LR-N15-0232, Supplemental Information Needed for Acceptance of Requested Licensing Action Amendment Request Regarding Chilled Water System Modification
| ML15309A750 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 11/05/2015 |
| From: | Jamila Perry Public Service Enterprise Group |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LAR S14-04, LR-N15-0232, TAC MF6724, TAC MF6725 | |
| Download: ML15309A750 (33) | |
Text
PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, NJ 08038-0236 PSECi Nuclntr Ll ,C 10 CFR 50.90 LR-N15-0232 LAR S14-04 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Salem Nuclear Generating Station Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC Docket Nos. 50-272 and 50-311
Subject:
Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
References 1. PSEG letter to NRC, "License Amendment Request Modifying Chilled Water System Requirements," dated September 11, 2015 (ADAMS Accession No. ML15254A387)
- 2. NRC letter to PSEG, " Salem Nuclear Generating Station, Unit Nos. 1 and 2Supplemental Information Needed For Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification," dated October 29, 2015 (ADAMS Accession No. ML15299A383)
In the Reference 1 letter, PSEG Nuclear LLC (PSEG) submitted a license amendment request for Salem Nuclear Generating Station (Salem), Unit Nos. 1 and 2. The proposed amendment would revise Technical Specification {TS) 3/4.7.10, "Chilled Water System- Auxiliary Building Subsystem," to allow (1) a reduction in the number of required components (two vs. three required chillers) and (2) use of the cross-tie capability between Unit 1 and Unit 2. A supporting change would also be made to the Control Room Emergency Air Conditioning System TS 3.7.6.1 (Unit 1) and TS 3.7.6 (Unit 2).
In the Reference 2 letter, the U.S. Nuclear Regulatory Commission staff requested that PSEG supplement the application with information necessary to enable the NRC staff to begin its detailed technical review. A conference call was held with the NRC on October 21, 2015, to clarify the supplemental information request. The requested information is provided in .
LRN150232 10 CFR 50.90 Page 2 PSEG has determined that the information provided in this submittal does not alter the conclusions reached in the 10 CFR 50.92 no significant hazards determination previously submitted. In addition, the information provided in this submittal does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.
There are no regulatory commitments contained in this letter.
If you have any questions or require additional information, please contact Brian Thomas at (856) 3392022.
I declare under penalty of perjury that the foregoing is true and correct.
NOV '05 2015 Executed on ------
(Date)
Cl £ F. 7f Respectfully, k; F. Perry Site Vice President Salem Generating Station Attachment 1 Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
Enclosure 1 S-C-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment" Enclosure 2 Technical Evaluation 801 1 0953-0 1 05, "Chilled Water System Crosstie FMEA" cc: Mr. D. Dorman, Administrator, Region I, NRC Mr. T. Wengert, Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator
LR-N15-0232 Attachment 1 Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification
( CAC Nos. MF6724 and MF6725 )
Page 1 of 10
LR-N 1 5-0232 NRC Request 1
- 1. Confirm whether the replacement of the six existing safety-related chillers is in the scope of this license amendment request. If the new chillers are in scope for replacement, provide the following information, as compared to the existing chillers. The information provided should include a form (shape, size, dimensions, etc.), fit (physical interface, connections, etc.) and function (designed to perform) evaluation. This should include, but not be limited to the following:
- Safety-classification
- Design and construction codes (American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers, etc.)
- Seismic Classification
- British thermal units per hour (BTU/hr) design rating (tonnage)
- Outlet temperature requirement of chilled water (range)
- Inlet temperature requirement of the service water (range)
- Chiller design pressure and temperature
- Chiller design flow rates
- Instrumentation and controls (alarm, permissives, and trips)- digital controllers vs analog
- Horsepower requirements of compressor (emergency diesel generator (EDG) loading differences)
- Cooling water requirements, pressure, flow
- Refrigerant type (address hazards)
- Refrigerant purge unit design (if utilized)
- Field modification for installation of the new chillers related to safety-related systems, structures, and components
- Control room habitability requirement and evaluation for the new refrigerant
- Fire protection evaluation for the new refrigerant
- Evaluation of the existing chiller water pumps/system relative to the new chillers
- Evaluation of the existing service water pumps/system relative to the new chillers
- Performance testing (shop/vendor)
In addition, provide a discussion related to testing of each replacement chiller following installation. Provide information describing testing of the new chillers to meet the design function as described in Appendix A to Title 10 of the Code of Federal Regulations, Generic Design Criteria (GDC)-45 and GDC-46, "Inspection of cooling water system," as applicable.
Information on testing should verify that the chillers can perform their safety-related design function before returning to Operable status.
PSEG Response The replacement of the chillers is being performed under 1 0 CFR 50.59 and is not in the scope of this License Amendment Request (LAR). The LAR is based on the current system Auxiliary Building Chilled Water (AB CH) System. The overall function of the AB CH is not altered by the replacement of the chillers.
The replacement chillers will meet or exceed the current chiller design requirements. As discussed with the NRC staff on October 1 5, 2015, the following information is provided regarding the planned replacement chillers.
Page 2 of 10
LR-N 15-0232 The design capacity of the proposed replacement chillers is 62.5 tons. This is slightly higher than the current chiller rating of 61 tons. Furthermore, the replacement chiller rating is based on a Service Water temperature to the condensers of g3oF, 3°F above the design value of gooF; thus the rating at gooF would be higher than 62.5 tons. Per the response to Question 3, the replacement chiller rating satisfies the heat load requirements with margin added.
The proposed replacement chiller refrigerant will be R-134a. According to the Environmental Protection Agency (EPA), this refrigerant has "low acute toxicity levels, and presents low risk to humans exposed to it in small amounts." Due to the physical location of the chillers with respect to the Control Room and control room ventilation intake dampers, the possibility of refrigerant entering the Control Room due to a loss of refrigerant is not considered credible. The chiller rooms are located in a separate ventilation system from the control room ventilation system.
This assessment will be documented in the DCP for the replacement chillers.
NRC Request 2
- 2. Provide a detailed description of the Auxiliary Building Chilled Water (AB CH) System, describing how the AB CH system is currently designed, and how it operates during normal and accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system.
The NRC staff requires this information to fully understand and evaluate the proposed changes to the AB CH system and the associated TS revisions.
PSEG Response The Auxiliary Building Chilled Water (AB CH) System design is unchanged by the proposed license amendment request (LAR). Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
A description of the AB CH system design was previously provided in response to a June 12, 1gg7 (ADAMS g70618034g), Request for Additional Information (RAI) related to Salem Amendments 1gg and 182 (ADAMS ML01172014g). The following provides an updated description of the system.
Auxiliary Building Chilled Water System Description The Auxiliary Building Chilled Water (AB CH) System is a closed loop system that removes heat from various safety related and non-safety related equipment, and rejects the heat to the ultimate heat sink via the Service Water (SW) System. There is one loop for each Salem Unit.
Figure 4-1 of the LAR provides a simplified one line diagram of the AB CH System.
