ML17354B317
| ML17354B317 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 08/31/1998 |
| From: | DIMMETTE J P COMMONWEALTH EDISON CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| 50-254-98-11, 50-265-98-11, SVP-98-273, NUDOCS 9809090061 | |
| Download: ML17354B317 (36) | |
See also: IR 05000254/1998011
Text
CATEGORY 1 REGULATORY
INFORMATION
DISTRIBUTION
SYSTEM (RIDS)ACCESSION NBR:9809090061
DOC.DATE: 98/08/31 NOTARIZED:
NO FACIL:50-254
Quad-Cities
Station, Unit 1, Commonwealth
Edison Co.~~~50-265 Quad-Cities
Station, Unit 2, Commonwealth
Edison Co.AUTH.NAME AUTHOR AFFILIATION
DIMMETI'E,J.P.
Commonwealth
Edison Co.RECIP.NAME RECIPIENT AFFILIATION
Records Management
Branch (Document Control Desk)DOCKET 05000254 05000265 SUBJECT: Responds to NRC 980702 ltr re violations
noted in insp repts 50-254/98-11
6 50-265/98.-11.Corrective
actions: compensatory
measures are in place that eliminate or minimize possible fire that could affect 125Vdc 6 4KV ecpxipment
at same time.DISTRIBUTION
CODE: IE01D COPIES RECEIVED:LTR
ENCL SIZE: TITLE: General (50 Dkt)-Insp Rept/Notice
of Violation Response NOTES: A RECIPIENT ZD CODE/NAME PD3-2 PD-INTERNAL:, ACRS AEO 8 NRR/DRPM/PECB
NUDOCS-ABSTRACT"OGC/HDS2 XTERNAL: LZTCO BRYCE, J H NRC PDR COPIES LTTR ENCL 1 1 2 2 1 1 1 1 1 1 1 1 1 1 1 1 1 1 RECIPIENT ID CODE/NAME PULSIFER,R
AEOD/SPD/RAB
DEDRO" NRR/DRCH/HOHB
NRR/DRPM/PERB
OE DIR RGN3 FILE 01 NOAC NUDOCS FULLTEXT COPIES LTTR ENCL 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0;NOTE TO ALL"RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTE.TO HAVE YOUR NAME OR ORGANIZATION
REMOVED FROM DISTRIBUTION
LISTS OR REDUCE THE NUMBER OF COPIES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL DESK (DCD)ON EXTENSION 415-2083 TOTAL NUMBER OF COPIES REQUIRED: LTTR 19 ENCL 19
(:<)mn)<)tnV<:Itltl)
i!<lip<)<)
(:<)I))i);))I<')t)I)<i
C:iti<.s G<:I)<:I".Itii)i.
St:)ti<tl)
)s It)st)C)II)AVQI)<IQ X<)fti)(<)r<i<)a".t.
II.ol)t)9-tt)"I'<:I.1<)W')~<.s'I I SVP-98-273
August 31, 1998 U.S.Nuclear Regulatory
Commission
Washington, D.C.20555 Attention:
Document Control Desk Subject: Quad Cities Nuclear Power Station, Units 1 and 2 Facility Operating License Numbers DPR-29 and DPR-30 NRC Docket Numbers 50-254 and 50-265 Response to NRC Inspection
Report Numbers 50-254/98011
and 50-265/98011
Reference:
(1)J.A.Grobe (NRC)letter to O.D.Kingsley (ComEd), dated July 2, 1998,"NRC Inspection
Report 50-254/98011 (DRS);50-265/98011 (DRS)" (2)J.P.Dimmette, Jr.(ComEd)letter to USNRC, dated May 22, 1998 (SVP-98-203),"Response to Questions Raised During Confirmatory
Action Letter Closure Inspection
and Summary of Fire Protection
Compensatory
Actions" Enclosed is Commonwealth
Edison's'(ComEd's)
response to the request concerning
Unresolved
Issue (URI)50-254/265-98011-01, transmitted
in the subject report.Attachment
A contains the response to the five-part URI which pertains to: (a)loss of 125 Vdc breaker control, (b)fire induced failure of non-safe-shutdown
equipment, (c)automatic closure of Main Steam Isolation Valves (MSIVs), (d)single spurious operation, including the effect of Automatic Depressor)sation
System (ADS)failures on the time line, and (e)adequacy of fire detection and suppression
in fire area TB-II.In concert with the ongoing fire protection
program at Quad Cities Nuclear Power Station and the Unresolved
Issues identified
in the subject NRC Inspection
Report, ComEd has initiated the Fire Protection
Improvement
Program.The Program objectives
consist of: 1)reducing the conditions
leading to control room evacuation,2)
eliminating
post-restart
compensatory
measures, 3)reducing inter-unit
dependencies,v, s!)t st<)lent'l<
0
USNRC SVP-98-273
August 31, 1998 4)assuring the availability
of 125 Vdc, 5)reducing exemptions.
