ML20148Q746

Insp Repts 50-327/88-24 & 50-328/88-24 on 880314-23. Violation Noted.Major Areas Inspected:Fire Protection & Licensee Action Re Implementation of Requirements of 10CFR50 App R,Sections Iii.G,Iii.J,Iii.L & Iii.O

ML20148Q746
Person / Time
Site:	Sequoyah
Issue date:	04/06/1988
From:	Garg H, Hubbard G, Pierson R, Sullivan K, Wescott R BROOKHAVEN NATIONAL LABORATORY, NRC OFFICE OF SPECIAL PROJECTS
To:
Shared Package
ML20148Q745	List: ML20148Q746
References
50-327-88-24, 50-328-88-24, NUDOCS 8804130302
Download: ML20148Q746 (68)

Text

. .

i Report Nos.: 50-327/88-24 and 50-328/8fi-24 Licensee: Tennessee Valley Authority 6N38 A Lookout Place  ;

1101 Market Street ,

Chattanooga, TN 37402-2801 Docket Hus: 50-327 and 50-328 License Nos: DRR-77 and DRR-79 Facility Name: Sequoyah 1 and 2 I Inspection Conducted: March 14-23, 1988 Inspectors: E- f. = 1 Vfb/M R. C. Pierson Date Signed

k. $N 4'f4fM R. G. Wescott Date Signed kC- y b klO H. C. Garg Date Signed b.77/,.L/A- 6/rf

9.T.Hubbard / Dat'e Signed ,

bd k.% be -

K. Sullivan Brookhaven National Laboratory l Upton, New York Approved by: k.C h Mill M l

R. C. Pierson, Chief Date Signed 4

Plant Systems Branch TVA Projects Division Office of Special Projects l

SUMMARY

j Scoce: This special, announced inspection was conducted in the area of fire i

protection and the licensee's actions regarding implementation of the recuirements of 10 CFR 50, Appendix R, Sections III.G, III.J. III.L and 111.0.

Specific items identified as allegations by a previous TVA contract employee were also reviewed.

. Results: One apparent violation was noted with respect to 10 CFR 50,  !

Appendix R Section III.G.2.

8804130302 800408 PDR ADOCK 05000327 O DCD i

REPORT DETAILS

1. PERSONS CONTACTED Licensee Employees S. White, TVA Manager of Nuclear Power

• B. Charlson, Advisor to TVA Manager of Nuclear Power H. Abercrombie, Site Manager J. LaPoint, Deputy Site Manager

• S. Smith, Plant Manager

• G. Morris, Licensing Engineer

• R. Williams, Assistant Branch Chief. EEB R. Buchholz, Site Representative

• R. Bryan, Staff Specialist

• J. Sullivan, Supervisor, Plant Operating Review Staff L. Martin, Site Quality Manager

• J. Pierce, Appendix R Frogram Manager, DNE-MEB

• E. Connell, Fire Protection Engineer

• P. Trudel, DNE Assistant Froject Engineer

• M. Harding, Site Licensing Panager

• J. Hosmer, Sequoyah Project Engineer

• S. Littrell, Maintenance Special Projects

• J. Walker, Manager Operations Support Group J. Maddox, Engineering Assurance

• H. Jones, Assistant Manager, Engineering Assurance

• F. Koontz, Assistant Branch Chief, DNE-NTB J. Brady, Information Supervisor

• G. Kirk, Compliance Licensing Manager W. Parker, HVAC Engineer, MEB R. Suffarage, HVAC Engineer, MEB

• N. Black, Electrical Engineer

• J. Staub, Principal Electrical Engineer, DNE T. Nahay, Plant Operating Review Staff J. Springfield, Unit Operator / Reactor Operator

• W. Baker, Fire Engineer L. Barker, Electrical Engineer, Electrical Maintenance L. Tyler, Engineering Aide, Electrical Maintenance T. Massie, Mechanical Engineer, Mechanical Maintenance T. Kontovich, Electrical Maintenance Engineering Supervisor D. McNeil, Engineering Associate

• J. McCamy, NMRG K. Whittenburg, Nuclear Information S. Spencer, Nuclear Engineer G. Cooper, Assistant Chief. Mechanical Engir.eer W. Baker, Fire Protection Engineering Supervisor K. Walker, Quality Evaluation DNQA

. i Other Organizations

• A. George, Tenera Consultant N. Fioravante, Tenera Consultant l R. Eberley, Tenera Consultant

• S. Whitsett, Impell

• W. Shields, Attorney, Bishop, Cook Other licensee employees contacted included engineers, technicians, operators, mechanics, security force members, and office personnel.

NRC Personnel

• S. Ebneter, Director of Office of Special Projects (OSP)

• G. Zech, Assistant Director for TVA Projects, OSP

• R. Zalcman, Technical Assistant, OSP F. McCoy, Sequoyah Restart M& nager K. Jenison, Senior Resident Inspector M. Branch, Sequcyah Restart Shif t Manager P. Harmon, Resident Inspector D. Loveless, Resident Inspector K. Poertner, Resident Inspector

• Attended exit interview

2. EXIT INTERVIEW The inspection scope and findings were summarized on March 18, 1988, with those persons indicated in paragraph 1 above. A closecut inspection of the installed suppression / detection in the Unit 2 reactor annulus was ,

performed March 23, 1988. The licensee did identify as proprietary some of the materials provided to or revien d by the inspectors during this inspection. The licensee acknowledged the following inspection finding:

Violation Item (50-327,328/88-24-01). Failure to meet the requirements of Appendix R, Section Ill.G.2 with regard to maintaining one train of hot standby systems free of fire damage - in that cable to cable spurious interactions were not addressed in Interactions 114, 118, 120 and C6 and in the annulus area as described in paragraph 4.9 of this report.

3. INSPECTION

SUMMARY

The objective of this team inspection was to evaluate the adequacy of the Sequoyah Nuclear Plant's (SQNP) Appendix R program and to detemine if

, SONP was in compliance with 10 CFR 50, Appendix R, Sections III.G, III.J.

III.L and 111.0.

Allegations questioning the SNQP's Appendix R program had been raised by a

previous TVA contract employee. Matters relating to these allegations were also inspected.

The inspection effort covered the following functional areas of Appendix R compliance:

Spurious actuation, specifically the ability to perform safe i shutdown.

Procedural actions for preventing or mitigating the effects of a fire.

• Fire effects on instrument sense lines associated with Appendix R instrumentation.

Peating, ventilation and cooling requirements during and following a fire.

Questions raised by the alleger and the staff's evaluation of those ques-tions are included as Enclosure 1. Questions raised as a result of the development of Revision 7 to TVA calculation SON-SQS4-127 are addressed in Enclosure 2. Other specific areas raised as allegations and concerns which were not Appendix R requirements were also inspected and disposi-tiened in applicable areas of the report as well as in Enclosures 1 and 2.

The specific findings in each area are presented within the pertinent paragraphs. The inadequate consideration of cable to cable spurious interactions resulted in a violation with examples discussed in paragraph 4.3, 4.4, 4.5, 4.7 and 4.9.

The NRC has conducted previous inspections of the SQNP Appendix R program and had selectively reviewed some interactions during the course of these inspections. The NRC inspection efforts were documented in various NRC inspection reports including Inspection Report Nos. 50-327,328/85-01, 50-327,328/86-40, 50-32/,328/86-66, and 50-327,328/87-41. The NRC had co P _ ed that SONP was in ecmpliance with the applicable portions of 10 CFR 50 Appendix R.

4 SPURIOUS ACTUATION Spurious signal associated circuit concerns occur when safety related or non-safety related circuits are not fire protected in the manner required by Section III.G.2 of Appendix R to 10 CFR 50 and have a connection to circuits of equipment whose spurious operation would adversely affect the safe shutdown capability. At the Sequoyah Nuclear Plant, associated circuits of this type are referred to as Type 11 associated circuits. The fire shutdown logic analysis, TVA calculation SQN-SQS4-127, "Equipment Required for Safe Shutdown per 10 CFR 50, Appendix R." identifies both the equipment which must operate to ensure the availability of a required shutdown path and those corponents whose spurious operation could impact the successful achievement of that path (Type II circuits). The safe shutdown paths are identified by various keys within the safe shutdown logic.

The licensee's fire shutd.own logic analysis evaluated circuits whose fire induced spurious operation could affect the safe shutdown capability in the same manner as redundant circuits required to achieve safe shutdown.

Therefore, components whose spurious operation may adversely affect the successful performance of required safe shutdown paths were evaluated for '

compliance with the separation criteria of Section III.G.2. During this evaluation the licensee had identified 121 specific cable and/or equipment interactions for locations outside of primary containment and an addition-al seven interactions within containment which did not meet the separation requirements of Section III.G.2. Each interaction was documented on 1 Interaction Identification forms which include recomended corrective 1 actions to provide alternate methods of protection. Such alternate methods typically include the rerouting and/or protective fire wrapping of interacting cables or procedural revisions which require additional  ;

operator actions, necessary to mitigate the possible effects of fire induced faults.  :

l During a review of the licensee's safe shutdown logic analysis (SON-SQS4-127), subsequent licensee submittals including a TVA letter to NRC dated March 2,1988, and certain Interaction Identification forms, it was detennined that the licensee had not considered cable to cable faults to l be credible events and, therefore, no corrective action had been taken l when such interactions were identified. The inspection team did not agree I with the licensee's stated justification for the failure to consider cable '

to cable faults and discussed its concerns with licensee representatives.

Based on these discussions, the licensee agreed to perform a reevaluation of all identified interactions which had not considered the occurrence of cable to cable faults as credible events. This reevaluation identified i the following interactions affecting Unit 2 and provided revised disposi- l tions of those interactions which had not considered the occurrence of cable to cable faults as credible events:

4.1 INTERACTION NO. 70 DESCRIPTION Initial Reactivity control Unit 2 at Auxiliary Building Elevations I 714, 734 and 759. This interaction identified cables associated with  !

the manual reactor trip circuits which did not meet the separation criteria of Section III.G.2.

REVISED DISPOSITION l This interaction would require the failure of all four paths in the ,

manual trip circuits. In the unlikely event of such an occurrence, I procedure FR-S.1, "ATWS" includes operator actions to trip the reactor at the reactor trip switchgear and the motor-generator set supply breaker. This alternative action has been found to be acceptable and this item is closed. ]

i

]

4.2 INTERACTION NO. 110 DESCRIPTION RCS Pressure Control Unit 2 at Auxiliary Building Elevation 734, 6.9KV S/D Room B, All-13/R line. This interaction identified cables associated with the pressurizer PORY PCV-68-334 and block valve FCV068-333.

REVISED DISPOSITION The licensee's reevaluation determined that the affected redundant /

associated circuits are separated by a distance of 24'-10" with each cable routed within conduit. In addition, the affected area is provided with fixed area wide suppression and detection systems. No further corrective action is required.

4.3 INTERACTION NO. 114 DESCRIPTION RCS Pressure Control, Unit 2 at Auxiliary Building Elevation 759 CRD Equipment Room A12-13/U-V line.

This interaction identified cables associated with the pressurizer PORY PCV-68-340A and train B auxiliary power cable for block valve FCV-68-332, as not meeting the separation requirements of Section III.G.2.

1 REVISED DISPOSIT!,0N The licensee has subsequently revised the disposition of this interaction to include as an interin measure continuation of a rovino fire watch within the area and long term corrective actions consisting of a potential reroute of the affected cabling. The staff recommends that the long term corrective action be completed at the

! next refueling outage.

In order to ensure safe shutdown capabilities, where cables or equipment of redundant trains of systems necessary to achieve and maintain hot standby conditions are located within the same fire area inside the primary containment, 10 CFR 50, Appendix R, Section 3

III.G.2 requires that one train of hot standby systems be maintained

, free of fire damage by providing fire protection features which meet the requirements of either Sections III.G.2.d. III.G 2.e. or III.G.2.f.

A postulated fire could cause fire damage to the cabling of both valves rendering both trains of PORV/ BLOCK VALVE pressure relief paths inoperable. This pressure relief path is required to be

operable per Technical Specification 3.4.3.2 for Modes 1, 2 and 3.

4

! i

This is one example of Violation 50-327,328/88-24-01, failure to meet the requirements of Appendix R,Section III.G.2, with regard to maintaining one train of hot standby systems free of fire damage, in that cable to cable spurious interactions w3re not addressed. ,

4.4 IhTERACTION NO. 118 DESCRIPTION Secondary Side Pressure Control Unit 2 at Auxiliary Building Elevations 734/714 A3-A13/Q-S. This interaction identified cab associatedwithsteamgenerator1and4atmosphericdumpvalves}es as not meeting the separation requirements of Section III.G.2. This interaction was identified in LER 327/84-074 and was subsequently closed in NRC Inspection Report Nos. 50-327/86-40 and 50-328/86-40.

This interaction does not involve a high/ low Loss of Coolant Accident (LOCA) pressure interface but does involve Type 11 spurious i actuation.

REVISED DISPOSITION The licensee has perfortned a reevaluation of its original disposition for this interaction to include the occurrence of cable to cable j shorts as a credible event. This reevaluation has determined that for a fire in the area of the solenoids, both the open and closed 4 solenoid circuits must be damaged to spuriously activate the valve.

The cables for both valves are routed together within a comon conduit which does not contain any other cables. These cables are '

normally deenergized and power is not normally available to spuriously operate the valve. The analysis determined that if a solenoid were energized the only possible cable to cable fault will energize both valves resulting in the operation of the closed solenoid which will close the valve. In the event of fire within other areas of the plant the reevaluation detennined that multiple cable to cable faults must occur in the proper sequence to spuriously operate the valve. '

l In order to ensure safe shutdown capabilities, where cables or l equipment of redundant trains of systems necessary to achieve and i maintain hot standby conditions are located within the same fire area I inside the primary containment, 10 CFR 50, Appendix R, Section III.G.2 requires that one train of hot standby systems be maintained

free of fire damage by providing fire protection features which meet l

l l 1 These valves are also referred to as steam generator Power Operated Relief i

Valves (PORV). ]

l

! i

I the requirements of either Sections III.G.2.d, III.G.2.e, or III.G.2.f.

