ML20155C071

Rev 4 to Branch Technical Position Cmeb 9.5-1, Control Room Fire Alternate Shutdown Evaluation (Spurious Actuation Study)

ML20155C071
Person / Time
Site:	Vogtle
Issue date:	06/01/1988
From:	GEORGIA POWER CO.
To:
Shared Package
ML20155C011	List: ML20155C007 ML20155C035 ML20155C047 ML20155C071 ML20155C075 ML20155C083 ML20155C087
References
NUDOCS 8810070227
Download: ML20155C071 (27)

Text

. - . -

Attachment 3 i I

B'IP OEB 9.5-1 FTRE EVENT SAFE SHUrDOWN EVALUATION  ;

P t

t I

i 1

c i

,1 COffrROL WM FIRE '

a ALTERNA'IT SN EVALUATION i I

(SPURICUS AC'IUATION STJDY) 1 l REVISION 4 i

l i

J I

i

FOR 'IHE V0GTLE ELECTRIC GENDtATING PLANT i

UNITS 1 & 2 i

, JUNE 1, 1988 1

1 1

i D7 000939 i

^

k hk0hCM050004 ,

FN 4

1 1

,,_m..-.._,_,_,,.__ - , , _ . , , _ , . - , _ . ,_.r,,,_,___.. .. _ , . , , - . , . - - - , .

Table of Contents l

Section Title Page 1.0 Introduction 1 i 1.1 Scope 1 1.2 Objective 1 2.0 Sumary 1 r 3.0 Conclusions and Recca'endations 1 3.1 General Operational Considerations 3 r

3.2 Reactor Coolant Systen 3

] ,

3.3 Chanical and Volume Control System 5 j 3.4 Main Steam System 8 3.5 Auxiliary Feedwater Systen 10 3.6 Residual Heat Removal System 11 3.7 Nuclear Service Cooling Mater System 13 3.8 Diesel Generator Fuel Oil Transfer System 14 3.9 Essential Chilled Water System 15 3.10 Engineerwi Safety Features Room Coolers 15 3.11 Electrical Distribution System 16 3.12 Ccotainment Spray System 17 4.0 Control Roca Fire Spurious Actuation 17  !

Evaluation Ground Rules l 4.1 NRC Guidelines 17 ,

4.2 Assumptions and Bases 18 4 5.0 Control Roca Fire Alternate Shutdown 24 E'raluation Logic l

a 1.0 INIRODUCTION 1.1 SCOPE The scope of this effort is to evaluate the impact of fire induced hot shorts, shorts to ground and opens in the control room electrical circuitry on the ability to safely shut down the plant from outside the control room both with and without offsite power.

1.2 OBJECTIVE The objective of this evaluation is to define any necessary special operating procedural requirements and/or design changes required to ensure safe shutdown capability within specific operational time constraints in the event of a control rom fire.

2.0 SUt+WE Ffre induced hot shorts, shorts to ground, and opens in the control room electrical circuitry may result in the spurious actuation or inaction of components which could impact the capability to achieve safe (cold) shutdom.

To assess the extent of the scenario, each of the fire event safe shutdown systems (Table 2-1) has been evaluated on a ccaponent-by-ccaponent basis (see Section 5). The O.m p 4,atory measures required to preclude undesirable occurrences are presented in Section 3.

3.0 CONCI,USI.ONS AND RECCitf>GMTIONS Section 3.1 details the general operational considerations which must be obcerved in the event of a control recm fire. The remaining sections will present the results of the review of the specific systems, including:

o Evaluation Findings The potential undesirable spurious control actions / inactions of the as-built systems are sunnarized, o Key Manitorable Parameters (functional) l Those available parameters which enable the operator to identify the spurious %c-nt action / inactions are listed. These parameters are electrically and physically independent of the control reca fire.

l l

I

. l TABLE 2-2

_ FIRE EVENT SAFE SHyrDOWN SY_STDg o Reactor Coolant o Chenical and Volume Control o Safety Injection

, o Residual Heat Removal o Containment Spray o NucJear Service Cooling Water Component Cooling Water o

o Nuclear Sampling-Liquid o Main Steam ,

o Auxiliary Feedwater o Main Feechater o Diesel Generator Fuel Oil, and Air Start o Control Building - Control Roca HVAC >

o Control Building safety Features Electrical Equipnent Roca HVAC o Control Building Cable SpreadirrJ Rocm HVAC o Diesel Generator Building HVAC o Essential Chilled Hater o Aux 111azy Feedwater Pumphouse HVAC i o Engineered Safety Features Roca Coolers o 4160 VAC, Class 1E, Electrical Distribution o 480 VAC, Class 1E, Electrical Distribution o 125 VDC, Class 1E, Electrical Distribution o 120 VAC, Class 1E, Electrical Distribution 4

o Class 1E Diesel Generators (Standby Power) 4 I

1 o Time Constraints Critical time constraints for system or component operation are quantified. These time constraints conservatively assume the effects of the fire to be instantaneous. In reality, a control room fire will be slow to develop and detected early. Therefore, these quantified times, i.e. 10 seconds, for action do rot mean action can't be taken, only that the action should be taken as soon as possible, o Operational Considerations The basis for operator action (s) required to prevent or mitigate the adverse effects of the spurious control action / inactions, stu:enarized a the evaluation findings, is detailed.

o Compensato W Measures The measures recu...cded to accomplish each of the operational considerations is presented. These cuwasatory measures should be included in the plant operating procedures as applicable.

