ML17354B317
| ML17354B317 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 08/31/1998 |
| From: | Dimmette J COMMONWEALTH EDISON CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| 50-254-98-11, 50-265-98-11, SVP-98-273, NUDOCS 9809090061 | |
| Download: ML17354B317 (36) | |
Text
CATEGORY 1 REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)
ACCESSION NBR:9809090061 DOC.DATE: 98/08/31 NOTARIZED: NO
~ DOCKET FACIL:50-254 Quad-Cities Station, Unit 1, Commonwealth Edison Co. 05000254 50-265 Quad-Cities Station, Unit 2, Commonwealth Edison Co. 05000265 AUTH. NAME AUTHOR AFFILIATION DIMMETI'E,J.P.
~ Commonwealth Edison Co. ~
RECIP. NAME RECIPIENT AFFILIATION Records Management Branch (Document Control Desk)
SUBJECT:
Responds to NRC 980702 ltr re violations noted in insp repts 50-254/98-11 6 50-265/98.-11.Corrective actions: compensatory measures are in place that eliminate or minimize possible A fire that could affect 125Vdc 6 4KV ecpxipment at same time.
DISTRIBUTION CODE: IE01D COPIES RECEIVED:LTR ENCL SIZE:
TITLE: General (50 Dkt)-Insp Rept/Notice of Violation Response NOTES:
RECIPIENT COPIES RECIPIENT COPIES 0 ZD CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD3-2 PD 1 1 PULSIFER,R 1 1
-INTERNAL:, ACRS 2 2 AEOD/SPD/RAB 1 1 AEO 1 1 DEDRO" 1 1 8 1 1 NRR/DRCH/HOHB 1 1 NRR/DRPM/PECB 1 1 NRR/DRPM/PERB 1 1 NUDOCS-ABSTRACT 1 1 OE DIR 1 1 "OGC/HDS2 1 1 RGN3 FILE 01 1 1 XTERNAL: LZTCO BRYCE, J H 1 1 NOAC 1 1 NRC PDR 1 1 NUDOCS FULLTEXT 1 1 0
NOTE TO ALL "RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTE. TO HAVE YOUR NAME OR ORGANIZATION REMOVED FROM DISTRIBUTION LISTS OR REDUCE THE NUMBER OF COPIES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL
- DESK (DCD) ON EXTENSION 415-2083 TOTAL NUMBER OF COPIES REQUIRED
- LTTR 19 ENCL 19
(:<)mn)<)tnV<:Itltl) i!<lip<)<) (:<)I))i);))I<')t)I)<i C:iti<.s G<:I)<:I".Itii)i.St:)ti<tl)
) s It) st)C)II) AVQI)<IQ X<)fti)
( <)r<i<)a".t. II. ol ) t ) 9 -tt)
"I'<:I .1<)W')~ <. s 'I I SVP-98-273 August 31, 1998 U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Attention: Document Control Desk
Subject:
Quad Cities Nuclear Power Station, Units 1 and 2 Facility Operating License Numbers DPR-29 and DPR-30 NRC Docket Numbers 50-254 and 50-265 Response to NRC Inspection Report Numbers 50-254/98011 and 50-265/98011
Reference:
(1) J. A. Grobe (NRC) letter to O. D. Kingsley (ComEd), dated July 2, 1998, "NRC Inspection Report 50-254/98011 (DRS); 50-265/98011 (DRS)"
(2) J. P. Dimmette, Jr. (ComEd) letter to USNRC, dated May 22, 1998 (SVP-98-203), "Response to Questions Raised During Confirmatory Action Letter Closure Inspection and Summary of Fire Protection Compensatory Actions" Enclosed is Commonwealth Edison's'(ComEd's) response to the request concerning Unresolved Issue (URI) 50-254/265-98011-01, transmitted in the subject report.
Attachment A contains the response to the five-part URI which pertains to: (a) loss of 125 Vdc breaker control, (b) fire induced failure of non-safe-shutdown equipment, (c) automatic closure of Main Steam Isolation Valves (MSIVs), (d) single spurious operation, including the effect of Automatic Depressor)sation System (ADS) failures on the time line, and (e) adequacy of fire detection and suppression in fire area TB-II.