Maintaining the systems necessary to achieve and naintain hot standby conditions requires that the steam generator PORV's be precluded from opening as a result of a Type 11 spurious actuation.

This is one example of Violation 50-327,328/88-24-01, failure to meet the requirements of Appendix R.Section III.G 2, with regard to maintaining one train of hot standby systems free of fire damage, in that cable to cable spurious interactions were not addressed.

The licensee's reevaluation has determined that a single cable to [

cable short could not result in the spurious operation of the valve.

4.5 INTERACTION NO. 120 DESCRIPTION Reactor Coolant System Inventory Control Keys 4 and 5 for Unit 1 and

2. This interaction occurs at multiple elevations within the Auxiliary Building.

These areas are:

1. The area around the motor driven auxiliary feed water pumps on Elev. 690'.

2. 6.9 kV shutdown board room B on Elev. 734'.

3. General area between column lines All to A14 and U to S on Elev.

714 4 6.9 kV shutdown board room A on Eley, 734'. I S. 480 V shutdown board room 2A on Elev. 734'.

6. Reactor MOV board room 2B on Elev. 749',

7. Vital inverter area 4 on Elev. 749'.

8, 480 V transformer room 28 on Elev. 749',

1

9. 480 V transformer room 2A on Elev. 749'.

iO. Reactor MOV board room 2A on Eley. 749'.

This interaction identified cables for both Volume Control Tank (VCT) outlet valves (FCV-62-132/133) which exist at multiple locations as described above and power cables for Centrifugal Charging Pump (CCP) i 1

4

i  !

i j B. Spurious operation of either valve could cause an inadvertent ,

loss of suction to the operating charging pump. During their initial evaluation of this concern, TVA did not consider spurious valve  ;

operation due to external cable to cable faults, f j The inspection team evaluated the licensee's proposed actions based on previous NRC inspections and concluded that these actions alone l were insufficient. The difficulty arises when the A CCP is operating. A spurious closure of the VCT isolation valve could destroy the operating CCP. The remaining B CCP's cables interact i with the VCT isolation valve cables and this pump too could be destroyed by the same fire scenarios. The A CCP pump has been provided with fire protected cables, i REVISED DISPOSITION In order to evaluate the significance of fire hazards that may affect interaction areas of the VCT i',olation valves and the B CCP. affected l areas in the plant were walked down by NRC inspectors.  !

With one exception all of the areas were free of combustibles (or the  !

potential for combustibles) which could cause an exposure fire i 3

capable of endangering the cable trays. The one exception was the

! Unit 2 A train motor driven auxiliary feed water pump on Elev. 690'.

! Although the pump oil reservoirs only hold approximately two quarts  ;

of oil, there could be significant combustibles in the vicinity of the pump during maintenance activities. In regard to the transformer :

4 rooms the oil used for cooling the transformers is askarel, which is not readily combustible. The inspectors did note that the auxiliary [

feedwater pump and transformer rooms are covered by fire detection '

and autcmatic suppression, in addition, the dikes around the transformer are offset from the cable trays by 8-10 feet. Hence, the pool area would have to be completely covered with oil and ignited to i endanger the trays. This is a situation likely to be prevented by an hourly fire watch.

This is one example of Violation item (50-327,328/88-24-01), failure to meet the requirements of Appendix R.Section III.G.2 with regard i to maintaining one train of hot standby systems free of fire damage,

! in that cable to cable spurious interactions were not addressed. As a result both trains of CCP's could have been rendered inoperable during certain fire scenarios.

! TVA will continue the roving fire watches established per NRC Confir-l mation of Actions letter dated August 10, 1984, in accordance with Technical Specification 3.7.12. The staff accepts the use of existing fire watches as a temporary solution to the interaction problem because the most significant fire hazard occurs intemittent-ly during major maintenance of the A Auxiliary Feed Pump. During these activities extra precautions are taken. Long term corrective 1

i

1 action will be required and will include the evaluation of several possible circuit modifications including an interlock to open the RWST suction when the VCT suction closes. i i

4.6 INTERACTION NOS. 02, 06, 21, 24, 88 DESCRIPTION in addition to the review performed on the disposition of those interactions identified by the licensee, an additional review was performed on a sample of six randomly selected interactions to verify the adequacy of their corrective actions and subsequent disposition.

~

The selected interactions were Interaction Numbers 02, 06, 21, 24, 86 and 88. Of ths interactions selected for review all except i

Interaction Number 86 were found to be appropriately dispositioned.

Irteraction Number 86 is discussed in paragraph 4.7.

4.7 INTERACTION NO 86 DESCRIPTION

Interaction No. 86 identified numerous redundant train cable inter-l actions within the auxiliary building, Elevation 714', comon area.

I This interaction was found to include 14 separate recomended 4 corrective actions required to achieve compliance with the separation 4 requirements of Section III.G.2. Each corrective action was reviewed t

with representatives of the licensee to verify acceptability. No unacceptable conditions were identified during this review axcept as  :

I follows. ,

i i

REVISED DISPOSITION l Corrective action nurber 14 of this interaction did not adequately

]

address fire induced faults which may occur on cabling associated .

t with the normal and excess letdown path RCS isolation boundary.

Specifically, cable to cable faults, which may occur as a result of

fire within this area, had not been considered credible and therefore i based on the licensee's definition of associated circuits of concern were not evaluated further.

Based on the inspectors' concern of the possible spurious actuation of the normal and excess letdown RCS pressure boundary, the licensee performed a reevaluation of this interaction to include the occurrence of cable to cable faults as a credible event, j -  ;

1 Subsequent to this reevaluation the licensee revised the disposition  !

I of the identified interactions by perfortning an analysis which demonstrates that the loss through the excess letdown path does not warrant further consideration since a 3/8" orifice will limit the i riaximum possible flow through this path to well within the makeup i capability of a single centrifugal charging pump. The analysis 10 -

l

I further demonstrated that in the event of the spurious operation of j the normal charging flow path, the maximum net loss from the system would be 57 gpm. Using this calculated flow mismatch, the analysis ,

concluded that the operators would have in excess of 1 1/2 hours to isolate the letdown line. In addition, the licensee has comitted to revise existing procedures to require the isolation of the instrument control air to containment during any event which results in an unanticipated loss of pressurizer level.

In order to ensure safe shutdown capabilities, where cables or equipment of redundant trains of systems necessary to achieve and maintain hot standby conditions are located within the same fire area inside the p imary containn nt, 10 CFR 50, Appendix R, Section Ill.G.2 requires that one train of hot standby systems be maintained free of fire damage by providing fire protection features which meet the requirements of either Sections III.G.2.d. !!!.G.2.e. or

!!!.G.2.f.

This is one example of Violation item (50-327,328/88-24-01), failure to neet the requirements of Appendix R.Section III.G.2 with regard to maintaining one train of hot standby systems free of fire damage, in that cable to cable spurious interactions were not addressed for ,

the normal and excess letdown path RCS isolation boundary valves <

which constitute a high/ low LOCA pressure interface.

It is the staff's opinion that the revised disposition adequately  :

addressed the interaction. -

l 4.8 INTERACTION NOS. 13, 74, 77 AND 85 l Based on the findings obtained during the inspectors' review of a i random sample of interactions, it was determined that the licensee's original submittal of interactions which had not considered the occurrence of cable to cable faults may have been incomplete. At the inspectors' request, the licensee performed an additional evaluation i of interactions based on considering cable to cable interactions caus- )

! ing multiple spurious actuation of valves previously considered to be "incredible" as had been noted in Interaction No. 86. This reevalua-tion identified the following additional interactions which pertain to l Unit 2. Interaction Nos. 13, 74, 77 and 85. Interactions 13, 77 and 85 did not consider cable to cable shorts as a credible event to

! initiate RCS depressurization through letdown paths. The disposition

of these interactions is identical to interaction number 86 addressed previously. The same systems and interactions were evaluated.

Interaction Number 74 did not address the occurrence of cable to cable shorts which may result in RCS depressurization through the reactor head vent. The reactor head vent system has been previously demonstrated by TVA as not meeting the definition of a LOCA since a 3/S" orifice located in this line will limit any possible loss to a l

l 1

{

l value which is less than the makeup capability of a single CCP. This ,

item is closed.  ;

4.9 _ ANNULUS AREA INTERACTIONS (UNNUMBERED AS OF THIS INSPECTION) j At the request of the NRC staff, TVA performed an analysis of RCS  ;

letdown path interactions within the primary containment. These interactions are documented in QlR SQP-SQN-88-238 R1.

Two interactions in the annulus required the addition of suppression /

detection in order to satisff Appendix R Section !!I.G.2. These  ;

interactions are located at AZ 303' to 355* where the 340 A PORV cable 2V5612A interacts with the 332 block cables 2V2445B and i 2V2447B and AZ 290' to 347' where the 334 PORY cable 2V55988 ,

interacts with the 333 block cables 2V24651A and 2V2453A.

The licensee has installed additional sprinkler heads and smoke detectors to the annulus area for these interactions. The staff

noted that the annulus area is fire protected in accordance with the provishns of Section Ill.G.2 of Appendix R to 10 CFR 50 that pertains to fire protection inside non-inerted primary containments. i The staff also noted that the fire suppression was designed to cover the interaction areas only and not provide area-wide fire suppression '

capability inside the annulus. The annulus does have area wide fire detection.

The staff had evaluated the pre-action fire suppression system as originally proposed for the annulus and approved it in Supplement 1 of the SON SER (NUREG-0011). The staff's approval was based on the system being designed in accordance with NFPA 15 as well as having ,

all exposed cables within the area coated with a flame retardant. '

It is the staff's opinion that this suppression system as modified

! will function as desigred and will meet the hydraulic performance criteria of NFPA 15. In addition, all non-lEEE-383 cables have been coated with flameastic. Although the existing closed sprinkler heads i are not near the ceiling, most are approximately level with o.' belcw the constricted spaces between the walkways and the concrete contain-  !

ment. This location along with heat collectors ensures that the sprinklers will open promptly from a developing fire. The new j sprinklers which were installed are the quick response type designed '

for in rack storage protectien and are located so as to protect the

horizontal trays in the interaction areas.

The detection system for the pre-action valve is a Class A cross

! zoned system using photoelectric detectors. Each interaction area j has at least two detectors, one in each of two zones. Only one detector in a zone has to alarm for the zone to be in an alarm state.

When two zones are in an alarm state, the pre-action valve opens and water flows to the heads which will then epen according to the heat output and location of the fire. As required by NFPA 720, the system l

l 1

1

is supervised and will register an audible trouble alarm by zone in the local control pahel and an indication of trcuble by local panel on the main fire panel in the control room. An actual valve opening and fire pump start is identified by zone.

The licensee performed an analysis in April 1986 showing the adequacy '

of the system to supply additional sprinkler heads (some of which were added in 1986) and verifying that partial area coverage is adequate for protection of the previously identified interaction areas. This analysis was revised in March 1988 to include the new sprinkler heads and the system (including water supply) was found to  :

be adequate.

Protection of this previously unidentified interaction will provide for a fire protected RCS alternate letdown path as well as prevention

! of high/ low LOCA pressure interface spurious actuations associated j with the pressurizer PORV and block valves.

Based on the results of the licensee's recent Appendix R reevalua-tion, Sequoyah Unit 2 was not in compliance with 10 CFR 50 Appendix R Section III.G.2 on March 14, 1988. It appears that if a fire were to occur in the annulus areas identified, redundant hot standby systems could be rendered inoperable; thus, the plant's ability to achieve 1 and maintain hot standby could not be assured. Therefore, this is identified as an example of Violation item 50-327,328/88-24-01, l failure to meet the requirements ~of Appendix R, Section !!!.G.2, with regard to maintaining one train of hot standby systems free of fire damage, in that cable to cable spurious interactions were not 4

addressed. ,

The staff concludes that the fire protection improvements being added a to the annulus will provide adequate protection to these interaction areas. The corrective action was inspected on March 23, 1988 and 4 found acceptable with the exception that caps will be required on the auxiliary drains. The licensee has agreed to provide these.

5. PROCEDURE REVIEW The inspectors reviewd Special Maintenance Instruction, SMI 0-317-18 "Appendix R - Casualty Procedures," Revision 1, dated February 18, 1987 and associated Instruction Change Form (Change No. 88-0601) dated March 12, 1988. This procedure defined the required maintenance actions necessary when a postulated fire damages certain identified equipment.

Entrance into this procedure is initiated by System Operating Instruction, 1 S01-26.2, "Fire Interaction Manual." The inspectors reviewed the I procedure for required actions and observed the material in storage required for performance of the procedure. The inspectors discussed the work to be performed with TVA personnel and performed a plant walkdown to 1 observe selected areas where the work would be perfomed. The walkdown i included observation of a sample of cable routings to be followed when procedures require the installation of jumpers between items of plant l

- 13

)

equipment. Within the scope of the procedure review and plant walkdown, the inspectors identified no concerns.

The NRC inspectors reviewed the procedures listed below relative to required actions in the event of a fire at Sequoyah:

Abnormal Operating Instruction, A01-27. "Control Room Inaccessibility," Revision 9, dated January 15, 1988, i

A01-30, "Plant Fires," Revision 6. dated January 24, 1988.

Emergency Instruction, E-0, "Reactor Trip or Safety injection,"

Revision 3 dated January 8, 1988.

System Operating Instruction, 501-3.2, Auxiliary Feedwater System,"

Revision 39, dated March 13, 1988 50!-26.2, "Fire Interaction Manual," Revision 7, dated March 12, 1988.