The AB CH System includes three packaged liquid chillers and two Chilled Water pumps. Each pump circulates nominally 370 gpm of chilled water at 200 feet total head in a closed loop from the chillers to the heat loads and then back to the pump suction header. Each chiller evaporator removes heat from the returning chilled water and, in the chiller condenser, rejects the heat to the ultimate heat sink via the SW System. The chillers are designed to supply chilled water at 44°F, and cycle on and off as a function of chilled water return temperature. An expansion tank is installed at the suction of the pumps to accommodate chilled water inventory, thermal expansion and to provide adequate net positive suction head (NPSH) for the pumps. The chiller compressor motors are powered from separate 460 VAC Vital Buses. The two pumps Page 3 of 10
LR-N 15-0232 are powered from separate 230 VAC Vital Buses. The heat loads serviced by the AB CH System for each Salem Unit are as follows:
Safety Related Heat Loads:
- Control Area Air Conditioning System (CAACS) Cooling Coils
- Control Room Emergency Air Conditioning System (CREACS) Cooling Coil
- Emergency Control Air Compressor (ECAC) Coolers Non-Safety Heat Loads:
- Penetration Area Cooler Units (PACUs)
- Miscellaneous Room Coolers (Unit 2 only), including the primary lab room cooler, secondary lab room cooler, counting room cooler and post-accident sampling room cooler The CAACS and CREACS are sub-systems of the Control Area Ventilation (CAV) System, which includes the Control Room Envelope (CRE), Relay Room and Electrical Equipment Room. The CRE is common for Salem Units 1 and 2. During normal operation, CAACS provides cooling for all the CAV System areas. During accident conditions, CREACS provides cooling for the CRE, and CAACS provides cooling for the Relay Room and Electrical Equipment Room. CAACS maintains the areas it serves at s; 76°F during normal and accident conditions.
CREACS maintains the CRE at s; 85°F during accident conditions, except for the Data Logging Rooms, which are maintained at s; 90°F.
The three-way control valve (CH74) located on the discharge side of the CAACS coils, originally designed to control flow through the coils, is fixed in the full open position to allow full flow through the coils all the time to simplify system operation and improve reliability. Similarly, the CH168 control valve located on the discharge side of the CREACS coil is fixed in the full open position for single failure concerns, allowing flow through the coil during all modes of operation.
Chilled water flow to the ECAC coolers is normally isolated and is provided when the ECAC is operating by an automatic isolation valve that opens when the compressor starts. The ECAC is normally aligned to chilled water but can be isolated from the chilled water system and provided cooling from the service water system.
Chilled water flow is provided to the PACUs as required to maintain the environmental conditions in the mechanical penetration area for protection of equipment. Room thermostats are provided to modulate three-way control valves to each PACU. The supply of chilled water to the PACU cooling coils is automatically isolated by redundant isolation valves (CH151 and CH30) on a safety injection signal.
The Salem Unit 2 AB CH provides chilled water to the miscellaneous room coolers in addition to the uses described above. Three-way control valves modulate flow to each room cooler based on room temperature. Chilled water flow to these non-safety room cooling coils is automatically isolated by redundant isolation valves on a safety injection signal.
Page 4 of 10
LR-N 15-0232 AB CH Operation A. Normal Configuration During normal plant operation, the AB CH System in each unit provides chilled water to the CAAC coils and PACUs. In addition to these loads the Unit 2 AB CH System supplies chilled water to the miscellaneous room coolers. The ECAC is normally in standby with cooling flow through the ECAC isolated. When the ECAC is operated for testing or when the Station Air Compressors are not available or not operating, the AB CH System provides chilled water to the ECAC coolers.
B. Accident Safety Injection (SI) Configuration During the accident Sl configuration, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. On an Sl signal, redundant isolation valves automatically isolate chilled water flow to the PACUs and the miscellaneous room coolers.
Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and each Unit's CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms. If one CREACS train is unavailable, the system is aligned in the single train filtration mode (also referred to as "Maintenance Mode"). A single CREACS coil is capable of maintaining the CRE at :5 85°F, except for the Data Logging Rooms, which are maintained at :5 gooF.
C. Accident High Radiation (RMS) Configuration During the accident RMS configuation, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. The PACUs and the miscellaneous room coolers are not automatically isolated by the RMS signal and continue to receive chilled water flow until manually isolated by procedure. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE. Chilled water to each Unit's CAACS coils provides cooling to their respective Relay and Electrical Equipment Rooms.
On initiation of an accident high radiation (RMS) signal when the CAV system is in the Maintenance Mode, a single CREACS coil is capable of maintaining the CRE at :5 85°F, except for the Data Logging Rooms, which are maintained at :5 gooF.
D. Loss of Offsite Power (LOOP) Configuration During a LOOP, chilled water flow is maintained to Units 1 and 2 CAACS coils to provide cooling to the CRE and their respective Relay and Electrical Equipment Rooms. Each Unit's ECAC is started and chilled water is supplied to the ECAC coolers. The PACUs and miscellaneous room coolers are isolated.
Page 5 of 10
LR-N 1 5-0232 E. Fire Outside Control Room Area (Recirculation)
During a postulated fire outside the control area, the CAV System is manually switched to the full recirculation configuration. This initiates the CREACS fans. The CAACS coils continue to receive chilled water. The PACUs and miscellaneous room coolers are manually isolated. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and the CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms.
AB CH Interfaces with other Systems The AB CH interfaces with the systems it supports through heat transfer across cooling coils.
Control air is required for operation of AB CH*control valves.
SW supplies cooling water to each packaged chiller condenser. The chillers reject heat to the ultimate heat sink via SW flow.
The Safeguards Equipment Controller (SEC) circuits provide automatic control of the AB CH during accident conditions. The interfaces between the AB CH and SEC circuits occur at the SEC contacts in the AB CH control circuits.
The Potable Water system provides make-up water to the AB CH Subsystem expansion tank.
Nitrogen is supplied to the expansion tank as a cover gas.
The Building and Equipment Drains system provides for transport and disposal of excess fluids from the AB CH Subsystem.
AB CH Cross-tied Operation The cross-tie piping connects the Unit 1 and Unit 2 Chilled Water Systems. The cross-tie piping is safety related seismic class 1 piping. The cross-tie piping enables the chillers from one unit to provide the cooling requirements for both units. Both the supply header cross-tie and the return header cross-tie contain one manual isolation valve that provides the boundary between unit one and unit two.
Calculations performed in support of the LAR have shown that from November 1 through April 30, one Chilled Water pump is capable of supplying the required cooling flow to both units, with the following conditions: ( 1 ) chilled water flow to the ECACs are isolated; (2) chilled water flow to the non-essential loads are isolated; (3) both CREACS trains are required (single filtration train alignment not permitted). The calculations also show that only 2 Chillers are required to remove the heat load.
The cross-tied LCO is requiring 3 chillers and 2 chilled water pumps to be operable. This requirement allows for the single failure of an electrical train that would lead to the loss of one chiller and one chilled pump. As documented in Section 4. 3 of the LAR, the analysis shows that with 2 chillers and 1 chilled water pump remaining, the cross-tied system can support the accident heat loads on one unit and safe shutdown heat loads on the other unit, as required per GDC-5.
Page 6 of 1 0
LR-N15-0232 The ECAC and non-essential loads are required to be isolated from the chilled water system prior to operating in the cross-tied configuration as required by the restrictions placed in the TS.
Therefore, there is no reliance on the automatic or manual operator action to isolate these loads following a design basis accident or loss of offsite power (LOOP). When entering the cross-tie configuration the chillers and chilled water pumps on the unit that is not supplying the cross-tie are isolated from that Unit's chilled water system. The unit supplying the chilled water cross-tie will then provide cooling to both Unit's CAACS and CREACS coils.
