ML13044A114

Multiple Spurious Operation Evaluation Report R1976-20-01, Dated January 2013, Revision 2

ML13044A114
Person / Time
Site:	Watts Bar
Issue date:	01/31/2013
From:	Brush C Engineering Planning & Management, Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
R1976-20-01, Rev 2
Download: ML13044A114 (86)

Text

Enclosure 1 WBN Unit 2 Multiple Spurious Operation Evaluation Report R1976-20-01, dated January 2013 Revision 2 6

ENGINEERING PLANNING AND MANAGEMENT, INC.

TENNESSEE VALLEY AUTHORITY WATTS BAR NUCLEAR PLANT UNIT 2 MULTIPLE SPURIOUS OPERATION EVALUATION Report: RI1976-20-01

Title:

MULTIPLE SPURIOUS OPERATION EVALUATION Revision: 2 Date: January 2013 Prepared by C. E. Brush 1-30-2013 Signature Print Date Reviewed by F. W. Tanner 1-31-2013 Signature Print Date EPM EnginceeingPlanningand Management, Inc.

E1-2

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant Rev. 2 Executive Summary This report evaluates multiple fire induced spurious failures at Watts Bar Nuclear Plant - Unit 2 as required by Nuclear Regulatory Commission (NRC) Regulatory Guide 1.189, Rev. 2. Based on the results of the Multiple Spurious Operations Expert Panel conducted at the plant for Unit 1, various scenarios were identified and were reviewed for WBN Unit 2. Most of these scenarios were resolved by the existing baseline Fire Safe Shutdown (FSSD) analysis. Resolutions have been incorporated for the previously unresolved scenarios identified in Appendices B and C.

Page ii E1-3

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear P1[ant Rev. 2 lant TABLE OF CONTENTS Contents 1.0 PU RPO SE ........................................................................................................................... 1 2.0 RESU LTS ........................................................................................................................... 1 3.0 BA CKG RO U N D ................................................................................................................ 1 4.0 SC O PE ................................................................................................................................ 2 5.0 M ETH OD O LO GY ........................................................................................................... 2 6.0 OPERATOR MANUAL ACTIONS ........................................................................... 2 7.0 R EFEREN CE S ................................................................................................................... 3 8.0 REC O RD O F REV ISIO N S ........................................................................................... 3 APPENDIX A: MSO EVALUATIONS APPENDIX B: UNIT 2 RESOLUTIONS APPENDIX C: UNIT 1/COMMON RESOLUTIONS Page iii E1-4

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant Rev. 2 1.0 PURPOSE This report provides the result of the evaluation of Watts Bar (WBN) Unit 2 for issues resulting from the publication of Nuclear Regulatory Commission (NRC) Regulatory Guide 1.189 Rev. 2 (RG 1.189) (Ref. 7.1). Specifically, Section 5.3 of RG 1.189 discusses an allowable approach to address multiple fire induced circuit failures. This report identifies scenarios that may be caused by multiple circuit failures and evaluates each scenario to determine if, in fact, it is a concern. For any concern identified, resolutions are provided to address the concern.

2.0 RESULTS Appendices B and C summarize the resolutions resulting from the review of Regulatory Guide 1.189 Multiple Spurious Operation (MSO) requirements at WBN-2. Concerns were identified in a few plant areas and for different post-fire scenarios. Where concerns were identified, resolutions were provided to eliminate the concern. Many of the resolutions were identified by the baseline post fire safe shutdown analysis (FSSD) and resulting plant modifications are in process. Such resolutions are included in this report for completeness.

The review of the MSO scenarios is attached as Appendix A. The scenarios selected for review are the same set of scenarios that were determined to be applicable to WBN unit 1 by the MSO Expert Panel. This list was based on the Pressurized Water Reactor Owner's Group (PWROG) generic list of multiple spurious operations. The Sequoyah (dual unit) MSO list was compared to the WBN Unit 1 list and no additional scenarios were identified due to dual unit operation.

3.0 BACKGROUND

RG 1.189 Revision 2 (Reference 7.1) was issued by the Nuclear Regulatory Commission (NRC) in October 2009. RG 1.189 provides guidance for nuclear power plants that are not transitioning their fire protection licensing basis to a performance-based standard under 10CFR50.48(c) and National Fire Protection Association (NFPA) standard 805.

RG 1.189 formalized the requirements for addressing multiple fire induced circuit failures, or MSOs and multiple concurrent hot shorts. RG 1.189 endorsed portions of NEI 00-01 Rev. 2 (Ref.

7.3) as an acceptable approach to address these issues. NEI 00-01 allows the use of an expert panel to identify plant specific scenarios that might be caused by MSOs.

TVA reviewed MSOs in accordance with RG 1.189 for Watts Bar Unit 1 and its sister plant, Sequoyah Units 1 and 2. Construction of Watts Bar Unit 2 is nearing completion and is proceeding through the licensing process. Most of the multiple spurious operation scenarios were previously addressed in the baseline post fire safe shutdown analysis of WBN-2. Those that were not in the baseline analysis have been incorporated into the as-designed post fire safe shutdown analysis as applicable.

Page 1 E1-5

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant Rev. 2 4.0 SCOPE This report evaluates the MSO scenarios selected for SQN Units 1 and 2 and for WBN Unit 1.

The evaluation determines whether the scenario is applicable to WBN Unit 2 and how WBN-2 complies with each scenario.

5.0 METHODOLOGY Starting from the WBN Unit 1 MSO information, the WBN-2 MSO evaluation used following the general process in the evaluation of each scenario.

1. For each scenario or issue, components were identified whose failure would cause the particular scenario or issue to occur.

2. These components were arranged in a logical relationship.

3. For components already included in the FSSD analysis, the associated cables already identified and located by fire zone/analysis volume. The MSO functional requirement for the component was compared to the FSSD functional requirement to ensure the appropriate cables were included in the evaluation.

4. For newly identified components (not included in the FSSD), or components with new functional requirements associated cables were identified and located by fire zone/analysis volume.

5. Cable and cable location information is maintained in the System Assurance & Fire Protection Engineering (SAFE) database (FSSD analysis).

6. For each Fire Area where MSO components could fail due to cable fire damage, an evaluation was performed to determine the impact of multiple fire induced faults.

6.0 OPERATOR MANUAL ACTIONS Operator Manual Actions (OMA) identified in the as-designed Post Fire Safe Shutdown (FSSD) analysis were identified and credited where applicable to resolve the MSO scenarios. Operator manual actions credited in the Unit 2 MSO evaluations have been evaluated for feasibility and reliability in accordance with the criteria described in the as-designed dual unit Fire Protection Report, Part V, Section 2.1.

Page 2 E1-6

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant Rev. 2

7.0 REFERENCES

7.1 NRC Regulatory Guide 1.189, Fire Protection For Nuclear Power Plants, Revision 2 dated October 2009 7.2 NRC Enforcement Guidance Memorandum 09-002, Enforcement Discretion for Fire Induced Circuit Faults, dated May 14, 2009 7.3 NEI 00-01, Guidance for Post Fire Safe Shutdown Circuit Analysis, Revision 2 dated May 2009 7.4 Calculation EDQ00099920090012, Unit 1 and 2 Appendix R Safe Shutdown Analysis 7.5 CM-6.20, Chemistry Manual - Sampling the Reactor Coolant System, Revision 26 7.6 CM-6.2 1, Chemistry Manual - Sampling the Pressurizer Liquid, Revision 16 7.7 CM-6.22, Chemistry Manual - Sampling Pressurizer Gas, Revision 14 7.8 CM-2.31, Chemistry Manual - Zinc Addition to the Reactor Coolant System, Revision 8 7.9 Not used.

7.10 NEI 00-01, Guidance for Post Fire Safe Shutdown Circuit Analysis, Revision 3 dated October 2011, Table G-2.

7.11 Westinghouse Letter LTR-RAM-I-10-053, White Paper on Westinghouse Reactor Coolant Pump Seal Behavior Revision 2.

8.0 RECORD OF REVISIONS Revision Description of Change I Noted that previously identified plant design changes are included and credited in this report. (see section 2.0 and scenarios 22, 32, 54, 54a, 54b, 54c, & 54d)

Noted that operator actions credited for MSO resolutions were the same as OMA's previously approved for Unit 1. (see section 6.0 and scenarios 2, 10, 12, 20, 27, 28, 30, 31, 35a, 54, 54a, 54b, 54c, & 54d)

Removed reference to Unit 1 Problem Evaluation Reports that are not applicable to Unit 2. (see scenarios 27 & 28)

Appendix B - Added resolutions for scenarios 13a, 22, 32, 54, 54a, 54b, 54c, & 54d Appendix C - Added resolution for scenario 15a.

Page 3 E1-7

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant Rev. 2 2 Updated MSO evaluations based on the As-Designed FSSD analysis and unit 1 and unit 2 MSO design changes.

Updated and added references.

Replaced "backup control" with "Auxiliary Control System" per NRC commitment tracking item 112331509. (affected Appendix A sections: 22.3.1, 23.3.1, 32.3.5.