6)resolving commitments
to NRC, 7)developing
an improved risk model, and 8)improving the fire protection
program.Elements of this Program include: 1)performing
necessary studies, 2)completing
fire protection
improvement
efforts, and 3)performing
necessary modifications.
All studies, including the identification
of potential improvement
changes, are scheduled to be completed by mid-December, 1998.The identified
potential changes from the Improvement
Program will be assessed using the revised fire risk model.Insights identified
during this assessment
will be reviewed for potential plant changes (modifications, procedure changes, etc.)and prioritized
based on enhanced compliance
with regulations, risk significance, and cost-benefit.
As described in Reference 2, compensatory
measures were taken (i.e., once per hour fire watches)for two issues (loss of 125 Vdc and multiple spurious operation of components
within the Residual Heat Removal and Reactor Core Isolation Cooling systems)that were identified
by the NRC.These two issues were subsequently
encompassed
within two of the elements of the URI of the subject Inspection
Report.As part of ComEd's ongoing efforts under the Fire Protection
Improvement
Program, periodic status meetings with the NRC are planned.ComEd will discuss results of its evaluations
relative to the URIs and planned activities
at the next meeting.If there are any questions or comments concerning
this letter, please refer them to Mr.Charles Peterson, Regulatory
Affairs Manager, at (309)654-2241, ext.3609.Sincerely, PS'oel P.Dimmette, Jr Site Vice President Quad Cities Station Attachment
A: "Response to URI Regarding Appendix R Inspection
Report 98-011" cc: J.L.Caldwell, Acting Regional Administrator, Region III R.M.Pulsifer, Project Manager, NRR C.G.Miller, Senior Resident Inspector, Quad Cities W.D.Leech;MidAmerican
Energy Company D.C.Tubbs, MidAmerican
Energy Company Office of Nuclear Facility Safety, IDNS INPO Records Center
ATTACHME<NT
A Response to URI Regarding Appendix R Inspection
Report 9S-011 SVP-98-273 (Page 1 of 17)'1.NRC URI 9S-011-01 a: The 125 Vdc control power system was not shown to be free of fire damage for the turbine building fire areas.When 125 Vdc is not available to the switchgear, fire induced faults are cleared by upstream breakers to isolate the fault.These concerns are discussed in Sections E.1.3 (b)and E.1.4 (b)of the inspection
report.ComEd Res onse to URI 9S-011-01 a: Inspection
Report 50-245/265
98-011 identified
a specific weakness in the 125 Vdc system described as"inadequate
evaluation
of, and level of protection
for, 125 Vdc control power to 4 kv switchgear" that does not satisfy the technical requirements
of 10 CFR part 50, Appendix R.Regulatory
Requirements
The applicable
sections of 10 CFR part 50 Appendix R are III.G.3, III.L.3 and III.L.7.Section III.G.3 states"Alternative
or dedicated shutdown capability
and its associated
circuits, independent
of cables, systems or components
in the area, room or zone under consideration
shall be provided: a.Where the protection
of systems whose function is required for hot shutdown does not satisfy the requirement
of paragraph G.2 of this section;or b.Where redundant trains of systems required for hot shutdown located in the same fire area may be subject to damage from fire suppression
activities
or from the rupture or inadvertent
operation of fire suppression
systems.In addition, fire detection and a fixed fire suppression
system shall be installed in the area, room, or zone under consideration." Alternative
shutdown capability
is provided because the requirements
of III.G.2 are not met at Quad Cities Station.Section III.L.3 states,"The shutdown capability
for specific fire areas may be unique for each such area, or it may.be one unique combination
of systems for all such areas.In either case, the alternative
shutdown capability
shall be independent
of the specific fire area(s)and shall accommodate
postfire conditions
where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.Procedures
shall be in effect to implement this capability."
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 2 of 17)Section III.L.7 states,"The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated
non-safety
circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated
circuits will not prevent operation of the safe shutdown equipment.
The separation
and barriers between trays and conduits containing
associated
circuits of one safe shutdown division and trays and conduits containing
associated
circuits or safe shutdown cables from the redundant division, or the isolation of these associated
circuits from the safe shutdown equipment, shall be such that a postulated
fire involving associated
circuits will not prevent safe shutdown." Compliance
Assessment
The equipment and associated
circuits used to achieve safe shutdown are independent
of the specific fire area(s)and accommodate
postfire conditions
where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.QCARPs have been written for this requirement
providing detailed instructions
to implement this capability
with both offsite power available and offsite power not available.
Safe shutdown equipment and systems are not damaged by fire and for each fire area are known to be isolated from associated
non-safety
circuits in the fire area prior to use so that hot shorts, open circuits, or shorts to ground in the associated
circuits will not prevent operation of the safe shutdown equipment.