The chilled water valve alignment to the various coolers at both units is not impacted by operation of the cross-tie with exception for pre-isolation of the aforementioned loads. The chiller control valves for the CAACS and CREACS coils are fixed in the full open position, and thus chilled water flow to these coils is maintained in both accident and normal conditions. The CAV System operating modes are not impacted by the chilled water cross-tie and no changes are being made to the CAV control circuits for the operation of the chilled water cross-tie.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
NRC Request 3
- 3. Provide a detailed explanation of how the current AB CH system heat loads/components currently interface with the AB CH system, how the system is designed, how the system operates during normal operations, and how the system operates during accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system. The NRC staff requires this information to fully understand and evaluate any proposed changes to the heat loads/components that are served by the AB CH system and any associated TS revisions.
PSEG Response The AB CH System design is unchanged by the proposed LAR. Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
The A B CH System provides cooling to various essential and non-essential loads. The essential loads include the CAACS, CREACS, and ECAC on both units. The non-essential loads include the PACUs on both units and miscellaneous lab and room coolers on Unit 2 only.
The following are the current heat loads for these components for normal and accident conditions based on design summer ambient conditions. Heat loads are also provided for the single filtration train alignment (also known as Maintenance Mode) of the control area ventilation where one unit is cooling the entire CRE. The control area ventilation can be operated in either normal alignment (both trains operating) or Maintenance Mode (single train operating). As described in the LAR, the control room ventilation is a shared system with each Salem Unit providing one train of the two train system. During normal operation, the CAACS is supplying Page 7 of 10
LR-N15-0232 the CRE with the CREACS system isolated and in stand-by. During an accident, the CREACS system is actuated and supplies the cooling to the CRE and the CAACS is isolated from the CRE. In the tables below for the Maintenance Mode (single train) alignment, during normal operation the CAACS on one unit is cooling the entire CRE and for accident conditions the CREACS on one unit is cooling the entire CRE. The values listed for Unit 1 and Unit 2 CAACS in Normal Operation in the Maintenance Mode include the entire CRE heat load in both the Unit 1 and Unit 2 columns (the Unit that is not supplying the CRE would actually have a lower heat load). The values listed for Unit 1 and 2 CREACS in Accident Conditions during Maintenance Mode reflects the heat load if that Unit is supplying CRE.
Normal Operation
- Based on three chillers running During accident conditions, the PACUs and Miscellaneous coolers are either automatically isolated or isolated by procedure.
Accident Conditions
- Based on two chillers running For the proposed TS changes, the above heat loads apply to the current configuration (3.7.10.a). For the new TS configurations, Two Chiller (TS 3.7.10. b) and Cross-tied (TS_3. 7.1 O. c), the above system heat loads will be less. The CAACS and CREACS loads will be less than the above values since they are based on summer design conditions, and the new TS configurations will only be applicable during the colder parts of the year (from November 1 to April 30). The ECAC load will be zero since the TS restrictions will require the ECAC to be isolated from the Chilled Water System for both the two chiller and cross-tied Page 8 of 10
LR-N15-0232 configurations. For the two chiller configuration, the non-essential loads (PACUs and miscellaneous coolers) remain aligned with both trains of CAV operable and are isolated when transitioning to Maintenance Mode. For the cross-tie configuration the non-essential loads will be isolated on both units prior to entering the cross-tie configuration; therefore, these heat loads are zero for the cross-tie configuration.
The specification for the replacement chillers includes a 10% margin added to the heat loads in the above two tables. Adding 10% to the bounding normal operation value of 55.5 tons/chiller yields 61.1 tons per chiller. Adding 10% to the bounding accident value of 50.3 tons/chiller yields 55.3 tons per chiller. The proposed replacement chillers are rated at 62.5 tons, so they will be capable of providing the required cooling for both normal and accident conditions with 10% heat load margin. In addition, this rating is based on a SW temperature to the condensers of 93°F, which is a 3°F margin above the design value of 90°F.
NRC Request 4
- 4. GDC-5, "Sharing of structures, systems, and components," states the following:
Structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and coo/down of the remaining units.
Provide a failure modes and effect analysis or suitable summary table, applicable to GDC-5, to describe the analysis and conclusions for the effects of the cross-tie between units. In addition, provide a discussion describing the interactions during a design basis accident (loss of off-site power, loss of cooling accident) related to electrical power, and EDG loading sequencing that supports both units, when the units are in the cross-tied configuration.
PSEG Response The existing failure modes and effect analysis (FMEA), S-C-CH-MEE-1139, was assessed in a Technical Evaluation (TE) that determined that the cross-tied configuration does not introduce any new failure modes. The existing FMEA and the TE are provided as Enclosure 1 and 2 respectively. During the review of S-C-CH-MEE-1139, PSEG identified the following items that will be addressed during the update of the FMEA:
- Section 3.0, the main steam line radiation monitors were permanently removed from the chilled water system.
- Section 4.1.2 and Attachment 8.2, the CH? 4 chiller control valves for the CAACS coils are fixed in the full open position as discussed in response to Question 2.
- Section 4.2, during the two chiller configuration the ECAC will be isolated from chilled water for the Unit in the two chiller configuration and during cross-tied configuration the ECACs will be isolated from chilled water for both Units.
- Section 4.4, during the two chiller and cross-tied configuration the Maintenance Mode alig nment is not allowed.
Page 9 of 10
LR-N 15-0232
- Section 5.0, describes chilled water system vulnerabilities without the details of the vulnerabilities. These vulnerabilities are associated with the CREACS and CAACS temperature control valves which are discussed in Section 4.1.1 and Section 4.1.2, respectively, and the safety related isolation discussed in Section 4.3. These discussions are not impacted by the two chiller and cross-tied configuration.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
Page 10 of 10
LRN150232 Enclosure 1 SC-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System ( CH ) - Single Failure Criteria Vulnerability Assessment"
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 14 *1212 EENo.: S-C-CH-MEE-1139 Rev No.: 1 DECEMBER 10, 199M TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 1 .0 Revision Summary Revision 1 -The CH168 valve modulating function is now inoperative. TI1e control air to the valve has been removed in order to keep the valve permanently in the full open (fail-safe) position. The associated temperature controller is also disconnected. This evaluation is being revised lAW CD P517 ofDCPs lEE-0371/1 Rev. 0 and 2EE-0317/1 Rev. 0. The following changes were incorporated into the evaluation:
- 1. Section 4.1.1 was revised to describe the condition which now exists as stated above.
- 2. Section 5.0 has been revised to describe the modifications made to CH168.
- 3. Section 7.0 has been revised to update the effects on other technical documents.
- 4. Attachment 8.2, page 4 has been revised to delete the effects of a control malfunction.
Note 2 of the attachment has also been removed.
2.0 Purpose The purpose of this evaluation is to document single active failure vulnerabilities of the safety related portion of the Salem Units 1 and 2 Chilled Water System. Specifically, this evaluation will document the Chilled Water System's capability to perform its design function after sustaining a single active failure, measures to minimize the risk of an unmitigated single failure, and compensatory measures in the event of an unmitigated single active failure.
3.0 Scope The chilled water system perfonns both safety and non safety related functions. The system is primarily non safety related except for the Auxiliary Building Subsystem, which provides chilled water to the following areas.
- 1. Control Area Ventilation System;
- 2. Control Air System (Emergency Air Compressors);
- 3. Various Non SafetyUsers.
Note that the Main Steam Radiation Monitors do not require chilled water cooling during an accident and are considered to be a non-safety related load for this evaluation.
The scope of this evaluation will be confined to the system and component interfaces noted in I and 2 above. Only single active failures will be evaluated.
A component is subject to an active failure if the component may be required to change state or position in order for the system to pe rform ito; safety function. Typical active failures include valves failing to move to the proper position when required, or a relay failing to energize when required. A component is subject to a passive failure if the position or state of the component is immaterial to the postulated failure. A typical passive failure is a pipe crack or rupture.
