ML20064L092
Text
{{#Wiki_filter:_ _ _ _ _ _ _ _ [dde%. AEOD/EZO3 (.i UNITED STATES N ' NUCLEAR REGULATORY COMMISSION This is an intemal, pre-e 3 ,g WASW NGTON. D. C. 20555 decisional document not \\*****p'8 necessarily representing a position of AE00 or tiRC. - J AN 211982 MEMORANDUM FOR: Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data FROM: Wayne Lanning. Ofrice for Analysis and Evaluation of Operational Data
SUBJECT:
INADVERTENT ISOLATION OF CONTAINMENT FAN UNITS AT SALEM GENERATING STATION - UNIT 1 An engineering ehaluation has been completed for the occurrence reported in the enclosed LER. The primary purpose was to evaluate the likelihood of inadvertent isolation of the containment fan coolers during LOCA conditions. The LER reported that the service water isolation valves were found closed to the containment fan coil uni.ts (ECUS) during cold shutdown. The cause of the occurrence was traced to the service water radiation monitors which had isolated ~ the FCUs after detecting the radiation emitting from the residual heat removal system. The monitors for the service water return piping are located in the same pipe chase as the residual heat removal system piping. The safety signi-ficance of this occurrence is that the FCUs may be. required during a LOCA and inadvertent isolation would render them inoperable. However, the containment a spray provides for redundant and diverse heat removal functions when the FCUs are inoperable. The licensee identified the design deficiency in October 1978 and removed the isolation function of the radiation monitors in January 1979. The isolation. function of the radiation monitors was included in the original design to. prevent radioactivity from being discharged to the river. As a result of this event, the licensee has determined that the service water pressure will exceed the containment pressure during a design basis LOCA thereby preventing releases of radioactivity through the service water system. Therefore, the automatic isolation feature is not necessary and leaking FCUs will be isolated remotely by procedure. IsolationprohisionsfortheserYicewatersystemtotheFCUswerereviewedfor other operating plants to determine if the radiation monitors provided an isola-tion function. In response to IE Bulletin 80-24 entitled " Prevention of Damage Due to Water Leakage Inside Containment," the licensee described provisions for isolating the service water system. Based on these responses, which may not be complete. since the function of the radiation monitors was not specifically addressed, no other designs included automatic isolation on radiation alarms. In general, the licensee indicated that for essential service water systems, manual actions are required to isolate the system. ^hael)1ca 36
J/ : 211882 In conclusion, it appears.that inadvertent isolation of the containmer' ' en. cooler system due to radiation alarms is not likely since most operst osants do not have this isolation feature. It appears that Salem had incorptsated this feature unnecessarily as an added protection to prevent radiological. releases.outside containment. Since the isolation function has been removed. this occurrence does not merit further consideration, I r Wa e anning Office for Analysi s and Evaluation ofOperationa1\\(ata
Enclosure:
As stated O e 4 e e O e = 0
h N LER SCREENING / DISPOSITION SHEET DocketNo.h7 R No.7 b 7 Y ~ b ! Engineer: 6 L. TM h/ 1. Add'l Info. [ Yes Required? Yes Yes (circle one) If YES, describe 2. Is this event significant? A Yes No Yas/ No No (Appendix A)) (Circldone de /M If yes. why? 4_6 M e-Aa & ] c/ 3.. Abnormal Occurrence? (Appendix B) Yes No Yes .Yes No (Circle one) If yes, why? l 4. Reportable to NEA? h No (Appendix C) - Yes Yes I (Circle One) O [*) If yes, why? 5. Recomended Action: IhIII Iy Category (circle one) I II IV I II IV 6. Lead Engirjeer (NSSS) Disposition (Category III only): Lead Engineer: Category: I II IV Coments: 7. Final Action / Disposition h 7 [ -Me --M Y de5'-r/4ff '72A R4E*'s Y$ e? 14k!x l 5 k f41ft.tM Y f M (M M A M 7& 44_ % hi LSes / lirestor,(Eco Date '
~ PSEG Phone 201/430 7000 Publ.c Se.'vice Electric and Gas Company. 80 Park _ Plaza Newark, N.J. 07101 March 25, 1981 Mr. Boyce H. Grier Director of USNRC Office of Inspection and Enforcement Region 1 631 Park Avenue King of Prussia, Pennsylvania 19406
Dear Mr..Grier:
