November 6, 1995 The Honorable Thomas P. Grumbly Assistant Secretary for Environmental Management Department of Energy Washington, D.C. 20585-0113 Dear Mr. Grumbly: Members of the Defense Nuclear Facilities Safety Board's (Board) staff recently reviewed both the electrical and structural design and construction of the Defense Waste Processing Facility (DWPF) at the Savannah River Site. The Board's staff noted findings in each area. The enclosed report on the electrical review is provided for your information. The Board believes the following two issues should be resolved prior to facility startup. As currently designed, several electrical loads are sequenced to the emergency diesel generators (EDG) using the DWPF's Distributed Control System (DCS). DCS is not a safety-related system and could fail during certain accident scenarios. This failure could potentially render the EDGs unavailable to supply safety loads, such as the Zone 1 Ventilation System. The second issue involves the separation between the safety and nonsafety electrical busses. As noted, certain nonsafety loads, such as the melter, can be operated during a normal loss of offsite power. However, only one safety-related circuit breaker exists between the busses to provide isolation. This violates single failure criteria and could lead to the loss of emergency backup power. The Board's staff also noted that cable tray supports in the Emergency Control Center have questionable seismic integrity. Their failure could lead to damage of the control panels. The Board understands that the completion of seismic qualifications for safety-class equipment, including Seismic II/I walkdowns and evaluations, will be completed prior to facility startup. DWPF startup is currently scheduled for December 30, 1995. The Board believes that adequate resolution of the issues noted in this letter should not delay startup. Please contact Mr. Joseph Sanders of my staff if you need any additional information or assistance. Sincerely, John T. Conway Chairman c: Mr. Mark Whitaker Dr. Mario Fiori Enclosure DEFENSE NUCLEAR FACILITIES SAFETY BOARD October 13, 1995 MEMORANDUM FOR: G. W. Cunningham, Technical Director COPIES: Board Members FROM: Ajit K. Gwal SUBJECT: Trip Report on Savannah River Site (SRS) Defense Waste Processing Facility (DWPF) Electrical Systems 1. Purpose: This report documents a review of the electrical systems at the Savannah River Site (SRS) Defense Waste Processing Facility (DWPF) by the Defense Nuclear Facilities Safety Board's (Board) staff members, Ajit Gwal and William White, on September 27-29, 1995. 2. Summary: The safety-class diesel generators at DWPF currently support both safety- and nonsafety-class electrical loads. Nonsafety loads are sequenced to the diesel generators by a distributed control system (DCS), which is not a safety-class system. If the DCS malfunctions during loss of power and fails to sequence the loads properly, the diesel generators might not be available to supply power to safety-class loads, such as the Zone 1 exhaust fans and certain radiation monitors. In addition, there is only one safety-class breaker separating the safety bus from the nonsafety bus. The use of a single breaker to provide separation between safety and nonsafety busses does not meet the requirements of Institute of Electrical and Electronics Engineers (IEEE) 384 (Separation Criteria) and IEEE 379 (Single Failure Criterion). Emergency lighting at DWPF is not seismically supported and thus might not be available after a seismic event. Also, Westinghouse Savannah River Company (WSRC) was unable to confirm that the battery rooms in the DWPF vitrification building comply with the American National Standards Institute (ANSI) C2 National Electric Code. 3. Background: WSRC has recently designated a few select electrical, instrumentation, and control systems at DWPF as safety class. This is the first review of these electrical systems since their upgrade to safety-class systems. DWPF is currently in startup testing with expected readiness for radioactive operations by the end of 1995. 4. Discussion/Observations: a. The review identified the following potentially significant issues at DWPF: 1. Nonsafety Loads on the Emergency Diesel Generators: During its review of one-line diagrams for the new operating configuration of the safety-class electrical system at DWPF, the Board's staff observed that there are nonsafety loads, such as Building 292-S HVAC and the health physics vacuum blowers, connected to safety-class electrical busses without appropriate isolation devices. In addition, other nonsafety loads, such as the melter, are supplied by a nonsafety bus that can be connected to the safety bus powered by the emergency diesel generators. In this configuration, there are no electrical isolation devices as required by ANSI/IEEE standard 384, Standard Criteria for Independence of Class 1E Equipment and Circuits, and ANSI/IEEE standard 379, Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Safety Systems. There is only one safety-class circuit breaker separating the safety-class electrical bus from the nonsafety bus, instead of the required two safety-class breakers in series. The Board's staff is concerned that a single fault on the nonsafety bus could render the safety-class power supply inoperable. Sequencing for the nonsafety loads is currently done by the nonsafety DCS. If the DCS malfunctions during loss of power and fails to sequence the loads properly, the diesel generators might not be able to supply power to safety-class loads, such as the Zone 1 exhaust fans and certain radiation monitors. WSRC plans to conduct simulations before startup to demonstrate that the nonsafety loads (which consume roughly 10 percent of diesel capacity) could not cause diesel failure through improper sequencing. On the other hand, if only safety-class loads are powered by the generators, operators will lose instrumentation and control, which are nonsafety class, during a loss of power event. Loss of power has been a frequent (twice yearly) occurrence at DWPF. If the loss of power continues long enough, the melter could freeze and become inoperable. WSRC officials estimate it could cost up to $40 million to replace a frozen melter. WSRC intends to resolve the above issues. 