501-26.3, "RCS Boration During A Fire Related Loss of CVCS Letdown and Boric Acid Makeup," Revision 2, dated March 12, 1988.

In addition to reviewing the above procedures, the inspectors perforned walkdown evaluations of eleven selected eperator actions required either l during or following various plant fire scenarios. The walkdown was perfortned to evaluate the required actions and observe the equipment to be i

utilized in the performance of the required actions, in addition to the walkdown, the inspectors discussed required actions with reactor unit operators, i

The inspectors also performed walkdowns of manual actions required in case of a loss of control air (Key 13 of 50126.2) during or following a fire. .

l These manual actions included throttling the flow to the steam generators I l

(S/G) with manual valves (Key 12), handwheel operation of the S/G 1evel control valves (Key 16), handwheel operation of two of the S/G FORVs. and operation of darrpers for the main control room air conditioning.

Based on the procedures reviewed and the walkdowns perfomed, the

! inspectors suggested some minor changes to 501 26.2. These procedere changes were discussed with the TVA Unit Operator who was in the process of reviewing 501 26.2 for needed revisions. The suggested changes I included:  !

• Specifically identifying the controllers used in corrective actions 1

relative to S/G FORVs. The procedures referenced the numbers for the PORVs; however, the controllers do not have the same number.

4 Correct the pro"edures which refer to the fact that control airlines i

to the S/G PORVs have fusible links located in the valve vaults. The l

]  :

r fusible links were observed to be installed in the containment annulus and/or the 480 Volt Shutdown Board Room.

Prior to the end of the inspection, a draft of proposed changes to the procedure was shewn to the inspectors. The proposed changes were found to be satisfactory to address the inspectors' suggested changes. No other

concerns were 10entified by insptctors during the procedure reviews and

! walkdowns. I j 6. STEAM GENERATOR PORY PLANT MODIFICATION DOCUMENTATION The NRC inspectors reviewed plant ncdification documentation pertaining to the relocation of the pilot solenoid valves,1/P converters, and associat-ed items (3-way-valves and hand controllers) of the steam generator PORVs from the valve vaults to less severe environments. Unit 2 solenoid valves 2-PSV-1-6A and B and 31A and B, converters 2-PM-1-6 and -31, and associated J' items were removed from the west valve vaults to the 480 Volt Shutdown Board rooms on elevation 734 Unit 2 solenoid valves 2-PSV-1-13 A and B and -74 A and B, converters 2-PM-1-13 and -24, and associated items were noved from the east valve vault to the Reactor Building annulus.

The inspectors performed a plant walkdown and observed that the installa-tions of the Unit 2 solenoids and associated items in the annulus and 480V Shutdown Board rooms had been completed. The inspectors also visually l inspected the mounting of the valve positioners on their respective PORVs l in the east and west valve . vaults.

The inspectors reviewed the issue of spurious actuation of the steam generator POPVs as part of their overall review of TVA's analyses of electrical cable interactions. Spurious actuation of the PORVs is discussed in this report under the discussion of TVA's Interaction <

j Analysis Number 118 (see paragraph 4.4). j

7. INSTRUMENT SENSE LINES a

j During the licensee's reiiew of Appendix R effects on sense line accuracy, l CAQR SQP 870857 was written to establish the design criteria for instru-i ment sense lines separation requirements. Corrective action for this CAQR 1

resulted in CAQR SQF 870151 which identified the interactions of required sense lines. The corrective actions involved a fire hazard analysis for inside containment instrumentation identified sense line interactions.

This analysis proved that fire effects will not adversely affect the t

required instruments and identified the alternate instruments which will j be available to assure required main control room indications. This i analysis is documented in SQN-00-005 2; EPM-EAC-011888, QIR-SQP-SQN-88-212 and January 20, 1988 memorandum from D. A. Boy 11 to R. E. Daniels. It should be noted the,t in the new analysis TVA has taken credit for the additional instrumentation which was not included in the previous l Appendix R analysis. TVA has included these instruments in the Appendix R analysis.

]

b .

The analysis consisted of determining the location of instrument sense lines and potential fuel sources that might affect t%n. The only viable j fuel sources identified were the Reactor Coolant Purps one and two which  !

have oil collection systems and the control red drive mechanism cables  ;

which are insulated with a Silicone Rubber C l Resistant Asbestos Jacket  !

l (SROAJ), a non-combustible material. For the purposes of analysis, the ,

licensee used heptane as the fuel Aurce from thed pumps and PVC as the fuel source for the cable insuletion. Both o these assumptions add

~

l significant conservatism to the analysh .

j In the analysis. TVA used a computer program, FIRST, developed by the ,

1 National Bureau of Standards. The FIRST program calculates radiant and l convective energy transfer from a fire to nearby objects. From this heat ,

transfer analysis, the maximum temperature of the sense lines was determined. TVA used 600'F as the temperature that would damage the sense lines. ,

TVA has also performed analysis for outside containment instrumentation in 50N-ISL-003 to document the effect of fire on instrument accuracy and determined that in most cases the required instrument accuracy will not be met. However, for all these cases an alternate path was available through a different fire zone and, therefore, unacceptable errors caused by the j fire do not pose any problem.

i The staff has reviewed the TVA analysis and has perforried a walkdown in  :

the containnent building to verify that TVA's approach was reasonable and

, had adequately resolved the concern with the instrument sense lines. The staff concurs with TVA's evaluation. This item is closed.

8 HEATING VENTILATION AND AIR CONDITIONING (HVAC)

Two concerns had been raised in regard to the effect of fire on tempera-tures in safety related aress. One concern was the possibility of high temperatures induced by ths fire itself in adjacent areas before dampers could close. The other rancern was the slow rise in temperatures due to .

the loss of HVAC.

L i TVA determined that the only locations which have a direct opening  ;

(dampered) between two fire areas in an area without sprinklers were t j between the pipe chases and pump rooms and a pipe chase and the Volume 1

Control Tank (VCT) room. Of these areas only the VCT is considered i necessary for shutdown. The fuel load in the pipe chase is very low, I consisting only of the motors on motor operated valves and individual i i cables. The VCT room is approxinately 20' X 20' X 20'. TVA concludes and l

! the staff agrees, that the small fuel load in the pipe chase cannot i I

j provide significant heating to the VCT room.

I All other locations involving a direct opening in a fire barrier had j sprinklers either on both sides of the barrier or had sprinklers located j where there was a significant fuel lord.

l l

1

s t k

s ThestaffhasconcludedthatHVACductdamperswouldcloseYefore significant heat transfer' between the enclosed duct and the roa! dould be '

obtained. N The staff has also concluded that there are no locations at SON where the temperature of Appendix R equipment could exceed th0 equipment s' qualified 5 temperature due to a fire in an adjacent area. i J

> 1 In regard to HVAC loss during a fire, TVA identified two areas where' temperatures may increase above or approach the qualification te79tchtur4s 4

4 of the equipment. These areas are

S , P, ,'/

t'

/ ,1 l3 o t

1. 480 V Transformer Room 2A, and #

+

, _i

) ,.; si

2. 480 V Transformer Room 2B. <

/' b

( '

Actionstakentomitigatetheconsequencesofafireintbkt,eavhlsare discussed in S0I 26.2, Revision 8, Attachment A. The NRC has revdwed the HVAC data developed by TVA and the actions proposed and consir'grs them to be sufficient to preclude aoverse t' mperature e effects, i(,

I

\ \

t '4 .r ,

[ ]

8 1 t

/

's

? h'l j ,/

b

/

t'

~ ,Y l

. J

$ \

//;

o

, t

-l l 1 i w!

/

s

.\

/

q

\

)

\  % g < f i i d i

,( ,

) {

b\ >

4  ;

A) e p

i -, .r

, s f

(

4

)

' / t -

s', i .

>> i t \ s 1

f' i-

)

/

/ ENCLOSURE 1

/ ,

/

f i l

/ \

' I l ,

v o n'

,9

I t ,

i/s

\ ., < r, \

, .1 s Y / 9 j

s, ,/ .

I ) , a .

$ a j

! ,+ A., >/ (t, ,

l f (

4 ,

h t

)

'y

/

c

, i i g

• / /

\_ ' \

, / '

) . , /. ,..

l ',

• J

) g- i e ,

T 1

g . < s '

'?

j i g

' i , 1

k. )

L;; /

-- a hd .

l l

SAFETY EVALUATION Questions Based on Alleger's Concerns The Sequoyah Nuclear Plant (SON) Unit 2 is committed by license condition 2.C(13)c to sections III.G, J, L, & 0 of 10 CFR 50, Appendix R. Based cm these l recuirements, the Tennessee Valley Authority's (TVA) Nuclear Engineering i prepared a safe shutdown logic analysis for Sequoyah which was documented in calculation SQN-SQS4-127. Revision 6 and earlier versions of this analysis formed the design basis for SQN. These versions were used by the Nuclear Regulatory Comission (NRC) as part of the review of Sequoyah Nuclear Plant's compliance to Appendix R. During TVA's Calculation Verification Program the Revision 6 analysis was found unacceptable due to some unverified assumptions and requirements and Condition Adverse to Quality Report (CAQR) (SCRSQNNEB8637) was issued. While regenerating the calculation, additional licensee developed requirements were included and the calculation was issued without operations review or extensive internal review by the TVA engineering branchs. The addition of these additional requirements beyond previous comitments and the lack of interface between TVA design engineering and Sequoyah Plant operations became significant factors which prevented the revised analysis from replacing the Revision 6 analysis as the design basis for SON. During the resolution of these discrepancies, additional issues were raised by TVA and their contract engineering personnel on the implementation of these requirements. TVA formed a review team to address the issues raised and to provide information to the Sequoyah Project Engineer so that a determination could be made on which items were required to be completed before restart.

Concurrently, the NRC was informed by a previous TVA contract employee that his contract had not been renewed by TVA because he had raised safety concerns.

The NRC conducted lengthy transcribed interviews with the 311eger on January 29 and February 3, 1988, and discussed the alleger's concerns informally on numerous other occasions. As a result of these interviews, the NRC developed a list of twenty-six questions which, the alleger agreed, captured the essen-tials of the allegations that had been made. These questions were sent to TVA by letter dated February 26, 1988. Those issues which were not specifically addressed within the context of the alleger's 26 questions are included with their disposition as Attachment 1 to this enclosure. The alphanumeric designators refer to numbers in the Appendices in Revision 7 to which these concerns apply. l By letter dated February 27, 1988, TVA submitted Revision 8 to the Sequoyah Appendix R. Safe Shutdown Logic Analysis. By letter dated March 2, 1988, TVA responded to the staff's 26 questions. The staff requested additional informa-tion on Question 12, spurious actuations, to which TVA responded on March 9, 1988. On March 9, 1988, the NRC held a transcribed public meeting with TVA to discuss TVA's responses to the questions. During the meeting the alleger nrovided questions to the staff on the matters being discussed, some of which

were asked on the record by the staff. At the end of the meeting, the alleger was given the opportunity to provide his views for the record. After the meeting and a preliminary review of the TVA submittals, the staff concluded that there was insufficient information to resolve all the allegations received. Spstifically, concerns remained in a number of areas including  ;

spurious actuations of equipment due to cable-to-cable electrical interactions i as a result of a fire; provision of a reactor coolant system letdown path to i comply with Appendix R requirements; adequacy of TVA procedures for actions l during a fire, and HVAC temperature considerations. To resolve these concerns, l the staff conducted an Appendix R inspection at Sequoyah. A fire protection expert from the Brookhaven flational Laboratory with expertise in electrical interactions and previous NRC fire protection inspections participated in the inspection.

The inspection began on March 14, 1988 and was completed on March 18, 1988. An exit meeting was held with the licensee on March 18 during which the licensee was informed of the specific inspection findings and licensee commitments for modifications and other corrective actions were obtained. The results of the inspection are summarized in Inspection Report 50-327,328/88-24. A close-out inspection of the installed suppression / detection in the Unit 2 reactor annulus was performed on March 23, 1988.

Based on their review, the staff concludes that some of the issues raised as allegations are in fact enhancements to TVA's Appendix R program at Sequoyah, other issues will not preclude startup; as such, all the issues will not be closed out prior to authorizing restart of Sequoyah 2. In those instances where the item remains open, the following staff Safety Evaluation clearly notes this and provides justification to support Sequoyah Unit 2 restart.

l

l QUESTION 1:  !

Provide the calculations supporting the TVA Task Group's opinion that the release of RCS water into the containment with only technical specification allowable levels of failed fuel does not result in an unacceptable off-site '

dose and thus the need for containment integrity as described in A.2 -

Radiation Release to the Environment - of TVA's "Task Group Disposition of Issues."

EVAL.UATION This question stenned from a concern raised in Revision 7 of Nuclear Engineer-ing Branch Calculation NEB 840913 222, "Equipment Required for Safe Shutdown per 10 CFR 50, Appendix R." that postulated the loss of containment integrity as a result of spurious actuations. TVA's Task Group which reviewed this evaluation of the safe shutdown logic calculation on Appendix R stated that

...it is the task group's engineering judgement that the release of RCS water into the containment with nominal activity would not result in an unacceptable offsite dose and thus mandate the need for containment integrity..."

The alleger emphasized that Reactor Coolant System boundary integrity could be lost through spurious actuation of valves such as the Reactor Head Vents or the Pressurizer Pressure Operated Relief Valve (PORV) and this coupled with spurious actuation of containment isolation valves could result in the above scenario. The licensee responded by addressing the potential radiation hazards assuming the above scenario (which they do not agree to be credible) did occur.

Spurious actuation is addressed separately under Question 12.

The licensee performed a conservative scoping calculation of reactor coolant system spills into containment during an unisolated purge operation to determine the offsite dose.