LICENSE NO. DPR-70 ~ DOCKET NO. 50-272 REPORTABLE OCCURRENCE 78-72/0lX-1 SUPPLEMENTAL REPORT Pursuant to the requirements of Salem Generating Station Unit No. 1 Technical Specifications, Section 6.9.1, we are submitting supple-mental Licansee Event Report for Reportable Occurrence 78-72/OlX-1. Sincerely yours, /
- f. s. c. W./'
R. A. Uderitz General Manager - Nuclear Production CC: Director, Office of Inspection and Enforcement (30 copies) Director, Office of Mahagement Information and Program Control (3 copies) $ ) h ).I'[ [(; % S ~ ? d I% i W/) /l s ' %t g n y J-110 4:0~2T50:4w
Raport Numb 3rs 78-72/0lX-1 Report Date: March 25, 1981 ~ Occurrence Date 11/7/78 Facility: Salem _ Gene. rating Station - Unit 1 Public Service Electric & Gas Company Hancocks Bridge, New Jersey 08038 IDENTIFICATION OF OCCURRENCE: Inoperable Fan Coil Units CONDITIONS PRIOR TO OCCURRENCE: Operational Mode 5 DESCRIPTION OF OCCURRENCE: l During the week of October 19, 1978, while the plant was shutdown for a maintenance outage, all five containment Fan Coil Unit's service water isolation valves were found ~to be tripped closed. The problem was traced to the CFCU sc+* ice water radiation mor.itors alarming due to radiation emitting from the residual heat removal piping passing through the area where the detectors are located. PSE&G Engineering Departm.ent was notified of this occurrence on October 19, 1978, and a resolution was requested. Oa November 6, 1978, the Engineering Department notified the stat. ton that this was i a potential unreviewed safety question and the Resident NRC Inspector was immediately notified. DESIGNATION OF APPARENT CAUSE OF OCCURRENCE: The cause of this occurrence is an apparent design deficiency for the RMS detector installation. The purpose of these detectors is to monitor radioactivity in the service water discharge from the Fan Coil Units during normal operation. Since the detectors are sensitive to changes in background radiation levels, they will cause service water isolation to the Fan Coil Units when the radiation levels are sufficient to cause the RMS detectors to initiate an alarm condition. ANALYSIS OF OCCURRENCE: The five Fan Coil Units use service water for cooling with a por-tion of the outlet flow diverted to a radiation monitor designed to initiate automatic isolation of the service water flow if there is radioactivity in the water, thus preventing radioactive water from being discharged to the river. This possibility existed, if the service water system failed during a LOCA with the containment at peak pressure, since the peak pressure was thought to be greater than service water pressure. However, as documented in the Mechanical Division Safety Evaluation SE-004, the service water pressure in the containment would,be greater than the peak containment pressure during a LOCA. -r-_. - -, - ~ _ -,, ...m,
LIR 78'-72/OlX-1 . March 25, 1981 The radiation levels in the area of the monitors will be extremely ~ high during a LOCA due to the activity present in the RHR lines or from streaming through the containment penetrations. These radiation levels would trip the monitors, thus isolating service water flow, resulting in inoperative Fan Coil Units. The isolation function is not applicable or necessary for the LOCA condition since no leakage of activity into the service water lines will occur. Shielding necessary to effectively alternate radiation levels during a LOCA would be in the range of tons per unit (approximately 12 to 16 inches of lead) and would require structural steel supports. The i l i;mnediate solution is to remove the isolation function circuitry and leave remote manually operated isolation valves in these service snater lines. By maintaining only the alarm function, administrativeW./ action could be taken to manually isolate service water flow to these components, if an alarm is received and determined to be validm This also eliminates the possibility of no service water flow to the Fan Coil Units during a LOCA due to high background radiation from the EHR lines or other sources. CORRECTIVE ACTION:. .. Design Change lEC-0448 was completed on January 11, 1979 which removed tdue control function of the Fan Coil Units radiation monitors. The detectors have been shielded with lead blankets to reduce their sensitivity to general area radiation. No further corrective action is planned. FAILURE DATA: Not Applicable Hf. // / 4(Ke &t-1 /)le Prepared By W. J. Steele Manpger - Salem Gdh6 rating Station SORC Meeting No. 81-19