33.3.1, 54.3.1, 54a.3.1, 54b.3.1, 54c.3.1, 54d.3.1, 54f.3.1, Appendix B)

Clarified statements crediting the Auxiliary Control System for control building fires "resulting in MCR abandonment" per NRC commitment tracking item 112384277 which noted that some control building fires would not result in MCR abandonment (affected Appendix A sections 4.3.1, 22.3.1, 23.3.1, 32.3.5. 33.3.1, 35.3.1, 38.3.3, 48.3.1, and Appendix B).

Added references 7.5 thru 7.8 as support information for scenario 21.

Updated MSO scenarios descriptions as needed based on NEI-00-01 Revision 3, Table G-2 (Ref. 7.10) while maintaining original scenario numbering to match WBN Unit 1 MSO evaluation. Added scenario 48a (49.1) and expanded scenarios 50 and 51 to include Table G-2 scenarios 52 and 53.

Replaced reference to White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios with Revision 2 (Westinghouse Letter LTR-RAM-I 053) See Reference 7.11.

Removed comparison of Unit 2 and Unit 1 compliance strategies Other changes to specific Appendix A Sections:

" 1.3.2, 4.3.1, 5.3.1, 9.3.1, 10.3.1, 39.3.2 -- Identified AV where TBC is credited.

• 2.3.1, 20.3.2 - Credited MCR closure of 2-FCV-62-89 rather than local manual valve.

• 2.3.2, 20.3.3, 37.3.1 - Credited closure of 2-FCV-63-39-A and 2-FCV 40-B from MCC rather than local manual valve operations.

" 5.3.2, 6.3.1, 7.3.1, 13.3.1 - Credit reactor building non-essential control air header isolation and venting to fail valves open/closed.

• 8.3.1, 9.3.1, 12.3.1, 13.3.2, 14.3.1, 14.3.2, 19.3.1, 22.3.1, 24.3.1, 29.3.2, 32.3.2; 32.3.5, 37.3.1, 39.3.2, 48.3.1 -Expanded compliance evaluation for clarity.

" 13a.3.1 - Revised CCP run out evaluation.

" 27.3.1, 27.3.2, 28.3.3, 29.3.4, 30.3.2 - Credited backup motive air supply (nitrogen) for MCR operation of SG level and AFWP pressure control rather than local valve operation (both units).

" 42.3.3, 47.3.1 - Changed EDG cooling water valves from normally open with power removed to normally closed, automatic opening on EDG start.

" 46.3.1 - Credited revised EDG loading calculation methodology.

Page 4 E1-8

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant Rev. 2

• 48.3.1 - Expanded evaluation of potential paralleling EDG with offsite sources through spurious breaker operation.

• 53.3.2 - Updated to include results of MOV stall analysis.

Updated Appendices B and C resolutions to reflect those that have been incorporated or are no longer needed.

Page 5 E1-9

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Appendix A UNIT 2 MSO EVALUATION PageA - I El-10

TVA I Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 1.0 PWROG Scenario 1: Primary Inventory Control - Loss of all reactor coolant pump (RCP) seal cooling due to spurious closure of RCP seal injection header valve(s) concurrent with spurious isolation of component cooling water (CCW) to the thermal barrier heat exchanger.

1.1.

Description:

Spurious isolation of reactor coolant pumps seal injection header flow AND spurious isolation of component cooling water (CCW) to the thermal barrier heat exchanger

1.2. Notes

• Scenario causes loss of all RCP seal cooling and subsequent increase in RCP seal leakage, challenging the reactor coolant system (RCS) Inventory Control Function.

" Westinghouse Tech Bulletin 04-22 Rev. 1 provides a summary of the issue. Tech Bulletin references provide additional detail. B&W plants with Westinghouse designed seals may have similar concerns.

• Seal injection flow isolation can occur at main header or at supply to each individual pump. In addition, scenarios that cause loss of all charging (i.e.,

multiple pump failure due to loss of suction, non-spurious pump failures such as loss of power, etc.) can also cause loss of seal injection.

• Loss of all seal cooling to any individual RCP is a problem (i.e., does not have to occur on all RCPs to be a problem)

• Westinghouse plants refer to Letter LTR-RAM-I-10-053 Revision 2 of White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios

• CE plants generally do not have seal injection and can lose seal cooling for an extended period of time without increased seal leakage. These plants can lose all seal cooling due to spurious isolation of CCW.

• Refer to WCAP-16175.

1.3. WBN Unit 2 Safe Shutdown Compliance:

1.3.1. Seal Injection Header Isolation can only be accomplished by closing flow control valve (FCV) FCV-062-093. FCV-062-093 is an air operated valve which is normally open and fails full open on loss of control air or electrical power. The valve has a pneumatic stop to ensure valve will allow a minimum seal injection flow. For analysis volume AV-005 (fire on the valve) or AV-104 (fire on panel 2-L-1 12 where pneumatic stop is located) fire damage PageA - 2 El-11

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 could possibly cause FCV-62-93 closure. For these AVs thermal barrier cooling (TBC) is available and provides RCP seal cooling. Both centrifugal charging pumps (CCPs) are stopped while manual valves are aligned to bypass FCV-62-93 and CCP suction is aligned to the RWST. One of the CCPs is restarted within 75 minutes to resume RCP seal injection.

1.3.2. Loss of suction to the centrifugal charging pump (CCP) has been reviewed and determined that one CCP will always survive considering multiple spurious closure of either volume control tank (VCT) suction valve, loss of refueling water storage tank (RWST) suction valves, loss of or multiple spurious start of CCPs, spurious safety injection (SI), and loss of CCP heating ventilation and cooling (HVAC). For analysis volume (AV)-106, fire on the RWST suction valves, TBC is credited for 75 minutes for RCP seal cooling.

During this time both charging pumps are stopped from MCR within 23 minutes, a RWST suction valve is manually opened within 75 minutes, and a charging pump is started after RWST suction valve is opened to resume normal seal injection.

2.0 PWROG Scenario 2: Primary Inventory Control - Loss of all reactor coolant pump (RCP) seal cooling due to charging flow diversion concurrent with spurious isolation of component cooling water (CCW) to the thermal barrier heat exchanger.

2.1.

Description:

Spurious opening of charging injection valve(s) causing diversion flow away from seals AND Spurious isolation of component cooling water (CCW) to the thermal barrier heat exchanger

2.2. Notes

• Flow diversion away from seal injection could be caused by spurious opening of charging injection valves. Note, spurious opening of #1 seal bypass valve is judged to not fail seal injection function due to orifice restricting bypass flow to -lgpm (Reference Letter #OG-09-156)

" Scenario causes loss of all RCP seal cooling and subsequent increase in RCP seal leakage, challenging the RCS Inventory Control Function.

• Westinghouse Tech Bulletin 04-22 Rev. 1 provides a summary of the issue. Tech Bulletin references provide additional detail. B&W plants with Westinghouse designed seals may have similar concerns.

PageA - 3 E1-12

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" Seal injection flow isolation can occur at main header or at supply to each individual pump. In addition, scenarios that cause loss of all charging (i.e.,

multiple pump failure due to loss of suction, non-spurious pump failures such as loss of power, etc.) can also cause loss of seal injection.

• Loss of all seal cooling to any individual RCP is a problem (i.e., does not have to occur on all RCPs to be a problem)

" Westinghouse plants refer to Letter LTR-RAM-I-10-053 Revision 2 of White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios.

• CE plants generally do not have seal injection and can lose seal cooling for an extended period of time without increased seal leakage. These plants can lose all seal cooling due to spurious isolation of CCW.

• Refer to WCAP- 16175.

2.3. WBN Unit 2 Safe Shutdown Compliance:

2.3.1. Cable separation ensures closure of at least one of the Injection Header Isolation valves (2-FCV-62-90-A or 2-FCV-62-91-B) except for a fire where the valves are located (AV-099). For AV-099, the Charging Flow Control valve (2-FCV-62-89) in series with the injection header isolation valves but located in a different fire zone will be closed from the main control room within 18 minutes.

2.3.2. The only fires that could cause the boron injection tank (BIT) outlet isolation valves 2-FCV-63-25-A or 2-FCV-63-26-B to spuriously open is a fire in their respective Reactor Motor Operated Valve (RMOV) board rooms (AV-072, -

073, -074). The BIT path will be isolated by closing the BIT inlet isolation valves 2-FCV-63-39-A and 2-FCV-63-40-B from their respective Control &

Auxiliary Building Vent Boards located in AV-054 and AV-057. The time requirement for these actions is 18 minutes.

3.0 PWROG Scenario 3: Primary Inventory Control - Spurious re-initiation of reactor coolant pump seal injection / thermal barrier cooling results in failure of the RCP seals due to thermal shock.

3.1.

Description:

Loss of all seal cooling to reactor coolant pump(s) (see PWR Owners Group scenarios #1 and #2)

AND PageA - 4 El-13

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 (Spurious re-initiation of seal injection OR spurious re-initiation of component cooling water (CCW) to the thermal barrier heat exchanger)

3.2. Notes

" Scenario is assumed to cause RCP seal failure and a subsequent RCP seal loss of cooling accident (LOCA), challenging the RCS Inventory Control Function.