Coordination
of load breakers with upstream breakers is provided.The alternate power supply is the SBO diesel generator.
This power supply as well as offsite power will p'rovide the necessary fault current for a sufficient
time to ensure proper coordination
without loss of function'of
safe shutdown loads.The power supply and safe shutdown loads are isolated from the fire area.Electrical
isolation is provided to prevent spurious operation.
The alternate power supply is available in sufficient
time to supply safe shutdown loads.Procedures
ensure isolation of these associated
circuits from the safe shutdown equipment such that a postulated
fire involving associated
circuits will not prevent safe shutdown.There is no self-induced
LOOP in order to align safe shutdown buses or loads.Offsite power is utilized if available.
If 125 Vdc control power is available, it is used prior to isolation.
The actions required to isolate and manually align the electrical
distribution
system in'the event of a fire induced loss of 125 Vdc control power and a loss of offsite power are contained in the procedures
and the time to carry out these actions is accounted for in the timeline.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 3 of 17)Compe'nsatory
measures (including
periodic fire watches), however, are in place to address this issue by eliminating
or minimizing
the possibility'f
a fire that could adversely affect the 125Vdc and 4KV equipment at the same time.Related Enhancements
Coordination
has been achieved to the individual
control circuit level by replacement
of molded case circuit breakers and the in'dividual
control circuit trip fuses.These replacements
were completed prior to the recent restart.This reduces potential loss of 125 Vdc control power.The safe shutdown analysis and implementing
procedures
are in compliance
with Appendix R III.L.As stated in our May 22, 1998 letter (Reference
2), a study of possible enhancements
to the 125 Vdc system has been'undertaken.
The objectives
of this study are to determine modifications
which will prevent simultaneous
loss of control power to both ECCS division switchgear
given a fire in any area;preventing
loss of control power to the remaining (unaffected)
division Emergency Diesel Generator;
arid preventing
loss of 125 Vdc control power from fires in opposite unit fire areas.The implementation
of the study has the potential to reduce local manual actions.As stated in our May 22, 1998 letter (Reference
2), compensatory
measures have also been implemented
on an interim basis.Conclnsion
Compensatory
measures are currently in place that eliminate or minimize the possibility
of a fire that could adversely affect 125Vdc and 4KV equipment simultaneously.
An evaluation
of actions that can be taken to ensure the availability
of 125Vdc power is in progress.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 4 of 17)2.NRC URI 98-011-01 b: NRC Inspection
Report 98-011 requested a response concerning
the effect of fire damage to non-safe, shutdown equipment on the ability to achieve and maintain safe shutdown conditions.
Section E1.3 of the inspection
report discusses how a loss of the 125 Vdc created a potential for secondary fires due to overloaded
and faulted conditions
on the EDGs.This in turn would create hazardous conditions
for operators implementing
the alternate shutdown capability
as well as for the fire brigade members attempting
to extinguish
the fire.ComEd Rcs onse to URI 98-011-01 b: The Inspection
Report states that the evaluation
performed to address the inspectors
concern of a faulted EDG"...did not address: (a)the impact that faulted cables in unknown locations of TB-II might have on the fire brigade's'ability
to extinguish
the fire;(b)the potential for secondary fires to occur in areas other than the bus duct, switchgear
and cable and the impact this additional
fire may have on the safe shutdown capability;
, (c)the effect that a corresponding
degraded bus voltage condition (i.e., reduced voltage resulting from the faulted condition)
would have on the operability
of shutdown loads that might have been automatically
loaded onto the faulted bus;or (d)the length of time before shutdown procedures
directed operators to trip the EDG output breaker." Regulatory
Requirenients
Appendix R,Section III.L.3 states"The shutdown capability
for specific fire areas may be unique for each such area, or it may be one unique combination
of systems for all such areas.In either case, the alternative
shutdown capability
shall be independent
of the specific fire area(s)and shall accommodate
postfire conditions
where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.Procedures
shall be in effect to implement this capability." Compliance
Assessment
The Safe Shutdown Report (SSR), Section 5.1.1 indicates that a fire in Fire Areas TB-I, TB-II and TB-III could result in the upstream switchyard
breakers clearing faults on safe.shutdown buses, which could result in the loss of offsite power (LOOP).This could lead to the automatic.
start of the emergency diesel generators (EDG)and, assuming the EDGs are connected'to
the bus prior to the loss of 125 Vdc control power, the EDGs would be operating connected to the bus without protective
relays.Therefore, the faults would only be limited by the capability
of the EDGs to supply the fault current until the generator winding fails or the diesel engine stalls (i.e.the engine can no longer turn the
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 9S-011 SVP-9S-273 (Page 5 of 17)generator).