The licensee's analysis (SQNAPS3-086) assumed an expected failed fuel fraction corresponding to ANSI /ANS Standard 18.1-1984, fission product activity in the primary system, an iodine peaking factor of 10, no holdup in containment, no dilution in containment, an instantaneous spill of coolant, and an efficiency of the containment purge HEPA filters and charcoal beds consistent with that used for the containment fuel handling accident described in Final Safety Analysis Report, FSAR Chapter 15.5.6. Plots were made for various fractions of reactor coolant inventory spilled to containment. Spill fractions up to 100 percent of the RCS inventory were plotted. As demonstrated by the plots, even with the bounding assumptions, offsite doses were considerably less than 10 CFR 100 limits. In the rare event of RCS conditions approaching levels of ,

technical specification faileo fuel limits or other compounding failures, l offsite doses would be expected to be higher than those plotted. It should be l noted that the failed fuel history for Sequoyah has been better than that assumed in the ANSI standard. Also, the following defense-in-depth must be noted: ,

l I

___.,_...y -

1. From a practical standpoint, the only path for release of radioactivity from the containment to the environment is through the pu,3 system.

2. The exhaust line has three fail-closed valves in series. If any of these valves close, a release will be terminated.

3. Should the valves not close, there are HEPA filters and charcoal beds in the exhaust lines.

4. On the supply side, the same three valve combination exists; however, there are no HEPA filters or charcoal beds in the line. There are four fail closed dampers in the supply line that the operators could close to terminate a release of radioactivity to the environment.

5. All valves and dampers close automatically if a radiation signal is received.

6. There are a variety of other actions that the operator can take to preserve containment integrity or mitigate offsite releases.

The NRC has reviewed the licensce's evaluation of this issue and concurs with the evaluation. The staff concludes that this issue is resolved.

l

j QUESTION 2:

Provide the information supporting the TVA Task Group's conclusion that boiling of the spent fuel pool is not a technical concern. With respect to this conclusion address the HVAC system's ability to rapidly and effectively mix ar dissipate steam ingested into the ventilation system. Provide justification that any resulting condensation would not adversely affect safety related equipment. Discuss effects of any resulting contamination.

EVALUATION TVA evaluated the possibility of spent fuel pool boiling occurring as a result of fire damage to the spent fuel cooling system and determined that the pool could boil at a rate of approximately 55 gal /mir. TVA also determined that with the HVAC system in operation, steam would not be transmitted into other l areas of the auxiliary building. Without the HVAC system in operation TVA states there will be a negligible temperature rise in the refueling building.

In regard to condensation, TVA has determined that the minimum components located in the refueling area that are necessary for safe shutdown are cables from the diesel generators. These will not be affected by condensation or by temperature of approximately 100*F.

In regard to radioactive contamination, TVA stated that safety-related eqcipment is qualified to much higher radiation levels than will result from spent fuel pool boiling.

In regard to off-site dose, an analysis has been performed to calculate the dose resulting from spent fuel poci boiling at the South Texas Nuclear Project.

This analysis was based on conservative assumptions similar to those used by TVA and resulted in a 30 day LPZ thyroid dose of approximately 0.54 ren. The staff considers this dose to be small in comparison with the limiting thyroid dose in 10 CFR 100 (300 rem thyroid dose) and will not require a similar analysis from TVA.

The staff concludes that this issue is resolved.

QUESTION 3:

Provide results of the procedure review conducted to review the coordination of procedures .for fire effects to determine if there are potentially confusing areas between procedures as discussed during the NRC/TVA staff meeting in Knoxville on January 5, 1988.

EVALUATION During a meeting with NRC personnel in Knoxville, Tennessee on January 5,1988, the TVA Appendix R Peview Team recomended, as a post restart iten, that operating procedures which the operator may use during a fire be reviewed for potential conflicts. This issue came from a requirement of Revision 7 to Design Nuclear Engineering Calculation SQN-5054-127, "Equipment Required for Safe Shutdown During Design Basis Fire." A memorandum discussing chis action was written from J. B. Hosmer to R. J. Johnson and S. J. Smith dated February 10, 1988 (B25 880210 101). A review / training request was made to the operations procedures staff and the training staff. Use of both staffs should maxinize the expertise, mininize the impact on operations, and reinforce knowledge on special Appendix R considerations. The review has not yet been completed.

Sequoyah Nuclear Plant (SON) has minimized the spurious actions that could occur as a result of a fire. This should in turn minimize the need for operators to enter and exit multiple procedures. -

The emergency operating procedures assure the operator knows how to get to hot stanoby independent of the cause of any event. In events where operator actions could be centrolled from several procedures, the operators are required to assess the plant situation and, based on their training and experience determine what actions are of the highest priority. The procedures have a structured hierarchy, backed by training, that assures the operators will treat the most important conditions first. The licensee's approach is to satisfy the status tree function (subcriticality, core cooling, heat sink, pressurized thermal shock, containment, inventory), satisfy the emergency procedures, stabilize the plant, and then to proceed to cooldown.

The staff is in agreement with this approach end agrees with TVA that accomplishment of a procedural interaction review, although not required, would represent a useful endeavor.

QUESTION C:

Describe how S01 26.3, Revision 1, provides adequate boron concentration for a cold shutdown condition after a worst case Appendix R fire. If "pressurizer level fluctuation" is used as a depressurizing mechanism provide the procedures controlling this evaluation and provide the calculations showing its effective-ness; i.e., depressurization rate vs. time. Provide the calculation justifying use of one train of Residual Heat Removal (R"R) to cool toe plant to less than 200 F. Provide the performance curve fo* ore train of RHR. Discuss availabil-ity of an operable pressurizer PORV, pressurizer heaters, auxiliary spray and nonnal spray for postulated fire scenarios.

EVALUATION Prior to establishing an Appendix R protected Peactor Coolant System (RCS) letdown path, TVA utilized S01 26.3, "RCS Boration During a Fire Related loss of CVCS Letdown and Boric Acid Makeup," to provide for boron addition to the RCS following some Appendix R fire interactions. Boron is reouired as a neutron absorber to ensure adenuate shutdown margin to maintain the reactor suberitical during cool down. Several factors enter into the physics calculation governing the shutdown margin. These include, among other considerations, the Xenon condition, the fuel cycle, the time in the fuel cycle, the initial boron concentration and the cooldown rate.

Additional boron is not required for at least 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown after a fire. This is the time which results from a maximum expected Xenon condition and resulting Xenon decay curve. Normal, excess, or alternate letdown can be used for RCS letdown to allow boration of the system. The licensee performed a reviseo reactivity analysis which indicated that a boration rate of 15 gpm initiated at various times following shutdown depending on the fuel cycle and Xenon concentration is sufficient to maintain the core in a suberitical condition. This flow rate is less than the charging flow used to provide reactor coolant pump seal cooling. Seal cooling is required one hour into the event. Therefore, normal seal flow injection will meet the boration requirement and the residual heat removal systei is not needed for reactivity control. TVA is evaluating the continuing need for S0I 26.3 since seal injection flow will meet the boration requirements and may delete or consolidate this guidance into 501 26.2.

Pressurizer level fluctuation is not used as a means for depressurization in this procedure. TVA has completed plant modifications to provide a protected letdown path for the Appendix R event.

Westinghouse has analyzed for Sequoyah Unit 2 several cases for plant cooldown using one train of RHR. These analyses demonstrate that cold shutdown conditions can be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Note that a more rapid cooldown to RHR conditions is not a reactivity control requirement.

Pressurizer heaters, auxiliary spray, and normal spray are not required to support safe shutdown but may be used by the operators when consistent with their availability following an Appendix R event.

The NRC staff has reviewed the licensee's evaluation of this issue and concurs with the evaluation. This issue is considered resolved.

t i

i i

1 QUESTION 5:

Provide the clarification of the minor revision to shutdown logic on Key 37 as discussed in A.9, "Pneumatic Systems of the Task Group Disposition of Issues."

Does TVA take credit for use of any control air system during an Appendix R event? Can the plant be shutdown and controlled including operating in a solid configuration if needed without the use of the air system? Please provide justification to support any statements recarding your conclusions.

EVALUATION The licensee performed a safe shutdown analysis and documented the results in calculation SQN-SQS4-127, Revision 8. The minor revision to Key 37 of that document added a note that manual control of the control room HVAC dampers could be taken to maintain control room temperature in the event control air was not available to provide automatic operation.

The licensee's safe shutdown analysis did not credit the use of air systems to reach safe shutdown. However, if air remained available, it would be used to normally operate valves. Manual actions are taken as a backup to manipulate devices in the event the air system is not available.

The licensee performed an analysis on Unit 2, and with the installation of sprinklers in the annulus in accordance with DCN X00 186B, a letdown path will be available for all fire scenarios.

The licensee has determined that in the unlikely event the plant is placed in a water solid condition and air systems are not available, pressure control can be maintained. The charging pumps are used to provide plant makeup and control pressure during plant cooldown; whereas, over-pressure protection is provided by the primary system safety valves. Plant pressure can be lowered by letdown until entry into Residual Heat Removal (RHR) cooling is possible.

The NRC staff has reviewed the licensee's analyses and concurs with them.

9

QUESTION 6:

Explain why the primary plant will not lose the pressurizer bubble in any fire scenario such that 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> is a conservative value for requiring the avail-ability of RHR. Does TVA take credit for plant operations in a water solid condition to cooldown following a fire and prior to entering cold shutdown? If so, describe the operating procedures and nperator training which is conducted for these water solid plant operations.

EVALUATION TVA has protected the pressurizer PORY and pressurizer block valve from spurious actuation. In addition, letdown through this path has been estab-lished as an alternate letdown path. TVA has also demonstrated that an interaction between the RHR valves FCV-74-1 and FCV-74-2 and the pressurizer FORV and pressurizer block valve does not exist. As a result the plant should not lose the pressurizer bubble in any fire scenario and RHR should be avail-able through manual actuation if ~necessary for any fire outside containment.

Any fire inside containment will not affect both the pressurizer PORV and block valve and the RHR valves.

There is no TVA or NRC requirement that the plant must be in cold shutdown or on RHR within 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />. The only case where the plant must be in cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is if an alternate shutdown method is used (i.e., abandonnent of the main control room and transfer to the auxiliary control room). The only other time constraint imposed by Appendix R is that if equipment required for cold shutdown is damaged by a fire, it must be repaired and made operable within 7? hours. ,

For fires outside containment access to containment to manually position affected valves ensures that cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> can be attained. A postulated fire inside containment cannot simultaneously render all letdown paths and the PHR valves FCV-74-1 and FCV-74-2 inoperable.

Since containment accessibility is not compromised by a fire affecting the RHR valves FCV-74-1 and FCV-74-2, these valves could be manually opened or repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following such a fire.

TVA does not take credit for plant operations on a water solid condition to cooldown following a fire and prior to entering cold shutdown.

Water solid operation has a low probability of occurrence, is not the preferred method of cooldown for SON and is not emphasized in operator training; never- l theless, see the response to Question No. 5 for the method of control in the event of a solid water condition.

The NRC staff has reviewed the licensee's evaluation of this issue and concurs with the evaluation.

QUESTION 7:

Provide justification for repair times for FCV-74-1 and FCV-74-2. State why these valves are considered operable for fires inside containment. In particular provide valve location information and describe how persons entering containment following a fire could be expected to repair and manually position these valves. If reactor head vents, pressurizer block valves and the pressurizer PORV are spuriously opened, discuss the effect on containment environment and RHR valve accessibility.

EVALUATION This question stemed from a concern raised in R7 of Nuclear Engineering Branch calculation SQN-SQS4-0127, "Equipment Required for Safe Shutdown per 10 CFR 50, Appendix R " that postulated the inability to enter containment to repair RHR letdown valves which are needed to achieve a cold shutdown condition. The inability to enter the containment could be caused by spuriously opened reactor head vent valves which were opened by the same fire which damaged the RHR letdown valves. The TVA Task Group in their final report dated January 20, 1988, stated in their resolution of item B.5, Spurious Opening of Reactor Head Vents, that "...for a fire inside of the containment the fire brigade has to make an entry into containment to fight the fire." Thus, TVA asserted that access by additional personnel would not be an issue.

The staff requested additional information from TVA in regard to system layouts and verified the information with an inspection inside the primary containment.

TVA determined that the only interaction between the RHR valves and any alternate letdown path is between RHR valve FCV-74-1 and reactor head vent valves FSV-68-394, 395, 396, and 397. The vent valves and associated cables are approximately 17 ft (horizontally) from and more than 20 ft above the RHR valves. In addition, the cables to the vent valves are in steel conduit with no adjacent energized cables which could cause spurious opening of the valves.

The staff has reviewed the TVA drawings and agrees with TVA's analysis. The staff has concluded that a fire which damages the RHR letdown capability and causes alternate 'etdown inside the containment is not a credible event and the interaction does not have to be protected from fire in accordance with section III.G.2.d of Appendix R to 10 CFR 50.

QUESTION 8:

Discuss the possibility of lubrication oil from the Main Peactor Coolant System Pumps being thrown beyond the oil collection system due to a break in the shaf t, shaft collar or lower oil pan assembly.

EVALUATION This issue was raised by the alleger while he was being interviewed by the NRC staff. The alleger told the NRC staff that another engineer had voiced a concern about the Reactor Coolant Pumps.

The existing oil collection system has been determined to be adequate after reinspection by a fire protection engineer. There are no known problems in regard to shaft breakage associated with other Westinghouse reactor coolant pumps. Also, it appears that even if the shaft should break coincident with a lubricating oil leak, oil will still not be thrown out of the housing, beyond the oil collection system.