In concert with the ongoing fire protection program at Quad Cities Nuclear Power Station and the Unresolved Issues identified in the subject NRC Inspection Report, ComEd has initiated the Fire Protection Improvement Program. The Program objectives consist of: 1) reducing the conditions leading to control room evacuation,2) eliminating post-restart compensatory measures, 3) reducing inter-unit dependencies,
'v, s!) t st<)lent'l<
0 USNRC SVP-98-273 August 31, 1998
- 4) assuring the availability of 125 Vdc, 5) reducing exemptions. 6) resolving commitments to NRC, 7) developing an improved risk model, and 8) improving the fire protection program. Elements of this Program include: 1) performing necessary studies, 2) completing fire protection improvement efforts, and 3) performing necessary modifications. All studies, including the identification of potential improvement changes, are scheduled to be completed by mid-December, 1998.
The identified potential changes from the Improvement Program will be assessed using the revised fire risk model. Insights identified during this assessment will be reviewed for potential plant changes (modifications, procedure changes, etc.) and prioritized based on enhanced compliance with regulations, risk significance, and cost-benefit.
As described in Reference 2, compensatory measures were taken (i.e., once per hour fire watches) for two issues (loss of 125 Vdc and multiple spurious operation of components within the Residual Heat Removal and Reactor Core Isolation Cooling systems) that were identified by the NRC. These two issues were subsequently encompassed within two of the elements of the URI of the subject Inspection Report.
As part of ComEd's ongoing efforts under the Fire Protection Improvement Program, periodic status meetings with the NRC are planned. ComEd will discuss results of its evaluations relative to the URIs and planned activities at the next meeting.
If there are any questions or comments concerning this letter, please refer them to Mr. Charles Peterson, Regulatory Affairs Manager, at (309) 654-2241, ext. 3609.
Sincerely, PS'oel P. Dimmette, Jr Site Vice President Quad Cities Station Attachment A: "Response to URI Regarding Appendix R Inspection Report 98-011" cc: J. L. Caldwell, Acting Regional Administrator, Region III R. M. Pulsifer, Project Manager, NRR C. G. Miller, Senior Resident Inspector, Quad Cities W. D. Leech; MidAmerican Energy Company D. C. Tubbs, MidAmerican Energy Company Office of Nuclear Facility Safety, IDNS INPO Records Center
ATTACHME<NTA Response to URI Regarding Appendix R Inspection Report 9S-011 SVP-98-273 (Page 1 of 17)
The 125 Vdc control power system was not shown to be free of fire damage for the turbine building fire areas. When 125 Vdc is not available to the switchgear, fire induced faults are cleared by upstream breakers to isolate the fault. These concerns are discussed in Sections E.1.3 (b) and E.1.4 (b) of the inspection report.
ComEd Res onse to URI 9S-011-01 a:
Inspection Report 50-245/265 98-011 identified a specific weakness in the 125 Vdc system described as "inadequate evaluation of, and level of protection for, 125 Vdc control power to 4 kv switchgear" that does not satisfy the technical requirements of 10 CFR part 50, Appendix R.
Regulatory Requirements The applicable sections of 10 CFR part 50 Appendix R are III.G.3, III.L.3 and III.L.7.
Section III.G.3 states "Alternative or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area, room or zone under consideration shall be provided:
- a. Where the protection of systems whose function is required for hot shutdown does not satisfy the requirement of paragraph G.2 of this section; or
- b. Where redundant trains of systems required for hot shutdown located in the same fire area may be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems.
In addition, fire detection and a fixed fire suppression system shall be installed in the area, room, or zone under consideration."
Alternative shutdown capability is provided because the requirements of III.G.2 are not met at Quad Cities Station .
Section III.L.3 states, "The shutdown capability for specific fire areas may be unique for each such area, or it may.be one unique combination of systems for all such areas. In either case, the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate postfire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in effect to implement this capability."
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 2 of 17)
Section III.L.7 states, "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown."
Compliance Assessment The equipment and associated circuits used to achieve safe shutdown are independent of the specific fire area(s) and accommodate postfire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. QCARPs have been written for this requirement providing detailed instructions to implement this capability with both offsite power available and offsite power not available.
Safe shutdown equipment and systems are not damaged by fire and for each fire area are known to be isolated from associated non-safety circuits in the fire area prior to use so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. Coordination of load breakers with upstream breakers is provided. The alternate power supply is the SBO diesel generator. This power supply as well as offsite power will p'rovide the necessary fault current for a sufficient time to ensure proper coordination without loss of function'of safe shutdown loads. The power supply and safe shutdown loads are isolated from the fire area. Electrical isolation is provided to prevent spurious operation. The alternate power supply is available in sufficient time to supply safe shutdown loads. Procedures ensure isolation of these associated circuits from the safe shutdown equipment such that a postulated fire involving associated circuits will not prevent safe shutdown.