The EDGs are not credited for use in safe shutdown.The Station Blackout Diesel Generators (SBO DG)are credited for use in safe shutdown.The specific Inspection
Report Issues (a)-(d), on the previous page, are not considered
to be of concern for the following reasons and are addressed as follows: (a)Nozzles on fire hoses used in areas which have electrical
equipment are required to be rated for use on energized electrical
equipment with a voltage rating appropriate
for the hazard in the area.The fire brigade is trained for fighting fires involving energized electrical
equipment as well as other expected hazards.(b)Secondary fires would not occur due to the low magnitude of the fault current and expected duration of the fault.The theoretical
maximum fault current from the EDGs is approximately
1700 amperes.Further, the EDG would not be expected to run for an extended time because the generator winding will fail or the diesel engine will stall due to the fault, as explained below.Therefore, secondary fires would not occur and would not have an impact on safe shutdown capability.
'(c).On an automatic start of the EDG without a LOCA signal present, only the associated
480 Volt Unit Substation
transformer
would be energized;
all 4 kV loads are automatically
tripped.Degraded voltage can only be a concern for safe shutdown loads if a specific sequence of events occur;For example, in Fire Area TB-II (per Figure TB-II-AC, Rev.2 of the SSR), Buses 14 and 14-1 could lose control power and are relied upon for safe shutdown.The RHR service water pumps, which are fed from Bus 14, are independent
of Fire Area TB-II and would not spuriously
start.Therefore, these pumps will be free of fire damage and available when Bus 14 is realigned for safe shutdown.Bus 14-1 feeds the RHR pumps credited for a fire in this area.The following sequence of events must occur for damage of the motors, due to degraded voltage, to be a concern: 1.The loss of offsite power (LOOP)must occur prior to the loss of 125 Vdc control power, which will result in the automatic start and connection
of the EDG to the bus.2.The breaker for the unit tie to Bus 24-1 or the feed to Bus 31 must spuriously
close.3.One of the RHR pumps must spuriously
start.4.125 Vdc control power must be lost and then a fault must occur on the feed to either the unit tie or Bus 31, whichever is connected to the bus.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-9S-273 (Page 6 of 17)This sequence of events is highly unlikely to occur;however, as described below, the EDG will not be able to sustain voltage under a faulted condition.
Therefore, the safe shutdown loads will not be damage by degraded voltage.(d)EDG runtime would be of a very short duration.The loss of 125 Vdc is due to the power feed cables from the battery bus to the downstream
buses being damaged;both the 4 kV switchgear
and the EDG would lose control power.The EDG automatic controls would be lost, preventing
the governor from increasing
output.With a fault on the generator output, the generator winding would fail open in a few seconds or the diesel engine would be expected to stall.Commercial
industry events[per discussion
with our EDG vendor]have shown that the generator winding usually fails open in a few seconds.Therefore, the EDG would not be expected to run until shutdown procedures
directed operators to trip the EDG output breaker.Related Enhancements
The concern with damage to safe shutdown equipment and secondary fires due to the automatic start and loading of the EDGs is related to the loss 125 Vdc control power.As stated in our May 22, 199S, letter (Reference
2), a study of possible enhancements
to the 125 Vdc system has been undertaken.
The objectives
of this study are to determine improvements
which will prevent simultaneous
loss of control power to both ECCS division switchgear
given a fire in any area;preventing
loss of control power to the remaining (unaffected)
division Emergency Diesel Generator;
and preventing
loss of 125 Vdc control power from fires in opposite unit fire areas.The implementation
of the study has the potential to reduce local manual actions during postulated
fire events and reduce the time required to achieve safe shutdown.The extent of implementation
will depend on the CDF reduction.
As stated in our May 22, 199S, letter (Reference
2), compensatory
measures have also been implemented
on an interim basis.Conclusion
Compensatory
measures are currently in place that eliminate or minimize the possibility
of a fire that could adversely affect 125Vdc and 4KV equipment simultaneously.