The NRC staff has also inspected the Reactor coolant pumps and agrees with TVA's conclusion. The reactor coolant pump oil collection system was inspected and approved by NRC in inspection report 50-327/85-01 and 50-328/85-01.

e 1

e i

QUESTION 9:

Describe the protection and provide a copy of the fire analysis for steam generator PORV controls. Are the Boron injection Tank, Boron Injection Pumps, Safety injection Pumps and the automatic actuation of charging pumps included in the Appendix R functional criteria?

EVALUATION A modification (ECN 6689 and FCR 5717) to the steam generator power operated relief valves (SG PORVs) associated with steam generators 1 and 4 ensures that a fire will not cause the SG PORVs to spuriously open. The other two SG PORVs associated with steam generators 2 and 3 are not subject to a fire exposure which could cause them to spuriously open. This is documented in item 8 of the QIR SQP-SQN-68-212 R0 (B29 880229 001).

The licensee has performed a reevaluation of its original disposition for the interagtioncablesassociatedwithsteamgenerator1and4atmosphericdump valves to include the occurrence of cable to cable shorts as a credible event.

This reevaluation has determined that for a fire in the area of the solenoids which control the opening of the steam generator PORV, both the open and closed solenoid circuits must be damaged to spuriously activate the valve. The cables for both valves are routed together within a common conduit which does not contain any other cables. These cables are ncrmally deenergized and power is not normally available to spuriously operate the valve. The analysis I determined that if a solenoid were energized the only possible cable to cable fault will energize both valves resulting in the operation of the close solenoid which will close the valve. In the event of fire within other areas of the plant the reevaluation deternined that multiple cable to cable faults must occur in the proper sequence to spuriously operate the valve. Since the licensee's reevaluation has determined that a single cable to cable short could not result in the spurious operation of the valve, this item is closed.

The licensee's safe shutdown analysis demonstrates that safe shutdown can be achieved and Appendix R requirements satisfied without the baron injection tank, boron injection pumps and safety injection pumps. The charging pump automatic actuation is also not necessary to achieve safe shutdown or to comply with Appendix R. However, the manual operability of at least one charging pump has been assured as discussed in Question 18.

The staff considers this issue resolved.

1 These valves are also referred to as steam generator PORV's.

QUESTION 10:

Describe the effects of a Main Steam Line Break and a resulting steam generator PORV opening spuriously. Describe the environmental cualification of the PORV including seismic. Is the FORV single failure proof? Discuss whether the Appendix R functional criteria specifically called for no blowdown of any steam generator.

EVALUATION 2

A break in the main steam line and a simultaneous steam generator PORV o wculd result in a decreasing Departure from Nucleate Boiling Ratio (DNBR)gening and a cooldown of the primary systen. A main steam line break downstream of the flow restrictor plus a spurious SG PORV blowdown is bounded from a core response standpoint by a stean line break upstream of the flow restrictor.

This event is similar to the large steam line break described in FSAR Section 15.4.2.

Westinghouse has analyzed a two steam-generator blowdown generically as part of the Emergency Response Guideline development. This best estimate analysis demonstrated that the DNBR remains above 1.30 and that the safety injection system capacity is adequate (TVA's NEB 880314 619).

The problem addressed in this question is not an Appendix R issue. Aopendix R does not require postulation of coincident fire with other accidents nor does it specify environmental qualification requirements for ecuipment. A Condition Adverse to Quality Report (CAQR) is being evaluated by the licensee that addresses fire, seismic and Main Steam Line Break (MSLB) as initiating events for failure of more than one SG PORV. The Appendix R initiating event has been addressed and corrective action is complete (see the response to Question  ;

No. 9). With respect to seismic, MSLB, and single failure concerns, the )

licensee has classified the CAQR post-restart based on (1) low probability, 1 (2) best estimate analysis by Westinghouse showing that safe shutdown can be obtained, (3) industry precedence. The staff agrees that this is consistent with industry practice.

The closing solenoid for the steam generator PORY is environmentally and seismically qualified.

Independent of Appendix R, the NRC does not require postulation of concurrent multiple independent initiating events. However, the condition noted has been 2 TVA also refers to these valves as steam generator atmolpheric dump valves.

3 This ratio is a reactor power distribution limit which coapares the heat flux necessary to cause partial film boiling on the fuel plates to the actual heat flux on the fuel plates.

e e documented in a Condition Adverse to Quality Report, CAQR SQT 871198 (S13 870709 038) and is being evaluated to determine if any corrective action is necessary.

The Appendix R functional criteria do not specifically exclude the possibility of a steam generator blowdown. Procedurally, the operators would determine from indications whether a PORY had spuriously opened and would take immediate action to close the valve.

The NRC evaluated the operator responses to this postulated event during an inspection conducted from March 14, 1988 through March 23, 1988 and fcund them acceptable. In addition, the spurious actuation of the S/G PORV's is discussed in Question 9.

The staff has concluded that this issue is resolved.

0 1

u , _ _ _ _ _ _ _ _ _ _ .._ _ _ _ _ _ _, _ ._ ,__ , _ , , __ _

QUESTION 11:

Provide assurance that the pressurizer block valve will close against full reactor coolant system pressure.

EVALUATION The requirenent for valve closure at full rector coolant system pressure (2500 psi differential) is specified on the TVA drawing 47A940 series. Tests conduct-ed and documented in accordance with maintenance instruction (MI) 10.43 have been completed by the licensee using the M0 VATS testing system. Specifically the valve thrust was verified to meet or exceed that required for closure at 2500 psig. The staff is in concurrence that adequate documentation is avail-able to substantiate that the pressurizer block valve will close against full reactor coolant system design pressure.

T

}

l

\

I

l QUESTION 12:

Provide an explanation of how Appendix R related cables are provided protection from spurious actuation. In particular, define the grounding mechanism of these cables. Do cables of a train for variuus required components share a comon ground? If so, is spurious actuation from a wire-to-wire short between different cables prevented? Were credible faults considered between individual conductors within a given cable? Cable to cable?

EVALUATION Type II spurious circuits were analyzed by TVA on a systems approach which was similar to required circuits analysis. SQN has included all the components whose spurious ooeration can affect the safe shutdown during a design basis fire as required components. TVA has treated 'hese components the same as the l I

required components for 10 CFR Appendix R lil.G.2 requirements. Cables identi-fied on block diagrams were treated as required circuits. These cables were identified on the physical cable location drawings. Based on these drawings, specific cable / equipment interactions were identified. These interactions were resolved based on cable reroute, operator action, fire protective wrap ard in some cases by a simple statement that cable-to-cable spurious operations were not credible. TVA has reviewed all the interactions and identified all the interactions where the TVA has taken credit by the argument that cable-to-cable spurious operations were not credible. TVA has also reviewed all Hi-Lo pressure interface cable routings to assure that spurious operation because of cable-to-cable shorts will not affect the integrity of the reactor coolant system boundary.

Based on these reviews, TVA has agreed to install additional fire detectors and suppression systems in the annulus area, have a roving fire watch in the Auxiliary Building (approxinately ten locations), and change the procedures to include certain operator actions.

Detailed evaluation of these interactions are covered in the inspection report i 50-327/88-24 and 50-328/88-24. In addition to these interactions the NRC staff independently reviewed six more interactions. Out of these six, the staff agreed with the TVA's resolution on five interactions. On one interaction the i staff disagreed with TVA's resolution identified in the interaction disposition. TVA performed additional analysis to justify that the cable-to-cable interactions will not result in any unsafe condition. TVA has  ;

also changed the operating procedure to include specific operator actions to mitigate the transient.

Based on the evaluation of TVA analysis and resolutions of the interactions, the staff concludes that TVA has adequately resolved this item.

CUESTION 13:

Is there base line data to say whether Revision 6 to DNE Calculation SQN-SQS4-127, "Equipment Required for Safe Shutdown During Design Basis Fire,"

has been properly implemented? Was a task force formed to establish the base line for Revision 6? Have audits been conducted to verify that breaker / fuse coordination efforts were conducted properly?

EVALUATION The licensee has baseline data which show proper implementation of the safe shutdown analysis. These data consist of ARSK (Appendix R sketches) for cable separation drawings, interactions, Safety Function Position Statements, approved deviation requests, fire hazard evaluations, and engineering change notices (ECNs) which are followed to completion by QA controlled procedures.

In December 1987, the licensee fortred a task force which reviewed internally identified Appendix R concerns which were raised in the preparation of Revision 7 to SQN-SQS4-127. This task force identified issues, dispositioned them into appropriate categories according to their requirement and status, examined them for resolution, and made recomendations for resolution when further licensee action was required.

Audits performed on Appendix R and breaker / fuse coordination calculations include:

-Appendix R audit (NRC) January and June 1985, June 1987

-Electrical calculations (NRC) June 1987

-Sargent & Lundy independent review of electrical calculations 1987

-IDI audit / review (NRC) July-September 1987  ;

-EA technical audit January 1987 The licensee believes that breaker / fuse coordination efforts have received sufficient attention by a combination of the listed audits.

The staff concurs with TVA's position.

l l

QUESTION 14:

Provide the HVAC calculations or damper closure information which show that rooms outside the fire area can stay within equipment qualification limits during a fire. Provide the HVAC calculations showing when containment access can be accomplished following a fire.

EVALUATION TVA determined that the only locations where there was a direct opening (dampered) between two fire areas in an area without sprinklers was between the pipe chases and pump rooms and a pipe chase and the Volume Control Tank (VCT) room. Of these areas only the VCT is considered necessary for shutdown.

The fuel load in the pipe chase is very low consisting only of the motors on motor operated valves and individual cables. The VCT room is approximately 20' X 20' X 20'. TVA concludes and the staff agrees, that the small fuel load in the pipe chase cannot provide significant heating to the VCT room.

All other locations involving a direct opening in a fire barrier had sprinklers either on both sides of the barrier or where there was a significant fuel load. 1 The NRC agrees with TVA's position that dampers in HVAC ducts would close before significant heat transfer occurred through enclosed ducts from a fire l affected area and to additional. rooms.

The staff has concluded that with respect to this scenario there are no locations at SQNP where the temperature of Appendix R required equipment would exceed that equipment's qualified temperature due to a fire in an adjacent area.

For HVAC loss during a fire, TVA identified two areas where temperatures may increase above or approach the qualification temperatures of the equipment.

These areas are the auxiliary building 480 volt transformer rooms 2A and 2B.

In regard to containment access following a fire, it was determined that spurious RCS letdown as a result of a fire inside containment which requires access is not a credible event. Refer to the response to Question 7.

- _ _ _ _ _ ._ . _ _ . _ _ _ _ _ _ _ . - . _ . _ _. _ =. -._ . ._ . _ _ . . _ _ _ . _ -

4 1

J 4

OVESTION 15:

i Provide the' fire interaction study for a fire in the imediate vicinity of the I pressurizer, i EVALUATION See the evaluation for Question 21.

, 1 5

3 J

4 i

j

'I l

4 i

I i

l  !

1 4

i

- 20 -

3 J #

1 a l

.,--,-,--~,.-------,,,--,-,,,,--.,,-,---,-,,-.n.-. - ,- -. _ ,,,- - - _ . - . _ _ _-.- , , , - . .,,,_n-,--<

QUESTION 16:

Provide a list of guaranteed Appendix R equipment which is required for availability during performance of S0I 26.3.

EVALUATION Appendix R equipnent for safe shutdown is described in TVA's shutdown logic.

The equipment required in 501 26.3 is found in Key 48 (page A149) of the shutdown logic analysis SQN-5054-0127 Rev. 8. This key will be revised in Rev. 9 to SQN-SQS4-0127 to reflect the additional protected letdown path which TVA has incorporated as a result of a commitment to the NRC during performance of inspection 50-327/88-24 and 50-328/88-24 This commitment resulted in the addition of a pre-action closed head sprinkler system to provide suppression for the pressurizer PORV and pressurizer block valve interaction in the reactor building annulus. This protection, which was reviewed and approved by the NRC, provides an additional fire protected letdown path and removes the technical basis for this concern. The licensee intends to delete the requirement for SOI 26.3 based on the availability of a fire protected letdown path for all postu-lated fire interactions.

The NRC staff considers this issue resolved.

I 1

I 1

r w-,..- --- _ _ . - , . - , _ , , , , . , _ _ _ _ . , _ _ . , . _ _ _ _ _ _ _ _ _ ___

QUESTION 17:

Provide information lf available regarding testing or analysis of passing liquid through a pressurizer code safety valve and the resultant erosion and subsequent ability of the valve to reseat.

EVALUATION Testing has been r ei' formed by the Electric Power Research Institute (EPRI) on pressurized water reactor safety valves. This was documented in the EPRI report, NP-770-CD, "PWR Safet Combustion Engineering project (CE) (y ValveV102-2).

number Test Report," which was prepared by SQN has provided a protected reactor coolant system letdown path for all postulated Appendix R fire scenarios. One of these paths is available to provide letdown and pressure reduction to prevent passing liquid through the pressurizer code safety valves.

The NRC considers this issue resolved.

1

QUESTION 18:

Provide rationale for protection of Centrifugal Charging Pump (CCP) cavitation from a spurious actuation of the VCT isolation valve. Provide calculations and procedural references for protecting the VCT when static pressure heat is lost from the RWST during cool down and RWST inventory reduction. Discuss spurious actuation of the VCT hydrogen blanket makeup valve.

EVALUATION The Volume Control Tank (VCT) is normally aligned to the Centrifugal Charging Pump (CCP) and provides a short term water source for reactor coolant system (RCS) makeup and for Reactor Coolant Pump (RCP) seal injection. VCT outlet valves FCV-62-132 and FCV-62-133 are normally open valves connected in series and are located in the suction line of the CCP's. The spurious closure of either valve prior to the establishment of suction from the refueling water storage tank (RWST) could result in a loss of suction to the CCP. The consequences of such an event wculd be the loss of the operating CCP due to cavitation of the pump. Cables for the VCT cutlet valves run from their respective motor control centers through multiple elevations of the auxilicry building then into the GC9 penetration room into the valves themselves. Fire induced faults occurring along the exposed cable paths of either valve could cause the valves to spuriously close. The licensee has provided fire protec-tion for the A train CCP associated cabling. Several fire areas exist within the Auxiliary Building, however, where both a VCT outlet valve and the B train CCP cables may be damaged due to fire.