There is no self-induced LOOP in order to align safe shutdown buses or loads. Offsite power is utilized ifavailable. If 125 Vdc control power is available, it is used prior to isolation. The actions required to isolate and manually align the electrical distribution system in'the event of a fire induced loss of 125 Vdc control power and a loss of offsite power are contained in the procedures and the time to carry out these actions is accounted for in the timeline.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 3 of 17)
Compe'nsatory measures (including periodic fire watches), however, are in place to address this issue by eliminating or minimizing the possibility'f a fire that could adversely affect the 125Vdc and 4KV equipment at the same time.
Related Enhancements Coordination has been achieved to the individual control circuit level by replacement of molded case circuit breakers and the in'dividual control circuit trip fuses. These replacements were completed prior to the recent restart. This reduces potential loss of 125 Vdc control power.
The safe shutdown analysis and implementing procedures are in compliance with Appendix R III.L. As stated in our May 22, 1998 letter (Reference 2), a study of possible enhancements to the 125 Vdc system has been'undertaken. The objectives of this study are to determine modifications which will prevent simultaneous loss of control power to both ECCS division switchgear given a fire in any area; preventing loss of control power to the remaining (unaffected) division Emergency Diesel Generator; arid preventing loss of 125 Vdc control power from fires in opposite unit fire areas. The implementation of the study has the potential to reduce local manual actions.
As stated in our May 22, 1998 letter (Reference 2), compensatory measures have also been implemented on an interim basis.
Conclnsion Compensatory measures are currently in place that eliminate or minimize the possibility of a fire that could adversely affect 125Vdc and 4KV equipment simultaneously. An evaluation of actions that can be taken to ensure the availability of 125Vdc power is in progress.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 4 of 17)
- 2. NRC URI 98-011-01 b:
NRC Inspection Report 98-011 requested a response concerning the effect of fire damage to non-safe, shutdown equipment on the ability to achieve and maintain safe shutdown conditions. Section E1.3 of the inspection report discusses how a loss of the 125 Vdc created a potential for secondary fires due to overloaded and faulted conditions on the EDGs. This in turn would create hazardous conditions for operators implementing the alternate shutdown capability as well as for the fire brigade members attempting to extinguish the fire.
ComEd Rcs onse to URI 98-011-01 b:
The Inspection Report states that the evaluation performed to address the inspectors concern of a faulted EDG "...did not address: (a) the impact that faulted cables in unknown locations of TB-II might have on the fire brigade's'ability to extinguish the fire; (b) the potential for secondary fires to occur in areas other than the bus duct, switchgear and cable and the impact this additional fire may have on the safe shutdown capability;
, (c) the effect that a corresponding degraded bus voltage condition (i.e., reduced voltage resulting from the faulted condition) would have on the operability of shutdown loads that might have been automatically loaded onto the faulted bus; or (d) the length of time before shutdown procedures directed operators to trip the EDG output breaker."
Regulatory Requirenients Appendix R, Section III.L.3 states "The shutdown capability for specific fire areas may be unique for each such area, or it may be one unique combination of systems for all such areas. In either case, the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate postfire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in effect to implement this capability."
Compliance Assessment The Safe Shutdown Report (SSR), Section 5.1.1 indicates that a fire in Fire Areas TB-I, TB-II and TB-III could result in the upstream switchyard breakers clearing faults on safe.
shutdown buses, which could result in the loss of offsite power (LOOP). This could lead to the automatic. start of the emergency diesel generators (EDG) and, assuming the EDGs are connected'to the bus prior to the loss of 125 Vdc control power, the EDGs would be operating connected to the bus without protective relays. Therefore, the faults would only be limited by the capability of the EDGs to supply the fault current until the generator winding fails or the diesel engine stalls (i.e. the engine can no longer turn the
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 9S-011 SVP-9S-273 (Page 5 of 17) generator). The EDGs are not credited for use in safe shutdown. The Station Blackout Diesel Generators (SBO DG) are credited for use in safe shutdown.
The specific Inspection Report Issues (a) -(d), on the previous page, are not considered to be of concern for the following reasons and are addressed as follows:
(a) Nozzles on fire hoses used in areas which have electrical equipment are required to be rated for use on energized electrical equipment with a voltage rating appropriate for the hazard in the area. The fire brigade is trained for fighting fires involving energized electrical equipment as well as other expected hazards.