.__,_-.-r,
U.Em NUcLkAM M8tsWLA f we e gasseeeeeee,w., NEC FoEM 364r . nm. LICENSEE EVENT REPORT .CdNTaotetoCoI i i1 1 I Q ietsass mNr on Tves au casuiten.N,:auariom fo Til IN la is I :.' sl1 l@l o f of -l o f ol o f o l ol -l ol o @l4 Iil11111 @ls1Catse@ I l ~ E 36 blCENst TYPt #d 7 8 9 LICIN548 Coot to is LiCENst NWWSER $$,$ l Li@Loi si olo I of 217I 21@l II II c I 717181@l013121s i s i 119 CON'T 60 si ooca ET Nuwegn es et Svegroaft 74 M AEPomfoaTE 80 0 1 7 8 EVENT DESCRIPTION AND PROSABLE CONSEQUENCES h i fo"TTI I ouring Mode 5 operation, all containment ran coil units were found to be 'Its problest was traced to the RMS l ro 1T) I inoperable due to tripped service water valves. [,,o_j,4,j l detectors and Engineering De rtment was notified on 1o/19/78. The station received a reply on 11/6/7s that a safety evaluation would be made and corrective action I ITTTIl l The Resident NRC Inspector was immediately notifier. lo16l l initiated. I o 7 l 1 so lo tel l sveS*obs svNN 'c$os "c^o$a s$e'c$ot courowsNT coot I S I B lh dh [,CJ@ l Z l 21 Z l Z l Z l Z lh Z @ UZ h i s e io it s2 u is i 20 afv's os saoutNtiat occunaENcr naroat avtNTvtaa ateoat wo. coot Tves se. "t lol7l2l l ol l l X b d @,"og..e i7l8l y,,j g a, n as 2, n a MAN 8acTunta MN Moums sus tTT foe 8. L 'I a os
- LANT
%3LZJ@ L:J@ tzJ@ IoIofofof LJJ@ LwJ@ L2J@ l z i S I S I S JG 34 as as 3' so en 42 es na u CAUSE DESCRIPTION AND ComRECTivE ACTRON 5 h l ITITll x desien deficiency in the installation of the RMS detectors for the CFCU service l l water did not sufficiently shield the detectors from backcround radiation comine fromI 1 i l The isolation function of the detectors was removed as per m i RHR piping in the area. i The detectors were shielded with lead blankets to reduce their L' J 3J l oCR 1rc-0448. No further corrective action is planned. I E I sensitivity to general area radiation. so of=ensvaTus @ EsEcm$ oescovsav ossemirTion h 7 se 'sYaNs* spowsa I [Gj h [oi ol ol@l N/A j [CJ@l Maintenance Test 1 5 Location os attsast @ ' aEnviTv cMTest amouwT or activ Tv @ l N/A 1 F/A j mettaseo os a Least hdi 1 6 ' n.so 'd e,os S ts otsc...Tio @ 1 ., von. Tvn E I ol ol oJ@LzJ@l w/x ' ' n.so ~.l's.uvLs o n c.i,Tio @ 1 u. E.IofoIoJ@l w/a 1 n n Loss o8 om oauaGt To. paesLITY i TYPC otsemiPTso. E. L. zJ@l n/x NaC uSE o~tv 1 to E.,uu], @Js'c.,,,,o.,@ #'b w/a 1 IllillilittI15 i l L.w-6o9-935-o998 { i. 8T010g,0,gTeanna -
- w. J. steele ma,,.
m
i ( 6,, i Fred: rick W.Schneider Public Service Electric arid Gas Company 80 Park Pla Newark, NJ. 07101 201/430-7373 Vice President Production January 2, 1981 Mr. Boyce H. Grier, Director Office Of Inspection and Enforcement - U. S. Nuclear Regulatory Commission Region 1 631 Park Avenue King of Prussia, Pennsylvania 19406
Dear Mr. Grier:
NRC IE BULLETIN NO. 80-24 PREVENTION OF DAMAGE DUE TO WATER LEAKAGE INSIDE CONTAINMENT (OCTOBER 17, 1980 INDIAN POINT 2 EVENT) SALEM GENERATING STATION UNITS NC. 1 AND 2 DOCKET NOS. 50-272 AND 50-311 In response to your letter of November 21, 1980, transmitting NRC IE Bulletin 80-24, the attached response is hereby submitted for your review. Approximately ninety-eight (98) manhours were expended en this bulletin's review. If you have any further questions, we will be pleased to discuss them with you. Sincerely, i pe-A CC Director Nuclear Regulatory Commission Office of Inspection and Enforcement Washington, D. C. 20555 ,3s n
- ,, ~ u 'l%..
j f v L
The following response corresponds to the Item Nos. of NRC Bulletin 80-24. 1. The only open cooling water system present inside of Salem Units 1 and 2 containment is the containment fan cooling system. The following information provides a summary des-cription of the system. a) The mode of operation of the fan cooler is different during normal reactor operation and during a response to a LOCA. During normal reactor operation, two to four of the five fan coil units are running depending on seasonal conditions and reactor power. The remaining units are in a standby condition and are ready for service. During a LOCA, the following three different operating modes would be possible:
- 1. All five containment fan coil units and no containment
- spray,
- 2. Two containment spray trains and no fan coil units, or
- 3. Three fan coil units and one. containment spray train.
