ML032680741

Document Regarding Braidwood Fire Protection Inspection Issues

ML032680741
Person / Time
Site:	Braidwood
Issue date:	09/05/2003
From:	NRC Region 4
To:
References
FOIA/PA-2003-0358
Download: ML032680741 (10)

Text

1. Fire Zone 5.5-1, Auxiliary Electric Equipment Room (AEER) 1.1 Alternative Shutdown Capability not Independent of the Fire Area Braidwood Facility Operating Ucenses, NPF-72 and NPF-77, Section 2.E required that the licensee shall implement and maintain in effect all provision of the approved fire protection program as described in the Final Safety Analysis Report, as supplemented and amended, and as approved in the SER dated November 1993 and its supplements, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

Braidwood Updated Final Safety Analysis Report (UFSARl Section 9.5.1, uFire Protection Systems," stated that the design bases, system descriptions, safety evaluation, inspection and testing requirements, personnel qualification, and training are described in Commonwealth Edison Company, uByron/Braidwood Stations Fire Protection Report in Response to Appendix A of BTP APCSB 9.5-1," current amendment 18 (known as Fire Protection Report from here on).

Section 3, "Guidelines of BTP 9.5-1," in the Fire Protection Report contained the licensee's implementation of or justification for noncompliance for the guideline of BTP CMEB 9.5-1 which was a part of NUREG 0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants."

The licensee stated that it complied with Sections-C.5.c.(1), "Alternative or Dedicated Shutdown Capability," of the BTP CMEB 9.5-1 which required, in part, during the post-fire shutdown, the fission product boundary integrity shall not be affected, i.e., there shall be no rupture of the primary coolant boundary.

The licensee stated that it complied with Section C.5.c (2) of the BTP CMEB 9.5-1 which discussed the performance goals for shutdown functions such as reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and supporting.

The licensee further stated that it complied with Section C.5.c.(3) of the BTP CMEB 9.5-1. It required that the alternative shutdown capability shall be independent of the specific fire area(s).

The licensee designated Fire Zone 5.5-1 (AEER) as an aftemative shutdown area since it did not meet the separation or protection requirements in Section C.5.b.(2) of the BTP CMEB 9.5-1 (analogous to Appendix R III.G.2). During the inspection, the team noted that the control cables for the VCT outlet valves (CV 11 2B and CV 112C) and RWST suction valves (CV 11 2D and CV 11 2E) to the charging pumps were routed through the fire zone. The VCT outlet valves were in series and maintained open during normal power operations. Fire damage to the VCT outlet valves could result in maloperation, i.e. closure, of either valve and a loss of suction source to the charging pumps. The RWST suction valves were In parallel and maintained closed during normal power operations. The licensee had Identified that these two valves were susceptible to mechanical damage as described in Information Notice (IN) 92-18. Fire damage to these cables could result in maloperation, i.e., closure of the valves and damages to the

valves such that they could not be manually aligned to supply suction source to the charging pumps.

The alternative shutdown capability as designed for Fire Zone 5.5-1 was not independent of the fire area because it relied upon equipments such as the VCT outlet valves and RWST suction valves whose control cables were located In the fire zone of concern. Failure to provide alternative shutdown capability which was independent of Fire Zone 5.5-1 as required by BTP CMEB Section C.5.c.(3) is a violation of Braidwood Facility Operating Licenses.

1.2 Alternative Shutdown Capability Did Not Ensure Integrity of Primary Coolant Boundary At Braidwood, reactivity control was partially accomplished by using one of two centrifugal charging pumps to inject borated water into the reactor coolant system via the CVCS makeup flow path. The source of borated water is initially taken from the VCT, then manually switched to the RWST. With normal letdown Isolated, required makeup has to be minimized to prevent the pressurizer from going solid, Therefore, the only need for makeup is RCS boration and RCP seal cooling.

RCP seals cooling could be provided by either CCW to the thermal barrier or charging flow.