3.1 G_Elg.RAL OPERATI_ONAL CONSIDERATIONS

1. In the event of a control rom fire, transfer switches must be opera *.ed and the plant aligned to the desired configuration frm the remote shutdown panels and other local control stations in order to prevent a control rom spurious :tuation undetected system realignment. NCTTE:

Once a transfer switch is operated, autmatic control functions will not occur (e.g., load sequencing will not occur).

2. In the event of a control rom fire, control the plant shutdown frm the Train B remote shutdown panel. (See the Bases for Assumptions 11 and 14 in Section 4.2.)

3.2 REACRR COOLANT SYSTDi A. Evaluation Findanas

1. With offsite power availabla (i.e., RCPs operating), a pressurizer spray valve (W-0455B or W-04550) can spuriously open, resulting in uncontrolled RCS depressurization.

2. A pressurizer PORV (W-0455A or W-0456A) can spuriously open, resulting in uncontrolled RCS depressurization and loss of RCS inventory.

l l

l

3. Fire damage to pressurizer pressure transmitter channel for FT-0455/PI-0457 can cause simultaneous opening of the pressurizer spray valves (PV-0455B and PV-0455C) and pressurizer PORV PV-0455A, resulting in uncontrolled RCS depressurization and loss of RCS inventory.

4. The pressurjzer auxiliary spray valve (HV-8145) can spuriously open, resulting in uncontrolled RCS depressurization while a charging pump is operating.

B. Key tenitorable_ Parameters (fune_tional)

1. RCS pressure

2. RCS pressure and pressurizer level

3. RCS pressure and pressurizer level

4. RCS pressure C. Time Constraints

1. The reactor coolant system may depressurize to the Safety Injection Actuation (SIA) set point in less than 4 minutes in the event one pressurizer spray valve opens.

2. The reactor coolant system may depressurize to the SIA set point in less than 1 minute if one pressurizer PORV opens.

3. The reactor coolant system may depressurize to the SIA set point in approximately 47 seconds if simultateous opening of both spray valves and 1 PORV occurs (fire damage to PT-0455 or PT-0457 circuits).

4. The reactor coolant system may depressurize to the SIA set point in approximately 3.5 minutes if the auxiliary spray valve opens.

D. Operational Cons _iderations

1. RCS pressure control is necessary to ensure adequate subcooling margin.

2. RCS pressure control is necessary to ensure adequato subcooling margin, and RCS inventory control is necessary to ensure maintaining the core covered.

1 l

l

.f

3. RCS pressure control is necessary to ensure adequate subcooling margin, and RCS inventory control is necessary to ensure maintaining the core covered.

4. RCS pressure control is ne essary to ensure adequate subcooling margin. ,

E. Cm.pensatory Measu _res 1, 2, 3.

To reduce the potential for uncontrolled RCS depressurizaticn and  :

loss of inventory, prior to establishing plant control at the remote shutdown panels, both PORV block valves should be closed and the Reactor CJolant Pumps (RCPs) for loops 1 and 4 should be stopped prior w evacuation of the control room. Upon arrival at the shutdown panels, ensure closure of the PORVs and their block valves and that RCPs 1 and 4 are tripped by operation of the appropriate transfer switches and control switches. With the transfer of control switch in local, the PORV block valves may be opened a.-d the PORV used to control system pressure if necessar f.

4. Upon arrival at remote shutdown panel "A", transfer control of the auxiliary spray valve and ensure that the valve is in the closed position to prevent any further depressurization.

3.3 _ CHEMICAL AND VOLlNE CONTROL SY5I1!N A. Evaluation Firdinas t

1. Fire induced spurious closure of a VCT outlet valve (LV-0112B or '

LV-0112C) may result in damage to an operating centrifugal charging pump. Since both pumps are autcmatically started in the event of a loss of offsite power, this may lead to simultanecen 1 failure of both pumps.

2. Fire induced spurious closure of the centrifugal charging pump minimum flow valves (HV-8111A and 81118) may result in damage to the respective operating charging planp. Spurious closure of valve HV-8110 can result in a failure of either or both operating charging pumps, l

1 I

l l

l

3. Fire induced simultaneous uncontrolled openirn of excess letdown valves (W-82 54, W-8153 and W-0123) may occur resulting in loss of RCS inventory.

4. Fire induced failure of charging pump discharge flow control valve (W-190B) may occur resulting in inability to control pressurizer level. (Transfer of control switch does not isolate all control room circuits.)

5. Automatic charging pump suctim transfer to the INST may not occur on low volume control tank (WI) level due to fire induced failure in a VCT level transmitter (LT-0112 or LT-0185) circuit. i B. Kev Monitor _able Parameters (func_tiona.ll

1. Pressurizer level 1 2. Pressurizer level

3. Pressurizer level j

j 4. Pressurizer level i

5. See compensatery measures C. Time Constraints

1. Loss of suction to any operating centrifugal cha ming pump can result in pump damage within appt m imately 10 seccr.ds.