The service water system flows to the operating and standby fan coil units. b) The source of witer to the fan coil units is service water. Its typical chemical content is: Item Minimum Average Maximum f Conductivity, micro-ohms 250.0 8,500.00 18,000.0 pH 6.2 7.1 9.0 Total dissolved solids, ppm 139.0 5,890.0 13,689.0 Suspended matter, ppm 5.0 135.0 694.0 Sulfides, ppm as H S 0.0 0.04 .48 2 Chlorides, ppm as Nacl 20.6 5,300.0 11,080.0 Dissolved oxygen, ppm 3.28 7.9 17.39-Chemical oxygen demand, ppm 0.0 84.5 594.0 Total ammonia, ppm 0.025 .32 2.33 Sulfates, ppm as SO 5.0 474.0 1,050.0 4 free carbon dioxide, ppm 0.0 3.6 26.2 G ,.a-,_.,-_,.-,,,.,,,,nn.,nn.. --,,c,-.- --n.
c) The piping and cooler tubes used in the fan cooling system are made of corrosion resistant materials. The piping to the coolers is cement lined carbon ~ steel.. The high erosion piping sections are currently being replaced with 316 stain-leus steel piping. The cooler tubes are currently 90/10 CuNi, and these will be replaced with AL6X tubing. d) Experience with system leakage is documented in the response to item 1(e). e) The following list is a history of the type of repairs done on the fan cooler system: W rk o Order No. Description Date MD-2162 11 FCU Motor Cooler Replacement 10/24/77 ,OD-6092 '144 FCU Motor Cooler Repair 10/24/77 MD-2319 13 FCU Motor Cooler Repair 10/31/77 OP-0146 15 FCU Motor Cooler Repair 11/03/77 MD-2315 13 FCU Motor Cooler Repair 11/03/77 MD-2895 11 FCU Motor Cooler Repair 8/04/78 MD-2948 & 11 through 15 FCU Replace Spool 8/23/7.8 OD-10060 & MD-2949 & OP-90396 OD-10158 14 FCU Motor Cooler Replace / Repair 8/30/78 I MD-0353 & 12 FCU Motor Cooler Replace / Repair 3/31/79 MD-903366 MD-905965 13 FCU Repaired Flange Leak 79 OD-916898 11 FCU Motor Cooler Replace / Repair 9/05/79 OD-915491 13 FCU Motor Cooler Replace / Repair 10/23/79 OD-932346 15 FCU Motor Cooler Replace / Repair 80 11 FCU Motor Cooler Replace / Repair 6/11/80 MD-912685 11 FCU Primary Cooler Coil Replace 7/08/80 11 FCU Motor Cooler Replace / Repair 9/03/80 11 FCU Primary Cooler Coil Replace 9/11/80 MD-910204 11 FCU Primary Cooler Coil Replace 9/11/80 l l 12 FCU Motor Cooler Replace / Repair 8/02/80 1 MD-936319 14 FCU Primary Cooler Coil Replace' '8/08/80 MD-936324 14 FCU Secondary Cooler Coil Replace 8/11/80 15 FCU Secondary Cooler Coil Replace 9/09/80 l l All repairs were done by welding of copper nickel to carbon l steel.
f) The service water system to the fan coolers is provided ~ - Each fan cooler unit has an inlet with isolation valves. and outlet isolation'va1ve located outside containment. i Isolation of the individual cooler can be accomplished by remote air operated valves from the control room or local manual operation. The pilot solenoid valves are the same power channel as the power feed to the respective fan cooler. Loss of power or air will cause the isolation valves to fail open (due to safety function design of the fan coolcrs). Redundant air is supplied to each valve to minimize probability of failure to close when needed. The fail safe condition for the valves must be open due to safety function conditions. This arrangement negates the vulnerability of this system to single failure. g) There are no provisions for testing the isolation valves in accordance with Appendix J to 10CFR50. This procedure -1:s not required because the isolation valves do not meet the criteria of II. H1 through 4 of Appendix J to 10CFR50. h) The following instrumentation is in place to detect leakage: Service Water Flow - Each containment fan coil has an individual flow indicator on the control console. In addition, a diff&rential service water flow inlet to out-let will cause a bezel alarm on the control console. Containment Fan Coil Leak Detector - The condensate from the fan coil drain pans is collected and funneled into a stand-pipe which has a high alarm and a high-high alarm which are 4 I located on the overhead annunciator. Also a selectable level indicator is located on the control console. Dewpoint - A dewpoint measuring system is installed to continuously monitor inlet dew temperature of each fan coil unit an'd recorded on panel 1RPl. Radiation Detection - A radiation detector is installed j i in the service water outlet piping of each containment fan coil. Upon initiation of a high radiation level a i l bezel alarm is actuated and the coil is isolated by procedure. Containment Sump Level' Indication-On the control console two channels of analog level indication are installed on Unit 1 and are,now being installed on Unit 2 as per post TMI requirements. Also included is a containment sump over-flow alarm on the' overhead annunciator. Procedures are in place to detect leakage in the contain-ment building utilizing both the reactor coolant leak detection procedure OI II-1.3.5 and reactor coolant leak rate computation procedure SP (0) 4. 4.6. 2 (d).