An evaluation
of actions that can be taken to ensure the availability
of 125Vdc power is in progress.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 9S-011 SVP-98-273 (Page 7 of 17)3.NRC URI 9S-011-01 c: The NRC Inspection
Report requested a response to the acceptability
of crediting automatic closure of the Main Steam Line Isolation Valves (MSIVs).The Inspection
Report provided that Generic Letter 86-10,"Implementation
of Fire Protection
Requirements," Question 5.3.10, provided the NRC's guidance regarding plant transients
that should be considered
in the design of an alternate shutdown system.This guidance specified that the shutdown capability
should not be adversely affected by a fire which results in the loss, of all automatic function (signals, logic)from the circuits located in the area in conjunction
with one worst case spurious actuation or signal resulting from the fire.Furthermore, the Inspection
Report provided that at Quad Cities, credit for automatic actions were taken in the part of time line analysis for the thermal hydraulic response of the plant.ComEd Res onse to URI 9S-011-01 c: Regulatory
Requirements
10CFR50 Appendix R, Section III.L.7 requires that,"The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated
non-safety
circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated
circuits will not prevent operation of the safe shutdown equipment;
The separation
and barriers between trays and conduits containing
associated
circuits of one safe shutdown division and trays and conduits containing
associated
circuits or safe shutdown cables from the redundant division, or the isolation of these associated
circuits from the safe shutdown equipment, shall be such that a postulated
fire involving associated
circuits will not prevent safe shutdown." Conrpliance
Assessment
The safe shutdown analysis credits the closure of the MSIVs to terminate vessel inventory loss.For all fire areas, except the control room (SB-1), this is achieved by giving the MSIVs a closed signal from the control room prior to evacuation.
A circuit analysis was performed for the MSIVs, to determine if any circuit failure, (i.e., shorts, grounds, opens, and hot shorts)could cause the MSIVs to open or prevent them from closing.Since the control switches were assumed to have been closed from the control room, no review was performed on the circuitry upstream of the control switch contacts.The circuit analysis determined
that no single spurious operation caused by fire induced circuit failures could prevent both the inboard and outboard MSIVs on a given steamline from closing.In addition, the circuit analysis identified
no single fire induced failure that
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 9S-011 SVP-9S-273 (Page 8 of 17)could reopen both the inboard and outboard MSIVs on a given steamline once they were closed.For the case where the fire is in SB-1 (control room, cable spreading room&, auxiliary electrical
equipment room), use of the control switches was not credited.This is conservative
since with the exception of a fire in control room panels 901(2)-3, 55, or 56, the control switches for the MSIVs will be accessible
prior to evacuation.
The QCARPs direct the operator to close the MSIVs from the control room switches if possible prior to evacuation.
Actions are also taken to close the MSIVs from outside the control room by deenergizing
both the AC and DC solenoids on both inboard and outboard valves.These actions are taken within 10 minutes of the start of the transient and assure that the valves are closed.The Safe Shutdown Report (SSR), Section 5.2.1.5.1, provides a discussion
of the effect of having the MSIVs open for the initial ten minutes of the event and comparing it to the effect on inventory loss of a single fire induced spuriously
open relief valve.In the case where the turbine bypass valves fail in the open position, the inventory loss would exceed the amount through a single open relief valve.Closure of the MSIVs from the Group 1 Primary Containment
Isolation (PCI)logic (low main steamline pressure with the mode switch in RUN)is credited for terminating
the reactor inventory loss.Analysis by GE determined
that the MSIVs would close within 16 seconds.The amount of inventory loss in 16 seconds through the main steamlines
would be less than the loss through one relief valve open for ten minutes.The original circuit analysis for the MSIVs was limited due to the assumption
that the control switches would be placed in the closed position.Further review of the MSIV control circuitry has been performed to determine if there were any other fire induced circuit failures that could have caused the MSIVs or the PCI, Group 1 logic maloperation
to prevent closure of the MSIVs.The standard circuit failures (i.e., shorts, grounds, opens, and hot shorts)were postulated
and reviewed for their effects on the MSIVs.This review included cables from the pressure sensors for the main steamlines
through the PCI Group 1 logic to the MSIVs control circuits.The results of the review indicate that no single fire induced failure can occur that will cause both MSIVs in a given line to fail open.Fire induced failures in at least two of the four instrument
channels are needed to prevent the main steamline low pressure isolation from being sensed by the PCI Group 1 logic system.The failures would have to be in two separate cables and would have to be a specific set of cables to prevent the MSIVs from closing.ThesamereasoningappliestothePCIGroupl
logic.Twospecificcables
must fail to prevent the isolation signal from being sent to the MSIVs and closing all the MSIVs.The PCI Group 1 logic is normally energized and will close the MSIVs when
4
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Rcport 9S-011 SVP-9S-273 (Page 9 of 17)deenergized, therefore, there are no adverse consequences
due to circuit failures which open the circuit.No single fire induced cable failure in the PCI Group I logic will cause both the inboard and outboard MSIVs to reopen once they are closed.Hot shorts on the cable between the PCI Group 1 trip relays and the actual MSIV solenoids could cause four MSIVs to be held open by energizing
either the AC or DC solenoids.