2. Loss of miniflow recire for any operating centrifugal charging pump can result in pump damage within approximately 30 seconds (RCP seal flow considered).

3. There is no immediate concern about not being able to isolate excess letdown.

4. The operator has approximately 15 minutes to regain pressurizer level control to prevent the pressurizer frca reaching an overfill condition.

5. The operator has approximately 6 minutes to transfer the chaming pump suction to the PHST before the Wr is dzy, 1

1 6-

4 D. Operational Considerations

1. At least one centrifugal chaming pump must be operational in order to control RCS inventory and RCS boration.

2. At least one centrifugal chaming pump must be operationai in order to control RCS inventory and RCS boration.

3. RCS inventory control is necessary to ensure maintaining the core covered.

4. RCS inventory control is necessary to prevent overfilling the pressurizer.

5. At least one centrifugal chaging pump must be operational in order to control RCS inventory and RCS boration.

E. Ccrnpensatory Measures

1. In order to reduce the potential for simultaneous chaming pump failures, prior to establishing control at the remote shutdene panels, the chaging tunp suctions will be aligned with the RMST prior to evacuation of the control roca by opening LV-112E or LV-112D.

2. Operation of the transfer of control switch for the cha ming pump minimum flow valves W-8111A and W-8111B will preclude damage to the respective centrifugal chaging pug due to spurious valve closure. Operation of the remote shutdown panel transfer of control switch for valve W-8110 will preclude simultaneous failure of both chaging pu gs due to spurious closure of the valve. 'Ihe probability of simultaneous failure of both charging pumps due to spurious closure of W-8110, is considered very low because the Ices of offsite power condition causing both pumps to run must be coincident with a high pressurizer level condition (no charging flow to RCS except via the RCP weals).

3. To ensure isolation of excess letdown, trip breaker 14 in 125V de panel IND32/2ND32 (power supply for valves W-8154 and W-8153) . l

4. Precasurizer level can be maintained frca the Train "B" shutdonc panel by starting and stopping the Train "B" cha m ing pump. An t alternative to this approach it to cycle the SIS boration valve,

O HV-8801B, open and closed, with the Train "A" SIS boration valve l HV-8801A, closed. (HV-8801A position may be detennined by watching pressurizer level while charging with HV-8801B closed.)

5. '1he chaging pump suctions will be aligned with the INST prior to evacuation of the control roce by opening LV-0112E or LV-0112D (see Compensator / Measure 3.3.E.1) .

3.4 _ MAIN STEAM SYSTDj A. Evaluation _Fi_ndings_

1. With offsite power available, steam generator cuerfilling can occur due to spurious opening (valves remain open) of the feedwater control valves or due to failure of the feedwater isolation valves to close on high level. These situations are aggravated by the following conditions:

o Turbine trip occurs o Feechater pumps continue to run o Main steam atnospheric durg valves ( ADVs) do not operate o No autcmatic turbine bypass system operation

2. With offsite power available, steem generator boil dry can occur due to spuriou closure of the feechster isolation valves, closure of the feechat, ontrol valves or spurious opening of the turbine bypass. rol valves. These situations are aggravated by ,

the foJ1owing ec. tions: 1 1

o No turbine trip o No MSIV closure o No main feedwater addition o Main stevn ADVs open o MSR isolation valves remain open o SG bloweb e valves remain open

3. Control of the main steam ADVs may be lost as a result of a control roca fire.

B. Kev M nitorable Parameters (func_tional)

1. Pressurizer level, Rr p w .*.! t, ard S/G 1 eve'

2. Pressurizer level, RCS p v. a , and S/G 1evel

-f

3. RCS temperature.

4 C. Time Constraints

1. The steam generators can reach an undesirable overfill condition within approximately 2 minutes assuming full main feedwater flow. t

- i 2.a The. steam generators can reach a dry conditim within approximately 4.5 minutes assuming, reactor trip, MSIVs open, no main feecheter, no auxiliary feedwater, RCPs running, steam '

gererator ADVs open, no turbine trip, steem dump full open, and no safety injection. As a result of the rapid overcooling, the i reactor can return to criticality with a maximum power of about 144 at approximately 57 seconds after the initial trip. l l

1 2.b Assuming reactor trip aM closure of the MSIVs, a steem generstor l can boil dry in approximately 13 minutes assuming no main  !

i feedwater, no auxiliary feedwater, RCPs running and the steam l generator ADV open. '

1

3. Operation of two ADVs (PV-3010 and PV-3020 in the event of a '

control room fire) is not required until after hot standby has been achieved, and the Es has been borated to the cold shutdcom concentration (approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if boration is fra the BAST l arxi 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> if boration is frcza the RHST) . Operation of the other two ADvs, or establishment of s ee other cooling means for the idle tw steam generators is desired within 2 to 4 additional hours. (If it is not possible to ensure a stable level condition l in the tm idle RCS loop steem generators during the cooldown then these steem generators should be allowed to boil dry.) ,

D. Operational Considerations i

1. Steam generator level control 's necessarf to preclude uncontmlled RCS cocidam, deg- oriza- tion, and steer generator overtill.