" Westinghouse Tech Bulletin 04-22 Rev. 1 (Reference 11) provides summary of issue. Tech Bulletin references provide additional detail.

" Westinghouse plants please refer to Letter LTR-RAM-I-10-053 Revision 2 of White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios.

• CE plants generally do not have seal injection and can lose seal cooling for an extended period of time without increased seal leakage. These plants can lose all seal cooling due to spurious isolation of CCW. Refer to WCAP-16175.

3.3. WBN Unit 2 Safe Shutdown Compliance:

3.3.1. Based on Scenario 1 & 2 discussions, there will not be a sustained loss of seal injection, so this scenario is not applicable.

4.0 PWROG Scenario 4: Primary Inventory Control - Catastrophic RCP Seal Failure 4.1.

Description:

Loss of all seal cooling to reactor coolant pump(s) (see PWR Owners Group scenarios #1 and #2)

AND Fire prevents tripping the reactor coolant pumps OR spurious start of a reactor coolant pump(s)

4.2. Notes

• Scenario causes catastrophic RCP seal failure and subsequent RCP seal LOCA, challenging the RCS Inventory Control Function.

" Westinghouse Tech Bulletin 04-22, Rev. 1 provides summary of issue. Tech Bulletin references provide additional detail. Additionally refer to Letter LTR-RAM-I-10-053, Revision 2 of White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios.

" Refer to WCAP- 16175 for RCP seal behavior on loss of seal cooling at CE plants.

Page A - 5 E1-14

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 4.3. WBN Unit 2 Safe Shutdown Compliance:

4.3.1. As discussed in Scenarios 1 & 2, RCP seal flow is always credited except for AV-005, -104, -106 where TBC is credited for 75 minutes until RCP seal cooling can be reestablished. The cables associated with the RCPs which can cause a spurious start of the pump or prevent the pump from being tripped are entirely contained inside the Control or Turbine Building. For all AVs except Control Building the RCPs are tripped from the main control room (MCR) panels. For a Control Building fires resulting in MCR abandonment, the RCPs and the normal and alternate supply breakers feeding the 6.9kv RCP board would be tripped prior to evacuating the control room. Additionally local action at the 6.9kv RCPs board ensures that the RCP breakers remain tripped.

5.0 PWROG Scenario 5: Primary Inventory Control - Loss of all reactor coolant pump (RCP) seal cooling concurrent with spurious operation of the number 1 seal leakoff valve results in failure of RCP seal number 2 5.1.

Description:

Loss of all seal cooling to any RCP(s). See Scenarios I & 2.

AND Spurious isolation of No. 1 seal leakoff valve(s).

5.2. Notes

" Isolation of the No. 1 seal leakoff line during a loss of all seal cooling event would force the No. 2 RCP seal into a high pressure mode of operation at high temperature, which is beyond the design bases of the No. 2 seal. This could cause failure of the No. 2 seal and increase RCP seal leakage.

" Westinghouse Tech Bulletin 04-22, Rev. 1 provides summary of issue. Tech Bulletin references provide additional detail.

" Also reference Letter WOG-05-163 DW-04-004 "Isolation RCP#1 Seal Leakoff' and Letter LTR-RAM-I-10-053 Revision 2 of White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios.

" This scenario would apply to B&W plants with Westinghouse designed RCP seals.

PageA - 6 E1-15

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 5.3. WBN Unit 2 Safe Shutdown Compliance:

5.3.1. As discussed in Scenarios 1 & 2, RCP seal flow is always credited except for AV-005, -104, and -106 where TBC is credited for 75 minutes until RCP seal cooling can be reestablished.

5.3.2. The No. 1 seal leakoff valves (2-FCV-62-9, -22, -35, and -48) are normally open and fail open on loss of air or electric power. For areas where valve circuits could be fire damaged the valves can be maintained open by main control room operator actions to close the Reactor Building non-essential control air header isolation valve (2-FCV-32-1 11-B) and open valve (2-XSV-32-112A1, A2, B1, B2) to vent the downstream header. This will depressurize the control air header and ensure the No. 1 seal leakoff valves fail open. For AV-057 a postulated fire could cause the seal leakoff valves for RCPs 2 and 4 to fail closed and also prevent isolation of the non-essential control air header.

5.3.3. Resolution

Relocate the cables for 2-FCV-62-22 and 2-FCV-62-48 out of AV-057.

5.3.4. WBN Unit 1 identified this condition in PER 227833.

6.0 PWROG Scenario 6: Primary Inventory Control - Failure to isolate / spurious opening of normal letdown active isolation valves 6.1.

Description:

Spurious opening of (or failure to close) letdown isolation valve(s)

AND Spurious opening of (or failure to close) letdown orifice valve(s)

6.2. Notes

" Scenario causes loss of RCS inventory, challenging the RCS Inventory Control Function.

" In a typical Post-Fire Safe Shutdown (PFSS) Analysis, the Chemical and Volume Control System (CVCS) downstream of the letdown isolation valve(s) and upstream of the Volume Control Tank (VCT) isolation valve(s) is not evaluated, and the RCS inventory (letdown) is conservatively assumed lost and unavailable for makeup. In reality, additional failures downstream of the letdown isolation valves would have to occur for this RCS inventory to be unavailable for makeup.

PageA - 7 E1-16

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" Also note that the letdown isolation valves and letdown orifice valves are often interlocked such that the isolation valves will not open without the orifice valves being open. Letdown failure to isolate can be a single spurious operation with interlocked valves.

" Note B&W plants do not have letdown orifice valves. Scenario applicable to B&W is spurious operation of multiple letdown isolation valves.

6.3. WBN Unit 2 Safe Shutdown Compliance:

6.3.1. Normal Letdown is isolated by closure of series valves 2-FCV-62-69-A or 2-FCV-62-70-A from the control room. For areas where valve circuit fire damage could prevent closure of one of the valves (AV-036, -037, -037C, -

038, -042(D,E,F,G), -045, -048, -056, -058, -067, -74, -115, and -117) letdown isolation is achieved by main control room actions to isolate and vent the reactor building non-essential control air header (2-FCV-32-1 11-B and 2-XSV-32-112A1, A2, B1, B2) causing 2-FCV-62-69-A and 2-FCV-62-70-A to fail closed.

7.0 PWROG Scenario 7: Primary Inventory Control - Normal letdown fails to isolate and inventory is lost to the pressurizer relief tank (PRT) 7.1.

Description:

Letdown fails to isolate (see scenario #6)

AND Spurious closure of downstream containment isolation valve.

7.2. Notes

Scenario causes letdown flow to Pressurizer Relief Tank (PRT) through relief valve. This letdown flow is assumed unavailable for RCS makeup.

7.3. WBN Unit 2 Safe Shutdown Compliance:

7.3.1. Normal Letdown is isolated by closure of series valves 2-FCV-62-69-A or 2-FCV-62-70-A from the control room. To ensure valve closure for areas where valve circuits could be fire damaged (AV-036, -037, -037C, -038, -

042(D,E,F,G), -045, -048, -056, -058, -067, -074, -115, and -117) main control room operator actions will isolate and vent the reactor building non-essential control air header (2-FCV-32-1 11-B and 2-XSV-32-112A1, B1, A2, B2) causing 2-FCV-62-69-A and 2-FCV-62-70-A to fail closed due to loss of control air.

PageA - 8 E1-17

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 8.0 PWROG Scenario 8 Primary Inventory Control - Excess letdown fails to isolate 8.1.

Description:

Spurious opening of (or failure to close) of multiple in-series excess letdown isolation valves

8.2. Notes

" Scenario causes loss of RCS inventory to the CVCS system, challenging the RCS Inventory Control Function. The RCS inventory (letdown) is conservatively assumed lost and unavailable for makeup. In reality, additional failures downstream of the excess letdown isolation valves would have to occur for this RCS inventory to be unavailable for makeup.

" This scenario often requires three spurious operations.

8.3. WBN Unit 2 Safe Shutdown Compliance:

8.3.1. The excess letdown isolation valves 2-FCV-62-55 and 2-FCV-62-56 are normally closed and fail closed on loss of air. Valve 2-FCV-62-55 is a solenoid controlled, air operated valve and fails closed on loss of power.

Hand indicating controller 2-HIC-62-56A opens/closes valve 2-FCV-62-56 from the MCR. Other than in the Control Building cables for 2-FCV-62-56 are routed in dedicated conduit with no energized circuits to prevent spurious opening due to hot shorts. Auxiliary Control System transfer switches isolate the Control building portion of the letdown isolation valves' circuits when the MCR is abandoned.

9.0 PWROG Scenario 9: Primary Inventory Control - Spurious valve operation results in loss of all high head RCS makeup flow paths 9.1.

Description:

Spurious isolation of reactor coolant pump (RCP) seal injection flow path AND / OR Spurious isolation of normal charging flow path AND / OR Spurious isolation of charging injection flow path

9.2. Notes

" Scenario isolates all high head RCS makeup flow paths, challenging the RCS Inventory Control Function.

" Each flow path contains a number of series and/or parallel valves. P&ID review is required to identify each relevant combination of valves.