However, the MSIV logic is divided such that the inboard and outboard~MSIVs do not share any cables.Therefore one cable failure would not affect both the inboard and outboard MSIVs.This assures at least one MSIV on each steamline will be closed.Conclnsion
Based on the above analysis of fire induced circuit failures, no one fire induced spurious operation could prevent both inboard and outboard MSIVs from closing.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 10 of 17)4.NRC URI 98-011-01 d: The NRC inspection
team concluded that the Quad Cities associated
circuits analysis did not meet the requirements
of 10CFR 50, Appendix R, Sections III.G and III.L.The primary concern was the assumption
that only a single spurious operation would occur as a result of a fire in any given fire area.The team also expressed concern over the potential for multiple fire-induced
ADS actuations
given that multiple ADS circuit cables are routed through the same fire zones.Related to this issue, the NRC requested an evaluation
of the impact of multiple ADS actuations
on the safe shutdown time line (the minimum time required to establish injection).
The NRC also expressed concern with the design changes recently implemented
to protect the RHR and RCIC pumps during a fire.These design changes provide adequate pump protection
for a postulated
single spurious operation, but may not provide protection
during multiple simultaneous
spurious operations
leading to both a pump start and concurrent
minimum-flow
valve closure (resulting
in deadheading
the pump).ComEd Rcs onse to NRC VRI 98-011-01 d: Regulatory
Reqairements
For Quad Cities Station, Appendix R to 10 CFR 50 provides the requirements
for ensuring adequate post fire safe shutdown capability.
Regarding associated
circuits, Appendix R,Section III.L.7 states: "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated
non-safety
circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated
circuits will not prevent operation of the safe shutdown equipment..." For safe shutdown actions taken outside the main control room (e.g.control room fire), Generic Letter 86-10, Section 3.8.4 states: "The analysis should demonstrate
that capability
exists to manually achieve safe shutdown conditions
from outside the control room by restoring a.c.power to designated
pumps, assuring that valve lineups are correct, and assuming that any malfunctions
of valves that permit the loss of reactor coolant can be corrected before unrestorable
conditions
occur."
0
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011.SVP-98-273 (Page 11 of,17)In addition, Generic Letter 86-10, Section 5.3.10, provides the performance
requirements
for designing alternate safe shutdown: "Per the criteria of Section III.L of Appendix R a loss of offsite power shall be assumed for a fire in any fire area concurrent
with the following assumptions:
a)The safe shutdown capability
should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area;and b)The safe shutdown capability
should not be adversely affected by a fire in any plant area which results in the loss of all automatic function (signals, logic)from the circuits located in the area in conjunction
with one worst case spurious actuation or signal resulting from the fire;and c)The safe shutdown capability
should not be adversely affected by a fire.in any plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line." Compliance
Assessment
The Safe Shutdown Report (SSR)for Quad Cities describes the methodology
used to ensure that that fire induced failures of equipment and cables will not adversely impact the post fire safe shutdown capability.
The associated
circuit analysis was not limited to a single spurious operation for each fire area.Any system or component that either interfaces
with the primary system or a safe shutdown system was evaluated.
Fire induced spurious operations
such as an uncontrolled
pump/turbine
starting, and valve or breaker repositioning
which could occur as a result of short circuits, open circuits, or hot shorts in control or power cables were identified
and evaluated.
The focus of the analysis was to ensure:~RCS inventory was maintained;
~RCS makeup capability
was provided;~Fire induced spurious operation of valves would not prevent system performance, cause system damage or divert essential flow;~Fire induced spurious operation of pumps/turbine
would not damage essential equipment;
and,~Fire induced spurious operation of electrical
components
would not result in a loss of power to essential equipment.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 12 of 17)For the special case of valves that form the interface between the primary coolant boundary and low-pressure
piping ("high/low
interface")
the evaluation
included the potential for sequential
failure of redundant valves.The high/low pressure interface valves are addressed in the SSR.The results of the associated
circuit analysis were used in the development
of the implementing.
Safe Shutdown Procedures.
As appropriate, specific actions to address each fire induced spurious operation have been incorporated
into the safe shutdown procedures.
These actions include the alignment of power to designated
pumps, assuring that valve lineups are correct, and assuming that any malfunctions
of valves are corrected before unrestorable
conditions
occur.The transient analysis which determined
the timeline and overall effectiveness
of the Safe Shutdown Analysis and implementing
procedures
considered
a single fire induced spurious operations
or signal.An adequate level of safety is provided by implementing
procedural
requirements
to address the potential for fire-induced
spurious operations, and by demonstrating
that the performance
requirements
for alternate safe shutdown are maintained
during a bounding fire induced single spurious operation.
It is our understanding
this approach demonstrates
compliance
with the requirements
of Appendix R in ensuring associated
circuits will not prevent operation of safe shutdown equipment.
ComEd is sensitive to the issues raised by the NRC during the NRC inspection
regarding multiple fire induced spurious operations
that could impact safe shutdown activities, such as the start of an injection pump and subsequent
closure of its corresponding
minimum flow valve leading to pump damage.Because of the NRC concerns, ComEd completed a multiple spurious operations
study on July 31, 1998.The results of this study are currently being evaluated.