2. Steam generator level control is r.in;-:- -_W to preclude j uncontrolled RCS cooldown and depressurizatton.

4 i

i l,

i 9

_ . _ _ . - - _ - -- -____--r, ,_ ,, . _ - , _ . _ - - - , - - ~ , - __ _ _ . . , - _ . , - _ _ r - , . .,- ,, -.,,,---

O I

3. Main steam ADV control is necessary to preclude uncontrolled '

cooldown (valves failed cpen corxlition) and to ensure the ability  ;

to accceplish a controlled cooldown (valves failed cicsed ,

ccrdition) . '

E. Cttpensatory Measures 1,2. Tb minimize the chances of a significant overrooling transient, as a result of steam generator overfill or boil dry, the PSIVs and ,

bypasses, the feedwater isolaticn and bypass valves, and the steam ,

generator biculown isolations r:ust be closed prior to leaving the i ccntrol rectn.

If there is any indication of urcontrolled ficw into or out of any ,

steam generator upcn arrival at the shutdown panels, trip breaker 08 in 125V de panel 1AD11/2AD11 and breakers 03 and 08 in 125V de panel 1AD12/2AD11 to ensure closure of the MSIVs and their bypass l

valves, the MFIVs an1 bypass valves and the steam generator l l blowdown isolation valves.  ;

3. To ensure the ability to control the plant cooldown, cpen the '

power supply circuit breakers to the Train "A" nainsteam ADVs (ensures valve closure).

UNIT 1 UNIT 2 o W-3000 Breaker 1AY2A-17 2AY2A-17 o W-3030 Breakert 1AY2A-18 2AY2A-18 t

To initiate cooldown frcrn the Train "B" shutdown panel, transfer control of ADVs W-3010 ani W-3020 to local then use portabic plug-in signal '

generating type devices to position PV-3010 and PV-3020 to ecntrol the RCS cooldown rate. (2tes  ;

Procedures controlling device availability and  ;

cperator training should be provided.) l 3.5 AUXILIARY FEEDU.'IER SYSIEM l

A. Evaluation Firdings '

1. Autcratic auxiliary feedwater actuaticn may not i occur.

2. One steam generator auxiliary feedwater ccntrol valve, for a rotor driven AFW puitp, may spuriously close during autcaratic feedwater actuaticn.

1

e

3. For other considerations involving the steam generators, see the !%in Steam System.

B. Key tenitorable Param_eters (functional)

1. Steam generator level and RCS temperature

2. Steam generator level, RCS pressure and pressurizer level. r C. Time Ccostrainj;s a

1. At least 30 minutes are available in which to establish auxiliary feedwater flow to the steam generators asm ming:

o Reactor tripped i

o RCPs tripped o Steam generator ADV closed o MSIVs closed o No main feedbeter o No auxiliary feedwater

2. One uteam generator level can reach an overfill condition in approximutely 20 minutes, assuming no main feedveter flow and one steam generator is receiving the full flow from one motor driven pump, spurious closure of one auxiliary feedwater valve, 1

and 1/4 of the flow frca the turbjne driven pump.

D. Operational Considerations Control of auxiliary feedbeter is nece m to ensure the ability to achieve safe shutdown.

E. Ccmpensatory Mansurws Auxiliary feecheter addition can be ace mplished frta the remote shutdom panel without spurious actvaticn concems af ter operation of the ecmponent "transfer of control" switches. i l 3.6 RESIDUAL HEAT RENNAL SYSTDj A. Evaluation Findinas

1. One or both RHR pung suction valves (HV-8701A and B for train A or HV-8702A and B for train B) can

] spuriously close while the pung is operating.

l l

T i

l l

i (Assumes plant is in shutdown cooling prior to the control roczn fire.)

2. Deleted

3. Fire induced spurious openir.g of RHR vent valve (HV-10465 or HV-10466) may occur resulting in loss

] of RCS inventory or PWST inventory.

4. Train B RHR heat exchanger outlet valve HV4607 may spuriously close or bypass valve W-0619 may spurioudy open resulting in loss of RCS cooling control c uing Males 4 and 5.

B. Key tenitor b_leprameters if nletional.1 3 4

1. RCS ' enperature

2. Deleted

3. Pressurizer level

4. Core exit themocouples C. Time Constraints

1. An operating RHR pump can be damaged within approximately 30 seconds following sInrious closure of its respective suction valve.

2. Deleted

3. '1here is no inanediate concern associated with an RHR systen vent valve opening. (See operationa) considerations).

] 4. ':here is no inanediate concern associated with loss of PCS cooling control due to RHR heat exchanger

outlet valve closure or bypass valve opening.

)

D. Operational Considerations '

]

1. RHR system operation is neciz z W to achieve and

, maintain cold shutdows. .

4

2. Deleted -

r I

e i

j _ _ _ _ . _ _ _ _ _ _ __ _ _ . __ _ _ _, _ . - _,- _ .___ _ _ . _ ~ _ . . _

- - = . . - . . .. _. - .. - --. . -- -

e l

3. RHR system vent valve closure is recessary to prevent undeoired loss of reactor coolant during shutdown coollng RHR system operation. Spurious vent valw open!ng prior to 7 stem starting can result in limitec.' loss of PHST volume.