(b) Secondary fires would not occur due to the low magnitude of the fault current and expected duration of the fault. The theoretical maximum fault current from the EDGs is approximately 1700 amperes. Further, the EDG would not be expected to run for an extended time because the generator winding will fail or the diesel engine will stall due to the fault, as explained below. Therefore, secondary fires would not occur and would not have an impact on safe shutdown capability.
'(c) . On an automatic start of the EDG without a LOCA signal present, only the associated 480 Volt Unit Substation transformer would be energized; all 4 kV loads are automatically tripped. Degraded voltage can only be a concern for safe if shutdown loads a specific sequence of events occur; For example, in Fire Area TB-II (per Figure TB-II-AC, Rev. 2 of the SSR), Buses 14 and 14-1 could lose control power and are relied upon for safe shutdown. The RHR service water pumps, which are fed from Bus 14, are independent of Fire Area TB-II and would not spuriously start. Therefore, these pumps will be free of fire damage and available when Bus 14 is realigned for safe shutdown. Bus 14-1 feeds the RHR pumps credited for a fire in this area. The following sequence of events must occur for damage of the motors, due to degraded voltage, to be a concern:
- 1. The loss of offsite power (LOOP) must occur prior to the loss of 125 Vdc control power, which will result in the automatic start and connection of the EDG to the bus.
- 2. The breaker for the unit tie to Bus 24-1 or the feed to Bus 31 must spuriously close.
- 3. One of the RHR pumps must spuriously start.
- 4. 125 Vdc control power must be lost and then a fault must occur on the feed to either the unit tie or Bus 31, whichever is connected to the bus.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-9S-273 (Page 6 of 17)
This sequence of events is highly unlikely to occur; however, as described below, the EDG will not be able to sustain voltage under a faulted condition. Therefore, the safe shutdown loads will not be damage by degraded voltage.
(d) EDG runtime would be of a very short duration. The loss of 125 Vdc is due to the power feed cables from the battery bus to the downstream buses being damaged; both the 4 kV switchgear and the EDG would lose control power. The EDG automatic controls would be lost, preventing the governor from increasing output.
With a fault on the generator output, the generator winding would fail open in a few seconds or the diesel engine would be expected to stall. Commercial industry events [per discussion with our EDG vendor] have shown that the generator winding usually fails open in a few seconds. Therefore, the EDG would not be expected to run until shutdown procedures directed operators to trip the EDG output breaker.
Related Enhancements The concern with damage to safe shutdown equipment and secondary fires due to the automatic start and loading of the EDGs is related to the loss 125 Vdc control power. As stated in our May 22, 199S, letter (Reference 2), a study of possible enhancements to the 125 Vdc system has been undertaken. The objectives of this study are to determine improvements which will prevent simultaneous loss of control power to both ECCS division switchgear given a fire in any area; preventing loss of control power to the remaining (unaffected) division Emergency Diesel Generator; and preventing loss of 125 Vdc control power from fires in opposite unit fire areas. The implementation of the study has the potential to reduce local manual actions during postulated fire events and reduce the time required to achieve safe shutdown. The extent of implementation will depend on the CDF reduction.
As stated in our May 22, 199S, letter (Reference 2), compensatory measures have also been implemented on an interim basis.
Conclusion Compensatory measures are currently in place that eliminate or minimize the possibility of a fire that could adversely affect 125Vdc and 4KV equipment simultaneously. An evaluation of actions that can be taken to ensure the availability of 125Vdc power is in progress.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 9S-011 SVP-98-273 (Page 7 of 17)
The NRC Inspection Report requested a response to the acceptability of crediting automatic closure of the Main Steam Line Isolation Valves (MSIVs). The Inspection Report provided that Generic Letter 86-10, "Implementation of Fire Protection Requirements," Question 5.3.10, provided the NRC's guidance regarding plant transients that should be considered in the design of an alternate shutdown system. This guidance specified that the shutdown capability should not be adversely affected by a fire which results in the loss, of all automatic function (signals, logic) from the circuits located in the area in conjunction with one worst case spurious actuation or signal resulting from the fire. Furthermore, the Inspection Report provided that at Quad Cities, credit for automatic actions were taken in the part of time line analysis for the thermal hydraulic response of the plant.
ComEd Res onse to URI 9S-011-01 c:
Regulatory Requirements 10CFR50 Appendix R, Section III.L.7 requires that, "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment; The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown."