As stated in our May 22, 1998 letter, interim compensatory
measures have been initiated to address this issue.
e
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 13 of 17)Multiple ADS Valve Actuntioas
The fire protection
design basis at Quad Cities and Dresden stations was challenged
by the NRC during a 1988 Appendix R audit at Dresden Station.During that audit, a specific concern was raised regarding the routing of several ADS conductors
in the same cable.The NRC indicated that when evaluating
spurious operations
of the Automatic Depressurization
System, multiple shorts do not need to be considered, but multiple shorts within any given cable should be considered'.
Based on this guidance, ComEd proposed design changes to separate individual
cables to preclude multiple spurious operations
of the ADS valves at Quad Cities and Dresden Stations.These modifications
have been completed at Quad Cities Station.In a July 6, 1989, NRC Safety Evaluation
Report for Dresden, the NRC reviewed the modifications
and found them to be acceptable
to address the issue.The current SSR at Quad Cities considers a single ADS valve actuation in evaluating
the timeline requirements
for establishing
injection.
The safe shutdown procedures
also require a 10-minute action to de-energize
the ADS system.This action effectively
closes the single ADS valves assumed to be open, and prevents further spurious ADS actuations
from occurring.
Considering
only a single ADS actuation during the initial 10-minute period provides an adequate level of safety in view of the low chance of multiple actuations
occurring during the initial 10-minute period.ComEd has performed a preliminary
assessment
of the impact of multiple spurious ADS valve actuations.
The evaluation
determined
that a total of two ADS valves has a relatively
minor impact on the time requirements
for establishing
RPV injection and does not pose a significant
safety issue.Considering
more than two ADS valve actuations
has a greater impact on the time requirements
for injection.
However, ComEd does not consider this a significant
safety issue because: 1)positive actions are taken within 10 minutes to de-energize
the.ADS valves, and 2)the low chance of occurrence
of multiple (more than two)ADS valve actuations
to occur within the first 10 minutes.'omEd letter to USNRC dated September l6, l988
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Rcport 98-011 SVP-98-273 (Page 14 of 17)Relaleil Enlrancemenls
Due to the NRC concerns in this area, ComEd completed a study of fire induced multiple spurious operations.
This study identified
combinations
of spurious operations (with.particular
focus on redundant valves and pump/valve
combinations)
that could have an adverse impact on post-fire safe shutdown capability.
A total of 78 combinations
of spurious operations
have been identified
that may have an adverse impact on post fire.safe shutdown.A systematic
evaluation
of the results of the study is underway which will identify any necessary safe shutdown program enhancements
including procedure changes, revisions to the Safe Shutdown Report, or plant design changes.Actions to address this issue will enhance compliance
with Appendix R and will be prioritized
based on risk benefit as determined
by our enhanced fire risk model.The multiple spurious operations
study encompassed
the RCIC and RHR pumps, which were identified
by the NRC as not potentially
being protected during fire induced multiple spurious actuations.
As stated in our May 22, 1998 letter (Reference
2), compensatory
measures have also been implemented
on an interim basis.Conclnsion
ComEd completed a study of fire induced multiple spurious operations.
A systematic
evaluation
of the results of the study is underway which will identify any necessary safe shutdown program enhancements
including procedure changes, revisions to the Safe Shutdown Report, or plant design changes.Actions to address this issue will enhance compliance
with Appendix R and will be prioritized
based on risk benefit as determined
by our enhanced fire risk model.'As stated in our May 22, 1998 letter, ComEd is committed to evaluate improvements
to strengthen
the overall fire protection
and safe shutdown capabilities
at Quad Cities Nuclear Power Station.ComEd is also working closely with the BWR Owners Group (BWROG)Appendix R-Fire Protection
committee.
The BWROG is in the process of developing
generic guidance on the implementation
of Appendix R requirements.
ATTACHMENT
A'esponse to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 15 of 17)5.NRC URI 9S-011-01 e: The NRC inspection
team indicated that fire area TB-II did not appear to have adequate fire detection and suppression
equipment to ensure compliance
with Appendix R,Section III.G.3.The inspection
report noted that failure to properly identify the correct'location
of a fire involving oil filled transformers
could cause the Operators to unnecessarily
enter safe shutdown procedures
and evacuate the control room, causing an additional
hazard to the unit, and could delay proper fire brigade response.ComEd Res onse to URI 9S-011-01 e: Regnlatory
Requirements
The NRC inspection
team reviewed whether the fire detection and suppression
in fire area TB-II complied with the requirements
of Appendix R,Section III.G.3.Section III.G.3 pertains to the use of an alternate shutdown strategy and requires that: "Fire detection and a fixed fire suppression
system be installed in the area, room, or zone under consideration." Additionally, Generic Letter'86-10
provides further guidance on the issue of area detection and suppression.