PageA - 9 El-18

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" Note that isolation of all RCS makeup may also involve non-spurious failures.

For example, the charging injection valves are normally closed, and a fire-induced loss of valve power (not a spurious operation) would cause these valves to fail closed. On the other hand, these valves could spuriously close after they have been opened.

" *Note CE plants generally do not have seal injection.

9.3. WBN Unit 2 Safe Shutdown Compliance:

9.3.1. Seal Injection Header Isolation can only be accomplished by closing FCV-062-093. FCV-062-093 is an air operated valve which is normally open and fails full open on loss of control air or electrical power. The valve has a pneumatic stop to ensure valve will always allow a minimum seal injection flow. For a fire on valve 2-FCV-62-93 (AV-104), or for a fire on panel 2-L-112 that contains the pneumatic stop for valve 2-FCV-62-93 (AV-005); TBC is available and provides RCP seal cooling for 75 minutes while an alternate injection path is established by manipulating' manual valves that are not located in either AV-005 or AV-104. During this time both charging pumps are stopped from the MCR and one is re-started from the MCR within 75 minutes.

9.3.2. No credit is taken for charging through the BIT flow path or normal charging flow path in the FSSD analysis.

10.0 PWROG Scenario 10: Primary Inventory Control - Spurious isolation of Makeup Tank (MUT) / Volume Control Tank (VCT) outlet valve(s) concurrent with spurious isolation of suction valves to the refueling water storage tank (RWST) results in damage to charging pump(s) when they are in normal operation (aligned to the MUT

/ VCT) 10.1.

Description:

Initial condition is charging pump running with suction from VCT.

Spurious isolation of suction from the MUT / VCT to running charging pump(s) when the charging pump(s) is aligned to the VCT AND Spurious isolation of (or failure to open) suction from the RWST to the running charging pump(s)

PageA - 10 E1-19

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 10.2. Notes:

" Scenario causes charging pump failure, challenging the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire.

" Can be a single spurious scenario if the RWST valves are normally closed motor operated valves (MOVs) and they are not interlocked with the VCT outlet valves.

" Note that valve interlocks may prevent scenario if they prevent VCT and RWST outlets from both being in closed position simultaneously.

10.3. WBN Unit 2 Safe Shutdown Compliance:

10.3.1. Spurious closure of the VCT isolation valves will automatically open the opposite train RWST suction valve. This automatic interlock has been evaluated in the FSSD analysis and is operable except for AV-106.

10.3.2. For AV-106, where the RWST suction valves are located, TBC is available and provides RCP seal cooling for 75 minutes. During this time both charging pumps are stopped from MCR, a RWST suction valve is manually opened within 75 minutes, and a charging pump is re-started to resume normal seal injection. This OMA was previously approved for Unit 1.

10.3.3. This SCENARIO is only addressing spurious valve closure resulting in CCP suction isolation. Gas ingestion into CCP's is addressed in section 12.3.

11.0 PWROG Scenario 11: Primary Inventory Control - Spurious isolation of two parallel refueling water storage tank (RWST) suction valves results in failure of running charging pump(s) when the charging pump(s) is aligned to the RWST 11.1.

Description:

Initial condition is charging pump running and drawing suction from the RWST.

Spurious isolation of two parallel RWST outlet valves.

11.2. Notes:

M Scenario causes loss of charging pump suction, causing subsequent pump cavitation and failure. This challenges the RCS Inventory Control Function.

11.3. WBN Unit 2 Safe Shutdown Compliance:

11.3.1. See Scenario 10 for discussion.

PageA - 1]

E1-20

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 11.3.2. For AV-106, fire on the RWST suction valves, both CCPs are available. A fire on the RWST valves (open per scenario initial condition) would not cause spurious closure.

12.0 PWROG Scenario 12: Primary Inventory Control - Spurious opening (or failure to close) of multiple series VCT outlet valves 12.1.

Description:

Spurious opening (or failure to close) of multiple in-series volume control tank (VCT) outlet valves 12.2. Notes:

" Scenario causes VCT drain down and hydrogen cover gas entrainment into charging pump suction, ultimately causing charging pump failure and challenging the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire. Note this scenario assumes that VCT makeup has been isolated (i.e., letdown isolated).

" Note that spurious starting of idle charging pump(s) may cause failure of additional pumps. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal.

" Potential resolution is comparison of charging pump suction header pressure provided by the RWST versus the VCT. Specifically, the RWST may provide sufficient pressure such that the check valve to the VCT remains seated and hydrogen is not entrained into the pump suction.

12.3. WBN Unit 2 Safe Shutdown Compliance:

12.3.1. For AV-111, fire on the VCT isolation valves (2-FCV-62-132-A, -133-B), or for AV-1 10, fire on the VCT vent valves (2-FCV-62-1228-A and 2-FCV 1229-B), one each of the VCT isolation and vent valves must be closed within 70 minutes. The closure of the VCT vent valves is to ensure the line going to the charging suction is water solid. One RWST suction valve is available to be opened from the main control room to provide suction to the CCP.

12.3.2. Manual closure of one of the VCT isolation valves is credited for some analysis volumes due to potential cable damage, but AV- 111 is the most time limiting. This OMA was previously approved for Unit 1.

PageA - 12 E1-21

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 13.0 PWROG Scenario 13: Primary Inventory Control - Failure to isolate / spurious opening of normal letdown active isolation valves concurrent with spurious isolation of component cooling water (CCW) to the letdown heat exchanger results in failure of charging pump(s) 13.1.

Description:

Letdown fails to isolate (see PWR Owners Group scenario #6)

AND Spurious isolation of component cooling water (CCW) to the letdown heat exchanger 13.2. Notes:

" Scenario causes elevated charging pump suction temperature and subsequent pump failure. Charging pump failure challenges the RCS Inventory Control Function. This is especially challenging if the credited charging pump is running at the time of the fire.

" Starting of additional charging pumps can cause failure of additional pumps.

Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal 13.3. WBN Unit 2 Safe Shutdown Compliance:

13.3.1. Normal Letdown is isolated by closure of series valves 2-FCV-62-69-A or 2-FCV-62-70-A from the control room. To ensure valve closure for areas where valve circuits could be fire damaged (AV-036, -037, -037C, -038, -

042(D,E,F,G), -045, -048, -056, -058, -067, -74, -115, and -117) main control room operator actions will isolate and vent the reactor building non-essential control air header (2-FCV-32-111-B and 2-XSV-32-112A1, A2, BI, B2) causing 2-FCV-62-69-A and 2-FCV-62-70-A to fail closed due to loss of control air.

13.3.2. In addition, 2-TCV-70-192 (CCS discharge from the non-regenerative letdown heat exchanger) is included in the FSSD analysis to ensure CCS flow to the letdown heat exchanger and prevent CCS suction heatup. For AV-038 either 2-TCV-70-192 is available to provide cooling to the heat exchanger or valves 2-FCV-62-69-A or 2-FCV-62-70-A can be closed promptly from the MCR to isolate letdown flow and avoid CCP suction heatup.

PageA - 13 E1-22

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 13a.0 PWROG Scenario 13a: Charging Pump Runout Note: PWROG Rev. 1 (6/5/09) Scenario No. 14 and 52 (partial) 13a. 1

Description:

Scenario causes charging pump runout and failure. Pump(s) must be running when RCS is at a depressurized condition. Unintentional RCS depressurization could occur due to spurious opening of pressurizer power operated relief valves (PORVs), for example. Charging pump(s) can spuriously start if they are not already running. Scenario may also require failure of other components (e.g.,

charging flow control valve, etc.).

13a.2 Notes:

Scenario causes charging pump runout and failure. Pump(s) must be running when RCS is at a depressurized condition. Unintentional RCS depressurization could occur due to spurious opening of pressurizer PORV(s),

for example. Charging pump(s) can spuriously start if they are not already running. Scenario may also require failure of other components (e.g., charging flow control valve, etc.).

13a.3 WBN Unit 2 Safe Shutdown Compliance:

13a.3.1 This scenario would cause CCP run out when the RCS is depressurized concurrent with fire induced failure of charging path flow control valves.

For WBN Unit 2 CCP run out cannot occur. because the FSSD analysis shows that the RCS will remain pressurized for a fire in any analysis volume. The normal charging path can be isolated by MCR operator actions. In AV- 117 (Annulus), a MCR operator action will close the pressurizer PORV block valve to prevent the pressurizer from flashing and depressurizing the RCS.

14.0 PWROG Scenario 14: Primary Inventory Control - Spurious opening of Containment sump motor operated isolation valves (including residual heat removal (RHR) and containment spray (CS) suction valves) results in gravity draining of refueling water (borated water) storage tank (RWST / BWST) inventory to the Containment sump Note: PWROG Rev. 1 (6/5/09) Scenario No. 15 14.1.

Description:

Spurious opening of multiple in-series containment sump valves PageA - 14 E1-23

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 14.2. Notes:

" Scenario causes a pumped RWST draindown via the containment spray ring. The RWST inventory ultimately settles to the containment sump. Since typical PFSS analyses do not credit alignment of the containment sump, the RWST inventory is assumed unavailable for RCS makeup, challenging the RCS Inventory Control Function.