4. Control of the RHR hat exchanger outlet and valve tr/ pass is necessarf to control RCS cooldown.

E. Compensatory Maastnye

1. Use the redundant tsystem to regain RCS cooldown control.

Deleted 2.

f

3. To preclude opening or to ensure clorurw of bot.b RHR systen vent valves HV-10465 and HV-10466, *: rip breaker 08 in 125V de panel IND31/2ND31.

l

4. To ensure the ability to acmnplish a cooldown using the Train B RHR system, it may be necessarf to open RHR heat exchanger outlet valve HV-0607 F

, and/or close RHR heat exchanger bypass valve FV-0619 by local isolation and venting of the valve air set instrument air supply.

3.7 NUCI.EA_R SERVICE COOLING WATE_R E(siTD4

)

A. Evaluation Findirvg

,' 1. Vire induced spurious failures of NSO4 return i

header temperature or preneure instruwnts  !

4 (TE-1668/1669 and PT-11741/11742) could result in simultarrous closure of NSCN cooling er.mer spray header isolation valves HV-1668A/1669A and NScid  !

cooling tower bypese valves HV-1668B/1669B. NSCW '

l retum flow would then be limited to the capacity of relief valves PSV-11759/11766.

, B. Kev Denitorable Pareaeters (functional)

1. Stees generator level, RCS prosecure and reaperature. ,

C. Time Constraint 3 r

la. Ternporar/ loss of NSCW f)ow to a diesel generator l I will not damage t)e diesel generator (diosal trips I l

i  !

l i

e on high jacket water tertperature). Diesel opera-tion n:ust be restored within approximately 30 minutes to support cooldown.

1b. NSCW cooling flow to the ESF chiller units is .

required before these units con be started.

D. g rational Considerations la. Diesel generator operation is required for safe shutdown cowc-nt operation in the event of loss ,

of offsite power.  !

lb. Icss of the ESF chillers may impact operation of i safe shutdown cornponents.  !

E. Ccenpe__nsla ory Measure _s 1a. If the diesel trips on high jacket m ter temperature before the NSCW valve connul can be transferred to the resnote shutdown panel, the diesel will haw to be manually resst ord started.

lb. Af ter the operator has transferred contml of all 1 the components to the shu Mown panel, re may have

, to manually restart the ESF chi 1Jer.

3.8 DJESEL_ GENERATOR PUEI.EL MANSFER SW (UNIT 1 CNLY) l A. _ Evaluation Finding '

The diesel generatcr fuel oil storage tank pumps may not be available for autcratic makeup to the diesel fuel oil 1 day tank.

B. Eey,jtqRorable Parameters (fune_t_ionaQ I hone required. See Ccapensatory Measures.

s C. Time Constraints

) 1he diceel will zun for approximately 1.4 hcurs with no  :

autcastic makaup assuniN mininnan Iwvel (level at Milch  ;

aute makeup shculd start) in the diesel generator fuel oil day tank, a D. Operational Conside n tions

i

! Makeup to the diesel fuel oil day tv N required in i l

on:ier to ensure long tem operabilit ' the safe shutdown equipnent in the event offsna roer is not available.

I i

i

E. Caqensatory Finsures Perfom necessary repairs in thi fuel oil storage tank punp electrical breaker cabinet to ensure a source of nakeup to the fuel oil day tank for an crerating diesel genera tor. (Ibte trat tcols, prccedures ard training are rtquired.)

3.9 ESSE 2/TIAL CHHLED h1G'ER SYS'nM A. Evaluation Firdings Irass of CDCR ESF chilled water flow through cooling unit 1-1532-A7-002/2-1532-A7-002 due to simrious closure of l valve W-12725 can result in Ices of cooling to the essentici Train B witchgear rurs,

3. Key !bnitorable Para ~e*ers (functicml)

Cperator ccnfort at ti.e rerote shutdown panel.

C. Tire Constraint l !b cooling water flow through W-12725 can result in urdesired terrerature increases within approxirately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> at the Train B rcrote shutdown panel ard ESF cwitchgear arcaJ servcd by the ecoling unit.

1 D. Creraticm1 Considerations A suitabic envirorrent for equirrent everation ard plant crerator ccnfort is desired.

E. Cctrencatory ?kusure_s Trip breaker 22 on 120V ac panel 11NA1/2BYA1 to de-energi::e the hWraulic pu p ard then locally position l valve W-12725 usirs its associated hvd nrp ard l positioner.

3.10 ESSE?frIAL SAFETI FEAWRES RCrN CCOLERS l A. Evaluacicn Firdings Loss of ventilation for the Train "B" GCR ESF chiller rocn can cccur due to spiricus stcyping of tre rocn exFaust fan (1-1531-B7-004/2-1531-In-004) l B. Key Ftnitorable Para ~eters (functicml)

Ibne rcquired. See CcrTensatory bbasures.

C. Tine cccstraints There muld be no tmrerature ircrease above the equirrent qualificaticn tecperature for approxinutely 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> in the CBCR ESF chiller rcms folicwing starting of the rocn heat icods and losn of the exhaust fans.

D. Operatictul Consideratiens A suitable environmnt for equirtent creraticn is desired.

E. Ccrrensatory !basures At scre tine during the first 2 days folicwing a control Irrn fire verify tlat the tenperature in tic CBCR TEF

> chiller rocn fu suitable for equirrent :peratico arxi.

provide tmporary ventilation as nccessary. (!bte tlat equirrent, procedures and trainirq are necessary.)