Conrpliance Assessment The safe shutdown analysis credits the closure of the MSIVs to terminate vessel inventory loss. For all fire areas, except the control room (SB-1), this is achieved by giving the MSIVs a closed signal from the control room prior to evacuation. A circuit analysis was performed for the MSIVs, to determine ifany circuit failure, (i.e., shorts, grounds, opens, and hot shorts) could cause the MSIVs to open or prevent them from closing. Since the control switches were assumed to have been closed from the control room, no review was performed on the circuitry upstream of the control switch contacts.
The circuit analysis determined that no single spurious operation caused by fire induced circuit failures could prevent both the inboard and outboard MSIVs on a given steamline from closing. In addition, the circuit analysis identified no single fire induced failure that
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 9S-011 SVP-9S-273 (Page 8 of 17) could reopen both the inboard and outboard MSIVs on a given steamline once they were closed.
For the case where the fire is in SB-1 (control room, cable spreading room &, auxiliary electrical equipment room), use of the control switches was not credited. This is conservative since with the exception of a fire in control room panels 901(2)-3, 55, or 56, the control switches for the MSIVs will be accessible prior to evacuation. The QCARPs direct the operator to close the MSIVs from the control room switches ifpossible prior to evacuation. Actions are also taken to close the MSIVs from outside the control room by deenergizing both the AC and DC solenoids on both inboard and outboard valves. These actions are taken within 10 minutes of the start of the transient and assure that the valves are closed.
The Safe Shutdown Report (SSR), Section 5.2.1.5.1, provides a discussion of the effect of having the MSIVs open for the initial ten minutes of the event and comparing it to the effect on inventory loss of a single fire induced spuriously open relief valve. In the case where the turbine bypass valves fail in the open position, the inventory loss would exceed the amount through a single open relief valve. Closure of the MSIVs from the Group 1 Primary Containment Isolation (PCI) logic (low main steamline pressure with the mode switch in RUN) is credited for terminating the reactor inventory loss. Analysis by GE determined that the MSIVs would close within 16 seconds. The amount of inventory loss in 16 seconds through the main steamlines would be less than the loss through one relief valve open for ten minutes.
The original circuit analysis for the MSIVs was limited due to the assumption that the control switches would be placed in the closed position. Further review of the MSIV control circuitry has been performed to determine ifthere were any other fire induced circuit failures that could have caused the MSIVs or the PCI, Group 1 logic maloperation to prevent closure of the MSIVs. The standard circuit failures (i.e., shorts, grounds, opens, and hot shorts) were postulated and reviewed for their effects on the MSIVs. This review included cables from the pressure sensors for the main steamlines through the PCI Group 1 logic to the MSIVs control circuits.
The results of the review indicate that no single fire induced failure can occur that will cause both MSIVs in a given line to fail open. Fire induced failures in at least two of the four instrument channels are needed to prevent the main steamline low pressure isolation from being sensed by the PCI Group 1 logic system. The failures would have to be in two separate cables and would have to be a specific set of cables to prevent the MSIVs from closing. ThesamereasoningappliestothePCIGroupl logic. Twospecificcables must fail to prevent the isolation signal from being sent to the MSIVs and closing all the MSIVs. The PCI Group 1 logic is normally energized and will close the MSIVs when
4 ATTACHMENTA Response to URI Regarding Appendix R Inspection Rcport 9S-011 SVP-9S-273 (Page 9 of 17) deenergized, therefore, there are no adverse consequences due to circuit failures which open the circuit. No single fire induced cable failure in the PCI Group I logic will cause both the inboard and outboard MSIVs to reopen once they are closed.
Hot shorts on the cable between the PCI Group 1 trip relays and the actual MSIV solenoids could cause four MSIVs to be held open by energizing either the AC or DC solenoids. However, the MSIV logic is divided such that the inboard and outboard ~
MSIVs do not share any cables. Therefore one cable failure would not affect both the inboard and outboard MSIVs. This assures at least one MSIV on each steamline will be closed.
Conclnsion Based on the above analysis of fire induced circuit failures, no one fire induced spurious operation could prevent both inboard and outboard MSIVs from closing.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 10 of 17)
- 4. NRC URI 98-011-01 d:
The NRC inspection team concluded that the Quad Cities associated circuits analysis did not meet the requirements of 10CFR 50, Appendix R, Sections III.G and III.L. The primary concern was the assumption that only a single spurious operation would occur as a result of a fire in any given fire area. The team also expressed concern over the potential for multiple fire-induced ADS actuations given that multiple ADS circuit cables are routed through the same fire zones. Related to this issue, the NRC requested an evaluation of the impact of multiple ADS actuations on the safe shutdown time line (the minimum time required to establish injection).