" Note that either the RHR pumps or the containment spray pumps could cause this RWST pumped diversion to the spray ring.

" Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or inadvertent ESFAS signal.

14.3. WBN Unit 2 Safe Shutdown Compliance:

14.3.1. CS/RHR containment sump valves have been evaluated with the in-series CS/RHR Pump Suction valves to ensure RWST drain down does not occur.

The CS/RHR containment sump valves 2-FCV-72-44-A, B and 2-FCV-63-72-A, B are normally closed. Their control circuits have been modified such that fire initiated spurious opening is only a concern in the AV where the MCC is located. The CS/RHR containment sump) valves and the CS/RHR pump suction valves are powered from different MCCs to ensure availability of at least one valve. For AV-072 and AV-073, 2-FCV-63-73-B and 2-FCV-72-45-B could spuriously open, but 2-FCV-74-21-B and 2-FCV-72-21 -B closure isolate the sump via MCR operator action. For AV-074, 2-FCV-63-72-A and 2-FCV-72-44-A could spuriously open, but 2-FCV-74-3-A and 2-FCV-72-22-A are available to isolate the sump via MCR operator action.

15.0 PWROG Scenario 15: Primary Inventory Control - Spurious start of containment spray pump(s) concurrent with spurious opening of associated pump discharge valve results in transferring refueling water (borated water) storage tank (RWST / BWST) inventory to the Containment sump Note: PWROG Rev. 1 (6/5/09) Scenario No. 16 15.1.

Description:

Spurious starting of containment spray pump(s)

AND Spurious opening of the associate pump discharge valve(s) AND / OR containment spray header valve(s)

PageA - 15 El-24

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 15.2. Notes:

" Scenario causes a pumped RWST draindown via the containment spray ring. The RWST inventory ultimately settles to the containment sump. Since typical PFSS analyses do not credit alignment of the containment sump, the RWST inventory is assumed unavailable for RCS makeup, challenging the RCS Inventory Control Function.

" Note that either the RHR pumps or the containment spray pumps could cause this RWST pumped diversion to the spray ring.

" Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or inadvertent ESFAS signal.

15.3. WBN Unit 2 Safe Shutdown Compliance:

15.3.1. For all AVs except AV-042 and AV-057, either the containment spray pump trip circuits are available and the pumps can be tripped from the control room or the containment spray header isolation valves are closed which will prevent RWST drain-down via containment spray ring. For a fire inside the applicable pumps board room A (AV-042) and B (AV-057), the board supplies are tripped at their upstream boards feeder breakers (normal, auxiliary, maintenance) within 10 minutes and the emergency diesel generator (EDG) for that board is shutdown. The diesel kill switches on both 0-M-26 and 0-L-4 were cabled thru and selected from the associated board rooms and as such could not assure functionality. Modification DCN 58383 added a switch to L-1 1A and/or L-11 B that will select between main control room and auxiliary control room and the circuit is powered from a 125V Vital Battery Board feed whose cable is not be routed in the board room. Associated cables to the MCR and DG building have been routed outside the board room. This modification has been done for each of the four EDGs.

15.3.2. WBN Unit 1 identified this condition in PER 227839.

15a.0 SCENARIO 15a : Primary Inventory Control - Spurious start of residual heat removal (RHR / shutdown cooling (SDC) / low pressure safety injection (LPSI) pump(s) concurrent with spurious opening of containment spray header valve(s) results in transferring refueling water (borated water) storage tank (RWST /

BWST) inventory to the Containment sump. Note: PWOG Rev.1 (6/5/09) Scenario No. 16.

15a.1

Description:

Spurious starting of residual heat removal (RHR / shutdown cooling (SDC) / low pressure safety injection (LPSI) pump(s)

PageA - 16 E1-25

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 AND Spurious opening of the associate pump discharge valve(s)

AND / OR Containment spray header valve(s) 15a.2 Notes:

0 Scenario causes a pumped RWST draindown via the containment spray ring.

The RWST inventory ultimately settles to the containment sump. Since typical PFSS analyses do not credit alignment of the containment sump, the RWST inventory is assumed unavailable, for RCS makeup, challenging the RCS Inventory Control Function.

E Note that either the RHR pumps or the containment spray pumps could cause this RWST pumped diversion to the spray ring.

0 Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or inadvertent ESFAS signal.

15a.3 WBN Unit 2 Safe Shutdown Compliance:

15a.3.1 For all AVs except AV-042 and AV-057, either the RHR pumps are available and can be tripped from the MCR or the containment spray header isolation valves are closed which will prevent RWST drain down via the containment spray ring. For a fire inside pump board room A (AV-042) or B (AV-057), the board's supplies are tripped at their upstream board's feeder breakers (normal, auxiliary, maintenance) within 10 minutes and the emergency diesel generator is shutdown. The diesel kill switches on both 0-M-26 and O-L-4 were cabled thru and selected from the associated board rooms and as such could not assure functionality. Modification DCN 58383 added a switch to L-1 IA and/or L-11B that selects between main control room and auxiliary control room. The circuit is powered from a 125V Vital Battery Board feed whose cable is not routed in the board room. Associated cables to the MCR and DG building are routed outside the board room. This modification has been done for each of the four EDGs.

PageA - 17 E1-26

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 16.0 PWROG Scenario 16: Primary Inventory Control - Spurious opening of shutdown cooling suction line isolation valves (interfacing systems LOCA)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 17.

16. 1.

Description:

Spurious opening of multiple in-series RHR suction valves from the RCS 16.2. Notes:

" Scenario causes interfacing system LOCA, challenging the RCS Inventory Control Function.

" The valve operators are typically maintained de-energized during normal plant operation. If so, spurious operation of each valve would generally require three proper phase hot shorts.

" Note B&W plants have three series valves.

" From a Fire PRA perspective, this interfacing system LOCA scenario generally screens out if at least two series valves are normally de-energized.

• From a PFSS analysis perspective, this is classified as a high/low pressure interface and maintaining the valves de-energized generally complies with fire protection regulatory requirements.

16.3. WBN Unit 2 Safe Shutdown Compliance:

16.3.1. RHR suction valves (interface with RCS) 2-FCV-74-l-A and 2-FCV-74-9-B are in-parallel and in-series with valves 2-FCV-74-8-A and 2-FCV-74-2-B.

These valves are administratively locked in the closed position with the power removed during normal operation. The power will not be restored until the valves are required for RHR. The power cable for valves 2-FCV-74-1-A and 2-FCV-74-9-B are routed in separate dedicated conduit with no other cables such that spurious operation due to hot shorts is not possible.

17.0 PWROG Scenario 17: Primary Inventory Control - Spurious operation of pressurizer PORV(s) / PORV block valve(s) given that the associated PORV block valve is open Note: PWROG Rev. 1 (6/5/09) Scenario No. 18 17.1.

Description:

PageA - 18 E1-27

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Spurious opening of multiple (two or three) pressurizer PORVs with corresponding block valves in their normal, open position 17.2. Notes:

" Scenario causes loss of RCS inventory through the pressurizer PORVs, challenging the RCS Inventory Control Function. Scenario also causes pressurizer depressurization, challenging the RCS Pressure Control Function.

" Note some CE plants do not have any PORVs. Scenario would not be applicable to these plants.

" Note B&W plants only have one PORV. Scenario would not be applicable to these plants.

17.3. WBN Unit 2 Safe Shutdown Compliance:

17.3.1. PORVs 2-PCV-68-334-B and 2-PCV-68-340A-A are in series with Block valves 2-FCV-68-332-B and 2-FCV-68-333-A respectively. Cables for PORVs 2-PCV-68-334-B and 2-PCV-68-340A-A are routed in dedicated conduit, thus spurious operation is not possible. The PORVs and their associated Block valves are routed through primary containment penetrations which are separated such that a fire on one penetration will not spuriously open the PORV and prevent closure of the associated Block valve. In AV- 117 (Unit 2 annulus), a MCR operator action can close the PORV Block valve to prevent pressurizer from flashing and depressurizing the RCS.

18.0 PWROG Scenario 18: Primary Inventory Control - Spurious operation of pressurizer PORV(s) / PORV block valve(s) given that the associated PORV block valve is closed.

Note: PWROG Rev. 1 (6/5/09) Scenario No. 19 18.1.

Description:

Spurious opening of pressurizer PORV(s)

AND Spurious opening of pressurizer PORV block valve(s) after the block valve(s) has been closed PageA - 19 E1-28

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 18.2. Notes:

• Scenario causes loss of RCS inventory through the pressurizer PORV(s),

challenging the RCS Inventory Control Function. Scenario also causes pressurizer depressurization, challenging the RCS Pressure Control Function.

" In this scenario, operators may have closed the block valve either to 1) mitigate a fire-induced PORV LOCA or as a 2) pre-emptive action to prevent PORV LOCA from occurring. The first spurious operation is the PORV and the second is the block valve that has been closed.

" Note that the initial PORV LOCA, caused by spurious operation of PORV alone, is a single spurious since block valve is normally open.