3.11 ELEC7RICAL DISTRIBUTION SYSID!

A. Evaluation Firdings A control roce fire ray cause decnergizing of 480 V l switchgear 1BBW/2BB07 resulting in loss of diesel genere. tor building ecoling due to spuricur: feeder l breaker croning.

B. Key Monitorable Paramters (furrticrn1)

Steam generator levels, RCS presscure and tccrerature and equignent status lights.

C. Tine Ccnstraints The diesel generator rocn tcrperature can apprtach a point where prtper cquirrent creration can not be assured within approxinutely 15 mirutes follcuing a diesel start with no cooling systcrn cperation.

D. Operational Consideraticns A suitable envirorrent for cquirrent creration is required in the event offsite powr is rot available.

E. Ccree_nsato_ry Measures The following breaker transfer of control switches must

! be placed in the local position and the breaker ensured closed following control room ovacuation to preclude Train B diesel generator building overheating:

.i

1. 1BA0304/2BA0304 l 4

2. 1BBO701/2BBO701 l 3.12 ,CONTA_I_PNE2fr SPRAY SYSTE24 A. _Eva.l_uation Findij)gs A control roce fire may cause a spurious containemt spray actua. tion signal.

B. Key Manitorable Parameters INST level C. Time _ Constraints

} Containment spray must be stopped within approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to limit the loss of RNST inventory.

D. Operational Considerations INST inventory is necessary to provide RCs makeup for l a ldown contraction.

1 d

E. Cwrensja ory Measures 4

Locally trip wvi rack out both the contairment spray l j pump breakers.

, Note: It may require trippire a breaker more than

) ance to rack out the breaker, (breaker rack i

l out requires use of a tool). j l UNIT 1 UNIT 2

! ],

1 o Ptup A breaker: 1AA02-14 2AA02-14 l

o Ptap B breaker

1BA03-14 2BAO'l-14 j

) 4.0 OC_trl13DL_ROLN FIRE SPURICUS AC@_ATION EVALUATION GROUtc RULES., ,

i i

j 4.1 .NRC__G_U_IDE_LIgs I i

j 1. No design basis events are assuned concurrent with a

, control room fire.

l_

1 i

I i s

- - - , - ,-_.m,_ e , =r- , _ , . . - - .

_---,___,_-.-,_,-m-. ,

---

,__.r- - --

--.._--.y , - , - - - , - ~ - - ,-._, , , ..n- -

i e

2. No single failures are aasumed concurrent with a control rom fire. -

3. The control rom is evacuated due to the presence of a fire.

4. No equipnent is assumed to be inoperable prior to the fire due to maintenance activities.

5. The only action allowed prior to evacuation of the control room is a reactor trip initiated by the ,

operator. No other infomation from Indications in the control rom can be used to assist the operator in detemining plant status (e.g., no credit for rod bottom lights even though these are available on the same panel fr m which reactor trip is initiated). A deviation wi.?1 be presented in FSAR Appendix 9.B for any other control room manual actions deemed necessarf prior to evacuation.

l 6. Cold shutdown from cutside tb, control room must be achieved and maintained, with or without the availability of offaite power, within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with limited remedial actions, i

7. As consequences of the fire, hot shorts, open circuits, or shorts to ground in associated circuits must be considered.

8. Where a hi/ low pressure interface (fire induced LOCA) is  ;

involved, an unlimited rumter of spurious control signal actions / inactions must be postulated.

9. Electrical circuitry for ccaponents used to acconplish safe shutdown, armi for methode employed to mitigate or p m lude the w g oences of control room fire induced spurious actions / inactions, must be independent of the i control room. '

4.2 ASStDFTIONS AND BASES i

1. The control room fire is emsidered to be of such j segnitude as to requim almt ct insnediate evacuation of ,

both the Unit 1 and Unit 2 control room operators.  !

However, fire induced spurious conponent l

) actions / inactions shall be considered to occur ira only l one undt. 1 1

1 4

4 4

_ , ._. . _ _ _ _ . . . _ _ _ _ _ _ _ . _ _ . . _ . ~ _ . _ _ _ _ _ , _

l 1

Basis:

J The existence of smoke in the control room would impact the capabili,y to safely control both Units 1 ard 2 from the control room due to sharing of the ecmnon space, while the special separation between the control consoles ard cabinets for the two units would limit the direct inpset of a fire to only one unit.

2. A spurious control signal action / inaction is defined as being caused by a single hot short, open circuit, or short to ground, inpacting either (a) a single ccenponent, or (b) the activation / inactivation of l multiple ccaponents actuated by ESFAS logics such as safety Injection (SI), Containment Spray (CS), Contain-nment Isolation (CI), etc.

Basis.:

Each electrically-cTerated ccenponent has its own unique coni.rol circuit which may be affected by the single hot i

short, open circuit, or short to ground. In addition, the circuitry of an electrically operated ccupanent may 2

be part of a logic circuit involved with activation of multiple ccenpanents (i.e. , SI, CS, CI, etc. ), subject to the effects of a single hot short, open circuit, or short to ground, either to a relay or to an entire logic cabinet.

