be applied in assessing the impact of fires on the population of potential spurious operation cables affected by a fire in a given fire area.
~
uri u m
ncnt t ri These components were defined as the set ofcomponents whose spurious operation could result in either a loss ofRPV inventory, an inadvertent overfillingofthe RPV or a flowloss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown.
~
Il 1
ri ri 'his criteria has two parts: one that applies to Hi/Lopressure interface components; another that applies to all other spurious components other than Hi/Lo pressure interface components.
Definition: Hi/LoPressure Interface Component: Valves whose spurious opening could result in a loss ofReactor Pressure Vessel Inventory, and, due to the lower pressure rating on the down stream piping, an interfacing system LOCA.
e In addition to the types offailures that must be assumed for "all other components", in determining the spurious operation potential ofcables for these components, itmust be assumed that 3-phase hot shorts on AC circuits and two hot shorts ofthe proper polarity without grounding on ungrounded DC circuits are credible.
~h One must evaluate for a single hot short causing spurious operation of the respective component.
(i.e. Ifmore than one hot short on the electrical circuitry for the component is required to cause the spurious operation, then this is not considered to be credible.)
Attachment A to PLA-4505 Page 4 Susquehanna Steam E<lectric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L
~
i i n ri er Similarly, this criteria has two parts: one that applies to Hi/Lo pressure interface components; another that applies to all other spurious components other than Hi/Lopressure interface components.
This criteria applies to the evaluation ofthe impacts due to fires governed by Appendix R,Section III.G@id III.L. Those circuits isolated from the Control Room, where the governing section ofAppendix R isSection III.L,are covered within this criteria.
f Where a single fire can impact the potential spurious cables for both Hi/Lopressure interface valves, itmust be assumed that both valves spuriously operate simultaneously.
This criteria applies to all areas including the Control Room and to all circuits regardless ofwhether or not they can be isolated from the Control Room by actuation ofan isolation transfer switch.
~Allp<<lipi p
i Iiglt igl ti b
addressed and the effects ofeach mitigated on a one-at-a-time basis unless a single cable fault can cause the spurious operation ofmultiple components. Ifa single cable fault can cause the spurious operation ofmultiple components, these spurious operations must be addressed simultaneously.
In addressing any and all spurious operations on a one-at-a-time basis, it is not necessary to attempt to consider the aggregate effects ofthe potential spurious operations on plant parameters nor is it intended that selected sequential multiple cable fault combinations be evaluated.
Time domain analyses, such as transient analysis, are not required to address the potential interactions between the various spurious actuations.
The focus is to be on addressing each potential spurious operation and mitigating the effects ofeach individually.
Examples ofways to mitigate, either prior to or during the process ofthe fire, the effects of each spurious operation are as follows:
~
Provide a fire barrier or wrap
~
Route the circuit ofconcern in a dedicated raceway that does not contain any other normally energized circuits that could cause a hot short
~
Reroute or relocate the circuit/component
~
Provide a Procedural Action, such as:
t Attachment A to PLA-4505 Page 5 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L
- Have the breaker for the component ofconcern normally racked out (or fuses removed) so that inadvertent operation is not possible.
[Note: For Hi/Lo pressure interface components, a 3 phase hot short on the ac power cable or 2 hot shorts ofthe proper polarity on the dc power cable must still be evaluated.]
- Perform an action in response to the fire condition to mitigate the impact of the spurious operation.
[Note: Ifthis action involves manually operating an MOVlocally using the hand wheel, itmust be demonstrated that fire damage did not result in a hot short with the potential to damage the valve (i.e. NRC IN 92-18 concern)]
~
Identify other equipment that can prevent the spuriously operated component from affecting safe shutdown When using the last option described above'f identifying other equipment that can prevent the spuriously operated component from affecting safe shutdown, the followingrule must be applied to the other equipment selected to mitigate the effects ofa spurious operation: The equipment selected cannot itself be a component that has the potential to spuriously operate during the same fire. (i.e. One cannot mitigate the effects ofone "Spurious Operation" by ignoring a "Hot Short/Spurious Operation" on another component.)
For the case ofa Control Room fire, spurious operations are also addressed on a one-at-a-time basis.
Spurious operations must be considered to occur in the Control Room prior to the post evacuation local manual operation ofthe isolation transfer switches. For the circuits in the Control Room Fire Area, it is necessary to identify all potential spurious operations resulting from the fire and to evaluate the impact ofeach on safe shutdown.
The spurious operations must be postulated on circuits that can be isolated, as well as, on ones that cannot be isolated.
As is the case in all other fire areas, each ofthese potential spurious operations is assumed to occur one-at-a-time. Ifthe circuit can be isolated by the actuation ofan isolation transfer switch, the actuation ofthe transfer switch is considered to be an adequate mitigating action.
For those circuits in the Control Room Fire Area which are not isolated by transfer switches, the criteria as described in the previous section must be applied. For these circuits, itmust be assumed that they spuriously operate on a one-at-a-time basis. For each identified potential and credible spurious operation, a mitigating action must be developed.
Attachment A to PLA-4505 Page 6 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L Therefore, for the Control Room fire analysis described above, spurious operation needs to be considered on a one-at-a-time basis for all cases, except the Hi/Lopressure interface cases.
In addition, the population ofisolable circuits must be evaluated for the effect ofdamaging hot shorts (i.e. NRC IN 92-18 concern) using the spurious operation criteria outlined in this document.
The issue ofAssociated Circuits-Spurious Operation can be addressed for SSES by applying the criteria described above.
The important points to understand and to address in order to successfully comply with NRC Guidance on the Spurious Operation Issue are as follows:
~
Those components with the potential to cause a Hi/Lopressure interface condition are ofthe greatest concern and, as such, these components have a more stringent spurious cable and spurious operation criteria applied to them. This criteria applies to all areas including the Control Room and to all circuits regardless ofwhether or not they can be isolated by the actuation ofan isolation transfer switch after evacuating the Control Room
~
For all potential spurious operations in any fire area, the focus must be to address each potential spurious operation and to mitigate the effects ofeach individually.
~
In identifying the mitigating action for each potential spurious operation in any given fire area, it is not acceptable to mitigate the effects ofone spurious operation by ignoring the effects ofanother potential spurious operation.
For circuits that are isolated from the main Control Room, post evacuation local manual actuation ofthe isolation transfer switch is an adequate mitigating action for any and all potential spurious operations.
~
The concern with damaging hot shorts identified in NRC IN 92-18 must be addressed (1) for Control Room MOVcircuits that are isolated by the post fire local manual actuation ofan isolation transfer switch and (2) for MOVcircuits with potential to be damaged by fires inside or outside ofthe Control Room whose mitigating action involves the manual local operation ofan MOV.