18.3. WBN Unit 2 Safe Shutdown Compliance:

18.3.1. See Scenario 17.3.1 discussion.

19.0 PWROG Scenario 19: Primary Inventory Control - Spurious operation of reactor vessel head vent valves Note: PWROG Rev. 1 (6/5/09) Scenario No. 20 19.1.

Description:

Spurious opening of multiple reactor head vent valves Note: PWROG Rev. 1 (6/5/09) Scenario No. 20 19.2. Notes:

" Scenario causes loss of RCS inventory through open reactor head vent flowpath(s), challenging the RCS Inventory Control Function.

" Spurious operation of one head vent flowpath generally requires two spurious operations. Likewise, spurious operation of two head vent flowpaths generally requires four spurious operations.

" Note B&W plants only have one head vent flowpath. Hot leg vents should be also be evaluated for B&W plants.

" From a PRA perspective, note that this scenario may screen out due to the low RCS inventory loss rate through these flowpaths. The scenario may also screen if the head vent valves are normally de-energized.

PageA - 20 E1-29

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 From a PFSS analysis perspective, a head vent LOCA may be acceptable if the available makeup mass flow rate exceeds the LOCA mass flow rate.

19.3. WBN Unit 2 Safe Shutdown Compliance:

19.3.1. Reactor Upper Head Vent valves 2-FSV-68-394-A and 2-FSV-68-395-B are in parallel and in series with in-parallel valves 2-FSV-68-396-B and 2-FSV-68-397-A. These valves are all administratively closed (Modes 1 through 4) with control circuits disabled (switch 2-SW-68-394, -395 are in "off' position). In addition, the power cables for 2-FSV-68-396, -397 are routed in dedicated conduits with no energized circuits and the cables are protected at penetrations with radiant energy shields if needed). This will preclude these valves spuriously opening and causing loss of RCS inventory through open reactor head vent flow paths.

20.0 PWROG Scenario 20: Primary Inventory Control - Spurious operation of high head charging pumps challenges pressurizer safety valves Note: PWROG Rev. 1 (6/5/09) Scenario No. 21 20.1.

Description:

Spurious starting of additional high head charging pump(s)

AND Spurious opening of additional RCS makeup flow paths (i.e., charging injection) 20.2. Notes:

" Scenario causes increasing RCS inventory, leading to a water solid pressurizer and PORV or safety valve opening. This scenario challenges both RCS Inventory and RCS Pressure Control Functions.

" Similar to inadvertent SI.

" Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal.

" Also note that other failures (spurious or non-spurious) in the makeup control system could contribute to this scenario.

20.2.1. See Scenario 2 for BIT isolation.

PageA - 21 E1-30

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 20.3. WBN Unit 2 Safe Shutdown Compliance:

20.3.1. Either CCP 2-MTR-62-104-B or 2-MTR-62-108-A is credited in all fire areas for makeup and seal injection (cooling). The normal charging path and BIT injection path are closed to prevent pressurizer overfill. Spurious start of the non-credited charging pump is not explicitly modeled in the FSSD analysis.

However, operating both pumps would not have a detrimental effect on seal injection flow since this would result in a slight increase in both flow and pressure.

20.3.2. The normal charging path can be isolated by closing either 2-FCV-62-90-A or 2-FCV-62-91-B. At least one of these valves is available in all AVs except AV-099 where both valves are located. For AV-099, 2-FCV-62-89 (in-series with the injection header isolation valves but located in a different fire zone) will be closed from the MCR to isolate the Injection Header within 18 minutes.

20.3.3. The only fires that could cause the BIT outlet isolation valves 2-FCV-63-25-A or 2-FCV-63-26-B to open is a fire in their respective board rooms (AV-072, -

073, -074). The BIT path will be isolated by closing BIT inlet valves 2-FCV-63-39-A and 2-FCV-63-40-B from their respective board rooms. These valves are powered by the respective Train A and Train B 480 VAC Control

& Auxiliary Building Vent Boards located in AV-054 and AV-057. The allowable time requirement for these actions is 18 minutes.

20.3.4. In summary, two charging pumps running with only the seal injection flow path available would result in a slight increase in both flows and pressure; but would not challenge pump minimum flow.

21.0 PWROG Scenario 21: Primary Inventory Control - Spurious opening of active valves in primary sample lines Note: PWROG Rev. 1 (6/5/09) Scenario No. 22 21.1.

Description:

Spurious opening of RCS sample valve(s) (i.e., hot leg, pressurizer liquid space, pressurizer steam space, etc.)

AND Spurious opening of inside containment isolation valve AND PageA - 22 E1-31

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Spurious opening of outside containment isolation valve AND Spurious opening of downstream sample valve(s) 21.2. Notes:

" Scenario causes loss of reactor coolant through the primary sample system, challenging the RCS Inventory Control Function.

" From a PRA perspective, scenario will generally screen due to requirement of 3+

spurious operations and the small magnitude of the leak. Also note that existing thermal hydraulic evaluation of loss of coolant through head vents may bound loss of coolant via the primary sample system.

" Scenario can be screened from consideration if a manual isolation valve prevents the flow. Scenario may also screen if it is within a closed loop capable of withstanding expected pressure.

21.3. WBN Unit 2 Safe Shutdown Compliance:

21.3.1. The RCS Hot Leg Loops 1 and 3, Pressurizer Liquid, and Pressurizer Gas primary sample isolation valves are not included in FSSD analysis. Each sample line consists of three in-series normally closed valves (fail close on loss of power or control air) and a manual isolation valve that could be closed in the Hot Sample room. The sample inlet valves 2-SMV-43-1153 (RCS hot leg sample), 2-SMV-43-1167 (Pressurizer liquid sample) and 2-SMV-43-1180 (Pressurizer gas sample) are closed during normal operation and are only open when taking a sample (Ref. 7.5 through 7.8). The sample lines are closed loop design with the liquid samples return to the volume control tank and the gas sample to the gas analyzer vent header except when a local sample is taken in the hot sample room. Therefore, a failure would require spurious operation of three in-series normally closed valves and a break in the sample line. In addition, a manual isolation valve for each sample line can be closed in Hot Sample Room. Also, the sample lines are 3/8 inch OD, thus the magnitude of the leak is small and need not be considered.

22.0 PWROG Scenario 22: Decay Heat Removal - Spurious opening of atmospheric relief valve(s) upstream of the main steam isolation valves (MSIVs)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 23 PageA - 23 E1-32

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 22.1.

Description:

Spurious opening of atmospheric relief valve(s) (also sometimes called atmospheric dump valves) upstream of the main steam isolation valves (MSIVs) 22.2. Notes:

" Scenario causes RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

" Note that spurious operation of each individual steam dump valve may require multiple hot shorts.

" Note some B&W designs do not have MSIVs.

22.3. WBN Unit 2 Safe Shutdown Compliance:

22.3.1. The FSSD Analysis includes the ability to close all 4 steam generator power operated relief valves (PORVs) in the event of spurious opening. A Unit 2 design change has been incorporated to add a third "C" solenoid of opposite train from the existing "A & B" solenoid valves for each PORV. It is located in a separate fire zone and its cables are routed separately from the "A & B" solenoid valves for each PORV. For all AVs except the Control Building, a MCR operator action will close the PORV's via either the "B" or "C" solenoid valve. For Control Building fires resulting in MCR abandonment the PORV's are closed by pressure indicating controllers in the auxiliary control system panel.

23.0 PWROG Scenario 23: Decay Heat Removal - Failure to close or spurious opening of main steam isolation valves with concurrent failure of downstream steam relief valve(s) to close Note: PWROG Rev. 1 (6/5/09) Scenario No. 24 23.1.

Description:

Main steam isolation valve(s) (MSIV(s)) spuriously open OR fail to close AND Valve(s) for downstream steam load(s) (e.g., condenser steam dumps, turbine inlet valves, some atmospheric relief/ dump valves, etc.) spuriously open OR fail to close PageA - 24 E1-33

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 23.2. Notes:

" Scenario causes RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

" Note that spurious opening, or failure to close, each individual MSIV may require multiple hot shorts. In addition, re-opening an MSIV once it has been closed may be very difficult due to differential pressure across valve.

" Note some B&W designs do not have MSIVs.

23.3. WBN Unit 2 Safe Shutdown Compliance:

23.3.1. The MSIVs can be closed from the main control room except for AV-032, -

037, 037C.-038, -112, -114S, -115. As an alternate the steam load valves (MS Cool Down, MS Dump, Main FW Pump Turb HP Stop & Control, Main Turb Stop & Control, MSR Control & Low Power Bypass Control) (TBISOL) are available and can be closed by MCR operator action for these AV's. For Control Building fires resulting in MCR abandonment the MSIV can be operated from the auxiliary control room.

24.0 PWROG Scenario 24: Decay Heat Removal - Failure to close or spurious opening of main steam isolation Bypass valves with concurrent failure of downstream steam relief valve(s) to close Note: PWROG Rev. 1 (6/5/09) Scenario No. 25 24.1.