Enclosure 1 to GL 86-10, Section 5, states: "Suppression
and detection sufficient
to protect against hazards of the area must be installed.
In this regard, detection and suppression
providing less than full area coverage may be adequate to comply with the regulation.
Where full area suppression
and detection is not installed, licensees must perform an evaluation
to assess the adequacy of partial suppression
and detection to protect against the hazards in the area." Compliance
Assessment
The area of concern identified
by the inspection
team is in the Turbine building central group within fire zone 8.2.7.C.on the mezzanine level.As this zone does not have full area detection and suppression, a fire protection
engineering
evaluation
was prepared to demonstrate
that sufficient
fire detection/suppression
is installed to protect against the hazards of the area.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 98-011 SVP-98-273 (Page 16 of 17)The inspection
team did not concur with this evaluation
noting'the
following issues: 1.The unprotected
section of this fire area contains two transformers
with approximately
380 gallons of oil each.2.A transformer
oil fire would be unmitigated
by an automatic suppression
system and give off a large quantity of smoke.3.The smoke could be very heavy and obscure the location of the fire.4.Failure to identify the correct location of the fire could cause operators to, unnecessarily
enter the safe shutdown procedures
and evacuate the control room.5.Fire brigade response could also be delayed if the correct location is not identified.
The inspection
team did conclude, however, that the revised SSR did not affect the technical basis for the exemptions
previously
granted in this fire area for complying with Appendix R,Section III.G.2.(separation
of redundant systems).The technical basis for not providing full area fire detection or suppression
in TB-II, fire zone 8.2.7.C.is based on the following fire hazard analysis features:~(Issues 1 and 2)The dielectric
in the subject transformers (transformers
for busses 17 and 27)is Pyranol, an askarel fluid, and not a combustible
mineral oil.Askarel has no fire point (the lowest temperature
a liquid will burn continuously
when ignited by flame).It is a nonflammable
fluid and indicative
of a non-fire hazard.Therefore, fire detection and a fixed suppression
system are not warranted for this nonflammable
liquid filled transformer.
~(Issues 3 and 5)In the event of a catastrophic
transformer
failure or rupture, the generation
of a large quantity of smoke is prohibited
due to the nonflammable
characteristics
of the askarel.Although a high-energy
arc or fault could result in a flash of this dielectric
fluid, automatic disconnects
are provided to de-energize
the equipment.
The elimination
of the ignition source, via phase overcurrent
and residual ground fault protection
on the high side of the transformer, further ensures that the askarel fluid will not support continued combustion
or result in a smoke-laden
environment.
Therefore, smoke obscuration
is prevented thereby allowing the Operators, including the fire brigade, to accurately
identify the fire location and to take appropriate
actions to mitigate the consequences
of a fire.
ATTACHMENT
A Response to URI Regarding Appendix R Inspection
Report 9S-011 , SVP-98-273 (Page 17 of 17)~(Issue 4)The notification
of a transformer
failure incident is provided by multiple alarms that annunciate
in the main control room.The alarms include bus trips, breaker feed trips, loss of control power, and the individual
trips for the equipment fed from these transformers.
Therefore, multiple simultaneous
alarms will annunciate
in the control room signifying
a failure in the immediate area of the transformers.
These alarm notifications
will promptly and accurately
identify the location in the event of a transformer
failure.An operator or the fire brigade can also be summoned to the specific location to assess potential fire damage.Since this is not a severe uncontrolled
fire, normal and emergency operating procedures
are sufficient
to handle this scenario, and since the transformers
for busses 17 and 27 do not supply safe shutdown equipment, prematurely
entering the safe shutdown procedures
or evacuating
the control room will not occur.Fire protection
features are provided for the hazards in the area.These features include: Ceiling level automatic sprinklers
in the center aisle area above the turbine lube oil tanks and the MG set coolers.Fixed automatic water spray systems for the turbine oil reservoirs.
Automatic sprinklers
at floor level above the resin containers.
Automatic fire detection in the center aisle area above the oil hazards.Curbing around the transformers
to contain a fluid spill.In addition, floor drains are provided immediately
outside the curbs and throughout
the area to handle any fluid runoff.Fire hose stations and portable fire fighting equipment throughout
the area.Steel beam fireproofing
above the switchgear
on Unit 1 and MCC on Unit 2.Limited fixed combustibles, a cable tray above the transformer/switchgear, and no permanent combustible
storage area within 30 feet of the transformers.
COll Cllls(Oil Prompt notification
via control room annunciation
alarms will alert the Operators to the fire location and the equipment affected.Fire and smoke development
are significantly
reduced by the use of nonflammable
dielectric
fluid in the transformers.
Adequate fire protection
equipment and measures are provided to ensure compliance
with the regulation.
0,