The NRC also expressed concern with the design changes recently implemented to protect the RHR and RCIC pumps during a fire. These design changes provide adequate pump protection for a postulated single spurious operation, but may not provide protection during multiple simultaneous spurious operations leading to both a pump start and concurrent minimum-flow valve closure (resulting in deadheading the pump).
ComEd Rcs onse to NRC VRI 98-011-01 d:
Regulatory Reqairements For Quad Cities Station, Appendix R to 10 CFR 50 provides the requirements for ensuring adequate post fire safe shutdown capability. Regarding associated circuits, Appendix R, Section III.L.7 states: "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment..."
For safe shutdown actions taken outside the main control room (e.g. control room fire),
Generic Letter 86-10, Section 3.8.4 states: "The analysis should demonstrate that capability exists to manually achieve safe shutdown conditions from outside the control room by restoring a.c. power to designated pumps, assuring that valve lineups are correct, and assuming that any malfunctions of valves that permit the loss of reactor coolant can be corrected before unrestorable conditions occur."
0 ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011.
SVP-98-273 (Page 11 of,17)
In addition, Generic Letter 86-10, Section 5.3.10, provides the performance requirements for designing alternate safe shutdown: "Per the criteria of Section III.Lof Appendix R a loss of offsite power shall be assumed for a fire in any fire area concurrent with the following assumptions:
a) The safe shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area; and b) The safe shutdown capability should not be adversely affected by a fire in any plant area which results in the loss of all automatic function (signals, logic) from the circuits located in the area in conjunction with one worst case spurious actuation or signal resulting from the fire; and c) The safe shutdown capability should not be adversely affected by a fire. in any plant area which results in spurious actuation of the redundant valves in any one high-low pressure interface line."
Compliance Assessment The Safe Shutdown Report (SSR) for Quad Cities describes the methodology used to ensure that that fire induced failures of equipment and cables will not adversely impact the post fire safe shutdown capability. The associated circuit analysis was not limited to a single spurious operation for each fire area. Any system or component that either interfaces with the primary system or a safe shutdown system was evaluated. Fire induced spurious operations such as an uncontrolled pump/turbine starting, and valve or breaker repositioning which could occur as a result of short circuits, open circuits, or hot shorts in control or power cables were identified and evaluated. The focus of the analysis was to ensure:
~ RCS inventory was maintained;
~ RCS makeup capability was provided;
~ Fire induced spurious operation of valves would not prevent system performance, cause system damage or divert essential flow;
~ Fire induced spurious operation of pumps/turbine would not damage essential equipment; and,
~ Fire induced spurious operation of electrical components would not result in a loss of power to essential equipment.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 12 of 17)
For the special case of valves that form the interface between the primary coolant boundary and low-pressure piping ("high/low interface") the evaluation included the potential for sequential failure of redundant valves. The high/low pressure interface valves are addressed in the SSR.
The results of the associated circuit analysis were used in the development of the implementing. Safe Shutdown Procedures. As appropriate, specific actions to address each fire induced spurious operation have been incorporated into the safe shutdown procedures. These actions include the alignment of power to designated pumps, assuring that valve lineups are correct, and assuming that any malfunctions of valves are corrected before unrestorable conditions occur. The transient analysis which determined the timeline and overall effectiveness of the Safe Shutdown Analysis and implementing procedures considered a single fire induced spurious operations or signal. An adequate level of safety is provided by implementing procedural requirements to address the potential for fire-induced spurious operations, and by demonstrating that the performance requirements for alternate safe shutdown are maintained during a bounding fire induced single spurious operation. It is our understanding this approach demonstrates compliance with the requirements of Appendix R in ensuring associated circuits will not prevent operation of safe shutdown equipment.
ComEd is sensitive to the issues raised by the NRC during the NRC inspection regarding multiple fire induced spurious operations that could impact safe shutdown activities, such as the start of an injection pump and subsequent closure of its corresponding minimum flow valve leading to pump damage. Because of the NRC concerns, ComEd completed a multiple spurious operations study on July 31, 1998. The results of this study are currently being evaluated.