~ }
- 1) Radiation monitors are provided to minotor fan cooler service water discharge and provide alarms and indication to operators.
Grab sample analysis capability is also i provided. No automatic isolation of fan cooler service water is initiated upon radiation alarms. The fan coolers are a safeguards system and perform an. accident mitigation function. l 2. The following actions and verifications were accomplished at our Salem plant. a) A redundant means exists to' detect and alert control room ) operators of a significant accumulation of water in the containment sump. There are two channels of level indica-tions on the control console. Also included is a containment , sump overflow alarm on the overhead annunciator. The reactor i sump has sump pump start-stop times and the sump high level alarm indicated on the auxiliary alarm printer. b) A positive means exists to determine flow from the con-tainment sump. Observation of containment sump pump start and stop times are indicated on the auxiliary alarm printer. Utilizing the standard plant operating instruction OI-1.3.5, ) the operator can thus determine leak rate into the sump. A similar arrangement is provided for the reactor sump pump. c) Whenever a containment fan coil leak detection high alarm is received, shift routine requires that the total fan coil unit leak rate be determined in accordance with t l OI II-1.3.5 (Reactor Coolant Leak Detection). In addi-I tion, it is required that an auxiliary annunciator alarm summary be initiated and evaluated at least once per shift, indicating sump pump operation and unusual alarms. These two shift procedures assure that the plant operators have at least two methods of determining water level in each location and at least one pump available to remove water from each sump. location. d) A review of the present leak detection systems and pro-cedures indicates they provide adequate means and measures to promptly detect, verify and isolate leaking ccmponents or systems within the containment building. ( e) All measures described in a) through d) above are implemented; consequently, no interim surveillance measures have been i undertaken. f) Procedures, as per the station's sta'ndard administrative procedures, have been established to notify the NRC of any service water system leaks within containment via a special license event report as a degradation of a containment boundary.
5-3. Portions of the component cooling system, a closed cooling system, are inside the containment. To date the units have not experienced any significant amount of component cooling water leakage into the containment. 4. This letter serves as a written report in response to your items listed in IE Bulletin 80-24. The attached letter of affirmation is provided. O O e O o O 4 m*
/ l' State of New Jersey ) ) SS:' - County of Essex ) Frederick W. Schneider, being duly sworn according to law deposes and says: I am a Vice President of Public Service Electric and Gas Company and as such, I find the matters set forth in our response dated January 2, 1981, to all items of Bulletin No. 80-24 " Prevention Of Dainage Due To Water Leakage Inside Containment" are true to the best of my knowledge, information,- and belief. l Frederick W. S~chneider Subscribed and sworn to before me this.4 day of h/pgz/dAir , 1981 ictary Publib of New Jersey My commission expires on M64) / /f[$
UNITED STATES AE0D/E204 d [( ( , NUCLEAR REGULATORY COMMISSION g r, j W4SHINGTON, D. C. 20555 \\*****/ JAN 281882 MEMORANDUM FOR: R. Vollmer, Director Division of Engineering, NRR E. Jordan, Director Division of Engineering and j//jf Quality Assurance, IE FROM: Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data
SUBJECT:
EFFECTS OF FIRE PROTECTION SYSTEM ACTUATION ON SAFETY-RELATED EQUIPMENT At the Operating Reactor Event meeting held on January 7,1982, the subject discussed.-{re protection system actuations at operating nuclear plants was of recent The events showed that safety-related equipment subjected to wa-ter spray from fire protection system could be rendered inoperable. The events also indicated that spurious actuation of fire protection system can 1 be initiated by operator error, by steam, high humidity or maintenance activi-ties in the vicinity of fire protection system detectors. Other events also exemplify that interactions of the fire protection system with other systeas (e.g., ventilation and diesel fuel oil) have not been adequately considered. At the meeting, IE was assigned the responsibility to review the recent fire system actuations and consider development of an Information Notice and the Division of Engineering, NRR was to review the events and consider the need for modifications to requirements or review procedures for fire protection systems. We have reviewed some of the recent operating reactor events involving fire protection system actuation. Brief descriptions of these events are enclosed. Based on a review of the events, the following information is provided for j your consideration in the efforts that are underway. We share you.' conclusion that the adequacy of design and qualifications of safety-related equipment and systems located in areas where fire protection is provided should be re-evaluated. Potential interactions between fire protection systems and other systems that affect the operation of safety-related systems need to be thoroughly understi,od. Safety-related equipment, not damaged by a fire itself, should be designed and qualified to perfonn I its intended function during and following a fire protection system activa-tion. r n n f) QQ D 1/ / Memorandum for D. Eisenhut from G. Lainas dated January 13,1982 on " Summary of Operating Reactor Events Meeting on January 7, 1982." h 5t l