Attachment B to PLA-4505 Page 1 Susquehanna Steam E<lcctric Station Spurious Operation ofHPCI During a Control Room Fire Appendix R,Section III.L In the event ofa Control Room fire, inadvertent initiation ofthe HPCI System concurrent with the loss ofthe 54" high water level trip for HPCI can result in a vessel overfillcondition. The concern with inadvertent HPCI injection concurrent with the loss ofthe 54" trip is that in a short time period this could result in the reactor vessel flooding to the point where HPCI would be disabled and the main steam lines would be filledwith high pressure water.
10 CFR 50 Appendix R, Section III.G.2 requires that redundant safe shutdown trains be separated by either fire rated barriers or a specified physical separation distance.
In the event that the requirements of Section III.G.2 cannot be met,Section III.G.3 governs.
Section III.G.3 requires that Alternate or Dedicated shutdown capability independent ofthe cables, systems or components in the area be provided.
The rules for Alternate or Dedicated Shutdown are provided in Appendix R,Section III.L.
Section III.L.7requires that the safe shutdown equipment and systems for each fire area be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits or shorts to ground in the associated circuits willnot prevent the operation ofthe safe shutdown equipment.
For SSES, the analysis offires in the Control Room is governed by the requirements ofSection III.L.
The additional guidance provided in Generic Letter 81-12, expands the definition ofassociated circuits ofconcern to include safety related, non-safety related Class 1E and non-Class 1E circuits. The spurious operation criteria provided to the NRC in PLA-4442 documented PP&L's approach to resolving this concern. In this criteria, spurious operation components were defined as the set ofcomponents whose spurious operation could result in either a loss ofRPV inventory or a flowloss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown.
Subsequent to the submittal ofthis PLA, discussions were held between PP&L and the NRC during which the definition ofspurious operation components was revised to the following: The set ofcomponents whose spurious operation could result in either a loss ofRPV inventory, an inadvertent overfillingofthe RPV or a flowloss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown. This final criteria is contained in Attachment A to PLA 4505.
0
Attachment B to PLA-4505 Page 2 In performing the final review ofthe SSES Safe Shutdown Analysis relative to this criteria, a concern with the potential inadvertent initiation ofthe HPCI System during a Control Room fire was identified.
~u~:
The purpose ofthis attachment is to explain the concern ofinadvertent initiationofHPCI during a Control Room fire and to explain how this issue willbe resolved for Susquehanna SES.
Dhumhm:
HPCI System inadvertent initiation can be postulated in three ways. For each ofthese ways to come to fruition, the cable faults described below must occur and, in addition, the fire must not damage the HPCI flowcontroller or any other system or component control circuits that could prevent the system from operating.
Should the fire damage the output ofthe HPCI flow controller, this would be interpreted by the HPCI Turbine as a zero flowdemand.
This would cause the HPCI system to shutdown.
Controls for all ofthe HPCI components discussed in this attachment, except for the Division I dc control circuit, are contained within Control Room Panel I/2C601. Therefore, the fire must be sufficiently limited so that only the selected portions ofthe circuit are damaged, but the fire must also be extensive enough to result in a condition that causes fire spread and, ultimately, an evacuation ofthe Control Room.
Based on the close proximity ofthis equipment and the discussion provided above, situations (1) and (3) below, which cause system initiation and loss ofthe 54" high water level trip without resulting in circuit damage that would prevent system operation, are considered to be extremely unlikely to the point ofbeing non-credible.
The three postulated inadvertent initiation scenarios are as follows:
(1): Individual hot shorts on the start circuitry for each ofthe followingthree components must be postulated (i.e. three hot shorts): the HPCI Aux. Oil Pump which would open the HPCI Control and Stop Valves; the HPCI Steam Admission Valve; the HPCI Pump Discharge Valve. For the fire in the Control Room, circuits for the 54" HPCI trip could also be postulated to be damaged by the same fire.
(2): A single Hot Short on the Division IIdc control circuit for HPCI automatic initiation logic. For a fire in the Control Room, relay contacts for the 54" trip are also part ofthis same control circuit. One ofthe two relays required to be energized to initiate the 54" trip, however, is a part ofa separate Division I dc control circuit. Iftwo individual shorts to ground, one on the positive side and one on neutral side, ofthis Division I dc circuit are postulated to occur, the control power to the circuit could be damaged by the Control Room fire, disabling the 54" trip.
to PLA-4505 Page 3 (3): The condition of sequential selected cable faults on the HPCI Division II dc control circuitry that initiates the system for 25 to 30 seconds and then is overcome by a fault to ground which disables the 54" trip within the next 30 to 40 seconds.
Should HPCI inadvertently initiate, an operator action is required within approximately 3 minutes to mitigate the effects ofthe spurious operation prior to vessel level reaching the elevation ofthe main steam lines. Performing any operator action within 3 minutes that could be guaranteed to mitigate the effects ofthis scenario would be difficultgiven the operators other priorities in such an event.
Because ofthe limited time available for the operator to take a mitigating action, the action taken must be one for which the total elapsed time for the operator to evacuate the Control Room, arrive at the location where the action is to be performed and perform the action must be within 3 minutes. This constraint limits the options available to mitigate the effects ofthis condition.
To mitigate the effects ofthe first and third situations described above would require the addition ofa keylocked switch in the lower relay room for each unit that would be activated by the operator while traversing the evacuation path from the Control Room to the Remote Shutdown Panel. Activation ofthis keylock switch would inhibitHPCI operation.
(Note: Additional time studies would need to be performed in order to assure that this action could be completed within the required time frame.) Similarly, failure ofthis switch during normal operation would inhibit HPCI operation and render itunavailable for service should it be called upon to function during other accident conditions. The probability ofswitch failure has been estimated to be 2 x 10 /
quarter.
The addition ofthis switch, should the required timing for this action be demonstrated, could also be used as a mitigating action for the second situation described above. With respect to the second situation described above, however, a modification could be performed that would eliminate the possibility for the event even occurring. The proposed change for this latter situation would place the Division I dc relay circuit on separate fusing isolated from the potential for any Control Room fire damage.
This change would allow the HFCI System to function as designed in an automatic mode controlling level between -38" and+54" during a Control Room evacuation and itwould also eliminate the potential negative effects ofan undetected switch failure that could inhibitHPCI operation during normal operation in support of other accident conditions.