USER RESPONSIBLE FOR VERIFYING .REVISION, STATUS AND CHANGES PRINTED2014 1212 Page £01< 1 EE No.: S-C-CH-MEE-1139 Rev No,: 1 NOVEMBER 16, 1998 TITLE: Chilled Water System (CH)- Single FailureCriteria Vulnerability Assessment 4.0 Discussion A Failure Modes and Effects Analysis (FMEA) was perfonned for Unit 1 to identifY the active components subject to single failure. The Unit 2 CH system is similar, with additional non-safety related loads for the counting room, laboratory unit coolers and PASS room cooler.
Refer to attachment 8.2 for the FMEA. The results are summarized below, and are divided into functional support areas.
4.1 Control Area Ventilation System (CAV)
Chilled water is supplied to the portion of the CAV System that includes the Control Area Air Conditioning System (CAACS) and the Control Room Emergency Air Conditioning System (CREACS). The CA ACS supplies conditioned air during normal plant operation to the combined Unit 1 and Unit 2Co ntro l Room Envelope, each unit's Relay Room, and each unit's Electrical Equipment Room. The CREACS provide s conditioned air to the combined Control Room Envelope (CRE) during emergency operation. The CAACS continues to cool the Electrical Equipment room and Relay Room for each unit during an accident. The chilled water system provides coolant to cooling coils in both these subsystems. Refer to Attachment 8.1 for the system schematic diagram. The following single active failures are evaluated.
4.1.1 Failure of Control Valve 1CH168 (2CH168)
The CH168 valve modulating function is now inoperative. The control air to the valve has been removed in order to keep the valve pennanently in the full open (fail- safe) position. The associated temperature controller is also disconnected.
As a result of these modifications, an evaluation of a failure ofCH168 is no longer applicable.
4.1.2 Failure of Three Way Valve 1 CH74 (2CH74)
Three Way Valve CH74 is located in the inletloutletlbypass piping to the CAACS cooling coil which during an accident serves the Relay Room and the Electrical Equipment Room. The valve has a pneumatically operated actuator to modulate chilled water flow through the CAACS coil or through the bypass line to control cold deck air temperature. On a loss of air, the valve will spring actuate to direct all flow to the CAACS cooling coil. The control circuitry has redundant solenoid valves that
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 141212 Page 3 of 7 BE No.: S-C-CH-MEE-1139 Rev No.: 0 Date: February 4, 1997 TITLE: Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment exhaust the air on a loss of power and as a consequence the spring wouid fail the valve to the full flow to the cooling coil position. Therefore the controls for this valve are redundant, enhancing the capability to endure a single failure.
A postulated failure scenario is that with the valve aligned in the bypass position during the winter time (cold makeup air and little or no heat load on the cooling coil) a mechanical malfunction may bind the valve in the bypass position. With the valve stuck ht this position, chilled water flow would bypass the CAACS and temperatures in the Relay Room and Electrical Equipment Room could increase.
This malfunction is not credible. Even in winter, the heat loading from the control area is high enough to require some cooling water flow, thus it is unlikely that the CH74 valve will ever be in the full bypass position. Also, the valve is modulating to control CAACS temperatu re which will require the valve to move to comp ensate for the 24 hr. day/night cycle. Therefore, the valve does not remain in one position for a long period of time.
If the valve were to bind in an intennediate position, adequate cooling is assured, because the CAACS heat load would drop due to the CRE load shifting to the CREACS. In addition, this valve is periodically stroke tested under S 1(2).0P-ST.CH-0003(Q). (Refs. 6.1 and 6.2) Regular preventive maintenance (PM Task Nos. 100011, 411320, 411323, 100599, 461320, 461327) is perfonned as well.
4.2 Emergency Control Air Compressor The chilled water system is the preferred source of cooling water for the Emergency Control Air Compressor (ECAC) in each unit. Because both ECACs (one in each unit) are cross-tied, and provide back-up for each other, there is no credible single failure of the CH system that will cause both ECACs to fail. In addition, for operational flexibility service water is available as a backup cooling water source for each air compressor.
4.3 Safety Related System Isolation The safety related portion of the chilled water system is separated from the non safety portions in some instances by a single safety related check valve. The following locations fall into this category:
Valve No. Size Description 1CH61 (2CH61) 3" Return from the PACU's 1CH132, 2" Return from Unit 2 Lab Coolers 1 CH260 (2CH260) 1" Return from Radiation Monitor Enclosure 1CH55 (2CH55) 1" Potable Water Supply To Chilled Water In these cases, the referenced check valves are safety related components, located in safety related seismically supported piping and separate the return piping from the non-safety class portions of the chilled water system.
By itself, a failure of a check valve to fully close does not affect the operation ofthe chilled water system. Redundant isolation v alve s are p r o v ided on the supply line to the nonsafety related loads.
These valves will isolate flow to the nonsafety related heat loads. The only time that a failure of a
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 141212 Page 4 of 7 BE No.: S-C-CH-MEE-1139 RevNo.: 0 Date: February 4, 1997 TITLE: Chilled Water Systm (CH)- S ingle Failure Criteria V ulne rab ility Assessment check valve will impact the CH system is if the pr essur e boundary associated with the non-safety related loads also fails, allowing leakage that could drain the CH s ystem. This scenario requires two failures, the check v alve failing to cl ose, and a failure of the pipi ng system. This does n ot constitute a single failure point during normal operation or during a Loss of Coolant Accident (LOCA).
However, because some of t.he piping to th e non-safety related loads is non-seismic class, failure of the piping is assumed during a safe shutdown earthquake (SSE). If an SSE occurred (without a LOCA), the Unit(s) woul d be shut down. If the earthquake caused a failure of the non-safety related chilled water pi ping, and a check valve failed open, procedu re S2/S LOP-AB.CAV-0001 Loss of Control Area HVAC" provides guidance to establish alternate cooling (References 6.9, and 6.10).
The chilled water system does not connect t o or interfac e with the p rimary coolant pressure boundary, the nuclear fuel or the reactivity control system. Therefore, any fai lure of the chil led water system is not a UFSAR Chapter 15 type accident initiator. Because the primary coolant system is designed to withstand an SSE and still maintain pressure integrity (UFSAR Section 5 .2.1.2, Ref.
6.5), an SSE cannot init iate a LOCA. Therefore, a Loss of Coolant A cci dent (LOCA) and an SSE are independent events.
Per 50.59 Safety Evaluation number S96-177 (Ref. 6.6), Salem station is not designed for a LO CA coincident with a safe shutdown earthquake. This safety evaluation also demonstrates that a SSE within seven days following a LOCA is not credible. The refore, a LOCA concurrent with a se is mic event is not a postul ated event. After the immediate stabilization phase of the po stul ated LOCA, there are sufficient resources of time and personnel available to manually isolate the affected pi ping. This will preclude any loss of function ofthe chil led water system due to an SSE.
Additionally failure of a check val ve is unlikely because all valves are regularly tested as part of the plant ISI!IST program (Ref. 6.1, Ref. 6.2, Ref. 6.3, and Ref. 6.4) along with regul ar scheduled preventive maintenance.
4.4 Operational Considerations for Chiller and Pump Alignments The chilled water system consists of three 50% c apacity chillers and two 100% capacity circulating pumps in each S alem unit. Each chiller is powered from a separate Diesel backed bus, and each of
- the circulating pumps is also powered from a separate Diesel bu s. During emergency operation, two chillers and one pump will meet all the safety related chilled water cooling load requirements f o r that respective unit. This provides some flexibility for back*up and maintenance. The common control room envelope provides additional flexibility by cooli ng the CRE with a single CREACS coil using the maintemi.lui mode (Reference 6.7).