As stated in our May 22, 1998 letter, interim compensatory measures have been initiated to address this issue.
e ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 13 of 17)
Multiple ADS Valve Actuntioas The fire protection design basis at Quad Cities and Dresden stations was challenged by the NRC during a 1988 Appendix R audit at Dresden Station. During that audit, a specific concern was raised regarding the routing of several ADS conductors in the same cable. The NRC indicated that when evaluating spurious operations of the Automatic Depressurization System, multiple shorts do not need to be considered, but multiple shorts within any given cable should be considered'. Based on this guidance, ComEd proposed design changes to separate individual cables to preclude multiple spurious operations of the ADS valves at Quad Cities and Dresden Stations. These modifications have been completed at Quad Cities Station. In a July 6, 1989, NRC Safety Evaluation Report for Dresden, the NRC reviewed the modifications and found them to be acceptable to address the issue.
The current SSR at Quad Cities considers a single ADS valve actuation in evaluating the timeline requirements for establishing injection. The safe shutdown procedures also require a 10-minute action to de-energize the ADS system. This action effectively closes the single ADS valves assumed to be open, and prevents further spurious ADS actuations from occurring. Considering only a single ADS actuation during the initial 10-minute period provides an adequate level of safety in view of the low chance of multiple actuations occurring during the initial 10-minute period.
ComEd has performed a preliminary assessment of the impact of multiple spurious ADS valve actuations. The evaluation determined that a total of two ADS valves has a relatively minor impact on the time requirements for establishing RPV injection and does not pose a significant safety issue. Considering more than two ADS valve actuations has a greater impact on the time requirements for injection. However, ComEd does not consider this a significant safety issue because: 1) positive actions are taken within 10 minutes to de-energize the.ADS valves, and 2) the low chance of occurrence of multiple (more than two) ADS valve actuations to occur within the first 10 minutes.
'omEd letter to USNRC dated September l6, l988
ATTACHMENTA Response to URI Regarding Appendix R Inspection Rcport 98-011 SVP-98-273 (Page 14 of 17)
Relaleil Enlrancemenls Due to the NRC concerns in this area, ComEd completed a study of fire induced multiple spurious operations. This study identified combinations of spurious operations (with.
particular focus on redundant valves and pump/valve combinations) that could have an adverse impact on post-fire safe shutdown capability. A total of 78 combinations of spurious operations have been identified that may have an adverse impact on post fire
. safe shutdown. A systematic evaluation of the results of the study is underway which will identify any necessary safe shutdown program enhancements including procedure changes, revisions to the Safe Shutdown Report, or plant design changes. Actions to address this issue will enhance compliance with Appendix R and will be prioritized based on risk benefit as determined by our enhanced fire risk model. The multiple spurious operations study encompassed the RCIC and RHR pumps, which were identified by the NRC as not potentially being protected during fire induced multiple spurious actuations.
As stated in our May 22, 1998 letter (Reference 2), compensatory measures have also been implemented on an interim basis.
Conclnsion ComEd completed a study of fire induced multiple spurious operations. A systematic evaluation of the results of the study is underway which will identify any necessary safe shutdown program enhancements including procedure changes, revisions to the Safe Shutdown Report, or plant design changes. Actions to address this issue will enhance compliance with Appendix R and will be prioritized based on risk benefit as determined by our enhanced fire risk model. '
As stated in our May 22, 1998 letter, ComEd is committed to evaluate improvements to strengthen the overall fire protection and safe shutdown capabilities at Quad Cities Nuclear Power Station. ComEd is also working closely with the BWR Owners Group (BWROG) Appendix R-Fire Protection committee. The BWROG is in the process of developing generic guidance on the implementation of Appendix R requirements.
ATTACHMENTA to URI Regarding Appendix R Inspection Report 98-011
'esponse SVP-98-273 (Page 15 of 17)
The NRC inspection team indicated that fire area TB-II did not appear to have adequate fire detection and suppression equipment to ensure compliance with Appendix R, Section III.G.3. The inspection report noted that failure to properly identify the correct'location of a fire involving oil filled transformers could cause the Operators to unnecessarily enter safe shutdown procedures and evacuate the control room, causing an additional hazard to the unit, and could delay proper fire brigade response.
ComEd Res onse to URI 9S-011-01 e:
Regnlatory Requirements The NRC inspection team reviewed whether the fire detection and suppression in fire area TB-II complied with the requirements of Appendix R, Section III.G.3.
Section III.G.3 pertains to the use of an alternate shutdown strategy and requires that:
"Fire detection and a fixed fire suppression system be installed in the area, room, or zone under consideration."