Qgncl~ui n:
It is our conclusion that the installation ofa keylock switch in the lower relay room for the purpose ofmitigating the effects ofindependent hot shorts on three separate HPCI components or multiple selective cable faults in the HPCI control circuitry would result in a condition contrary to overall nuclear plant safety. The existence ofthis switch would create a situation with a higher probability offailure than the probability ofthe failure that it is designed to prevent.
Because ofthis, we request that situation (1) ofindependent hot shorts on three separate
Attachment B to PLA-4505 Page 4 HPCI components and situation (3) selective sequential cable faults be considered to be non-credible events which are outside ofthe required design basis for Control Room fires.
With respect to the HPCI inadvertent initiation concern, PPAL willperform a permanent plant modification to prevent the vessel overfill condition described in situation 2 above.
This change willpreserve the availability ofthe 54" high water level trip for the postulated condition ofa hot short in the HPCI automatic initiation logic.
Susquehanna Steam Electric Station Appendix R Safe Shutdown Analysis Additional Compensatory Actions Attachment C to PL Page 1
- 1. Valve damage to valves required to operate at the RSP as a result ofHot Shorts in the Control Room.
- 2. A drain down ofthe suppression pool during a Control Room fire due to spurious opening ofthe suppression pool clean-up system isolation valves.
Redundant safe shutdown capabilities exist at the SSES Remote Shutdown Panel so that the failure ofany valves in the high pressure make-up system willnot impact the ability to safely shutdown. For this condition, Appendix C to Calculation EC-013-0859 explains that RHR in the alternate shutdown cooling mode can be used. Plant Procedure ON-1/249-001 provides instructions for entering Alternate Shutdown Cooling. Conversely, for a failure ofany single valve in the low pressure system, safe shutdown willnot be impacted.
For this condition, RCIC can be used to maintain level while the RHR loop that is not installed on the RSP can be put into service manually. Plant Procedure OP-1/249-005 addresses placing this loop in service when at the RSP. These actions willplace the plant in a safe configuration. IViththe plant in a safe condition, adequate time is available for developing subsequent actions, as dictated by the situation, to bring the unit to cold shutdown. These actions would be developed based on the specifics ofthe situation by the emergency response team. These compensatory actions are currently in place to prevent a single damaging hot short on any valve required for safe shutdown at the RSP from impacting safe shutdown.
Loss ofSuppression Pool Inventory is an entry condition for EO-103. This emergency operating procedure tells the operator to maintain suppression pool level using the suppression pool clean-up system. In the process oftrying to do this, the system problems would be identified in sufficient time to close the I/257025 valve. These compensatory actions are currently in place to prevent damaging hot shorts to these valves from impacting the ability to safely shutdown.
These actions provide an adequate level of safety until permanent procedural changes scheduled for the end ofthe U2-SRIO can be made.
'he compensatory actions specified in this table are in addition to the normal actions described below for the Control Room.
~
The Control Room is continuously manned.
~
The Control Room has an installed under floor manual spurt CO< suppression system and detection throughout.
~
Operations Control Room personnel willbe briefed on the fire concerns described above.
~
There is a qualified fire brigade leader on every shift.
~
Portable fire fighting equipment is available for use by Operations personnel in the immediate Control Room Fire Area.
~
There are self-contained breathing apparatus available in the Control Room Fire Area for use by Operations personnel.
Susquehanna Steam Electric Station Appendix R Safe Shutdown Analysis Additional Compensatory Actions Attachment C to PL Page 2 l.
Inadvertent HPCI injection during a Control Room fire.
(Scenario 2) 2.
Spurious feedwater injection during a Control Room fire.
3.
Inadvertent Condensate injection for fires inside and outside ofthe Control Room.
4.
Spurious RCIC injection for fires outside ofthe Control Room.
It is expected that the operator would be in the Control Room continuing to fight the fire when the inadvertent HPCI initiation occurs, Plant Procedure OP-I/252-001 instructs the operator to override the HPCI injection. This is an adequate compensatory action for preventing damage to safe shutdown systems, based on the expected fire damage associated with this issue. This action provides an adequate level ofsafety until permanent modifications can be installed.
ON-1/200-009 currently provides instruction for the operator to close the MSIV's and the feedwater pump discharge valves prior to evacuating the Control Room. This is an adequate compensatory action to prevent an uncontrolled injection by feedwater until permanent procedural changes can be made.
EO-102 instructs the operator to maintain level between 13" and 54". In addition, EO-102 instructs the operator to prevent an uncontrolled injection by condensate should pressure be reduced to less than 600 psig. Based on this procedural guidance and the expected extent offire damage associated with this issue, it is expected that the operator would continue to fight the fire and control the unit from within the Control Room. From within the Control Room, procedural actions can be taken to mitigate spurious condensate injection. This is an adequate compensatory action for preventing an impact to safe shutdown systems.
For fires outside ofthe Control Room, the protected safe shutdown Path is ADS with Core Spray. The normal shutdown sequence using this path willpreclude the event ofconcern. These actions provide an adequate level ofsafety until permanent procedural changes can be made.
EO-102 instructs the operator to maintain level between 13" and 54". For fires outside ofthe Control Room, the protected safe shutdown Path is ADS with Core Spray. The normal shutdown sequence using this path willpreclude the event ofconcern. These actions provide an adequate level ofsafety until permanent procedural changes scheduled for the end ofthe U2-8RIO can be made.
The compensatory actions specified in this table are in addition to the normal actions described below for the Control Room.
~
The Control Room is continuously manned.
~
The Control Room has an installed under floormanual spurt CO< suppression system and detection throughout.
~
Operations Control Room personnel willbe briefed on the fire concerns described above.
~
There is a qualified fire brigade leader on every shiA.
~
Portable fire fighting equipment is available for use by Operations personnel in the immediate Control Room Fire Area.
~
There are self-contained breathing apparatus available in the Control Room Fire Area for use by Operations personnel.
~m m esca oaea M M m 'le ~
REGULATO NF RNATZON DISTRIBUTION TEN (RIDE)
Pt.j I
ACCESSION NBR:9612160348 P.DATE: 96/12/06 NOTARIZED: NO DOCKET FACIL:50-387 Susquehanna St.'j Electric Station, Unit 1, Pennsylva 05000387 50-388 Susquehanna Steam Electric Station, Unit 2, Pennsylva 05000388 UTH.NAME AUTHOR AFFILIATION RAM,R.G.
Pennsylvania Power
& Light Co.
RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)
SUBJECT:
Provides util interpretation
& application of App R,Spurious f
Operations Criteria at Susquehanna SES.Closure of listed issues re App R Safe Shutdown for SSES,requested to satisfy remaining issues.