For a complete discussion of the various operational modes and system operating requirements, see the CH System ModeOps calculation SCCH-MDCl629 (Re ference 6.8) 5.0 Conclusions l11e CH system has several single failure vulnerabilities. Although not ideal compared to today1s standards, the design of the chilled water system is consistent with other Salem HVAC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. However, because calculation S-C-CAV-MDC-1640 (Reference 6.11) has determined that the consequences of the CH168 valve failing to open are unacceptable, temporary modifications are
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS .AND CHANGES PRINTED20 14 1212
- **u EENo.: S-C-CH-MEE-1139 Rev No.: 1 NOVEMBER 16, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 5.0 Conclusions The CH system has several single failure vulnerabilities. Although not ideal compared to today's standards, the design of the chilled water system is consistent with other Salem HVAC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. The consequences of the CH168 failing to open have been addressed as described above. Consequences of all other identified failures are acceptable, as discussed above.
The ongoing testing and maintenance programs provide confidence that the auxiliary building chilled water system will continue to provide the required heat removal for the control room area (CAACS and CREACS), and the ECAC.
To enhance the post LOCA availability of the CH system in the event of a seismic event, the following suggestion is made:
Modify the EPIPS such that within seven days after a LOCA the non-safety related chilled water loads are manually isolated (AR 970204152 to track implementation).
6.0 References 6.1 St.OP-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.2 S2.0P-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.3 SH.RA-IS.ZZ-0151(Q) REV. 1; Non-Intrusive Check Valve Testing Data Collection 6.4 SC.RA-AP.ZZ-0021(Q) REV. 5; lSI Group Examination and Test Activities 6.5 Salem Updated Final Safety Analysis Report.
6.6 50.59 Safety Evaluation Number 896-177.
6.7 S-C-CAV-MDC-1570 Revision 1; Units 1 & 2 Control Room Envelope Equilibrium Temperatures 6.8 S-C-CH-MDC-1629, Revision 0; Mode Ops Analysis Aux. Bldg. Chilled Water System Units 1 & 2 (Draft) 6.9 S1.0P-AB.CAV-0001 "Loss of Control Area HVAC" (Draft) 6.10 S2.0P-AB.CAV-000 1 Loss of Control Area INAC" (Draft) 6.11 S- C-CAV MDC- 1640 EACS Operation with Single Failure of Cooling Coil" Rev 1.
(In approval cycle)
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 1412 12 Page 6 OF 7 EENo.: S-C-CH-MEE-1139 RevNo.: 1 NOVEMBER 16,1 998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 7.0 Effects On Other Technical Documents None 8.0 Attachments 8.1 Sketch of Chilled Water Flow Path 8.2 Unit 1 Failure Modes and Effects Analysis 8.3 10 CFR 50.59 Applicability Review for S-C-CH-MEE-1139/Revision 1
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20141212 Page 7 OF 7 EE No.: S-C-CH-MEE-1139 Rev No.: 1 NOVEMBER 17, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 9.0 Signatures
!1/J{q? KURT DOTEN NAME (PRINT) 14:/!fY RAYMOND RUNO\NSKI NAME (PRINT)
/.((! ({9 NEAL MOTLEY DATE NAME {PRINT)
I '2./J_fE9 t) JOHNZUDANS NAME (PRINT)
u c
/O Ul z r-rl
-l ;;o Chilled Water Flow Sketch fTl Expansion o AJ Attachment 8 . 1 to N r'l Tank o Ul S-C-CH-ME E- 1 1 39 u
-l'- 0 Page 1 of 1 z Ul N rn Potabe Water r fTl Lab, PASS, and Supply 1 CH2 1 CHI 68 Count R m . Coolers (2CH2) i CH55 'l 0
(2C H 1 68)
(U nit 2 only) (2CH55) ;;o I
fTl 1 CH 1 32 ;;o (Unit 2 only) 'l 1 CH74 z (2CH74) 1 CH61 1 CH260 GJ (2CH61 ) (2CH260) ;;o fTl l7i
\ ..- 0 z
Ul
-1
)>
1 CH21 6 1
- : -1
'(
' (2CH216) c Ul
.... r .. ...
' )>
.., .! _ z
\.
0
... ., .,.I I 1.. '
()
J 11
"*r-"
I
' 1 1 (21 ) i 1 CH 1 3 )>
I
- ' z
' . Chiller (21 CH 1 3) i GJ fTl lit - - ,.1
- l .r Ul
'i i i i
.. 1 1 (21 ) Chilled 1 2 (22) Water Pump Chiller i CH 1 50 1 CH 1 51 1 2CH 1 3 1 CH252 (22CH13)
( Unit 2 only) (2CH 1 5 1 )
(2CH252) 1 CH1 1 7 (Unit 2 only) 1 3 (23 )
1 C H30 Chiller I CH253 12 (22}
(2CH30)
(2CH253) Chilled Water Pump
u c
- Q lll z rrl
-l ;;o r'1 .2 to S-C-CH-MEE-1139 Salem Unit 1 Auxiliary Building Chilled Water System Page 1 of 9 o
N
- o r'l o lll Failure Modes and Effects Analysis-LOCA Condition --o (Active Failures Onlf) -1>-- 0 z
Component Failure Mode Failure Effects Detection Single Adive Mitigation!Comments l/l N [J -J Mech.aiDsm Failure I r'1 1 1CH13 (Check Fails Closed Mechanical Loss of flow from 1CHE5. Loss FL-1652 No Yes Pump 1CH6 and check valve 'l Valve) Binding of cooling to all safety related Alarms Note 12CH13 provides 100% redundancy 0
- o loads. Trip of operating chiller(s) (1) from low flow switch. or low r'1
- o chilled water outlet temperature. 'l Possible pump damage if -<
z operated for long period of time GJ at shut-off. ;;o r'1 Fails Open (with Mechanical Reduced flow from Pump FL-1652 No Yes Opeiator action to manually close <
Pump 1 CHE5 Binding 1 CHE6 due to short cycling flow Alarms Note Valve 1 1CH14 lJl 0
Off) through idle pump 1CHE5. May (1) z cause chillers to trip on low lJl flow. ---1
- 13 Chiller Trips/fails to start Control Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50% capacity malfunction local indicating light chillers can provide cooling for all safetv related loarls. I
)>
z l
Diesel Power train Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50 % capacity 0 Malfunction local indicating chillers can provide cooling for all 0 light safety related loads. Remaining I
)>
chillers powered from independent z GJ diesel sources. r'1 lJl Loss of service Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50 % capacity I
water flow local indicating chillers can provide cooling for all light safetv related loads.