2. Emergency Lighting: The emergency lighting at DWPF is not seismically supported. These lights, which illuminate personnel egress routes during an electrical loss of power, might not be available after a seismic event. WSRC personnel are reviewing this situation and will provide the Board's staff with their resolution. 3. Battery Ventilation: ANSI C2 National Electric Safety Code requires adequate ventilation and loss of ventilation alarms for rooms with lead-acid batteries to ensure hydrogen does not build up and result in an explosion. The battery rooms in the vitrification building have recently been redesigned, but WSRC personnel were unable to confirm that the new design meets ANSI C2. 4. Ampacity Derating of Fire-Protected Cables: WSRC uses fire-protected cables in DWPF building 292-S to ensure continued cable performance during a fire exposure. Fire-protection related products, such as those used at DWPF, may reduce the heat transfer characteristics associated with the cable ampacity. The Board's staff observed that WSRC has not determined the ampacity derating of the fire-protected cable systems at DWPF to confirm cable performance during a fire exposure. WSRC will provide the Board's staff with relevant documentation. The Board's staff is concerned that the cable may not perform its intended function. 5. Electrical Calculations: Electrical calculations for voltage profile, short circuit studies, and protective device coordination, as required by ANSI/IEEE Standard 141 IEEE Recommended Practice for Electrical Power Distribution for Industrial Plants and ANSI/IEEE Standard 242 IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems, are incomplete. Without these calculations, WSRC cannot verify the capability of electrical equipment to withstand potential short circuits. WSRC plans to complete the calculations before beginning radioactive operations, and the Board's staff will review the completed calculations when they are available. 6. Environmental Qualification: Safety-class electrical equipment at DWPF is not qualified per IEEE Standard 323 Qualifying Class 1E Equipment for Nuclear Power Generating Stations. WSRC is currently writing a justification for not qualifying this equipment. The staff will review the justification when it is available. 7. Distributed Control System/Alarm Management: In an effort to improve human factors in the DWPF control room, WSRC is procuring and installing an alarm management system that will filter the alarms received in the control room. This system will determine which alarms are important and will also diagnose probable causes of alarms. This might work out very well if the expert systems are accurate. However, if the expert systems do not perform as advertised, the operators could be relying on inaccurate information during emergency situations. The Board's staff will continue to review this issue. 8. Fire Protection of the Central Control Room (CCR): In a trip report dated December 1, 1993, the Board's staff expressed concern over WSRC's plans to provide a water sprinkler system in lieu of a Halon system in the CCR. With a water sprinkler system, water intrusion into electrical panels could result in electrical shorts, spurious operations, and make it difficult to control the plant from remote control panels. WSRC has reevaluated its earlier decision and now plans to use a Halon system in the CCR. While this approach is technically acceptable, the Board's staff expressed concerns over the future availability of Halon, which is no longer being produced in the United States. The Department of Energy (DOE) and WSRC have completed a study on the future availability of Halon at DWPF. This study will be supplied to the Board's staff for its review. b. The review also identified two systems at DWPF that are significant improvements over similar systems at SRS and other DOE nuclear facilities. 1. Electrical Characteristics and Diagnostic System: The Board's staff was impressed with the Electrical Characteristics and Diagnostic System 1000 data acquisition system. This automated system is an informative technology program that covers electrical system inspection, trouble shooting, condition monitoring, and preventive maintenance. DWPF has used this system to obtain baseline information for almost all of the critical electrical systems in the facility. This information, if properly used, will allow DWPF to easily locate and diagnose electrical failures and to plan for plant life extension. 2. Lightning Protection System: The lightning protection system at DWPF was designed in accordance with DOE Order 6430.1A, Section 1630.5 and National Fire Protection Association 780, Lightning Protection Code. In addition to this system, DWPF has a lightning dissipation array system for equipment and control system protection. Since the system was installed in 1992, there have been no direct lightning strikes at DWPF. 5. Future Staff Actions: The Board's staff will follow the resolution of concerns regarding the assignment of nonsafety loads to safety-class electrical buses. The staff also plans to review the new facility electrical calculations and the justifications for not qualifying safety-class equipment per IEEE 323. The staff will perform another review at DWPF to look more closely at the distributed control system and alarm management and to review compliance of battery room ventilation and loss of ventilation alarms with ANSI C2.