Description:

Main steam isolation valve(s) (MSIV(s)) bypass valves spuriously open OR fail to close AND Valve(s) for downstream steam load(s) (e.g., condenser steam dumps, turbine inlet valves, some atmospheric relief / dump valves, etc.) spuriously open OR fail to close 24.2. Notes:

• Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function PageA - 25 E1-34

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" Note, depending on size and number of bypass lines failing open, scenario may not cause overcooling.

" Note some B&W designs do not have MSIVs.

24.3. WBN Unit 2 Safe Shutdown Compliance:

24.3.1. Electric power is removed from the steam line warming valves (main steam isolation valve bypass valves) 2-FCV-1-147-A, -148-B, -149-A, -150-B by administrative control of local control switches (2-HS-1-147B, -148B, -149B,

-150B) during normal power operation to prevent spurious opening due to Appendix R fire. In addition, as an alternate the steam load valves (MS Cool Down, MS Dump, Main FW Pump Turbine HP Stop & Control, Main Turbine Stop & Control, MSR Control & Low Power Bypass Control) (TBISOL) are available for all auxiliary and reactor building fires and can be closed by MCR operator action.

25.0 PWROG Scenario 25: Decay Heat Removal - Spurious operation of main steam header drain valve(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 26

25. 1.

Description:

Spurious operation of main steam header drain valve(s) 25.2. Notes:

" Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

" Thermal hydraulic analysis may show that the drain valve flowpath is not large enough to be a problem.

25.3. WBN Unit 2 Safe Shutdown Compliance:

25.3.1. Not Applicable. WBN has no solenoid valves associated with the Main Steam Drains (in Aux. Bldg.), these are manual valves that are locked closed, and the DRVs and ISVs are not Appendix R equipment.

26.0 PWROG Scenario 26: Decay Heat Removal - Spurious operation / failure to operate of active steam supply valves fails the turbine driven auxiliary (emergency) feedwater pump (AFW / EFW)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 27 PageA - 26 E1-35

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 26.1.

Description:

Spurious isolation of redundant steam supply valves to turbine driven AFW pump.

26.2. Notes:

Scenario causes turbine driven AFW pump loss of function, which challenges the Decay Heat Removal Function.

26.3. WBN Unit 2 Safe Shutdown Compliance:

26.3.1. The turbine driven auxiliary feedwater pump (TDAFWP) is credited in AV-026, and AV-038. The steam supply valves are operational for AV-026 and AV-38. For AV-026, 2-FCV- 1-51-S requires local operator action within 20 minutes. For AV-038 cables have been relocated out of AV-038 to prevent spurious isolation of the steam supply to the TDAFWP.

26a PWROG Scenario 26a: Decay Heat Removal - Spurious operation / failure to isolate steam to non-credited TDAFW pump Note: PWROG Rev. 1 (6/5/09) Scenario No. 26 (partial) 26a. 1

Description:

Failure to isolate steam to non-credited TDAFW pump.

26a.2 Notes:

" Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function.

" Thermal hydraulic analysis may show that the drain valve flowpath is not large enough to be a problem..

26a.3 WBN Unit 2 Safe Shutdown Compliance:

26a.3.1 The motor driven auxiliary feedwater pumps (MDAFWPs) are credited in all AV's except AV-026 and AV-038.. For all other analysis volumes, at least one of the TDAFWP steam supply valves 2-FCV- 1-1 7-A, 2-FCV 18-B, or 2-FCV-1-52 can be closed from the MCR to isolate steam to the non-credited TDAFWP. Although the TDAFWP can be driven by steam from either SG1 or SG4 the FSSD analysis only credits SG1. Spurious opening of 2-FCV-1-16-B (SG4) is not of concern because the steam PageA - 27 E1-36

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 supply valves listed above are down stream of the SG selection valves (2-FCV-1-15-A & 2-FCV-1-16-B).

26a.3.2 The baseline FSSD Analysis did not specifically evaluate shutting the non-credited TDAFWP steam supply valves; however, as described above that capability does exist and is included in the FSSD analysis. This problem is identified in WBN Unit 1 PER 227804.

27.0 PWROG Scenario 27: Decay Heat Removal - Spurious closure of auxiliary (emergency) feedwater pump (AFW / EFW) active discharge valve(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 28 27.1.

Description:

Spurious closure of multiple valves in AFW pump discharge flow path(s) 27.2. Notes:

" Scenario isolates AFW flow to the steam generator(s), challenging the Decay Heat Removal Function.

" AFW flow isolation can occur due to several combinations of valve closures in the pump discharge and/or discharge cross-connect flow paths. Review P&IDs to identify specific valves.

27.3. WBN Unit 2 Safe Shutdown Compliance:

27.3.1. WBN auxiliary feedwater (AFW) system consists of 1 TDAFWP feeding all four SGs and 2 MDAFWPs feeding 2 SGs each. The TDAFWP is credited in AV-026 and AV-038. The MDAFWPs are credited for the remaining AVs. Local operator manual actions previously credited to operate the steam generator level control valves have been eliminated by EDCR 58210 which provided a nitrogen supply as a backup to the control air for the level control valves and the MDAFW pump back pressure control valves. These valves are now operable from the main control room. There are no other valves between the AFW pumps and the credited steam generators.

27.3.2. WBN Unit 1 identified the control air problem in PER 226948. DCN 58387 installed a nitrogen backup to the control air for the unit 1 steam generator level control valves just like unit 2.

27.3.3. With implementation of Unit 2 EDCR 58210 and Unit 1 DCN 58387 compliance strategy for both units is the same.

PageA - 28 El-37

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 28.0 PWROG Scenario 28: Decay Heat Removal - Spurious operation / failure to operate of active steam supply valves fails the turbine driven auxiliary (emergency) feedwater pump (AFW / EFW) concurrent with spurious isolation of the AFW / EFW discharge flow path Note: PWROG Rev. 1 (6/5/09) Scenario No. 29 28.1.

Description:

Spurious closure of steam supply valve(s) to turbine driven AFW / EFW pump AND Spurious isolation of AFW / EFW pump discharge flow path(s) 28.2. Notes:

Scenario isolates AFW flow to the steam generator(s) and causes turbine driven AFW pump loss of function, challenging the Decay Heat Removal Function.

28.3. WBN Unit 2 Safe Shutdown Compliance:

28.3.1. As discussed in scenarios 26 and 26a the TDAFW pump and associated FCVs and level control valves (LCVs) are credited in AV-026 and AV-038.

For all AVs except AV-026 and AV-038, the MDAFW pumps are available.

28.3.2. The TDAFWP and MDAFWPs LCV's are discussed in scenarios 26 and 26a.

28.3.3. WBN Unit 1 identified the loss of control air problem in PER 226948 and resolved it by DCN 58387.

28.3.4. Unit 1 and Unit 2 compliance strategies are the same.

29.0 PWROG Scenario 29: Decay Heat Removal - Auxiliary (emergency) feedwater (AFW

/ EFW) flow diversion to non-credited steam generator(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 30 29.1.

Description:

Combination of spurious valve operations in the AFW / EFW pump discharge flowpaths to the steam generators PageA - 29 E1-38

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 29.2. Notes:

" Scenario causes AFW flow diversion to a non-credited steam generator(s),

challenging the Decay Heat Removal Function. A steam generator may be "non-credited" by the FSSD analysis for a number of reasons including unavailability of instrumentation, failure of steam dumps on that loop, etc.

" Scenario may be a single spurious event in some cases.

" Also note that plants with unit-crossties may be subject to flow diversion to steam generators for another unit.

29.3. WBN Unit 2 Safe Shutdown Compliance:

29.3.1. The FSSD analysis ensured that two credited SGs had AFW flow either from the MDAFWP or TDAFWP.

29.3.2. As discussed in scenarios 26 and 26a, the TDAFWP is credited in AV-026 and AV-038. The steam supply valves are operational for these AVs. For AV-026, 2-FCV-1-51-S requires local operator action within 20 minutes. In addition, the MDAFWPs are stopped from the MCR, thus preventing flow diversion to the non-credited SGs. For AV-026 the pumps are stopped from the MCR. For AV-038 MDAFW pump A is stopped from the MCR and MDAFW pump B is stopped via the auxiliary control transfer and control switches on 6.9kv Shutdown board 2B (2-BD-21 1-B-B).

29.3.3. The MDAFWPs are credited with the remaining AVs. The non-credited MDAFWP can be stopped either in the MCR or in the associated shutdown board room. The non-credited TDAFWP can be stopped from the MCR by closing one of the TDAFWP steam supply valves 2-FCV-1-17-A, 2-FCV 18-B, or 2-FCV-1-52, thus preventing flow diversion to the non-credited SGs.

29.3.4. Pressure control valves (PCVs) 2-PCV-3-122 and 2-PCV-3-132 are modeled in the FSSD analysis and are designed to prevent MDAFW pump runout.

Unit 2 EDCR 58210 and Unit 1 DCN 58387 added a nitrogen supply to provide motive power to the MDAFW pump pressure control valves upon loss of control air. The valves (PCVs) can be controlled from the MCR.