3. Either of the two conditions stated in Assumption 2 can be assumed to occur during any plant operating mode following the onset of a control room fire event, until action is taken to defeat or preclude the action / '

inaction from occurring.

l _ Basis:

Because of the B'2P CHEB 9.6-1 requirement to achieve and maintain cold shutdom. the plant can be in any of its normal cperating modes (i.e. , Itdes 1 thru 6) at the  !

time of initiation of a control room fire event.

4. In the ownt that offsite power is available, it is astr.med that all equipment ranains in its pafire cotv11tien (i.e., condition during norinal plant operation for the assi.smed mode). In the event of loss of offsite power, all equipacnt goes to its designed loss of offsite pcur position.

1

i

• l

_B_asJ :

The basis for this assumption is that the components /

systems will function as dasigned, with the exception of the actions / inactions caused by the single hot short, open circuit, or short to ground.

5. The operator will trip the reactor prior to evacuation from the control rom. Credit will be taken for events which would normally be expected in conjunction with the

, reactor trip, except that these events are subject to the spurious control signal action / inaction.

Basis:

The NRC has ot:pulate that, in the event of a control room fire, credit may be taken for operator action to manually trip the reactor prior to evacuating the control mom, mis evaluation will take credit for the operator manually tripping the reactor. The other components / system actions nonnally associated with a reactor trip will perfona as designed, but will be subject to the singla hot short, open circuit, or short to ground in the control rom circuits. A deviation will be presented in FSAR Appendix 9.P for any other control rom manual actions dee.ned neccesarf prior to  ;

evacuation. >

6. Tht- analysis will be perfonned on a system basis for the  ;

fire area being evaluated (in tnis case, the contml rom) . Systems interfacing with the systems identified in Table 2-1 will be evaluated to deter-nine their impact -

on systems required for safe shutdown.

.B48.is :  :

! NRC Generic Imtter 81-12 allows the choice of evalukting on a system or fire aren basis, i 7. There will be s ee time interval between the onset of  !

i the cmtrol roon fire event (time t=0) and that time t i h the operator can rmamewably be expected to be able  ;

i to counter the adverse effects cf the spurious '

action / inaction (t=15 minutes), his time interval 1 j shall be quantified.

i f

l l

b

Basis:

situation control rocm fire.

an operator e may face ashis assumption ect the "rer.1 warld" within 15 minutes It has been determined ofcanleaving be acccep thof that ta result ransfer control and of the plant assignirn priorities sto necessarevaluation raints to allcw his will define plant procedure develognent y operator actions for 8 .

All plant operating modes evaluated (i .e. , Mades 1, 2, 3except refueling will be Dasa : . 4, and 5).

here is sufficient time durirg th (Made 6) for an operator to e refueling made 9.

contnal or fission product bourdrespond to condition pudizing reactivity ary integrity.

Only cenponents with circuit control roca are subject to thiss routed to or frce the Basis: evaluation.

(

The evaluation scenario is f i

l control rocn will be being subject to the single hn this n considered iroom, and therefore with circuits in the short to ground. evaluation as

10. ot short, open circuit, or offsite power (LOP)y result .

conditionNrbine in a loss of trip does not nec Basis:

assume that a IDPe more condition conser dGiven a turbine trip, it m trip circuitry is subject t oes not occur.vative to circuit, or short to ground o the single hot short, openThe turbine

11. .

the Train B rw ote nwn shutdowControl will be acecnplished at panel.

of the plant cooldo Basis:

As part of the VEGP design instrmentation circuitry has b patential control recneen fire danag, only the Train 8 vital

e. isolated frun (See Asswption 14)

Basis:

'ntis assumption is intended to reflect the "real wrld" situation an operator may face as a result of the control room fire. It has been detemined that transfer of control and plant realignment can be acecrnplished within 15 minutes of leaving the control rocrn. This evaluation will define time constraints to allow assigning priorities to necessary operator actions for plant procedure developnent.

8. All plant operating modes except retteling will be evaluated (i.e. , Modes 1, 2, 3, 4, ard 5) .

Basis:

'1here is sufficient time during the refueling mode (Mode 6) for an operator to assess plant status and respond to conditions without jeopardizing reactivity control or fission product bcundary integrity.

9. Only ccanponents with circuits routed to or frcun the j control room are subject to this evaluation.

Basis:

The evaluation scenario is for a fire in the control rocxn, and therefore, any equipment with circuits in the control recen will be considered in this evaluation as being subject to the single hot short, open circuit, or short to ground.

10. Turbine trip does not necessar!'.i result in a loss of offeite power (LOP) condition.

Bania:

Given a turbine trip, it may be more conservativa to assune that a IDP conditical does not occur. The

• abine trip circuitry is subject to the single hot chart, own cire.uit, or short to ground.

11. Ccsttrol of the plant cooldown will be accomplished at the Train B runote shutdown panel.

Basis:

As part of the VEGP design, only the Train B vital instrunentation circuitry has been isolated frun potential control zwam fire damage. (See Assumption 14)

e

12. No single (including ccrmon node) failures in addition to the spurious action / inaction will be evaluated.

Basis:

The BIP CNEB 9.5-1 scope does not consider any failures other than those caused by the fire.

13. For this evaluation, the spurious action / inaction shall be assumed to result in the least desirable action / inaction.