During the inspection, the team also noted that the control cables for CCW supply containment isolation valve 1CC9413A and 1CC 9413B were routed though the AEER. These valve were in series and maintained open during normal operation. Fire damage to either cables could result in maloperation (closing) of the valve and isolation of CCW to the RCP seals. With loss of charging flow to the RCP seals (due to loss of suction source as mentioned above) and loss of CCW flow to the thermal barriers, there would be no RCP seal cooling. The licensee stated that upon the complete loss of RCP seal cooling, RCP seal integrity could be assured if the RCPs were tripped prior to the seals reaching a temperature limit of 235 0F. However, there was no instrumentation available to the operators to determine the seal temperature during a post-fire condition outside of the control room as would be required If a fire occurred in the AEER. The seal leak-off temperature indication was not credited in the licensee's SSA and not available on either the Remote Shutdown Panel or Fire Hazard Panel. Therefore, the operators may not trip the RCPs prior to the pump seals reaching the temperature limit. The RCP seals may fail resulting In a maximum leakage of 300 gpm. This leakage at RCS pressure

/temperature of 2250 psia/500 'F would correspond to a small LOCA as refemced in UFSAR Section 5.4.1.3.10. Therefore, fire damage to the above cables would result in a rupture of the primary coolant boundary.

The licensee's alternative shutdown capability for Fire Zone 5.5-1 did not assure that during the post-fire conditions, the fission product boundary integrity shall not be affected because a fire in the AEER could result in a complete loss of RCP seal cooling and the operators' inability to ensure seal integrity by tripping the RCPs before the seals reaching 2350F. Failure to ensure that the current alternative shutdown capability for AEER would not render rupture of the primary coolant boundary through the failure of RCP seals, as required by BTP CMEB 9.5.1 Section C.5.c.(1) is a violation of Bradiwood Facility Operating Licenses.

1.3 The Effects of Associated Circuits Not Isolated from Alternative Shutdown Capability

In Fire Protection Report, the licensee stated that it complied with the requirement of BTP CMEB 9.5-1, Section C.5.c.(7). It required that the safe shutdown equipment and system for each fire area should be known to be isolated from associated circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. In addition, the isolation of these associated circuits from the safe shutdown equipment should be such that a postulated fire involving associated circuits will not prevent safe shutdown. The licensee further stated In Section 2.4.1.5.5 of the Fire Protection Report that the concern of spurious actuation by an associated circuit, whose fire-induced failure could affect shutdown, does not exist in the current Braidwood Design.

The team noted that fire damage to the Solid State Protection System (SSPS) could result in a containment phase B isolation signal which would isolate the CCW flow to the RCP thermal barriers. Although the SSPS required 2 out of 4 containment pressure input signals to be present to satisfy the containment isolation logic, it appeared that one fire-induced ground fault in the master/slave relay logic on the output of the SSPS may be sufficient to initiate the automatic actuation signals from the SSPS.

A short to ground in the output of the SSPS could result in the initiation containment phase B isolation signal. This actuation and the loss of suction sources to the charging pump will result in RCP seal failures and a small LOCA as discussed above. The fire-induced actuation of the SSPS in this case would prevent the licensee from achieving and maintaining safe shutdown conditions for a postulated fire In the AEER. Failure to Isolate the associated circuit, I.e. SSPS from the safe shutdown equipment, Is considered a violation of Braidwood Facility Operating Licenses.

2. Auxiliary Building 401' Elevation, Fire Zone 11.5-0 2.1 Alternative Shutdown Capability Not Independent of the Fire Area Fire Zone 11.5-0 was originally designated as an area meeting the requirement of BTP CMEB 9.5-1, Section C.5.b(2) such that one of redundant trains is free of fire damage by separation of cables and equipment and associated circuits of redundant trains by a fire barrier having a 3-hour rating. However, the licensee later Identified that the control room ventilation system cables were routed through the area and did not meet the above separation requirement. The licensee then designated this fire zone as an alternative shutdown area. The licensee determined that the operators could stay in the control room until the temperature exceeded the equipment limits.

During the inspection, the team noted that the power cable for IA charging pump, control cables for the VCT outlet valves (CV 11 2B and 112C) and RWST suction valves (CV 11 2D and CV 112E) to the charging pump were routed through the areas. The VCT outlet valves were in series and maintained open during normal power operations. Fire damage to the VCT outlet valves could result in maloperation, i.e, closure, of either valve and a loss of suction source to the remaining 1B charging pump resulting In pump cavitation. The RWST suction valves were in parallel and maintained closed during normal power operations. The licensee had identified that these two valves were susceptible to mechanical damage as described in IN 92-18. Fire damage to these cables could result in maloperation, i.e., closure of the valves and casue mechanical damages to the valves such that they could not be manually aligned to supply suction source to the remaining 1B charging pump.

The alternative shutdown capability as designed for Fire Zone 11.5-0 was not independent of the fire area because it relied upon equipments such as the VCT outlet valves and RWST suction valves whose control cables were located in the fire zone of concern. Failure to provide alternative shutdown capability which was independent of the area for Fire Zone 11.5-0 as required by BTP CMEB Section C.5.c.(3) is a violation of Braidwood Facility Operating Licenses.