A concern exists, therefore, that in the event of fire within these areas all makeup capability ray be lost. The licensee's analysis of this concern took credit for manual operator actions to align CCP suction from the RWST. Such operator actions, however, could not be demonstrated by the licensee to be performed within an acceptable time frame. As an interim corrective action the licensee will continue the roving fire watch established per the NRC Confirmation of Action letter dated August 10, 1984. Long term resolution includes the implementation of circuit modifications to provide an adequate level of protection for the make-up system. Approaches discussed with the licensee include the installation of a fire protected interlock circuit to automatically open the RWST suction valves upon closure of a VCT outlet valve and the installation of fire protected low suction pressure trip circuits on the CCPs.

The NRC staff considers this action acceptable for restart and reconmends that long term resolution be accomplished during the next refueling outage.

QUESTION 19:

Provide the basis for fire protection of Appendix R shutdown systems inside the containment.

EVALUATION This questicn stemmed from a concern raised by the alleger that TVA did not mect Appendix R requirements in the containment.

The systems inside the containment at SQN are protected in accordance with Section III.G.2 d-f of Appendix R to 10 CFR 50. TVA has protected systems inside the annulus in a similar manner. Because of the restricted entry requirements associated with the annulus, the NRC considers this level of protection to be adequate.

The NRC staff has inspected sections of the annulus and primary containment in regard to fire protection and considers the fire protection features to be adequate.

1

- 24 - i e- - - -- - - , , - - , . - - - , . . . - - - - - , , - - - - -

• QUESTION 20:

Discuss possibility of two low pressure signals causing an actuation of the safety injection system. Also discuss the protection of circuitry required to assure proper alignment of the safety injection system.

EVALUATION TVA has not taken credit for the safety injection system for their Appendix R analysis. In the event of spurious operation of safety injection, the Emer-gency Operating Procedure (E-0 Step 4) provides instructions for operators to take corrective actions. Since protection of systems required for the design basis accident in the context of Appendix R is not needed, protection of SI is not required.

Based on this, the staff concludes that TVA has adequately addressed and 1 resolved this concern.

f I

J t

l .

00ESTION 21:

Has TVA evaluated the effect of fire on instrument sense lines? Provide the restit of the evaluation and its effect on the Functional Analysis Report.

Discuss the effect on the safe shutdown analysis due to the fire effect on pressurizer level, steam generator level and temperature instrumentation.

EVALUATION INSTRUMENT SENSE LINES.

CAQR S0P 870857 was written to establish the design criteria for instranent sense lines separation requirements for Appendix R. Corrective action for this CAQR resulted in CAQR SQF 870151 which identified the interactions of required sense lines. The corrective actions involved a fire bazard analysis for inside containment instrumentation sense line interactions. This analysis proved that fire effects will no' adversely affect the required instruments and identified the alternate instrutants which will be available to assure required main control room indications. This analysis is documented in SQN-00-D05 2; EPM-EAC-011888, QIR-SQP-SQN-88-212 and the January 20, 1988 memorandum from D. A. Boyll to R. E. Daniels. It should be noted that in the new analysis TVA has taken credit for the additional instrumentation which was not included in the previous Appendix R analysis. TVA has included these instruments in the Appendix R analysis.

The staff reviewed in detail the analysis for the pressurizer instrument sense lines which consisted of determining the location of instrument sense lines and potential fuel sources that might affect them. The only viable fuel sources identified were the Reactor Coolant Pumps Nos. 1 and 2 oil collection systems and the control rod drive rechanism cables which are insulated with Silicone Pubber Oil Resistant Asbestos Jacket (SROAJ), a non-combustible material. For the purposes of analysis, the licensee used heptane as the fuel source from the pumps and PVC as the fuel source for the cable insulation. Both of these assumptions add significant conservatism to the analysis.

In the analysis, TVA used a computer program, FIRST, developed by the National Bureau of Standards. The FIRST program calculates radiant and convective energy transfer from a fire to nearby objects. From this heat transfer analysis, the maximum temperature of the sense lines was determined. TVA used 600*F as the temperature that would damage the sense lines.

The staff reviewed the TVA analysis and also verified by system walkdown the assumptions regarding fuel load and location inside the containment. The staff concludes that the TVA analysis is conservative.

TVA has also performed analysis for outside containment instrumentation in SCN-ISL-003 to document the effect of fire on instrument accuracy and deter-mined that in most cases the required instrument accuracy will not be met.

However, for all these cases an alternate path was available through a

~.- . _ . . - __ ._

-l- .

r i

',+ ,1 l)' j

./f

, y ', '

3p i

/( j j

j ',

i

. . ]

, ,' / o i different fire zone and, therefore, unacceptable errors caused ' ), ' bi not pose any problem. '

/

The staff considers the issue of the effects of fire on instrument sense lines at Sequoyah to be resolved. *

.,,4 fj v 4 i

N

.i f

'I- - .

i

! )  :

I j

1 4

< r e

p

,k

,e j

l )

, t i l i

J

)

) I I

t .

1 I

b l .;

9 '

>1 }a.

• t * , 6

) '

J '

,A- ,

& n' ,

a

/. , t h '

,,\

( .'

y[, l,1. ,<)

, i

~ ,. .

{> ', )

l ,, QUESTION 22,: j 4

O Explain wrN h.' g fit e 'in c<.dtainment would not affect the instrumentation (as Task discuned "in the preliminard: dwre,0;oup th operatortodistinguis e fire andDisposition a LOCA. of Issues in B.2) used by

[AtbATION , x j ,

This question stemed from a epicum raihd in hvision 7 of NEB Calculation SQN MS4-17. "Equit; ment RequiNd Jod Safe S'vt%h pe;10 CFR 50, Appendix R,"

?that :lle instrument respoase pi%iated to tne operatW'i the Main Control Room

' (MCR' {could be identical for a dre or for a LOCA. The concern was that this could result in c3nf> pion and twsibly a failure to resporid as required.

) s

( Whilythisspepffy'icenarioisinotarequirementofAppendixR,theissuewas addressed ^ om Me standpoint c/swhat are the poqible combinations of events which wouk : represent the above concern. / Four combinations we e identified.

(The first Two corbinations inclu'oe (1) securrence of a LOCA and the operator

~

r repondi'ng to a d.1CA,and (2) oceptrence of a fire and the operator responding to i; fire. f,These'tso combinations rewired ra, evaluat)on since the operator wou'd be respondir) .iporopriately.

I i, ,

The ,,tMrd e abination' ks if a fire occurred ar.nt,he operator responded to a Thi<, combination (n considered highly un'rikely since operator training

' R ;woulc. LOCA , } pr'ic'ude this hd;9enire huwever, if 'f p did occur the operator wculd be putting Thd plant in a oundidenLas safe af if he had initially recognized the

) event as a ffre and res'pented, appropriotely. Based / on this no evaluation is

,< required.

^

/ < ,

! ,i 4

i s

- I >i The fourtn combination would be We LG~A Jas diay:rsed as a fire, in the case of a large break LOCA, plant corditio's .toud eadly allow the event to be recognized as u LOCA. In the cass of a small break LOCA, an incorrect i~, diagnosis could be possible; howdver, several things contribute to preventing on incorrect event diagnosis ard/or al, low vexificatioa of initial event diagnosis. These include:

(1) The equipment for either event is cualified to be functional for each respectivc eve.it regardless of the event diagnosis.

(2) Since. the above is true and accurtte information is available for the xtnal event (small break LOCA); *.he operator could verify the event bv obrervation of phnt parameters.

(3) Operators are trained to recognize desf.)n basis events.

Additionally, TVA tias started training operators in recognizing the difference between LOCAs and Appendix R events.

TVA has performed an analysis (SCN-00 0052, EPM P.-11888) to demonstrate that J minimum set of instrumentation, whiCh includti pressurizer pressure and 1

level, steam generator pressure and level, and reactor coolant system pressure and temperature, are available after a fire inside containment. Also Information Notice 84-09 provided the guidelines for the instrumentation required for Appendix R. The staff has previously reviewed and approved SQN compliance with Information Notice IN 84-09. The staff has reviewed the TVA analysis (see question 21) and has concluded that the TVA analysis adequately demonstrated that sufficient instrumentation will be available to the operator.

These instruments can be used by the operator to distinguish between a fire and a LOCA.

Based on the staff's evaluation of the analysis the staff concludes that TVA has addressed and resolved the concern, i

s t

l I

I QUESTION 23:

Discuss how steam generator overfill from the main feedwater system is protected against following a fire in the control building. In particular address response times for feedwater isolation following loss of the control building.

EVALUATION TVA has ensured the availability of one steam generator level indication for each steam generator. Abnormal Operating Instruction (AOI) 27 provides that for a fire in the control room which affects operation from the main control rocm, the operator immediately trips the reactor and refers to Emergency Operation (E-0). The first 13 steps of E-0 are memorized inmediate actions for licensed operators. Step 7 of this sequence requires verifying Main Feedwater (MFW) Isolation by verifying:

a) MFW Isolation Valves closed b) MFW Regulation Valves - closed c MFW Pumps - Secured d MFW indicates no flow For a fire in the control room the operator would then reenter AOI 27 which requires:

STEP ACTION IV.B Close MSIVs IV.M.1 Position Aux Control Room transfer (U.0, steps) switches U.0. (Unit Checklist 27-1 will isolate A & B train Operator) solenoids either of which will isolate the MSIVs

! XS-1-4A #1 S/G 1 XS-1-4A l

XS-1-11A #2 S/G XS-1-11B

. XS-1-22A #3 S/G XS-1-22B XS-1-29A #4 S/G l XS-1-29B V.M.10 Check MFP turbine tripped l

1

i l

Additionally, there is non-Appendix R oualified circuitry which will provide for MFW isolation as follows:

a. A reactor trip and (LO Tavg (b54'F) gives a feedwater isolation (FWI) signal nain turbine trip and a Hotwell Pump trip.

b. A 75 percent level in any S/G gives a FWI main turbine trip and Hotwell Pump trip. l

c. A 60 percent level in any S/G causes the bypass and FW reg valve on the affected loop to close.

1 A FW1 signal provides the following:

a. MFP trip,

b. FW reg valve closes.

c. Feedwater Isolation Valve closes. ,

All of these actions isolate main feed to the steam generators.

As a summary there are 3 reans of achieving feedwater isolation from the main -

control room, (a), (b) and (c) of E-0, and two methods of isolating main feedwater from the auxiliary control roon Steps IV.B. and IV.M.I of A01-27.

The NRC has evaluated the licensee's response tine to reach and take action from the ACR ard has judged that main feedwater to the steam generator in the event of a centrol room fire will be isolated from the ACR in sufficient time '

to prevent excessive overfilling of the steam generators in the unlikely event that this isolation cannot be accomplished from one of the multiple isolation .

paths from the main control room. -

l i

1 I

31 -

. l

p OUESTION 24:

WCAP 10541 provides justification of RCP seal integrity under a station black-out condition where the RCP's would not be running. If TVA has not assured the ability to promptly trip the RCP's during a fire, on what basis do you consider this analysis applicable to Sequoyah? WCAP 10541 provides for no less than one hour until failure for ncn-energized RCPs using high tempertaure elastomers, it appears this is not true for all elastomers available. Provide information +

on elastomers installed in Sequoyah's RCP seals.

EVALUATION If there is a loss of seal flow for any reason, the operator is instructed to shut off the affected pump. These general instructions are contained in 501 68,2, "Reactor Coolant Pumps." In the event that the reactor coolant pump (RCPs) cannot be tripped from the main control room, they can be tripped locally in a matter of minutes from their 6.9 KV breakers in the turbine building. This was verified by the NRC inspection team in a walkdown and during discussions with auxiliary and licensed operators.

Westinghouse, in a letter tc TVA dated March 11, 1988, provided additional information regarding the capability of the RCP seals.

"... We concur with the position presented by TVA, i.e., that 0-Rings not specifically qualified for high temperature performance, such as the Parker E515-80 or equivalent specification which are currently installed at Sequoyah, are capable of sustaining high temperature integrity as predir.ted in WCAP-10541 for a minimum of one hour. This position is based upon independent tests on the 0-Ring materials in question conducted by the NRC and the Westinghouse Owners Group. These tests demonstrated the capability of the Parker E515-80 0-Rings to i withstand the predicted conditions in the RCP seal for at least one hour. Furthermore, full scale demonstration tests conducted

, by the Westinghouse Owner's Group with Electricite de France (WCAP l 10541, App B) using 0-Rings of the E515-80 specification showed no deterioration of these secondary seals throughout the entire loss of ac test simulation."

The NRC staff concludes that this issue is resolved and that SQNP's RCPs will

, maintain seal integrity for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the event that seal injection is lost in a fire scenario.

J r

,n. - - - - - - - - - , , - - -

QUESTION 25:

Given that TVA considers the spurious opening of a pressurizer PORV a credible ,

event and relies on the manual closure of the block valve to limit the consequences of this event. discuss for a control building fire how long will it take for the operator to take this action. What will the RCS conditions be at the time of PORV isolation? Does Si actuation occur and is it available?

What restoration guidelines will be used? What specific operator training and procedures have been provided?

EVALVATION IVA has protected the pressurizer PORV and pressurizer block valve from spurious actuation. TVa has also demonstrated that an interaction between the RHR valves FCV-74-1 and FCV-74-2 and the pressurizer PORV and pressurizer block valve does not exist.