Chiller operates Control Less than full capacity of chiller Incidental No Yes Remaining two 50% capacity I with degraded malfunction available. reduced cooling to observation chillers can provide cooling for all i performance safety related loads safety related loads. I
LJ C
- 0 Ul z rrl
--1 ::::0 fTl o :::o .2 to S..C-CH-MEE-1139 Salmt Unit 1 Auxiliary Building Chilled Water Systmt Page 2 of 9 N f'l o lfl Failure Modes and Effects Analysis-LOCA Condition u 0
(Active Failures Only) z Ul Nm Component Failure Mode Failure Effects Detcrlion Single Active MitigationlCommeuts I fTl Mecllanism Failure 'l
- 12. Chiller Trips/fails to start Control Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50% capacity 0
- 0 malfunction local indicating chillers can provide cooling for all light safety related loads. fTl
- 0 Diesel Power train Loss of one 50 % capacity cru1ler Chiller Trip No Yes Remaining two 50% capacity 'l Malfunction local indicating chillers can provide cooling for all z light safety related loads. Remaining Cl chillers powered from independent :::0 fTl diesel sources. <
U)
Loss of service Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50% capacity 0
water flow local indicating chillers can provide cooling for all z liht safety related loods. Ul
--1 Chiller operates Control Less than full capacity of chiller Incidental No Yes Remaining two 50% capacity )>
--1 with degraded malfunction available. reduced cooling to observation chillers can provide cooling for all c performance safety related loads safety related loads. Ul
- 1 1 Chiller Trips/fails to start Control Loss of one 50 % capacity chiller Chiller Trip No Yes Remaining two 50 % capacity )>
z malfunction local indicating chillers can provide cooling for all 0 light safety related loads. n I
Diesel Power train Loss of one 50% capacity chiller Chiller Trip No Yes Remaining two 50% capacity )>
z Malfunction local indicating chillers can provide cooling for all GJ fTl light safety related loads. Remaining Ul chillers powered from independent diesel sources.
Loss of service Loss of one 50 % capacity chiller Chiller Trip No Yes Remaining two 50 % capacity water flow local indicating chillers can provide cooling for all light saf related loads.
Chiller operates Control Less than full capacity of chiller Incidental No Yes Remaining two 50% capacity with degraded malfunction available. reduced cooling to observation chillers can provide cooling for all performance safety related loads safety related loads.
1CH 1 5 1 (Air Fails Open Mechanical If during DBE loss of cooling to Position No Yes Redundant isolation valve 1 CH30 Operated Valve) binding safety related loads, from leakage indication in in non-seismic portion of system CR.
Control Signal If during DBE loss of cooling to Position No Yes Redundant isolation valve 1CH30 failure safety related loads, from leakage indication in in non-seismic portion of system CR.
u c
- 0 (!) .
z :::0 [Tl
---1
[Tl o :::o .2 to S-C-CH-MEE-1 139 Salem Unit 1 Auxiliary Building Chilled Water System Page 3 of9 N f'l o l/)
Failure Modes and Effects Analysis-LOCA Condition u 0
(Active Failures Only) z
'::::;' (/)
N OJ -
Component Failure Mode Failure Effects Detection Single Active r Mitigation!Commt!llts [Tl Mechanism Failure 'l 1 CH30 (Air Fails Open Mechanical If during DBE loss. of cooling to Position No Yes Redundant isolation valve 1CH151 0
- 0 Operated Valve) binding safety related loads, from leakage indication in in non-seismic portion of system CR. [Tl
in non-seismic portion of system CR. .
G) 1CH232 (Check Fails Closed Mechanical Loss of cooling to Emergency High No Yes Redundant compressor for Unit 2. :::0
[Tl Valve) binding Control Air Compressor, failure Temperature Note Operator action to line-up service <
i:fi of compressor alarm on (1) water cooling.
0 compressor z 1CH216 (Air Fails Closed Mechanical Loss of all cooling to one ECAC. High No Yes Redundant compressor for Unit 2. l/)
---1 Operated Valve) binding Failure of compressor. Temperature Operator action to line-up service )>
---1 alarm on water cooling. c compressor l/)
Controls Loss of all cooling to one ECAC. High No Yes Redundant compressor for Unit 2. )>
z
. Malfunction Failure of compressor. Temperature Operator action to line-up service 0 alarm on water cooling. n I .
compressor )>
z 1CH2 1 8 (air Fails Closed Mechanical Loss of cooling to one ECAC High No Yes Redundant ECAC cross tied from GJ
[Tl operated valve) binding after cooler and cylinders. Temperature other unit. Operator action to open l/)
alarm on manual bypass valve 1CH219.
compressor Controls Loss of cooling to one ECAC High No Yes Redundant ECAC cross tied from malfunction after cooler and cylinders. Temperature other unit. Operator action to open alarm. on manual bypass valve 1CH2 19.
compressor 1 CH74 (Air Fails full bypass Mechanical Loss of cooling to CAACS High Yes Yes Valve modulates to control operated 3-way flow binding temperature in temperature. unlikely to be full TCV) Electrical bypass. Testing and.PM increase Equipment and reliability. Operator action to Relay rooms. repair/restore flow to CAACS Controls Loss of cooling to CAACS High No Yes Redundant controls malfunction temperature in Electrical Equipment and Relay rooms.
-o c
- 'Q VJ z r'l
-1 ;::o r'1 Attachment 8.2 to S-C-CH-MEE-1 139 Salem Unit 1 Auxiliary Building Chilled Water System Page 4 of 9 o :::o N r'l Failure Modes and Effects Analysis-LOCA Condition o UJ
-o (Active Failures Only) .P. O z
- Vl N -
CD Component Failure Mode Failure Effects Detection Single Active Mitigation/Comments r r'1 Mechanism Failure
'1 0
1 CH 1 68 {Air N/A N/A NJA N/A N/A NJA Control air as well as the ;::o operated temperature controller have <
r'1 temperature been disconnected from ;::o
'1 control valve) CH 1 68. The fail is now in -<
permanently in th e full open z C)
. (fail-safe) position .
- o r'1 1 CH55 (check Fails closed Mechanical Loss of make-up capability. LA-41 56 Yes Yes Loss of inve nto ry will be Vi 0
valve) bindi ng Alarms. Also Note (1} slow with only normal S1/S2.0P-DL.ZZ-leakage. Operator action to provide alternate make-up
-1
)>
-1 0006{0) source. c Vl Primary logs. !
I I
0 Fails open Mechanical If concurrent with a seismic LA-4156 Yes n Yes Passive failure of non- J:
)>
binding event, draining of expansion Alarms. Also Note (1) safety class piping is not an z*
tank via the non-safety related S 1 /S2.0P- accident initiator. The CH C) r'1 Vl potable water make-up piping. DLZZ- system is not required to Loss of make-up capability. 0006(0) withstand a LOCA Pump damage from low NPSH. Primary concurrent with a DB E.
Loss of cooling to safety related Logs. Operator action to close
. loads. _ valves 1 CH3 or 1 CH 1 .
-o c
- o ())
z f'l
---j /0 fTl o /0 .2 to S-C-CH-MEE 1 139 Satan Unit 1 Auxiliary Building Chilled Warer System Page 5 of 9 N f'l 0 ())
-o Failure Modes and Effects Analysis-LOCA Condition
-1:>- 0 (Active Failures Only) z
())
N m I
Component Failure Mode Failure Effects Detection Single Activ:e Mitigation/Comments fTl Mechanism Failure '1 1 0
1 CH2 (air Fails closed Loss of air Loss of automatic make-up LA-4156 Yes Yes Loss of inventory will be slow with ;;o operated LCV) capability. Alarms. Also only normal leakage. Operator <
S liS2.0P- action to open manual bypass valve fTl
- o DL.ZZ- I CH57 'l 0006(Q) z
- "L" Logs. Cl ,
i Mechanical Loss of automatic make-up LA-4156 Yes Yes Loss of inventory will be slow with ::::o J f'l binding capability. Alarms. Also only normal leakage. Operator <
())
S I IS2. 0P- action to open manual bypass valve 6' DL.ZZ- 1 CH57 z 0006(Q) ())
-l Primarv Lo_gs. :r>
-l Control Loss of automatic make-up LA-4156 Yes Yes Loss of inventory will be slow with c Alarms. Also ())
malfunction capability. only normal leakage. Operator SliS2.0P- action to open manual bypass valve :r>
z DL.ZZ- 1CH57 0 0006(Q) n I
Primary Logs. :r>
z Fails open Mechanical Overfill of expansion lank, LA-4 156 Yes Yes Operator action to close valves Cl fTl binding possible flooding of expansion Alarms. Also 1CH3 or lCHl ())
tank area Sl/S2. 0P-DL.ZZ-0006(Q) wu.y Logs.