,, JAN 281982 These considerations should include all types of fire protection systems, e.g., water, halides, carbon dioxide and other chemicals. In addition, consideration could be given to incorporate diverse design considerations in the fire protection system to minimize inadvertent spray, e.g., smoke detectors and heat detectors. The diverse detectors should also minimize the likelihood of inadvertent fire protection activation during a seismic event which can induce smoke detector alarms due to airborne dust. In summary, the NRC should have confidence that all safety-related and essen-tial support equipment located in areas where fire protection spray systems are provided will perform the intended function during and following the activation of the fire protection system. If you should desire additional information or assistance, the AEOD contact is Matthew Chiramal. ~ 'Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data
Enclosure:
As state cc: H. Denton, NRR D. Eisenhut, NRR G. Lainas, NRR R. Ferguson, NRR Z. Rosztoczy, NRR V. Benaroya, NRR W. Lanning, AE0D C.J. Heltemes, AEOD S. Rubin, AE00 a e I o 2
r
+, - - ---. -
r. Enclosura Events Related to Fire Protection System Actuation Plant Date of Occurrence Description of Event Sur ry-2 May 28, 1981 LER 81-033 - An open valve from the fire main to the fire protec-tion foam system allowed approxi-mately 4,000 gallons of water to enter the above ground fuel oil storage tank. Water was subse-quantly found in the underground and wall tanks for the emergency diesel generators. This occur-rence represents a potential com-mon mode failure for both trains of the onsite emergency power sys-tem. The fire protection sparger is located inside the fuel oil storage tank. The potential for ~ water to leak from the fire pro-tection system into the fuel oil had not been considered during the design or before installation of the fire protection system. In-adequate procedures and sampling techniques contributed to this event. ( AE00 is performing an engineering evaluation of this event.) Troj an July 26,1981 LER 81 During steady state operation with the plant at 80% i power, the control room operator l noticed that the control power had l been lost to the "B" train hydro-l gen recombiner... The loss of control power was due to inadver-l tent activation of the fire protec-tion deluge system while welding in the electrical penetrating area. The spray caused a short circuit and loss of control power to the hydrogen recombiner... Trojan _ Sep. l'0, 1981 LER 81-021 - During normal opera-tions, high ambient temperatures in the room housing the "A" trains 9
. j Plant Date of Occurrence Description of Event of the preferred instrument and control power buses for the ESF equipment exceeded the Techni-cal Specifications. The occur-rence resulted from the instal-lation of a three-hour rated fire barrier between the two trains of equipment which lead to inadequate ventilation in the new room created by the wall. Inadequate interdisciplinary review resulted in an incom-plete safety evaluation for the plant design change that crea-ted the fire barrier, i.e., cooling requirements for the installed heat loads versus the cooling capability of the installed ventilation system were not analyzed. Girna Nov. 14, 1981 Daily Report - Duri.ng start-up testing of the new fire sup-pression system, failure to fol-low teet procedures caused activation of several portions of the system... Various power cabinets and electrical equipment in the turbine and intermediate buildings were sprayed. A manual reactor trip was initiated at 10:26 am following indication of two dropped rods and numerous control room annunciator al arms. The dropped rods were attributed to a trip of the "A" RPS MG set which may have reduced voltage enough to drop two rods. All sytems functioned pro-perly following the trip"and plant was maintained in ho t-shutdown" status while opera-bility of equipment affected by the suppression system was assured... m
I 17. ~ i Plant Date of Occurrence Description of Event ~~ ' Dresden 1 Nov. 30, 1981 LER 81-39/0IT Unit start-up was in progress when the control room received a HPCI Room Fire System Initiation alarm from the south ionization smoke detec-tor. The HPCI system was de-clared inoperable and the HPCI steam line isolated. An Unusual Event was declared and a nor-mal unit shutdown initiated. The health and safety of the general public was not endan-gered since all safety systems performed as designed and this was the firstevent of this type at Dresden Station. The cause of the fire system initiation is believed to have been a buildup of humidity / steam vapor in the HPCI room. The smoke detector operates on the ionization principle and is usually activated by the presence of combustion products. Discussions with the manufacturer of the smoke detector indicated that the detector may actuate if expo-sed to a high concentration of water vapor. The HPCI room has had a history of high humidity / steam be-cause of steam leaks and the leakoff / drain system which runs to the sump in the HPCI room. Temporary ventilation was not operating prior to the occurrence which would have reduced the water vapor con-centration. The smoke detec-tor continued to intermittently alarm until the ventilation was restored. ~ The station Fire Marshall will be reviewing the entire fire protection system for this HPCI room. In addition,