Additionally, Generic Letter'86-10 provides further guidance on the issue of area detection and suppression. Enclosure 1 to GL 86-10, Section 5, states:
"Suppression and detection sufficient to protect against hazards of the area must be installed. In this regard, detection and suppression providing less than full area coverage may be adequate to comply with the regulation. Where full area suppression and detection is not installed, licensees must perform an evaluation to assess the adequacy of partial suppression and detection to protect against the hazards in the area."
Compliance Assessment The area of concern identified by the inspection team is in the Turbine building central group within fire zone 8.2.7.C. on the mezzanine level. As this zone does not have full area detection and suppression, a fire protection engineering evaluation was prepared to demonstrate that sufficient fire detection/suppression is installed to protect against the hazards of the area.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 98-011 SVP-98-273 (Page 16 of 17)
The inspection team did not concur with this evaluation noting'the following issues:
- 1. The unprotected section of this fire area contains two transformers with approximately 380 gallons of oil each.
- 2. A transformer oil fire would be unmitigated by an automatic suppression system and give offa large quantity of smoke.
- 3. The smoke could be very heavy and obscure the location of the fire.
- 4. Failure to identify the correct location of the fire could cause operators to, unnecessarily enter the safe shutdown procedures and evacuate the control room.
- 5. Fire brigade response could also be delayed ifthe correct location is not identified.
The inspection team did conclude, however, that the revised SSR did not affect the technical basis for the exemptions previously granted in this fire area for complying with Appendix R, Section III.G.2.(separation of redundant systems).
The technical basis for not providing full area fire detection or suppression in TB-II, fire zone 8.2.7.C. is based on the following fire hazard analysis features:
~ (Issues 1 and 2) The dielectric in the subject transformers (transformers for busses 17 and 27) is Pyranol, an askarel fluid, and not a combustible mineral oil. Askarel has no fire point (the lowest temperature a liquid will burn continuously when ignited by flame). It is a nonflammable fluid and indicative of a non-fire hazard. Therefore, fire detection and a fixed suppression system are not warranted for this nonflammable liquid filled transformer.
~ (Issues 3 and 5) In the event of a catastrophic transformer failure or rupture, the generation of a large quantity of smoke is prohibited due to the nonflammable characteristics of the askarel. Although a high-energy arc or fault could result in a flash of this dielectric fluid, automatic disconnects are provided to de-energize the equipment. The elimination of the ignition source, via phase overcurrent and residual ground fault protection on the high side of the transformer, further ensures that the askarel fluid will not support continued combustion or result in a smoke-laden environment. Therefore, smoke obscuration is prevented thereby allowing the Operators, including the fire brigade, to accurately identify the fire location and to take appropriate actions to mitigate the consequences of a fire.
ATTACHMENTA Response to URI Regarding Appendix R Inspection Report 9S-011
, SVP-98-273 (Page 17 of 17)
~ (Issue 4) The notification of a transformer failure incident is provided by multiple alarms that annunciate in the main control room. The alarms include bus trips, breaker feed trips, loss of control power, and the individual trips for the equipment fed from these transformers. Therefore, multiple simultaneous alarms will annunciate in the control room signifying a failure in the immediate area of the transformers.
These alarm notifications will promptly and accurately identify the location in the event of a transformer failure. An operator or the fire brigade can also be summoned to the specific location to assess potential fire damage. Since this is not a severe uncontrolled fire, normal and emergency operating procedures are sufficient to handle this scenario, and since the transformers for busses 17 and 27 do not supply safe shutdown equipment, prematurely entering the safe shutdown procedures or evacuating the control room will not occur.
Fire protection features are provided for the hazards in the area. These features include:
Ceiling level automatic sprinklers in the center aisle area above the turbine lube oil tanks and the MG set coolers.
Fixed automatic water spray systems for the turbine oil reservoirs.
Automatic sprinklers at floor level above the resin containers.
Automatic fire detection in the center aisle area above the oil hazards.
Curbing around the transformers to contain a fluid spill. In addition, floor drains are provided immediately outside the curbs and throughout the area to handle any fluid runoff.
Fire hose stations and portable fire fighting equipment throughout the area.
Steel beam fireproofing above the switchgear on Unit 1 and MCC on Unit 2.
Limited fixed combustibles, a cable tray above the transformer/switchgear, and no permanent combustible storage area within 30 feet of the transformers.
COllCllls(Oil Prompt notification via control room annunciation alarms will alert the Operators to the fire location and the equipment affected. Fire and smoke development are significantly reduced by the use of nonflammable dielectric fluid in the transformers. Adequate fire protection equipment and measures are provided to ensure compliance with the regulation.
0,