Basis:

For an electrical component, the only failure initiators are hot shorts, open circuits or shorts to grounis.

Since all three condit1rns must be pastulated, the assm ption that all adverse conditions will happen to the subject emponent(s) yields a conservative evaluation. Further circuit analysis is required to eliminate an assumed concern.

14. Key monitorable parameter (s) shall be sufficient to enable the operator to identify the occurzwnee of a spurious control signal action / inaction and monitor the mitigation processes (if this "criteria" is not met, recw...ardations to satisfy it shall be made) . The following Train B instrunents arri control loc 5e are isolated fra the ccotrol roca, and will be utilized to assess overall plant conditions, o Neutron Flux (Reg. Guide 1.97 Fission Chamber),

RE-13135 o Core Exit Temperature (quadrant 2 and 3) o RCS Wide Range Cold Img Temperaturw. TE-0423B and

'I7.-0433B o RC;a Wide Range Pressure, PT-0403 o Steam Generator 2 and 3 Wide Range Invel, LT-502 and LT-503 o Preneurjrsr Invel, LT-460 o RPV Head Vent throttle Control (OIM), HCV-0442B o Accuum11ator Tank Gas Vent Contiel (OIM), HCV-0943B o Ccmdensate Storage Tank Invel, LI-5100 and LI-5115 (Incal) o PHST Invel LI-0990C (local device) o BAST Level PI-10115 or PI-10116 (local devices)

Basis:

In ortler to aid in control of the pinnt, the design of both Train A and Train B equipnent allows for disconnecting of control room circuits through the use of transfer switches located at the remote shutdown panels and other local control stations. Similarly, the instrumentation and control loops (Train B only) listed in this assunption are electrically isolated from the control rcron to provide parameters for use by an operator in assessing overall plant conditions. There are also other means available to an operator to assess component conditions: 1.e., local breaker / switch position, local valve position indication, etc.

15. Ccaponents or devices which can not impair safe shutdown operation or control by their actuation or malfunction are considered not to affeet safe shutdcun.

Basis: ,

BTP CNEB 9.5-1 requires being able to achieve and maintain cold shutdown. Any systens/ components not impairing safe shutdown are not within the scope of this evaluation.

[16. Evaluation drawings will be project documents controlled l by Bechtel Drawing and Data Control (DDC). Examples

) are:

I P& ids Elementary Diagrams Trop Diagrams One-Line Diagrams Controlled Vendor Prints

_ Bas _is :

The identification of the controlled drawings defines ,

4 the source material used for the evaluation anc' aids in tran==hility and r+prMoctibility of results.

17. Protection of nonsafe shutdane equipnent is not a priority iteen of this evaluation.

Basis: 1 The B7F CNEB 9.5-1 requilement is to achieve and l maintain cold shutdown to protect the health and safety of the public.

0

10. Fire induced circuit damage can not result in loss of reactor coolant pump seal cooling due to a spurious actuation.

Basis:

Either auxiliary ccuponent cooling water system j

, operation or CVCS seal injection is required to maintain the integrity of the reactor coolant pump seals. These systems are physically independent of each other and each systen has redundant pumps (powered frcm the i redundant Class 1E electrical dictribution system) which share ccanon piping within the respective system. There ,

is no single signal caused by fire damage that can  :

result in loss of both means of cooling (temporary loss t 4

of seal cooling during load siwdding and load sequencing  ;

is acceptable).

5.0 _00pmDL R00>. FIRE _ ALTERNATE SHigDggi EVAQJATION IDGIC l The folicwing figure details the logic used in perfoming the evaluation for each ccaponent of the Table 2-1 systems in the event of a control room fire.

t I

1 t

l I

i 4

i

-24~

s n

Ct.u.v.s N, i

t

~:.~

~

l

....n.

. . . . ~ .

,. .  ; .~. . . .

I V I V l=1' -

,. TV v

o I/  :<= II

- ,,7 v

,h--

}

l I (

Q,- ) . "'

s,-

) - ..

c .. )

- - lg6 ( ,,o )  ;;;, "5

• o o e o t ,- ) ( ..- )

,L3 .. .['. ,,'

,L .. ... . . . ,

i r if

== ..::.:..

o ,gya , epa

. & o. ,

_......m.

F _...... e~'r o -e ~ - o o

( ..o .

( ,,o 3

3

..........e.,

.~ ... .. . ... _.c,

o. ,< ,. . _. .<..e..o.<..... ,.~,.o..,..

. , <o .< .o , < .o. .

_m-

.

l> bh II ~,~..

n. I= I - /.. ?.<, --

I. I - /...., %. s

• KJ '

[ s,- )

I ~~~

. ._ I = *K'7" o

{ s,os. ]

o.

• o. . .e os as n. . . .

o**

...."."I L.. , gt;l7

... "! L.. . m.c;;7 VEOP CONTROL ROOM FIRE ALTERNATE SHUTDOWN EVALUATION LOG!C DIAGRAM

. RE F E RS TO i tJS T RUvE f 4 T A T I OtJ RE QU I RE D F OR SAF E SHUTDOWrJ. O Tl4f R DE v l Cf G f .T t O4 fHE " f 40" PATH.

. _ _ _ _