> g Plant Date of Occurrence Description of Event our Station Nuclear Engineer - ing Department has been request-ed to review both the fire pro-tection detectors and the venti-lation system for possible modifications to improve re-liability. Dresden 2 Dec. 24, 1981 PNO-III-81-120A - The Unit 2 reactor was brought from full power to a cold shutdown con-dition on December 24, 1981, after a failure of both re-quired high pressure ECCS systems; HPCI and ADS... The ,HPCI system was declared in-operable on December 23, 1981, following activation of the HPCI room fire protection wa-ter deluge system. The deluge system was activated by smoke from welding operations near a HPCI room smoke detector. The water spray caused water intrusion into the HPCI tur-bine oil system (which did not affect HPCI operability)... Oyster Creek Jan. 9,1982 Daily Report - With the plant in cold shutdown at about 9:50 am, the auxiliary pump on the reactor water cleanup system seized. Its motor overhead. Smoke from the motor activated the fire suppres-sion system on the south side of the reactor building at the 51-foot elevation... The fire suppression system was secured at 10:25 am. Water spray from the suppression system shorted out the position indication on one torus vent valve, damaged I one reactor lo-lo-water level i sensor and one reactor high pressure sensor. Troj an Jan. 9,.'382 Daily Report - Shortly after 1:00 am the control room l
g P,1_a nt_ Date of Occurrence _ Description of Event operators received signals indicating a fire in the tur-bine building and actuation i of several deluge systens located in that area. Fire brigade personnel responding to the alam reported that the turbine b1dg was filled with steam. The control room opera-tor there upon manually tripped I the reactor and brought it to hot shutdown. Further investiga-tion revealed that the source of the steam was a failure of a 90 degree elbow in a low pressure (150 psi) steam line from the high pressure turbine to the No. 5 feedwater heater. In addition, the heat from the steam is credited with tripping the fire alarms and deluge sys-tems... McGuire 1 Jan. 6, 1982 Daily Report - On January 6 licen-see identified an interaction of non-safety related to safety-re-lated equipment that could com-promise Diesel Generator IA operation following a seismic event. During a check of equip-ment installation the licensee identified fire protection piping routed over one of the safety-related cable and an instrument panel used for HVAC inside the diesel generator roGP. S
AEOD/E201
- y
$"*eug. UNITED STATES g f 8 NUCLEAR REGULATORY COMMISSION n ?, ,,i wiswiuarow.o.c.nosss . \\,...../ JAN 121882 +- MEMORANDUM FOR:. Robert F. Burnett, Director Division of Safeguards, NMSS I FROM: 'Carlyle Michelson, Director of Operational Data' ~ " '. * 'l 3,. ',., t, T " - 0ffice for Analysis.and. Evaluation.;'. ; -
SUBJECT:
METHODOLOGY FOR VITAL AREA DETERMINATION ~ In ou'r meeting of July'23; 1981, we indicated that we would provide our thoughts' on the vital area identification prpcess. Based on review of selected reports, contractor meetings, and discussions between members of our staff, the following coments are provided for your consideration. 1. Generic sabetage fault trees are used for.ihe analysis..of.' nuclear power ~ plants to identify vi.tal areas and. provide the basis for the proposed rule on vital area definition. Application of this technique for diiveloping sabotage scenarios is an important part of a systematic approach for identifying vital equipment. Significant efforts have been directed . toward the development and application of fault trees as exemplified by the major expenditures of resources within the safeguards research program for this purpose. However, as discussed below we believe that it is practical and necessary to identify the vulnerabilities.of reactor systems and components before the application of these fault trees is undertaken. Although the need for. vulnerability studies have been recognized, the only documented vulngrability study that we are aware of is the SAI component vulnerability study. This was a commendable effort and we believe that additional studies of this general type and approach are needed. For example, vulnerability studies of safety systems, considering system inter'- actions and comon mode failures resulting from an act of sabotage, should be used to help identify fault trees which may not otherwise have been i considered. In addition, transient and accident initiators may be identified which should be further analyzed through detailed fault trees, such as air systems which have not yet been properly analyzed in sabotage scenarios. Finally, we believe that additional vulnerability studies of reactor systems are needed to help define " key vital areas" as used in the_ proposed rule.. With regard to the generic fault trees developed by Sandia, some tests for completeness and accuracy may be beneficial. This would complement the review by RES's Division of Risk Analysis, with regard to the methodology and its application. For example, a working group of senior reactor pg, Lj yrx,o u uuv 7 (