DISTRIBUTION,CODE: A006D COPIES RECEIVED:LTR L ENCL
(
SIZE: I TITLE: OR/Licensing Submittal: Fire Protection App R GL-88-12 NOTES:
05000387 RECIPIENT ID CODE/NAME PDl-2 LA POSLUSNY,C COPIES LTTR ENCL 1
0 1
1" RECIPIENT ID CODE/NAME PD1-2 PD COPIES LTTR ENCL 1
1 INTERNAL: ACRS NRR/DRPM/PECB NUDOCS-ABSTRACT 1
1 1
1 1
l.
~LE CENTER 01 2
2 NRR/DSSA/SPLB 1
1 OGC/HDS2 1
0 RNAL: NOAC NOTES:
1 1
1 1
NRC PDR 1
1 D
Q L
C E
N NOTE TO ALL "RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTE!
CONTACT THE DOCUMENT CONTROL DESK, ROOM OWFN 5D-5(EXT. 415-2083)
TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!
TOTAL NUMBER OF COPIES REQUIRED:
LTTR 13 ENCL 11
~ ~
~d~>1, Pennsylvania Power 8 Light Company Two North Ninth Street ~ Allentown, PA 18101-1179 ~ 610/774-5151 Robert G. Byram Senior Vice Pres/den/-/t/ue/ear 610/774-7502 Fax: 610/774-5019
- ."
- :C 06 1996 U.S. Nuclear Regulatory Commission Attn.: Document Control Desk Mail Station PI-137 Washington, D. C.
20555 SUSQUEHANNA STEAM ELECTRIC STATION APPENDIXR, SECTION III.GANDIII.L SPURIOUS OPERATIONS CRITERIA Docket Nos. 50-387 and 50-388 This letter provides PP&L's interpretation and application of Appendix R, Spurious Operations Criteria at Susquehanna SES.
The criteria employed for the analysis of Associated Circuits-Spurious Operations to address Appendix R,Section III.G~ III.Lis documented in Attachment A hereto.
The attached criteria encompasses the criteria defined in Attachment A to PLA-4442 and includes the provisions for addressing fires governed by Appendix R,Section III.L.
Compliance with the attached criteria for fires in the Control Room required revisions to calculations previously submitted to the staff under PLA-4442. Our revised calculations (see the listing below) are submitted herewith to assist the staff in understanding our approach.
Please note that the revised portions ofCalculation EC-013-0859 and its Appendix C are marked with a vertical line in the right hand margin.
Calculation EC-013-0788 is essentially a complete revision. This calculation contains no revision marks.
Gale. No.
Rev. No.
EC-01 3-0788 2
EC-01 3-0859 4
Description Inadvertent HPCI or RCIC Initiation Control Room Fire Analysis
, Info. Submitted Upfront text Upfront text EC-01 3-0859 Appendix C Control Room Fire Analysis - Appendix to Complete Appendix address NRC IN 92-18 To fully comply with this revised spurious operations criteria for fires inside and outside of the main Control Room and to address the concerns ofNRC IN 92-18 related to MOV Hot Shorts, completion ofthe following changes willbe made.
C 9612160348 96i206 PDR ADOCK 05000387 F
PDR FILE R41-2 PLA-4505 Document Control Desk
. ':Change To'Be Made issue Being Addressed Description of:Change 1.
Modifications to 24 valves to prevent valve damage as a result of Hot Shorts.
2.
Add a procedural action to close a valve in the suppression pool clean-up line to prevent a drain down of the suppression pool.
3.
Perform a modification to prevent inadvertent HPCI initiation.
4.
Add the procedural actions described below for preventing spurious feedwater injection.
5.
Perform an analysis to demonstrate that inadvertent condensate injection will not impact safe shutdown.
6.
Add a procedural caution to prevent the effects of spurious RCIC injection for fires outside of the Control Room.
NRC IN 92-18 5 Revised Spurious Operations Criteria NRC IN 92-18 5 Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria Revised Spurious Operation Criteria The valves required to be modified are listed in Table 4 of Appendix C to Gale. EC-01 3-0859.
The procedural action to be performed is described in Gale.
EC-013-0859 under section 7.
The modification is described in Attachment B to this letter.
The procedural actions required are described in Gale.
EC-01 3-0859.
The analyses to be performed is described in Gale. EC-013-0859.
The procedural caution to be performed'is described in Gale.
EC-01 3-0788.
The analysis of the inadvertent condensate event and all of the permanent procedure changes for the procedural actions identified above willbe completed by the end of the next refueling outage scheduled for the spring of 1997, except the action to trip the feedwater pump turbines as an immediate operator action for Control Room fires requiring evacuation which willbe completed within one month of receiving NRC approval to use this action for the Appendix R Control Room fire.
With respect to the analysis of the condensate event, should the results not be favorable and additional analyses be required, we willnotify you.
Allof the modifications listed above will be completed by the end of the Unit 1 10RIO (May 1998) and the Unit 2 9RIO (May 1999). Attachment C to this letter describes the compensatory actions currently in place for addressing these issues.
With respect to the MOV hot short issue, we are presently reviewing the plant procedures affected by this issue to determine if more definitive procedural guidance is required until the permanent plant or procedure changes are made.
With respect to the inadvertent vessel overfill concerns, we are presently addressing this issue as a part of our deficiency management process.
Any additional procedural enhancements required to address the MOV hot short issue will be completed by the end of the next refueling outage.
FILE R41-2 PLA-4505 Document Control Desk Completion of the circuit modifications for the twenty-four MOV's referenced in item 1 in the table above will address the concerns identified in NRC IN 92-18.
As described in Appendix C to Calculation EC-013-0859, this will assure that the low pressure RHR LPCI system will be available to perform its function in the alternate shutdown cooling mode of operation.
Since 3 SRV's are assured to be available at the Remote Shutdown Panel, reactor pressure can be reduced to the level where RHR LPCI can be used to accomplish the other required safe shutdown functions ofinventory make-up and decay heat removal.
C In addition, we have elected to modify the circuits for two additional valves per unit: the RHR F028 and F006 valves.
Although performing modifications to these two additional valves is not required based on the spurious operation criteria contained in Attachment A and the evaluation performed in Appendix C to Calculation EC-013-0859, by doing so, we can preserve the ability to operate one valve in each of the two potential flowdiversion paths offofthe main RHR LPCI flow path. Therefore, in addition to the valves required to be modified as described in Appendix
.C to Calculation EC-013-0859, we will also modify circuits for the 1F028B, 1F006B, 2F02SA and-the-2F006A-valves;-
To satisfy remaining issues, PP&L requests closure ofthe following issues related to Appendix R Safe Shutdown for-SSES:
l.
Agreement on the spurious operation criteria contained in Attachment A to this letter.