2.2 Alternative Shutdown Capability Failed to Ensure Primary Coolant Boundary Integrity The team also identified that control cables associated with seal Injection flow path valves CV 8355 A, B, C, and D were routed through the Fire Zone 11.5-0. These valves were in parallel and supplies a portion of charging flow to cool each RCP seal. The team also noted that the control cables for the CCW RCP seal cooling isolation valves CC 941 3A and 941 3B were routed through the area. These valves are In series and supplied cooling water to the RCP Seal thermal barriers. Fire damage to these cables could result in maloperation, i.e., closure of these valves and a complete loss of RCP seal cooling.

The licensee stated that upon the complete loss of RCP seal cooling, RCP seal integrity could be assured if the RCPs were tripped prior to the seals reaching a temperature limit of 2350F.

However, there was no instrumentation available to the operators to determine the seal temperature during a post-fire condition outside of the control room as would be required if a fire occurred in the Fire Zone 11.5-0. Seal leakoff temperature indication was not credited In the licensee's SSA and not available on either the Remote Shutdown Panel or Fire Hazard

Panel. Therefore, the RCP seals may fail resulting in a rupture of the primary coolant boundary.

The licensee alternative shutdown capability for Fire Zone 11.5-0 did not assure that during the post-fire condition, the fission product boundary integrity shall not be affected. A fire in the Fire Zone 11.5-0 could result in a complete loss of RCP seal cooling and the operators' inability to ensure seal integrity by tripping the RCPs before the seal reaching 2350F. Failure to ensure that the current alternative shutdown capability for Fire Zone 11.5-0 would not render rupture of the primary coolant boundary through the failure of RCP seal, as required by BTP CMEB 9.5.1 Section C.5.c.(1) is a violation of Braidwood Facility Operating Licenses.

3 Auxiliary Building Elevation 425', Fire Zone 11.6-0 Fire Zone 11.6-0 was originally designated as an area meeting the requirements of BTP CMEB 9.5-1, Section C.5.b(2) such that one of redundant train is free of fire damage by separation of cables and equipment and associated circuits of reduction trains by a fire barrier having a 3-hour rating. However, the licensee later identified that the control room ventilation system cables were routed through the area and did not meet the above separation requirement. The licensee then designated this fire zone as an alternative shutdown area. The licensee determined that the operators could stay in the control room until the temperature exceeded the the equipment limits.

During the inspection, the team noted that the power cable for 1A charging pump, control cables for the VCT outlet valves (CV 112B and CV 112C) and RWST suction valves (CV 112D and CV 11 2E) to the charging pump were routed through the areas. The VCT outlet valves were in series and maintained open during normal power operations. Fire damage to the VCT outlet valves could result in maloperation, i.e. closure, of either valve and loss of suction source to the remaining 1B charging pump. The RWST suction valves were in parallel and maintained closed during normal power operations. The licensee had identified that these two valves were susceptible to mechanical damage as described in IN 92-18. Fire damage to these cables could result In maloperation, i.e., closure of the valves and cause mechanical damages to the valves such that they could not be manually aligned to supply suction source to the remaining 1B charging pump.

The alternative shutdown capability as designed for Fire Zone 11.6-0 was not independent of the fire area because it relied upon equipments such as the VCT outlet valves and RWST suction valves whose control cables were located in the fire zone of concern. Failure to provide alternative shutdown capability which was independent of the area for Fire Zone 11.6-0 as required by BTP CMEB Section C.5.c.(3) is a violation of Braidwood Facility Operating Licenses.

4 Insufficient Number of Operators BTP CMEB 9.5-1, Section c.1.b, "Fire Hazard Analysis," stated, in part, that on multiple-reactor sites, unrelated fires in two or more units need not be postulated to occur simultaneously, fire involving facilities shared between units and fire due to man-made site related events that have a reasonable probability of occurring and affecting more than one reactor unit (such as an aircraft crash) should be considered. The licensee stated in the Fire Protection Report that it complied with this requirement in that a fire involving more than one reactor unit was not postulated except for facilities shared between units.

The licensee stated that they complied with the requirement of BTP CMEB 9.5-1, Section C.5.c.(4). It required that the number of operating shift personnel, exclusive of fire brigade members, required to operate such [safe shutdown related] equipment and systems, shall be onsite at all times.