In addition, TVA has censervatively estimated that it would be about two minutes for one operator to reach the auxiliary control room and to begin taking action. A01 27 Revision (Step F), "Control Room Inaccessibility" instructs the operator to imrediately close the PORV, etc. if abnormalities in pressurizer pressure or level are noted. The WCAP-9600 Vol. 111 analysis for a small break PORY LOCA predicts RCS pressure to be about 1700 PSIG in two minutes. This is below the setpoint to initiate safety injection but above the pressure at which safety injection pump flow would occur. In the event spurious safety injection occurs, the emergency operating procedure (E-0 Step

4) provides instructions to the operator to take corrective actions. The restoration guidelines and procedures are covered by A01 27. This procedure is

• part of the normal training for the operators for control room inaccessability.

The staff has performed a walkdown of the control room and Auxiliary Control Room and agrees that two minutes is sufficient time for the operator to begin corrective action.

Based on the staff's walkdown and evaluation of TVA response, it is concluded that TVA has adequately addressed and resolved the concern.

4

. .= .- . __ _ _ _ _ .

I i

4 CUESTION 26:

Are the narrow range RCS pressure sensors included in the Appendix R analysis and has it been verified that they are sufficiently separated such that 2 out of 4 logic required to actuate SI would not be jeopardized. Considering that the spurious actuation may ledd the operator to think a LOCA is in progress, what other instrumentation may also be affected, i.e., (pressurizer level sensing, sump level sensors, reactor building temperature sensors, wide range RCS pressure sensors and containment radiation monitors)? What procedure and/or operator training have been developed to aid the operator in distinguishing an actual RCS depressurization from fire induced spurious failures which falsely indicate a LOCA?

EVALUATION i RCS narrow range pressure sensors are not required for Appendix R analysis.

Discussion on the instrumentation required to distinguish between LOCA and fire is covered under question 22. As an enhancement TVA is looking into develop-ing a procedure to aid operators in distinguishing between LOCA and fire.

Based on this, the staff concludes that this concern is adequately resolved.

i  !

i f

l 1 i i

h 1

l -_._ ._-- ~ _ .-_ . . _ - - - - - , _ - _ . _ .- .-

' " A u , a e & _ , ,

e 8 ENCLOSURE 2 1

[

b 1

{

l l

f Y

i i

i I

t i i I

Issues Raised by Revision 7 of SQN-SQS4-127 During TVA's calculational review process the Appendix R safe shutdown logic analysis, TVA calculation SQN-SQS4-127 "Equipment Required for Safe Shutdown per 10 CFR 50, Appendix R," was re-evaluated. The basis for TVA's Appendix R program which was reviewed by the NRC staff had been Revision 6 and earlier revisions of this calculation. The resulting re-evaluation became Revision 7 (R7) to this calculation.

R7 represented a change from previous revisions of this calculation. The authors used as their objective not the requirements of Appendix R but what in their opinion was necessary to achieve safe shutdown. One of the stated purposes of Appendix R is to achieve safe shutdown but the authors of R7 felt that,

"...a rather large gap is possible between an implementation program which is legally responsive to Appendix R. and one which is technically responsive."

The NRC staff does agree that individual licensees can improve their fire protection and safe shutdown programs beyond the ninimum requirements of the Appendix R regulation; however compliance with the requirements of Appendix R does provide a technically responsive fire protection and safe shutdown progran. As a result many items regarded as "issues" in R7 were not fixed on a regulatory basis. Furthemore many of these "issues" have been addressed in other design processes.

Although R7 had been reviewed and approved by the Design Engineering staff, it was not reviewed by, or concurred with, by the Sequoyah operations staff. As a result when R7 was presented to the operations staff, disagreements occurred o:,

the validity of the calculation and the prudence of attempting to implement many "issues" which in the operations staff's opinion were already encompassed by existing plant design. The addition of requirements beyond previous comitments and the lack of interface review then became major issues preventing the revised analysis from replacing the R6 analysis as the design basis for the Sequoyah Nuclear Plant.

A TVA review team was formed to scope the issues in question and provide infomation to the Sequoyah Project Engineer so that decisions could be made on which items required pre-restart action for SQNP. The issues raised were evaluated by TVA and the NRC and were dispositioned as noted in this enclosure.

The issues are presented in this enclosure as they were presented in the TVA review summaries. The NRC staff did not attempt to rephrase or characterize the issues as the subject of their disposition was raised as an allegation.

The alleger contended that these issues were improperly dispositioned or had not been properly considered. The NRC staff has reviewed TVA's response to these issues. The technical basis supporting their resolution has been addressed in Inspection Report 50-327,328/88-24 and Enclosure 1 of that report where not specifically addressed in this enclosure.

J

A.1 Changes Needed to Shutdown Logic Calculation Revision 7 Issue:

The TVA reviewers who developed R7 wrote that several issues are involved in resolving this item. The first deals with the purpose of the calculation. Specifically, it says "The purpose of this document is to specify a set of criteria which if implemented will provide the capability of achieving a safe shutdown during a fire which affects all components within any fire zone. With respect to its declared purpose it contains some requirements which are more restrictive than some interpretations of Appendix R. In all cases those requirements are considered necessary for

, safe shutdown under fire conditions." The second issue is the calculation contains a number of requirements that either need to be or are already in existing design criteria. The calculation is trying to assure design control which is beyond its scope.

Resolution:

The NRC staff agrees that many of the declared requirements from R7 are beyond the requirements of Appendix R to 10 CFR 50. We do not agree that "in all cases those requirements are considered necessary for safe shutdown under fire conditions." '

The TVA task force recomrended that Revision 7 of the shutdown logic calculation be revised. The calculation has been revised to only include those items that are expressly required to meet paragraphs Ill.G, J. L, and 0 of Appendix R. These are the portions of Appendix R which Sequoyah has committed to comply with. The revision also deleted design control requirements that should be in design criteria. This revision, Revision 8 of the calculation, was interface reviewed through NEB, MEB, EEB, P0RS, and the site operation procedures staff prior to issuance. The calculation was reissued. The items addressed in this attachment were dealt with in Revision 8 as follows:

A. Items to be deleted due to purpose Waste Gas Decay Tank rupture (A.2)

Requirement for containment isolation (A.2)

Differentiating a LOCA and a fire (B.2)

Potential for conflicting procedures (B.6)

Need for spent fuel pool cooling (A.4)

B. Items belonging in Design Criteria Comunice?. ions - SQEP 53 (A 5) l Detection / Suppression of fires - SQN DC-V-7.5 & 7.6 (A.3)

Lighting - SQN DC-V-24.0 (A.6)

Access - SQN DC-V-24.0 (A.7, B.3, B.4, and B.5)

Spurious Actuations SON DC-V-10.7 (A.10 and A.17) i l

Containment Access - SQN DC-V-24.0 (B.4)

Operation Staffing Requirements - SQN OC-V-24.0 (B.7)

Sense Lines - SQN DC-y-74.0 (A.11) 1 I

C. Items to be updated due to existing documentation Reactivity Control (A.8)

Pneumatic Systems (Key 37 A) (A.9)

Need to use Special Startup Test #3 (A.14)

RCP Seal Life (B.12)

A.2 Radiation Release to the Environment Issue:

R7 added a requirement to assure that a fire cannot result in an uncontrolled release of radioactivity to the environment via (1) an uncontrolled release of the contents of a waste gas decay tank, or (2) inability to maintain containment isolation.

Resolution:

(1) Need to consider Waste Gas Decay Tank Rupture The need to consider this event is not required by Paragraphs Ill.G.

J, L, or 0 of Appendix R. These are the paragraphs Sequoyah is comitted to meet, in addition the rupture of one Waste Gas Decay Tank is evaluated in Section 15.3.5.1 of the FSAR with the resulting offsite dose provided in Section 15.5.2. The FSAR assumes the uncontrolled release of the contents of one tank directly to the environment without holdup or filtration. The reali analysisghowedthesiteboundarydosewas2.2x10'gticdose rems (gamma),

1.1 x 10' rems (beta), and 1.3 x 10 ~5 rems (thyroid). This is well within all regulatory limits. Conservative analyses of this event were also well below 10 CFR 100 regulatory limits.

(2) Need to assure containment isolation This is addressed in Question 1 of Enclosure 1 of Inspection Report 50-327,328/88-24.

A.3 Ability to Detect and Extinguish a Fire Issue:

R7 added a requirement to assure that the effects of any postulated fire cannot result in the inability to detect or extinguish that fire.

Resolution:

Design Criteria SQN DC-V-7.5 requires that detection systems be designed to the guidelines in NFPA. This is what NRC requires. Design criteria SQN DC-V-7.5 covers detection systems and is being revised to include NFF A I 72D and NFPA 72E guidelines.

A.4 Spent Fuel Pool Coo. ling issue: ,

R7 added a requirement to assure that a fire cannot result in the inability to adequately cool spent fuel in the spent fuel pool.

Resolution:

This is addressed in Question 2 of Enclosure 1.

A.5 Communications Issue:

R7 (key 41) added a requirement to assure that a fire cannot result in the loss of features necessary to support communications capability between main control room or auxiliary control room operator and support personnel at other plant locations.

Resolution:

Explicit requirerents for communication systems are not required by Appendix R. This position is documented in EEB calculation EEB '850128 914 which states "Although there are no specific requirements in Appendix R for communications systems other than emergency equipment for the fire brigade, it is infomative to determine what the effectiveness of the Intraplant Communication System would be during an Appendix R event."

This calculation showed that the systems in the plant were adequate. Some

, enhancements were recommended but were not found to be required to have -

an acceptable design. These recommendations were to be considered by 1

Operations on individual merits for future incorporation (501 850201 812).

The checklist in SQEP-53 also requires that any modifications involving communication systems that serve safety related areas must be evaluated to ensure adequate communication is maintained.

A.6 Lighting 6 Issue:

R7 (see R8 Section 5.2.10. key 14) added a requirement to assure that adequate lighting is available to support operator actions required to assure safe shutdown in the main control room during a fire. The addition was via reference to SQN-0SG7-025. R1, Emergency Lighting Requirenents for Main Control Room Lighting. The requirements of R7 are based upon military and industry emeroency lighting standards for areas where safety is contingent upon the ability to read instruments, drawings, and procedures. This requirement is 3.5 foot candles.

i

Resolution: >

The NRC does not per se r.equire 3.5 ft-candles of light in the main control roon. Lighting levels at Sequoyah in both the main control rocm and in the plant areas have been reviewed by the NRC and found to be acceptable. This item was specifically discussed in NRC Inspection Report 50-327/87-41 and 50-328/87-41 dated August 7, 1987. The NRC had TVA perform lighting blackout tests and on the basis of this testing the NRC closed this as an issue at Sequoyah. The Appendix R lighting level tests were performed by and documented in work plan WP 11721. The acceptability of the lighting levels for the operators to perform their functions throughout the plant is also documented in this work plan. Several hardware upgrades were implemented to achieve acceptable lighting levels during performance of the work plan.

A7 Access Issue: <

R7 (see R8 Section 5.2.10, key 41) added a requirement to assure that a

' fire cannot preclude access capability to all areas where local operator  !

actions are required (e.g., operability of appropriate card key readers, electronic locks, and other portions of the security system).

Resolution:

TVA has documented the adequacy of access during a fire in EEB 841010 912.

A.8 Lono Term Reactivity Control Issue:

R7 added a requirement to assure that a fire cannot result in the loss of all support features necessary to assure long term reactivity control.

This addition (key 44) included a choice of either the boric acid transfer pumps and valves as a source of relatively high concentration boric acid solution, or the capability to letdown relatively low concentration boric acid solution from the reactor coolant system so that the required higher concentration boric acid can be injected.

]

Resolution:

This is addressed in Question 4 of Enclosure 1 of Inspection Report 50-327,328/88-24 8 .

.-s

A.9 Pneumatic Systems Issue:

R7 (Section 4.3) added a requirement to assure that fire effects upon pneumatic system components are adequately considered when credit has been taken for operability of these systems.

Resolution:

TVA considered adverse effects of diverting control air as a result of the fire. As a result nn credit was taken for pneumatic systems operating equipment after a fire. Also see Questiun 5 of Enclosure 1 of Inspection Report 50-327,328/88-24 A.10 Fire Induced Spuricus Actuations issue:

R7 (Section 6.0) added requirements to assure that a fire cannot result in loss of features needed for a safe shutdown via fire-induced spurious actuation. Requirements were based upon the sensitivity of the circuits involved, and also included factors which must be considered if circuits are disabled to prevent spurious actuations. Appendix 0 was added to the functional criteria to suggest possible methods of responding to spurious actuations.

Resolution:

See Questions 3 through 7, 9, 12 through 14, 16, 18 through 28 of Enclosure 1 and Section 4 of Inspection Report 50-327,328/88-24 A.11 Sense Lines Issue:

As a result of an awareness resulting from CAQR SOF 870151, draft R8 (Section 4.4) now explicitly requires all instrument sense lines which are in the zone of influence of a fire be analyzed and the effects justified as being acceptable relative to safe shutdown.

This is addressed in Question 21 of Enclosure 1 and Section 7 of Inspection Report 50-327,328/88-24.

A.12 HVAC.

Issue:

R8 (key 37) added numerous requirements as a result of the resolution of R7 unverified assumptions. Additional HVAC components are expected to be required to assure safe shutdown. At this time, only preliminary j .

1

. o I

information is available on this issue as some heat load calculations, predecessor to the functional criteria, are incomplete. QlR NEB 87289 ,

(B45 870917 260) has been written to MEB [ sic] to resolve this item.

This is addressed in Question 14 of Enclosure 1 and Section 8 of Inspection Report No. 50-327,328/88-24.

A.13 ERCW Traveling Screens Issue:

R8 (key 3) added: (1) an operability requirement for the traveling screens, and (2) a choice of delta-P instrumentation operability or a procedure for manual inspection of the scree'.s. This item was added as a result of a CAQR written during the IDI NRC inspection.