2.
In the event of a Control Room fire, in addition to a manual SCRAM, credit be given for the followingoperator actions:
~
Closure ofthe MSIVs prior to leaving the Control Room.
~
Closure of the feedwater discharge valves and tripping of the feedwater turbine prior to leaving the Control Room to prevent a vessel overfill condition caused by the spurious operation of the feedwater flow controller during feedwater system coastdown.
Demonstration ofcompliance with the requirements of Generic Letter 86-10 section 3.8.4 for these actions is contained in Calculation EC-013-0859 in section 7 under MSIVs and Feedwater.
Allofthese actions, including the manual scram action currently allowed, can be accomplished in rapid succession by a single operator from his/her normal position in the Control Room.
3.
Resolution ofNRC IN 92-18 concerns for SSES.
Our approach is documented in Appendix C to Calculation EC-013-0S59, Revision 4.
C
4 FILE R41-2 PLA-4505 Document Control Desk 4.
Acceptance of PP&L's positions on the credibility of the inadvertent HPCI initiations as described in Attachment B to this Letter and the feedwater spurious operation as described in Calculation EC-013-0859, Section 7.
Upon receipt ofyour concurrence with the above, PP&L willrevise the SSES FPRR to document the final agreed upon positions on the issues described in this letter.
If you have any questions on any of the issues addressed in this letter, please contact Mr. W.W. Williams at (610) 774-7742.
Very truly yours, R.
yr m Attac ents copy:
Regional Administrator - Region I Mr. K. M. Jenison, NRC Sr. Resident Inspector Mr. C. Poslusny, NRC Sr. Project Manager
C
~
O.
Attachment A to PLA-4505 Page 1
Susquehanna Stcam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L r
n 10CFR50 Appendix R, Sections III.G.2 and III.L.7require that the impact ofassociated circuits on safe shutdown be addressed.
NRC Generic Letter 81-12 defines three categories ofassociated circuits: Common Power Supply; Common Enclosure; Spurious Operation. As a part ofthe NRC's review ofRevision 4 to SSES's FPRR, questions arose concerning the criteria to be used at SSES to address Spurious Operations in accordance with the requirements cited above.
The criteria provided herein focuses on "hot short" cable faults. Appendix R also requires that redundant safe shutdown equipment be evaluated for impacts due to shorts to ground or open circuits that could result from a fire in each fire area. This criteria in no way attempts to place a limiton the number ofopen circuits or shorts to ground that must be considered in an Appendix R Safe Shutdown Analysis. In addition, this criteria in no way alters the positions described in NRC Generic Letter 86-10 paragraph 5.3.2 and 5.3.3 relative to the duration ofthe postulated hot shorts.
The basic philosophy behind this criteria is that fire induced damage to equipment required to support safe shutdown is highly unpredictable.
As a result, mitigating actions that bound the spectrum ofpotential damage states offire induced damage willenhance the operators ability to deal with the unexpected.
Cable faults induced by the fire can prevent safe shutdown equipment from performing its required function. The postulated cable faults are open circuits, shorts to ground and hot shorts. Ofthese three types ofcable faults, open circuits and shorts to ground could prevent equipment from operating. Hot shorts, conversely, can cause equipment that is not required for safe shutdown to operate spuriously in a way that could be detrimental to the safe shutdown train. It is this class ofcable fault that is the subject ofthis criteria.
Fire induced hot shorts although unlikely can cause the spurious operation ofequipment capable ofaffecting safe shutdown systems.
Due to the lower probability ofthese types ofcable faults, simultaneous spurious operation ofall potentially affected equipment is not required for cases other than the case oftwo valves in a Hi/Lo Pressure interface line. For spurious operation of equipment, other than Hi/Lo pressure interface components, spurious operations are to be mitigated on a one-at-a-time basis.
Attachment A to PLA-4505 Page 2 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L To satisfy the criteria for spurious operation, all potential fire induced spurious operations must be identified and a mitigating action must be developed for each. This mitigating action may be an action taken prior to the start ofthe fire event that precludes the condition from occurring or a post fire action that mitigates the effects ofthe condition prior to it reaching an unrecoverable condition relative to safe shutdown.
In any case, the corresponding mitigating action for each potential spurious operation must be known and this action must be capable oflimitingthe potential adverse effects ofthe spurious operation without reliance on any other equipment that is also potentially susceptible to a spurious operation resulting'rom a fire in the same fire area.
For the SSES Control Room fire, evacuation ofthe Control Room is assumed.
The safe shutdown circuits that must function to achieve hot shutdown and to achieve and maintain cold shutdown can be isolated from the fire in the Control Room by isolation transfer switches at the--
Remote Shutdown Panel (RSP). Therefore, by using this set ofsystems, in the absence ofany postulated spurious operations, safe shutdown is assured upon actuation ofthe transfer switches at the RSP. In the time required for the operator to evacuate the Control Room and to assume control ofthe unit at the RSP, however, spurious equipment operation is possible.
As a result, this set ofcircuits must be evaluated under the same criteria as the rest ofthe plant prior to actuation ofthe transfer switches, i.e. on a one-at-a-time basis.
The difference for this set ofcircuits, however, is that actuation ofthe transfer switch is an acceptable mitigating action.
Therefore, for the set of isolable circuits, the postulated spurious operations are evaluated on a one-at-a-time basis with the accepted mitigating action always being actuation ofthe transfer switch at the RSP.
Those circuits in the Control Room that are not isolable from the Control Room must be addressed in the same way as potential spurious operations in fire areas outside ofthe Control Room. Therefore, for each potential and credible spurious operation a mitigating action must be developed.
By assuming that spurious operations occur one-at-a-time prior to assuming control at the RSP, the operator is able to mitigate the effects ofpostulated fire scenarios requiring multiple spurious operations once he/she has taken control ofthe unit at the RSP.
Applying this criteria to the Control Room provides assurance that no spurious operation resulting from a fire induced hot short willimpact safe shutdown prior to the operator taking control ofthe unit at the RSP.
Once the operator has assumed control ofthe unit at the RSP, the equipment and controls available at that location allow for a controlled response in mitigating the even more unlikely effects ofsubsequent spurious operations affecting non-isolable circuits remaining in the Control Room that must combine to impact safe shutdown.
Attachment A to PLA-4505 Page 3 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L In summary, for a fire in any fire area, the ability to mitigate on a one-at-a-time basis any and all spurious operations with the potential to impact the safe shutdown train must be available. For the Control Room, safe shutdown cannot be impacted by any spurious operation caused by a hot short in the. time frame required to evacuate the Control Room and to assume control ofthe unit at the RSP.