.w NAbAOO2 2-Robert F. Burnett operators could provide a valuable perspective and review of the sabotage sequences including the vulnerability of systems. A second test might be to compare the fault trees to reactor operational experiences, seth as events which have resulted from manual valve manipulations and system misalignment. In this regard,.it is our understanding that the fault trees do not. explicitly include the manipulation of manual valves. If true, this would be a significant omission in the usefulness of. generic sabotage fault .. - ' trees. Further,. based;on.our review _of the Beaver Valley vital area analyses, it appears that. review teams consider manual valves only on an ad hoc basis during site visits.. 2. Ie bel.ieve the major threat of sabotage to a nuclear. power plant is associated with the insider or an employee of the plant who has access to the vital areas of the plant. As previously discussed, the identification of the vital areas is an important.first step in the physical protection process. The second, and equally impbrtant consideration, is how should the vital area be protected against the insider threat. The prevalent metho' employed to'date is access' control utilizing' locks. d Yet, access to eq0ip' ment during an emergency may be critical-for.sparticular systems of-certain plants to prevent damage to equipment and degradation of safety systems. functions..The impact on operational safefyldue to physical protection measures need. to' be carefully evaluated as an; integral-step before implementing protective' measures which restrict access. Since a large number of plant personnel are authorized access.to..al.1.v. ital. areas, l a specific analysis should address the reduction in risk due to an insider ] compared to the. reduction in operational safety resulting from the'phy'sical protection measures employed.. This is particularly.important.where f.; ; "compar.tmentalization"; of equipment is involved;.The. impact:on-operational safety due.to physical protection requirements continues to be a concern t'o the.' licensees'and oth'ers and i equires' further and3 timelystops.iderat. ions r. Protecting' nuclear power l plants from insider threats is an. extremely -; difficult and n' cessary undertaking. Based on our review of 1.1.censee reports, e it appears that the'. number.of " employee problems" has increased in.recent-years suggesting that the insider threat is increasing. 'The' problent i.s.1; finding a practii:a1 and effective method of safeguards. As.you know,. access control' measures we're' never intended to be. effective. against the.. insider and were to be replaced or supplemented with other assurances of personn.el integrity, e.g., clear'ances, psychological evaluations,. profile identification and recognition,"special ap' plication of access control measures, and; de' sign changes to protect against sabotage. Furthernore, a majority. of. Security Incident Reports are related to improperly secured vital area doors and improper key controls which indicates a real concern.regarding the effectiveness of access ' control measures. In summary, we recomnend that additional resources be allocated for developing and evaluating practical methods to minimize. insider threats and that this activity receive budge.tary priority. e ,,---.,.,--,,----,--,-------,w,,---, r,,, - - - - ,-r-----w- -w
l
- b. Robert F. Burnett 3.
The Beaver Valley study doesiof clearly define the criteria for identifying the type of situations to be prevented from postulated sabotage actions. For example, there are a number of other accident scenarios which could produce radiological releases. The assumptions areenot provided in order to analyze the identified events with regard to such items as operator actions and credit for nonsafety-relat'ed equipment. The scope seemed incomplete in 'that protection of vital equipment to prevent station blackout was not considered, and randomly occurring transients in combination with - a covert act of sabotage were not considered. While the. events analyzed include a number of other~ even'ts.as" subsets during power"opeVation, events ' occurring during shutdow'n 'and refueling di'd not receive proper emphasis. Vulnerability during these conditions Mc increased due to the incr. eased number of personnel onsite and reduced system operability requirements. ~ If you desire additional infomation or if we can provide additional assistance, please contact me or Wayne Lanning in my office. Carlyle Michelson, Direc' tor' I Office for Analysis and Evaluation of Operational Dat,a,,, _., e S e
- e 4
- e
_.__m.,_. -, _, _ - - -... -,., _ _}}