Control Overfill of expansion tank, LA-4156 Yes Yes Operator action to close valves possible flooding of expansion Alarms . Also 1CH3 or lCHI roo tank area S 11S2.0P-DL.ZZ-0006(Q)
Primarv Logs.
u c
- 0 VJ >
z l'l
-j :::O 1'1 o :::o .2 to S-C-CH-MEE-1 139 Salem Unit 1 Auxiliary Building Chilled Water System Page 6 of 9 N i'l o Vl Failure Modes and Effects Analysis-LOCA Condition u
+>- 0 (Active Failures Only) z
(/)
N CO r
Component Failure Mode Failure Effects Detection Single Active Mitigation/Comments 1'1 Mechanism Failure 'l 1 CH616 (Air Fails Closed Mechanical Loss of capability to vent None No Yes Relief valve 1CH143 will open at 24 0
vent No f'l Control Loss of capability to None Yes Relief valve 1CH143 will open at 24 :::0 malfunction nitroto control pressure. psig. 'l Fails open Mechanical Venting of nitrogen blanket. None Yes Yes The required NPSH for the CH z C)
Increased corrosion in system pumps is 1 1 ft, without N2 approximately 30 ft is available. :::0 f'l Control Venting of nitrogen blanket. None Yes Yes The required NPSH for the CH <
Vi malfunction Increased corrosion in system. pumps is 1 1 ft, without N2 6 approximately 30 ft is available.
I 1CH 147 {Air Fails open Mechanical Increase expansion tank pressure None No Yes Relief valve 1 CH143 will open at 24 operated PCV) to float on N2 header pressure . psig May overpressurize portions of c
(/)
system.
- Control malfunction Increase expansion tank pressure to float on N2 header pressure.
May overpressurize portions of None No Yes Relief valve 1CH143 will open at pSig 24
)
()
I system. )>
z Fails Closed Mechanical faJ.1ure Loss of ability to pressurize None Yes Yes The required NPSH for the CH C) 1'1 expansion tank pumps is 1 1 ft, without N2 (/)
approximately 30 ft is available.
Control Loss of ability to pressurize None Yes Yes The required NPSH for the CH malfunction expansion tank pumps is 1 1 ft, without N2 approximately 30 ft is available.
1CH416 (check Fails open Mechanical If concurrent with a seismic None Yes Yes The required NPSH for the CH valve) binding event, venting of nitrogen Note pumps is 1 1 ft, without N2 blanket via the non-safety related (1) approximately 30 ft is available. .
nitro<>en supply piping.
Fails closed Mechanical Loss of ability to pressurize None Yes Yes The required NPSH for the CH binding expansion tank Note pumps is 1 1 ft, without N2
{1) approximately 30 ft is available ..
1 CH61 (check Fails open Mechanical If concurrent with a seismic LA-4156 Yes Yes Operator action to close 1 CH60.
valve) binding event, draining of system Alarms. Also Note through non-safety related piping S 1 1S2.0P- (1) to the Penetration Area Cooling DL.ZZ-Unit piping. Loss of cooling to 0006 (Q) saf related heat loads Primary Logs.
u c
- s! Ul z 1'1 .
---1 :;u '
1'1 o :::o .2 to S-C-CH-MEE-1 139 Salan Unit 1 Auxiliary Building Chilled Water Systtm Page 7 of 9 N I'l o Vl Failure Modes and Effects Analysis-LOCA Condition u
.P. O (Active Failures Only) z Ul N OJ Component Failure Mode Failure Effects Detection Single Active Mitigation/Comments 1'1 Mechanism Failure .,.,
1CH260 (Check Fails closed Mechanical Loss of cooling to rad monitors Temperature Yes Yes The radiation monitors are not 0
- u valve) binding alarms on rad Note required to function during a <
monitors (1) LOCA. or a DBE. The only 1'1
- u function that they provide is for .,.,
detection of a steam generator tube z rupture. C)
Fails open Mechanical If during a DBE draining of CH LA-4156 Yes Yes Passive failure of non-safety Fg ;
binding system through non-safety related Alarms. Also Note class piping is not an accident <
piping to rad monitors. loss of S l /S2.0P- Ul (1) initiator. The CH system is not 6 cooling to safety related loads DL.ZZ- z required to withstand a LOCA 0006(Q) Ul concurrent with a DBE. Operator ---1 Primary Logs.
action to close manual valves )>
---1 ICH260 or 1CH26 1 . c Ul 1 CH253 (Air Fails closed Mechanical failure Loss of cooling to rad monitors Temperature Yes Yes The radiation monitors are not
)>
operated isolation valve) alarms on rad monitors required to function during a LOCA. or a DBE. The only I z 0
n function that they provide is for :r::
detection of a steam generator tube I )>
z rupture. . C)
I 1'1 Control Loss of cooling to rad monitors Temperature Yes Yes The radiation monitors are not I Ul malfunction alarms on rad required fo function during a monitors LOCA, or a DBE. Safety function is 1 only for detection of a steam
- generator tube rupture. I I
Fails open Mechanical failure If during a DBE draining of CH LA-4156 No Yes Redundant valve 1CH252 will be I system through non-safety related Alarms. Also able to isolate on low pressure to rad piping . Loss of cooling to safety SliS2.0P- monitors I related loads. DL.ZZ-0006(Q)
Primary Logs. I i
Control If during a DBE draining of CH LA-4156 No Yes Redundant valve 1 CH252 will be malfunction system through non-safety related Alarms. Also able to isolate on low pressure to rad I piping . Loss of cooling to safety S l !S2. 0P- monitors related loads DL ZZ-0006(Q)
Prima_!)'_ Logs. I
- O Vl
--o c z
-j l'l
- O l'l o i'l :::o Attachment 8.2 to s-c-CH-MEE-1 139 Salem Unit 1 Auxiliary Building Chilled Water System Page S of 9 N o Vl Failure Modes and Effects Analysis-LOCA Condition --o O
-JO>. '
(Active Failures Only) z Vl N- OJ I
Component Failure Mode Failure Effects Detection Single Active MitigationlComments '
l'l Mechanism Failure ---1 0
. 1 CH252 (Air Fails closed Mecbaillcal failure Loss of cooling* to rad monitors Temperature Yes Yes The radiation monitors are not :::0 operated alarms on rad required to function during a <
isolation valve) monitors LOCA. or a design basis l'l
- 0 earthquake. The only function that 'l they provide is for detection of a z steam generator tube rupture. . C)
Control Loss of cooling to rad monitors Temperature Yes Yes The radiation monitors are not :::0 l'l malfunction alarms on rad required to function during a <
monitors Ul LOCA, or a design basis 0 earthquake. The only function that z they provide is for detection of a steam R'enerator tube rupture.
Fails open Mechanical failure If during a DBE draining of CH LA-4156 No Yes Redundant valve 1CH252 will be system through non-safety related Alarms. Also able to isolate on low pressure to rad piping to rad monitors. loss of Sl/S2. 0P- monitors )>
z cooling to safety related loads. DLZZ- 0 0006(Q) i ,
Primary Loi:!:S.