The criteria required to address the issue ofassociated circuits for spurious operation covers three distinct areas: Spurious Component Criteria: Criteria to determine the population of components whose spurious operation could potentially affect safe shutdown; Spurious Cable
,Criteria: Criteria to be applied to the cabling for this population ofcomponents to determine which cables have the potential to cause a spurious operation ofthe component; Spurious Operation Criteria: Criteria to be applied in assessing the impact of fires on the population of potential spurious operation cables affected by a fire in a given fire area.
~
l r
These components were defined as the set ofcomponents whose spurious operation could result in either a loss ofRPV inventory, an inadvertent overfillingofthe RPV or a flow loss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown.
I i ri This criteria has two parts: one that applies to Hi/Lo pressure interface components; another that applies to all other spurious components other than Hi/Lo pressure interface components.
Definition: Hi/Lo Pressure Interface Component: Valves whose spurious opening could result in a loss ofReactor Pressure Vessel Inventory, and, due to the lower pressure rating on the down stream piping, an interfacing system LOCA.
r In addition to the types offailures that must be assumed for "all other components", in determining the spurious operation potential ofcables for these components, it must be assumed that 3-phase hot shorts on AC circuits and two hot shorts ofthe proper polarity without grounding on ungrounded DC circuits are credible.
~D I
f i Ih I
ig i
i f
the respective component.
(i.e. Ifmore than one hot short on the electrical circuitry for the component is required to cause the spurious operation, then this is not considered to be credible.)
Attachment A to PLA-4505 Page 4 Susquehanna Steam Electric Station
, Associated Circuits-Spurious Operation Appendix R, Sections III.G and III.L
~
uri i
r i
i
~ Similarly, this criteria has two parts: one that applies to Hi/Lo pressure interface components; another that applies to all other spurious components other than Hi/Lopressure interface components.
This criteria applies to the evaluation ofthe impacts due to fires governed by Appendix R,Section III.G~ III.L. Those circuits isolated from the Control Room, where the governing section ofAppendix R isSection III.L,are covered within this criteria.
m
'here a single fire can impact the potential spurious cables for both Hi/Lopressure interface valves, it must be assumed that both valves spuriously operate simultaneously.
This criteria applies to all areas including the Control Room and to all circuits regardless ofwhether or not they can be isolated from the Control Room by actuation ofan isolation transfer switch.
~Allp<<lp p
I gk gl
~
b*
addressed and the effects ofeach mitigated on a one-at-a-time basis unless a single cable fault can cause the spurious operation ofmultiple components. Ifa single cable fault can cause the spurious operation ofmultiple components, these spurious operations must be addressed simultaneously.
In addressing any and all spurious operations on a one-at-a-time basis, it is not necessary to attempt to consider the aggregate effects ofthe potential spurious operations on plant parameters nor is it intended that selected sequential multiple cable fault combinations be evaluated.
Time domain analyses, such as transient analysis, are not required to address the potential interactions between the various spurious actuations.
The focus is to be on addressing each potential spurious operation and mitigating the effects ofeach individually.
Examples ofways to mitigate, either prior to or during the process ofthe fire, the effects of each spurious operation are as follows:
~
Provide a fire barrier or wrap
~
Route the circuit ofconcern in a dedicated raceway that does not contain any other normally energized circuits that could cause a hot short
~
Reroute or relocate the circuit/component
~
Provide a Procedural Action, such as:
Attachment A to PLA-4505 Page 5 Susquehanna Stcam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L
- Have the breaker for the component ofconcern normally racked out (or fuses removed) so that inadvertent operation is not possible.
[Note: For Hi/Lo pressure interface components, a 3 phase hot short on the ac power cable or 2 hot shorts ofthe proper polarity on the dc power cable must still be evaluated.]
- Perform an action in response to the fire condition to mitigate the impact of the spurious operation.
[Note: Ifthis action involves manually operating an MOV locally using the hand wheel, it must be demonstrated that fire damage did not result in a hot short with the potential to damage the valve (i.e. NRC IN 92-1S concern)]
~
Identify other equipment that can prevent the spuriously operated component from affecting safe shutdown When using the last option described above ofidentifying other equipment that can prevent the spuriously operated component from affecting safe shutdown, the followingrule must be applied to the other equipment selected to mitigate the effects of a spurious operation: The equipment selected cannot itselfbe a component that has the potential to spuriously operate during the same fire. (i.e. One. cannot. mitigate the. effects ofone "Spurious Operation" by ignoring a "Hot Short/Spurious Operation" on another component.)
For the case ofa Control Room fire, spurious operations are also addressed on a one-at-a-time basis.
Spurious operations must be considered to occur in the Control Room prior to the post evacuation local manual operation ofthe isolation transfer switches.
For the circuits in the Control Room Fire Area, it is necessary to identify all potential spurious operations resulting from the fire and to evaluate the impact ofeach on safe shutdown. The spurious operations must be postulated on circuits that can be isolated, as well as, on ones that cannot be isolated.
As is the case in all other fire areas, each ofthese potential spurious operations is assumed to occur one-at-a-time. Ifthe circuit can be isolated by the actuation ofan isolation transfer switch, the actuation ofthe transfer switch is considered to be an adequate mitigating action.
For those circuits in the Control Room Fire Area which are not isolated by transfer switches, the criteria as described in the previous section must be applied. For these circuits, it must be assumed that they spuriously operate on a one-at-a-time basis.
For each identified potential and credible spurious operation, a mitigating action must be developed.
Attachment A to FLA-4505 Page 6 Susquehanna Steam Electric Station Associated Circuits-Spurious Operation Appendix R, Sections III.Gand III.L Therefore, for the Control Room fire analysis described above, spurious operation needs to be considered on a one-at-a-time basis for all cases, except the Hi/Lopressure interface cases.
In addition, the population of isolable circuits must be evaluated for the effect ofdamaging hot shorts (i.e. NRC IN 92-18 concern) using the spurious operation criteria outlined in this document..
1 i n:
The issue ofAssociated Circuits-Spurious Operation can be addressed for SSES by applying the criteria described above.
The important points to understand and to address in order to successfully comply with NRC Guidance on the Spurious Operation Issue are as follows:
~
Those components with the potential to cause a Hi/Lopressure interface condition are ofthe greatest concern and, as such, these components have a more stringent spurious cable and spurious operation criteria applied to them. This criteria applies to all areas including the Control Room and to all circuits regardless ofwhether or not they can be isolated by the actuation ofan isolation transfer switch aAer evacuatmg the Control Room
~
For all potential spurious operations in any fire area, the focus must be to address each potential spurious operation and to mitigate the effects ofeach individually.