The team reviewed actual staffing required to achieve shutdown. The minimum shift staffing, exclusive of the fire brigade was 13 in accordance with BwAP 320-1. In accordance with the requirements, the licensee was required to consider a fire involving more than one unit for facilities shared between units, such as the control room. In addition, the licensee was required to consider fire affecting the control room and to shut down both units concurrently. Based on review of the procedure, the team determined that the licensee needed to have operators for both units to perform various duties at the following locations for a control room fire:

• Remote shutdown panels (2)

• Fire Hazard panels to monitor shutdown instruments (2),

• Emergency diesel generators to manually start, load and monitor the EDGs (2),

• Switchgear room to manually start charging pumps and align charging paths (2)

• Auxiliary feed pump rooms to manually align and operate the AFW pumps (2)

• Steam tunnel to manually control steam generator PORVs (2)

• AEER to install SI signal mitigation jumpers (2)

• Manual trip of the main turbine and feed water isolation (2)

• Local breaker operation of safe shutdown equipment (2)

The team determined that a minimum of 18 operators would be required to simultaneously shut down both units. When asked about this, the licensee stated that fire damage was only postulated to occur In one unit, even though the MCR is a common area to both units. This would allow operators on the "undamaged" unit to assist in the shutdown of the "damaged" unit.

The licensee further stated that postulating damage to only one unit is based on the position documented in NRC Inspection Reports for Byron 50-454/84-60 and 50-454/86-39. The team did not agree with the licensee's position concerning the previous inspections, in fact, the team observed that the original Inspections were conducted when only one unit was operating and the other unit in startup with full staffing available to assist the operating unit. The reports appeared to state that the licensee had acceptable staffing for the condition identified during the previous inspection, but that the licensee would have to ensure adequate staffing existed when the second unit was licensed.

Review of safe shutdown procedure BwOA PRI-5 indicated that the licensee did not consider a fire effecting (included smoke, fire damages, etc) shared facilities and did not have adequate staffing to implement a concurrent shutdown if both units sustained fire damage in the MCR.

Failure to consider fire affecting shared facilities such as the control room and failure to provide

sufficient number of operating personnel to shut down both units in the event of a control room fire damaging both units is considered a violation of Braidwood Facility Operating Ucenses.

2. Fire Protection of Safe Shutdown Capability

a. Inspection Scope For each of the selected fire areas, the team reviewed the licensee's safe shutdown analysis to ensure that at least one post-fire safe shutdown success path was available in the event of a fire. This included a review of manual actions required to achieve and maintain hot shutdown conditions and to make the necessary repairs to reach cold shut down within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The team also reviewed procedures to verify that adequate direction was provided to operators to perform these manual actions. Factors, such as timing, access to the equipment, and the availability of procedures, were considered in the review.

The team also evaluated the adequacy of fire suppression and detection systems, fire area barriers, penetration seals, and fire doors to ensure that at least one train of safe shutdown equipment was free of fire damage. To do this, the team observed the material condition and configuration of the installed fire detection and suppression systems, fire barriers, and construction details and supporting fire tests for the installed fire barriers. In addition, the inspectors reviewed the license documentation, such as deviations, detector placement drawings, fire hose stations drawings, carbon dioxide pre-operational test reports, smoke removal plans, fire hazard analysis reports, safe shutdown analysis, and National Fire Protection Association codes to verify that the fire barrier installations met license commitments.

b. Issues and Findings (George, include Phil Quall's input on the staffing and lack of area-wide suppression for zones 11.5-0 and 11.6-0)

10. Fire Protection Systems, Features, and Equipment.

a. Insnection Scope The team reviewed material condition, operations lineup, operational effectiveness and design of fire detection systems, fire suppression systems, manual fire fighting equipment, fire brigade capability, and passive fire protection features. The team reviewed deviations, detector placement drawings, fire hose stations drawings, carbon dioxide pre-operational test reports, and fire hazard analysis reports to ensure that selected fire detection systems, carbon dioxide system, portable fire extinguishers, and hose stations are installed in accordance with their design, and that their design is adequate given the current equipment layout and plant configuration.

b. Issues and Findings The team did not Identify any findings.

11. Adequacy of Compensatory Measures

a. Inspection Scope

The team reviewed administrative procedures to verify that adequate compensatory measures are put in place by the licensee for out-of-service, degraded of inoperable fire protection and post-fire safe shutdown equipment, systems, or features. The team also verified that short term compensatory measures were adequate to compensate for the degraded function or feature until appropriate corrective action can be taken.

b. Issues and Findings The team did not identify any findings.