Control If during a DBE draining of CH LA-4156 No Yes Redundant valve 1CH252 will be malfunction system through non-safety related Alarms. Also able to isolate on low pressure to rad Vl piping to rad monitors. loss of Sl/S2.0P- monitors cooling to safety related loads. DL. ZZ-0006(Q)
Primary LQgs.
- 1 1 Chilled Pump stops Mechanical failure Loss of flow to chillers. Loss of Flow alarm FL- No Yes Redundant pump 1 CHE6.
water pump cooling to safety related heat 1652 1 CHE5 loads.
Electrical failure Loss of flow to chillers. Loss of Flow alarm FL- No Yes Redundant pump 1 CHE6.
cooling to safety related heat 1652 loads.
- 12 Chilled Pump stops Mechanical failure Loss of flow to chillers. Loss of Flow alarm FL- No Yes Redundant pump 1 CHE5.
water pump cooling to safety related heat 1652 1CHE6 loads.
Electrical failure Loss of flow to chillers. Loss of Flow alarm FL- No Yes Redundant pump 1 CHE5.
cooling to safety related heat 1652 loads.
NOTES
u c AJ (J) z :;o l'l
--j 1'1 .2 to S-C-CH-MEE-1 1 39 Salem Unit 1 Auxiliary Building Chilled Water System Page 9 of 9 o AJ N i'l Failure Modes and Effects Analysis-LOCA Condition 0 (/)
u (Active Failures Only) -J0.- 0 Bi t Note 1 : At the time of the Salem design, check valves were considered as "passive" devices, this position was Nml , ,
1'1 accepted by the NRC. Current design standards do not permit a single check valve to fun ction as the class boundary 'l 0
between safety and non-safety related piping. :;o rrJ Note 2: Deleted :;o
'l z
GJ
- o 1'1
(/)
0 z
(/)
--1
)>
--1 c
I n
I
)>
z GJ 1'1
(/)
LRN15-0232 Enclosure 2 Technical Evaluation 801 10953-0105, "Chilled Water System Crosstie FMEA"
.:. 1 -
Revi s ed to include L i c en s i ng c omment s
- * * * * * * * * * * * *
- L ong Text Ob j e c t I dent i f i c a t i on* * * * * * * * * * * * *
- Orde r 0 0 0 0 8 0 1 1 0 9 5 3 Ope r a t i on 0 1 0 5 Conf i rmat ion 0 0 1 2 7 0 2 4 3 8 Conf i rma t i on c ount e r 0 0 0 0 0 0 0 5 Long t ext DOCUMENT # : 8 01 1 0 95 3 - 0 1 0 5 TITLE : Chi l l ed Wat e r Sys t em Cro s s t i e FMEA REASON FOR EVAL UAT I ON / S COPE :
LAR S 1 4 - 0 4 i s b e ing p repared to reque s t a change to the Chi l l ed Water ( CH ) Sys t em T e c hn i c a l Spec i f i c a t i on 3 . 7 . 1 0 . One o f the reque s t e d change s i s to a l l ow us e of the exi s t ing CH Sys tem c ro s s t i e b e tween the two uni t s to a l l ow one uni t 1 s chi l l ers t o b e removed f rom s e rvi c e in order t o p e r f o rm maintenance on c ommon l ine c omponent s on that uni t . Thi s eva luat i on perf orm s a Fai lure Mode s and E f f e c t s Ana lys i s ( FMEA) over u s e of the c ro s s t i e .
The s c op e o f thi s T e chni c a l Evalua t i on was revi ewed unde r procedure HU-AA - 1 2 1 2 as part o f the p re - j ob b r i ef . The r e s u l t i ng R i s k Rank was 1 , whi c h c a l l s f o r exis t ing pro c e s s reviews . I n thi s c as e . the Techn i c a l Eva l uat ion i s s a f e ty - re l a t ed , s o an independent review i s p e r f o rmed .
DETA I LED EVALUAT ION .:
Gene ral D e s ign C r i t e r i on 4 4 , 11 Cool ing Wat e r 11 s t a t e s that 11 s u i t ab l e redundancy in c omponents # s ha l l b e provided to a s s ure that # the sys t em s af ety func t i on can be a c c omp l i shed , a s s uming a s ingl e f a i lure 11
- Reference 1 perf orms a FMEA o f the CH Sys t em . The eva luat i on addre s s e s s ing l e a c t i ve f a i lure vu lne rab i l i t i e s . Use of the CH c r o s s t i e doe s no t impac t the func t ion of the c omponen t s c urrent l y addressed i n the eva luat i on o r the impac t o f a f a i lure of any of t he s e c omponent s . The current FMEA i s c ons i s t en t w i th dra f t S t andard Revi ew P l an 9 . 2 . 7 , 11 Chi l l ed Wa t e r 11
Sys t em a na lys e s in support of LAR S 1 4 - 0 4 , whi ch inc lude s evalua t i on o f the CH sys t em c ro s s t i e a l i gnment . The analys e s addre s s a sing l e f a i lure o f a c hi l l e r o r pump o n the uni t with the ava i l ab l e chi l l e r s .
The c :ro s s t i e l in e s thems e lves do not c ontain any act ive c omponent s , and thus no new a c t ive f a i lure me chani sms are i nt ro du c e d . Both the s upp l y and return l ine s cont a in a s ingle manual i s ol a t i on valve . Onc e opened , the r e is no fai lure m e c hani sm that w i l l cause e i ther o f thes e valve s t o go c lo s e d .
Admini s t ra t ive cont ro l s wi l l be e s t ab l i shed t o ensure the valves s t ay open for the durat i on the .c ro s s t i e i s ne ede d .
- 2 -
The CH sys tem i s a medium ene.rgy sys tem . Medium Energy Line Breaks ( MELB ) f o r a l l medium energy sys tems <;.re addre s s ed by Re f e rence 4 1 and thu s thi s i s not a new f a i l ur e mechani sm .
CONCLUS IONS / FINDINGS :
Use of the CH S y s t em c r o s s t i e doe s not impac t the f a i l u r e
- e f fe c t s of CH Sys t em act ive and pa s s ive f a i lures current ly ana ly z ed . The cro s s t i e l ines do not c on t a in any a c t ive c omponents and do not introdu c e any new f a i lure mechani sms . The resul t s .o f thi s Techn i c a l Evaluat ion wi l l be incorpora t ed into S - C - CH - MEE - 1 1 3 9 upon NRC app rova l o f LAR S 1 4 - 0 4 [ 8 0 1 1 0 9 5 3 - 0 1 0 6 ] .
REFERENCES :
1 . S - C - CH-MEE - 1 1 3 9 , Revi s i on 1 , Chi l l ed Wat e r Sys t em S ing l e Fai lure Cr i t eria Vulnerab i l ity A s s es sment
- 2. S - C - CH - MDC - 2 2 8 2 , Rev i s ion 2 , Chi l ler S ervi c e Wat e r F l ow Requirement s [ i s sued per Tecb,ni cal Eva luat ion 8 0 1 1 0 9 5 3 - 0 0 1 5 ;
pending NRC approva l of LAR S 14 - 0 4 ]
3 . S - C - CAV - MD C - 2 3 2 0 , Revi s i on 1 , Eva l ua t i on o f the Control Ar e a Vent i l ation Sys tem Dur ing Chi l l ed Water Sys t em Chi l l er Repl ac ement [ i s sued p e r Techni c al Evaluat ion 8 0 1 1 0 9 5 3 - 0 0 1 5 ;
pending NRC approva l o f LAR S 1 4 - 0 4 ]