~
In identifying the mitigating action for each potential spurious operation in any given fire area, it is not acceptable to mitigate the effects ofone spurious operation by ignoring the effects ofanother potential spurious operation.
For circuits that are isolated from the main Control Room, post evacuation local manual actuation ofthe isolation transfer switch is an adequate mitigating action for any and all potential spurious operations.
~
The concern with damaging hot shorts identified in NRC IN 92-18 must be addressed (1) for Control Room MOV circuits that are isolated by the post fire local manual actuation ofan isolation transfer switch and (2) for MOVcircuits with potential to be damaged by fires inside or outside ofthe Control Room whose mitigating action involves the manual local operation ofan MOV.
Attachment B to PLA-4505 Page 1
Susquehanna Steam Electric Station Spurious Operation ofHPCI During a Control Room Fire Appendix R,Section III.L r
I m t In the event ofa Control Room fire, inadvertent initiation ofthe HPCI System concurrent with the loss ofthe 54" high water level trip for HPCI can result in a vessel overfillcondition. The concern with inadvertent HPCI injection concurrent with the loss ofthe 54" trip is that in a short time period this could result in the reactor vessel flooding to the point where HPCI would be disabled and the main steam lines would be filled with high pressure water.
10 CFR 50 Appendix R, Section III.G.2 requires that redundant safe shutdown trains be separated by either fire rated barriers or a specified physical separation distance.
In the-event that the requirements of Section III.G.2 cannot be met,Section III.G.3 governs.
Section III.G.3 requires that Alternate or Dedicated shutdown capability independent ofthe cables, systems or components in the area be provided.
The rules for Alternate or Dedicated Shutdown are provided in Appendix R,Section III.L.
Section III.L.7requires that the safe shutdown equipment and systems for each fire area be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits or shorts to ground in the associated circuits willnot prevent the operation ofthe safe shutdown equipment.
For SSES, the analysis offires in the Control Room is governed by the requirements of Section III.L.
The additional guidance provided in Generic Letter 81-12, expands the definition ofassociated circuits ofconcern to include safety related, non-safety related Class 1E and non-Class 1E circuits. The spurious operation criteria provided to the NRC in PLA-4442 documented PP&L's approach to resolving this concern. In this criteria, spurious operation components were defined as the set ofcomponents whose spurious operation could result in either a loss ofRPV inventory or a flow loss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown.
Subsequent to the submittal ofthis PLA, discussions were held between PP&L and the NRC during which the definition ofspurious operation components was revised to the following: The set ofcomponents whose spurious operation could result in either a loss ofRPV inventory, an inadvertent overfillingofthe RPV or a flowloss or blockage in the inventory make-up or decay heat removal systems being used for safe shutdown. This final criteria is contained in Attachment A to PLA 4505.
Attachment B to PLA-4505 Page 2 In performing the final review ofthe SSES Safe Shutdown Analysis relative to this criteria, a concern with the potential inadvertent initiation ofthe HPCI System during a Control Room fire was identified.
The purpose ofthis attachment is to explain the concern ofinadvertent initiation ofHPCI during a Control Room fire and to explain how this issue willbe resolved for Susquehanna SES.
~lI~Cl<~l}Q:
HPCI System inadvertent initiation can be postulated in three ways. For each ofthese ways to come to fruition, the cable faults described below must occur and, in addition, the fire must not damage the HPCI flowcontroller or any other system or component control circuits that could prevent the system from operating.
Should the fire damage the output ofthe HPCI flow controller, this would be interpreted by the HPCI Turbine as a zero flowdemand.
This would cause the HPCI system to shutdown.
Controls for all ofthe HPCI components discussed in this attachment, except for the Division I dc control circuit, are contained within Control Room Panel I/2C601. Therefore, the fire must be sufficiently limited so that only the selected portions ofthe circuit are damaged, but the fire must also be extensive enough to result in a condition that causes fire spread and, ultimately, an evacuation ofthe Control Room.
Based on the close proximity ofthis equipment and the discussion provided above, situations (1) and (3) below, which cause system initiation and loss ofthe 54" high water level trip without resulting in circuit damage that would prevent system operation, are considered to be extremely unlikely to the point ofbeing non-credible.
The three postulated inadvertent initiation scenarios are as follows:
(1): Individual hot shorts on the start circuitry for each ofthe following three components must be postulated (i.e. three hot shorts): the HPCI Aux. Oil Pump which would open the HPCI Control and Stop Valves; the HPCI Steam Admission Valve; the HPCI Pump Discharge Valve. For the fire in the Control Room, circuits for the 54" HPCI trip could also be postulated to be damaged by the same fire.
(2): A single Hot Short on the Division II dc control circuit for HPCI automatic initiation logic. For a fire in the Control Room, relay contacts for the 54" trip are also part ofthis same control circuit. One ofthe two relays required to be energized to initiate the 54" trip, however, is a part ofa separate Division I dc control circuit. Iftwo individual shorts to ground, one on the positive side and one on neutral side, ofthis Division I dc circuit are postulated to occur, the control power to the circuit could be damaged by the Control Room fire, disabling the 54" trip.
Attachment B to PLA-4505 Page 3 (3): The condition of sequential selected cable faults on the HPCI Division II dc control circuitry that initiates the system for 25 to 30 seconds and then is overcome by a fault to ground which disables the 54" trip within the next 30 to 40 seconds.
Should HPCI inadvertently initiate, an operator action is required within approximately 3 minutes to mitigate the effects ofthe spurious operation prior to vessel level reaching the elevation ofthe main steam lines. Performing any operator action within 3 minutes that could be guaranteed to mitigate the effects ofthis scenario would be difficultgiven the operators other priorities in such an event.
Because ofthe limited time available for the operator to take a mitigating.action, the action taken must be one for which the total elapsed time for the operator to evacuate the Control Room, arrive at the location where the action is to be performed and perform the action must be within 3 minutes. This constraint limits the options available to mitigate the effects ofthis condition.
To mitigate the effects ofthe first and third situations described above would require the addition ofa keylocked switch in the lower relay room for each unit that would be activated by the operator while traversing the evacuation path from the Control Room to the Remote Shutdown Panel. ActivationofthiskeylockswitchwouldinhibitHPCI operation.
(Note: Additional time studies would need to be performed in order to assure that this action could be completed within the required time frame.) Similarly, failure ofthis switch during normal operation would inhibit HPCI operation and render it unavailable for service should it be called upon to function during other accident conditions. The probability ofswitch failure has been estimated to be 2 x 10 /
quarter.