Resolution:

This concern was identified in CAQR 871342 101. The resolution of the CAQR resulted in a physical modification to the plant which is documented l in DCN-59 and was implemented by work plan WP-12713.

A.14 Limits of Special Startup Test #3  :

Issue:

j Special Startup Test #3 was used during the 1984-85 as the basis for not I needing pressurizer heaters during a fire. However, conditions which a

. fire could cause could invalidate the results of the test. This item was '

( reco R8 (gnized as a 1) key 28, note result of resolution added a conditional of an unverified operability assumption requirement to in R7.

reflect the limits of Special Startup Test #3.

i Also, ti3e R6 analysis contains an unidentified unverified assurption that the RHR system will be available to serve as a letdown path, which is needed for long term reactivity control, within 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />. This assumption (

is based upon an extrapolation of Special Startup Test #3. This is ,

questionable because (1) the extrapolation itself may be inappropriate, and (2) the validity of Special Startup Test #3 is not assured in a fire.

Resolution:

l TVA has established a protected letdown path for all Appendix R scenarios, i

See Questions 4, 5, 6, 12, 16 of Enclosure 1 and Section 4 of NRC l Inspection Report 50-327,328/88-24 j A.15 VCT to RWST Transfer j Issue:

i There are two issues that must be addressed. The first is spurious closure of FCV-62-132 and 62-133 due to a fire that could cause a loss of I

. o ,

suction to the operating Centrifugal Charging Pump (CLP). The other CCP can be damaged in the same fire and is assumed to be lost. The other issue is inventory problems in the volume control tank (VCT) due to a loss of makeup or diversion of letdown flow to the VCT. This could also result in a loss of suction to the CCP.

Resolution:

The first issue is addressed in Question 18 of Enclosure 1 and paragraph 4.5 and Section 5 of Inspecticn Report 50-327,328/88-24 The second issue is addressed through detailed operator at.tions described in S0I 26.2.

l This procedure was reviewed by the inspection team (Section 5 of Inspec-tion Report No. 50-327,328/88-24). The following comments should be noted.

The initial VCT level is not at the 7% Lolo setpoir,t. The tire availabic for operator action should be based on the normal level of at least 20%

where auto makeup starts. The calculation around the 7% lolo setpoint yielded 544 gallons. Per TI-28 Figure C.17, 7% volume equals approximately 700 gallons and 20% 920 gallons.

In the first part of the fire there is little reactor coolant system cooldown as the charging flow minus letdown is 40 gpm maximum. The

! cooldown rate is also restricted and a best estimate cooldown rate is between 25-50'F/hr. When the operator has initiated cooldown, he will obviously be contemplating the shrinkage effect and will be monitoring the q

VCT level trend to ensure proper makeup or alignment to the RWST. '

1' Regarding step 8.5 of SOI 26.2 if flow is more than 132 gpm (which is greater than the normal capacity of 75 gpm to the VCT) the operator is  !

watching his water levels and would probably have already aligned suction to the RWST.

i The allowable operator action times are based on fire damage occurring at  :

j t=0. In reality, the cable damage will occur at sora point into the fire I thus increasing the time the operator has for action. The following note

]j has been added to 50! 26.2. '

3 NOTE:

In the event of a fire, observe VCT water level indication. In the event that level indication is LOST, becomes erratie or trends downward (indication of insufficient makeup or letdown diversion) l promptly align the RWST suction to the CCP suction OR promptly stop theoperatingcentrifugalchargingpump(s)untiltheRW5Tcanbe

aligred to the CCP suction. The VCT must also be isolated in the l longer tenn by closing its outlet valves or depressurizing the VCT l vithin 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

l The staff considers that with corrective action as discussed in Paragraph 1 4

4.5 of Inspection Report 50-327,328/88-24 this issue is resolved. j j

i i

< ~8-i I

A.16 Steam Generator Overfill Issue:

Currently, only the instrumentation on two ; team generators has been assured to be functional after a fire. The operator may not know which  !

, steam generators have functional instrumentation. As a result an overfill of one or more steam generators may occur. This could result in a  !

1 waterhamer or other event for which the steam lines have not been j analyzed.

Resolution:

i  !

This has been addressed in Question 23 of Enclosure 1 of Inspection Peport j 50-327,328/88-24, 1

A.17 Spurious Safety injection Issue:

Corrinents received on R7 include the scenario that a fire-induced spurious .

safety injection could result in over-pressurization of the RCS with the possibility of a subsequent release of radioactive coolant into containment. While such a release would nortnally be acceptable, it would preclude taking credit for manual entry into containment to open the RHR letdown line and proceed to cold shutdown. During consideration of this corsnent it was recognized the same scenario, were it to occur when [ sic) during RHR cooldown, could result in over-pressurization of the RHR s

withsubsequentpipefailure(i.e.,aLOCA[LossofCoolantAccident)ystem ). [

1 Resolution' '

i The issue of overpressurization of the RHR system has previously been  !

l handled by design and procedures. During normal operation the breakers in the power supply to both RHR series suction valves to the loop D hot leg, FCV-74-1 and FCV-74-2, are padlocked open and the door to the breaker cabinet is padlocked. The keys to these cabinets are controlled by the shift engineer. Once the plant is ready to go onto RHR cooling, GOI 3

, steps 24 and 33 require that both safety injection purops and that one of the centrifugal charging pumps be locked out. This occurs when the RCS l

I temperature decreases to 350*F. The relief valve in the RHR system is I

capable of handling the flow from one centrifugal charging pump. One charging pump operating is a normal condition when the plant is on RHR.

Fire-induced spurious actuation is addressed in Question 12 of Enclosure 1

, and Section 4 of Inspection Report 50-327,328/88-24 J

Containment access is addressed in Questions 6, 7, and 12 of Enclosure 1 l

ard Paragraphs 4.2, 4.8, and 4.9 of Inspection Report 50-327,328/88-24. l l l I l

)

i l l

1 i

. O B.1 Maintenance of Appendix R Documentation Issue:

The maintenance of Appendix R documentation was not clearly defined and as a result of that, some of the documentation may not have been kept up-to-date. Additionally, a concern was expressed that documentation sufficient to support the electrical features requirements in the safe shutdown logic calculation may not exist.

Resolution:

The inspection team has noted that electrical block diagrams and marked up cable drawings noting electrical separations were prepared during the 1984/1985 Appendix R program. In addition, other documentation such as Safsty Function Position Statements were prepared documenting systems considerations in implementing the requirements of Revision 6 of the shutdown logical calculation. However, the NRC staff was also informed that a TVA Task Force review team noted that more clearly defined responsibilities were required to assure all previous documentation was maintained up-to-date. Their solution includes the following steps:

1. Assign Knowledgeable Coordinator. Fill the Appendix R coordinator position with a knowledgeable Appendix R individual recruited from TVA or industry. (Recomend M5 level position.) Name an Assistant / backup Appendix R trainee for the above coordinator.

2. Make Coordinator Accountable. Assign authority, responsibility, and accountability for all Appendix R issues to the coordinator. Work with the Site Director and Operaticns to assure their buy-in and assistance to the coordinator.

3. Train Coordinator. Train the coordinator via the Manager Training on Operations (6-10 weeks) course. Have the coordinator get up to speed on previous Appendix R work by reading and identifying all previously prepared Appendix R oScumentation.

4. Provide Discipline Assistance. Assign, via SQEP-53, Appendix R discipline responsibilities at the Lead Engineer level. fhese engineering and documentation maintenance responsibilities are to be performed for the Appendix R coordinator who is ultimately responsible and accountable.

Documentation responsibilities by discipline should be:

EEB -

block diagrams ARSK drawings Lighting Access Cocununications MEB -

Coordinator, APP R files, SOEP-53. SQN-DC-V.24.0, training Compartmentation Fire Protection System Safety Function Position Statements Fire Hazards Analysis FSAR & Technical Specifications

. o NEB -

Functional Criteria for Appendix R 4

OPERATIONS -

Procedures

5. Training Assisting Disciplines. Have the Appendix R coordinstor provide brief training to discipline sections involved in Appendix R engineering. These sections are to be selected by the lead Engineers identified in SQEP-53,

6. Review Existing Documentation. After discipline assignments are made and training has been completed, each discipline should perform a technical adequacy review of assigned documentation. This will aid personnel in understanding previous work, assure consistency with TVA's licensing basis, and assure it matches the plant configuration.

As an example, changes made to circuits due to the ampacity study will be reviewed to assure consistency with the safety function position statements.

The NRC staff concurs that implementation of the recommendations would strengthen the Sequoyah Appendix R Program.

B.2 Inability to Distinouish a LOCA from a Fire Issue:

The instrument response presented to the operator in the MCR could be identical for a fire or for a LOCA. This could result in confusion, and possibly a failure to respond as required,  ;

Resolution:

This is addressed in Question 22 of Enclosure 1 of Inspection Report 50-327,328/88-24 B.3, B.4, B.5 Access into Containrent after a Fire Issue:

B3 Containment Access - R8 (key 30) added a caution that the containment environment rust support entry if credit is to be taken for manual operation of the RHR letdown valves. This is related to item B4 and B5.

B4 Waste System - R8 (keys 46 and 47) added conditional operability  ;

requirements for the waste system. These requirements are contingent upon the need for manual access into centairment. This is related to items B3 and B5.

B5 Spurious Opening of Reactor Head Vents - Requirements in both R7 and the draft R8 preclude spurious opening of the reactor head vents. The concern here is not loss of RCS inventory (although that could be a j j l a

4 11 -

)

\

J

- - - , _ _ . . - ~.-

problem), but rather the fact that such a spurious actuation could preclude the access into containment which is presently required to open the RHR letdown line and proceed to cold shutdown.

This is related to items B3 and B5.

Resolution:

These issues pertain to containment access and are addressed in Questions 6, 7 and 12 of Enclosure 1 and Paragraphs 4.2, 4.8, and 4.9 of Inspection Report 50-327,328/88-24 B.6 Coordination of Procedures for Fire Effects Issue:

1 R7 and R8 draft (Section 7.0) added a requirement to assure there are no conflicts between procedures which the operator may be forced to use during a fire.

This is addressed in Questions 3 and 22 of Enclosure 1 and Paragraph 5 of Inspection Report 50-327,328/88-24.

B7 Operator Action as a Substitute for Hardware Requirements Issue:

R7 (Section 7.0 and 8.0) added requirements to assure that the extensive i credit taken for operator action in the analysis is supported by procedures, consistent with staffing levels and work load during fire mitigation, etc.

Resolution:

I

See Question 3 and 22 of Enclosure 1 and Paragraph 5 of Inspection Report 50-327,328/88-24  ;

B.8 Separation Between Pressurizer PORV and Bloc'. Valve ]

i l l Issue: j This is a specific case of the implementation problem cited in item P.1. )

R6,R7,andR8[ sic) All agree that .ny fire which causes spurious opening of the PORV requires an operable block valve. It appears this I requirement has not been satisfied. See attached informal convnent sheet for additional discussion of this issue, q Resolution

This is addressed in Ouestions 6, 12, 21 and 25 of Enclosure 1 and

Paragraphs 4.3 and 4.9 and Section 7 of Inspection Report 50 327,328/88-24.

t  !

I

. o B.9 ,R_CS Makeup via Seal Injection Issue:

There are two issues to be considered. The first is that the operator needs to be aware that his cooldown rate may be limited by the amount of water that can be injected through the RCP seals. The other issue is that without letdown the plant may go water solid before an RHR cooldown can be initiated.

Resolution:

S0I 26.2 has been revised to add a note that an injection flow of 34 cpm is required to support a ecoldown rate of 25'F/hr. This addresses the first issue. Key 2 of the shutdown logic calculation was revised consistent with this note in S01 26.2. The second issue is addressed in Questions 6, 12, 17, and 21 of Enclosure 1 and paragraph 4.9 of Inspection Report No. 50-327,328/88-24 B.10 CCP Lube-Oil Pump Bypass Issue:

R8 (key 1) added the bypass for the lube oil pump runnina interlock in the CCDstartcircuittothelogicdiagramandinthenotes(note 12,page A18). This iten is the result of recommendation made by the 1984-85 team.

Resolution:

This item is covered in 501 26.2 B.11 Unmitigated Steam Generator Blowdown issue:

Multiple steam generator blowdowns may occur as a result of a fire. This blowdown could result in the need for an automatic SI which has not been assured.

Resolution:

The issue is addressed in Questions 9 and 10 of Enclosure 1 and Paragraph 4.4 of Inspection Report 50-327,328/88-24.

l

. e >

J,

(

8.12 Loss of RCp Seal Injection for One Hour Issue:  !

The R6 implementation takes credit for loss of seat injection for one hour. There appears to be no basis to allow a loss for this long. See attached infonnal coment sheet for additional discussion of this item. '

Resolution:  !

i This is addressed in Question 24 of Enclosure 1 of Inspection Report 1 50-327,328/88-24.

i l

j  !

J l

l

{ l 1  !

1 l 1  !

1  !

i'  !

l I

L 1

4 I J l i .

! i I

I l,

j e I

l 1

i j I .

i

r

't . o Mr. S. A. White Tennessee Valley Authority Sequoyah Nuclear Plant

SUBJECT:

REPORT NOS, 50-3?7/88-24 AND 50-328/88-24 DISTRIBUTION: (w/ enclosure)

DCS (Docket No. 50-327/328)

NRC PDR LPDR TVA TP R/F OSP R/F JPartlow, NRR FMiraglia, NRR JAxelrad KBarr, RII RHermann, OSP RPierson EMarinos JDonohew, OSP NSIC NTis ACRS (10)

5. D.~ Richardson G. G. Zech F. R. McCoy

-) Ratberg