The addition ofthis switch, should the required timing for this action be demonstrated, could also be used as a mitigating action for the second situation described above. With respect to the second situation described above, however, a modification could be performed that would eliminate the possibility for the event even occurring. The proposed change for this latter situation would place the Division I dc relay circuit on separate fusing isolated from the potential for any Control Room fire damage.
This change would allow the HPCI System to function as designed in an automatic mode controlling level between -38" and+54" during a Control Room evacuation and it would also eliminate the potential negative effects ofan undetected switch failure that could inhibit HPCI operation during normal operation in support of other accident conditions.
CmuJushn:
It is our conclusion that the installation ofa keylock switch in the lower relay room for the purpose ofmitigating the effects of independent hot shorts on three separate HPCI components or multiple selective cable faults in the HPCI control circuitry would result in a condition contrary to overall nuclear plant safety. The existence ofthis switch would create a situation with a higher probability offailure than the probability ofthe failure that it is designed to prevent.
Because ofthis, we request that situation (1) ofindependent hot shorts on three separate
Attachment B to PLA-4505 Page 4 HPCI components and situation (3) selective sequential cable faults be considered to be non-credible events which are outside ofthe required design basis for Control Room fires.
With respect to the HPCI inadvertent initiation concern, PPkL willperform a permanent plant modification to prevent the vessel overfill condition described in situation 2 above.
This change willpreserve the availability ofthe 54" high water level trip for the postulated condition ofa hot short in the HPCI automatic initiation logic.
Susquehanna Steam Electric Station Appendix R Safe Shutdown Analysis Additional Compensatory Actions I
Attachment C to 5
e1 Event ofConcern
- 1. Valve damage to valves required to operate at the RSP as a result ofHot Shorts in the Control Room.
- 2. A drain down ofthe suppression pool during a Control Room fire due to spurious opening ofthe suppression pool clean-up system isolation valves.
Appendix R Spurious Operations - MOVHot Short Issues (NRC IN 92-18)
Additional Compensatory Actions Redundant safe shutdown capabilities exist at the SSES Remote Shutdown Panel so that the failure ofany valves in the high pressure make-up system willnot impact the ability to safely shutdown.
For this condition, Appendix C to Calculation EC-013-0859 explains that RHR in the alternate shutdown cooling mode can be used.
Plant Procedure ON-1/249-001 provides instructions for entering Alternate Shutdown Cooling. Conversely, for a failure ofany single valve in the low pressure system, safe shutdown willnot be impacted.
For this condition, RCIC can be used to maintain level while the RHR loop that is not installed on the RSP can be put into service manually. Plant Procedure OP-I/249-005 addresses placing this loop in service when at the RSP. These actions willplace the plant in a safe configuration. With the plant in a safe condition, adequate time is available for developing subsequent actions, as dictated by the situation, to bring the unit to cold shutdown. These actions would be developed based on the specifics ofthe situation by the emergency response team. These compensatory actions are currently in place to prevent a single damaging hot short on any valve required for safe shutdown at the RSP from impacting safe shutdown.
Loss ofSuppression Pool Inventory is an entry condition for EO-103. This emergency operating procedure tells the operator to maintain suppression pool level using the suppression pool clean-pp system.
In the process oftrying to do this, the system problems would bc identified in sufficient time to close the I/257025 valve. These compensatory actions are currently in place to prevent damaging hot shorts to these valves from impacting the ability to safely shutdown. These actions provide an adequate level of safety until permanent procedural changes scheduled for the end ofthe U2-8RIO can be made.
'he compensatory actions specified in this table are in addition to the normal actions described below for the Control Room.
~
The Control Room is continuously manned.
~
The Control Room has an installed under floor manual spurt CO< suppression system and detection throughout.
~
Operations Control Room personnel willbe briefed on the fire concerns described above.
~
There is a qualified fire brigade leader on every shift.
~
Portable fire fighting equipment is available for use by Operations personnel in the immediate Control Room Fire Area.
~
There are self-contained breathing apparatus available in the Control Roon'ire Area for use by Operations personnel.
Susquehanna Steam Electric Station Appendix R Safe Shutdown Analysis Additional Compensatory Actions Attachment C to 5
e2 Event of Concern l.
Inadvertent HPCI injection during a Control Room fire.
(Scenario 2) 2.
Spurious feedwater injection during a Control Room fire.
3.
Inadvertent Condensate injection for fires inside and outside ofthe Control Room.
4.
Spurious RCIC injection for fires outside ofthe Control Room.
Appendix R Spurious Operations - Inadvertent Reactor Vessel Overfill Issues Additional Compensatory Actions It is expected that the operator would be in the Control Room continuing to fight the fire when the inadvertent HPCI initiation occurs, Plant Procedure OP-I/252-001 instructs the operator'to override the HPCI injection. This is an adequate compensatory action for preventing damage to safe shutdown systems, based on the expected fire damage associated with this issue. This action provides an adequate level ofsafety until permanent modifications can be installed.
ON-1/200-009 currently provides instruction for the operator to close the MSIV's and the feedwater pump discharge valves prior to evacuating the Control Room. This is an adequate compensatory action to prevent an uncontrolled injection by feedwater until permanent procedural changes can be made.
EO-102 instructs the operator to maintain level between 13" and 54". In addition, EO-102 instructs the operator to prevent an uncontrolled injection by condensate should pressure be reduced to less than 600 psig. Based on this procedural guidance and the expected extent offire damage associated with this issue, it is expected that the operator would continue to fight the fire and control the unit from within the Control Room. From within the Control Room, procedural actions can be taken to mitigate spurious condensate injection. This is an adequate compensatory action for preventing an impact to safe shutdown systems.
For fires outside ofthe Control Room, the protected safe shutdown Path is ADS with Core Spray. The normal shutdown sequence using this path willpreclude the event ofconcern. These actions provide an adequate level ofsafety until permanent procedural changes can be made.
EO-102 instructs the operator to maintain level between 13" and 54". For fires outside ofthe Control Room, the protected safe shutdown Path is ADS with Core Spray. The normal shutdown sequence using this path willpreclude the event ofconcern.
These actions provide an adequate level ofsafety until permanent procedural changes scheduled for the end ofthe U2-SRIO can be made.
The compensatory actions specified in this table are in addition to the normal actions described below for the Control Room.
~
The Control Room is continuously manned.
~
The Control Room has an installed under floor manual spurt CO< suppression system and detection throughout.
~
Operations Control Room personnel willbe briefed on the fire concerns described above.
~
There is a qualified fire brigade leader on every shiA.
~
Portable fire fighting equipment is available for use by Operations personnel in the immediate Control Room Fire Area.
~
There are self-contained breathing apparatus available in the Control Room Fire Area for use by Operations personnel.