30.0 PWROG Scenario 30: Decay Heat Removal - Auxiliary (emergency) feedwater (AFW

/ EFW) pump failure due to runout following spurious full opening of multiple AFW /

EFW flow control and / or isolation valves Note: PWROG Rev. 1 (6/5/09) Scenario No. 31 PageA - 30 El-39

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 30.1.

Description:

Spurious full opening of multiple EFW / AFW flow control and / or isolation valves 30.2. Notes:

" Scenario may cause AFW pump runout and failure, challenging the Decay Heat Removal Function.

" Note that this scenario may occur even without spurious operations if the fail-safe position of relevant valves is full open.

30.3. WBN Unit 2 Safe Shutdown Compliance:

30.3.1. The TDAFWP and MDAFWP mini-flow lines contain breakdown orifices.

30.3.2. For the TDAFWP the credited SGs LCVs are modulated from the MCR as discussed in 27.3.1 within 20 minutes. Speed control of the TDAFWP is included as part of the FSSD analysis. Local control of the TDAFWP (credited for AV-026 and AV-038.) prevents turbine overspeed.

30.3.3. For the MDAFWPs, the credited pump discharge PCV and SG LCVs are modulated from the MCR as discussed in section 27.3.1 within 20 minutes.

MDAFWP A is credited in AV-037 and AV-037C and its associated discharge PCV could fail open due to fire damage to the differential pressure transmitter cable. The PCV can still be modulated from the MCR via 2-PDIC-3-122A (manual mode) with the operator using the AFW flow indicators for SG 1 and 2.

31.0 PWROG Scenario 31: Decay Heat Removal - Spurious opening of condenser hotwell makeup control valve results in gravity draining condensate storage tank (CST) inventory to the hotwell Note: PWROG Rev. 1 (6/5/09) Scenario No. 32 31.1.

Description:

Spurious opening of valves between the Condensate Storage Tank (CST) and condenser hotwell.

31.2. Notes:

• Scenario causes inadvertent draining of CST inventory to the condenser. This CST inventory becomes unavailable as an AFW source, challenging the Decay Heat Removal Function.

PageA - 31 El-40

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" In some plants, this requires spurious operation of multiple valves. In other plants, this only requires spurious operation of one valve. And in other plants, this may occur due to loss of instrument air or a non-spurious valve failure (e.g.,

loss of air / power).

" Other CST draindown paths may exist. P&ID review required.

" Some plants may have a standpipe that prevents the CST from draining below a certain level.

31.3. WBN Unit 2 Safe Shutdown Compliance:

31.3.1. Valve 2-LCV-2-9 is not part of the FSSD analysis. The Hotwell makeup can not lower the CST level below the minimum volume required for supply to AFW (standpipe protected volume). The valve is normally shut and fails closed on loss of air and power. AFW pump suction can be aligned to the ERCW discharge header from the MCR within 120 minutes for all analysis volumes except AV-026, AV-069, AV-037, AV-038, and AV-072 which credit local operator manual actions for pump suction alignment. Per technical specification bases the CST standpipe protected volume is sufficient for more than 120 minutes. This OMA was previously approved for Unit 1.

32.0 PWROG Scenario 32: Decay Heat Removal - Spurious pump(s) operation / failure to trip pump(s) results in steam generator(s) overfill / overcooling Note: PWROG Rev. 1 (6/5/09) Scenario No. 33 32.1.

Description:

Scenario can occur due to various combinations of spurious AFW / EFW pump starts, spurious opening (or failure to close) of valves in AFW / EFW pump discharge flowpaths and spurious opening of main feedwater (MFW) isolation valves with MFW pump(s) running.

32.2. Notes:

" Scenario causes RCS over-cooling and/or steam generator overfill, both challenging the Decay Heat Removal Function. RCS over-cooling can cause RCS shrinkage and low pressurizer level. Steam generator overfill can affect operability of turbine-driven AFW pump.

" Note that the spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal.

PageA - 32 E1 -41

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 32.3. WBN Unit 2 Safe Shutdown Compliance:

32.3.1. This scenario was not specifically addressed in the baseline post fire safe shutdown analysis, but is included in the As-Designed FSSD analysis as described below.

32.3.2. As discussed in scenario 29, the TDAFWP is credited in AV-026 and AV-038. The steam supply valves are operational for these AVs. For AV-026, 2-FCV-1-5 1-S requires local operator action within 20 minutes. In addition, the MDAFWPs can be stopped, thus preventing steam generator overfill. For AV-038 MDAFW pump A is stopped from the MCR and MDAFW pump B is stopped from 6.9kv shutdown board B (2-BD-21 1-B-B) via the auxiliary control system (ACS) transfer and control switches.

32.3.3. The MDAFWPs are credited with the remaining AVs. The non-credited MDAFWP can be stopped either from the MCR or the associated 6.9KV shutdown board room. Steam flow to the non-credited TDAFWP can be isolated from the MCR by closing either of the TDAFWP steam supply valves 2-FCV-I-17-A, or 2-FCV-I-18-B, or 2-FCV-1-52 within 20 minutes.

32.3.4. As noted above, the credited MDAFWP or TDAFWP can be stopped within 20 minutes.

32.3.5. The MFW isolation and control valves for both the main and bypass lines are included in FSSD analysis. For Control Building fires resulting in MCR abandonment, MFW main line isolation is ensured by operator action at the ACS stations and bypass line isolation is ensured by operator action in Vital Battery Board rooms III and IV. The bypass feedwater line isolation and regulating valve control circuits have been modified to ensure main and bypass line isolation for all postulated fire locations.

32.3.6. WBN Unit 1 identified this condition in PER 227804.

33.0 PWROG Scenario 33: Decay Heat Removal - Spurious operation of steam generator blowdown valves with subsequent loss of steam generator(s) inventory Note: PWROG Rev. 1 (6/5/09) Scenario No. 34 33.1.

Description:

Spurious opening of, or failure to close, multiple series steam generator blowdown valves PageA - 33 E1-42

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 33.2. Notes:

" Scenario causes drain down of steam generator inventory through the blowdown system, challenging the Decay Heat Removal Function.

" The number of valves required to spuriously open varies by plant design.

" B&W plants generally do not have a steam generator blowdown system.

However, some B&W plants with replacement steam generators may have this system.

" Potential Resolution: Scenario may screen if available AFW mass flow rate exceeds steam generator inventory mass loss rate through blowdown.

33.3. WBN Unit 2 Safe Shutdown Compliance:

33.3.1. Each pair of Steam Generator Blowdown Containment Isolation Valves was evaluated in the FSSD analysis to ensure closure of at least one SGBD valve in each flow path. MCR operator actions will close the SGBD CIVs within 71 minutes. For Control Building fires resulting in MCR abandonment, the valve controls will be transferred to and closed from the Auxiliary Control System stations.

34.0 PWROG Scenario 34: Decay Heat Removal - Spurious opening of active valves in secondary sampling system(s) causes loss of steam generator(s) inventory Note: PWROG Rev. 1 (6/5/09) Scenario No. 35

34. .

Description:

Spurious opening of steam generator sample valve(s) inside containment AND Spurious opening of isolation valve(s) outside containment AND Spurious opening of downstream sample valve(s) 34.2. Notes:

• Scenario causes drain down of steam generator inventory through the sample system, challenging the Decay Heat Removal Function.

PageA - 34 E1-43

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" From a PRA perspective, scenario will generally screen due to requirement of 3+

spurious operations and the small magnitude of leak.

" Scenario can be screened from consideration if a manual isolation valve prevents the flow or if the system is closed loop capable of withstanding expected pressure.

" Scenario may also screen if available AFW mass flow rate exceeds steam generator inventory mass loss rate through the sample system.

" B&W plants sample directly from the steam generator (i.e., not through blowdown system).

34.3. WBN Unit 2 Safe Shutdown Compliance:

34.3.1. The Steam Generator Drum and Blowdown Sampling Isolation Valves are required to be closed to complete Secondary Side Isolation to ensure that the AFW system can maintain steam generator level and remove decay heat.

However, these valves were removed from the FSSD analysis since the steam generator blowdown sample flow (maximum of 0-6 gpm) is considered negligible and would not compromise the auxiliary feed water makeup flow.

35.0 PWROG Scenario 35: Primary Pressure Control - Spurious operation of active normal pressurizer spray valves concurrent with inability to trip operating reactor coolant pump(s) (RCPs) from the Control Room Note: PWROG Rev. 1 (6/5/09) Scenario No. 36 35.1.

Description:

Spurious opening of normal pressurizer spray valve(s)

AND Inability to trip / failure to trip, or spurious operation of, RCP(s)

AND Inoperability of pressurizer heater(s) 35.2. Notes:

• Scenario causes a RCS pressure transient, challenging the RCS Pressure Control Function. Typical PFSS analyses address this issue; PRAs often consider scenario negligible since there is no real threat of core uncovery.

PageA - 35 El-44

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2

" Potential candidate for generic analysis to evaluate various spray / heater combinations and show no adverse impact on safe shutdown capability.

" Note that spurious opening of failure to isolate pressurizer auxiliary spray would have similar consequence; however this is typically a single spurious scenario.

35.3. WBN Unit 2 Safe Shutdown Compliance:

35.3.1. The cables associated with the RCPs which can cause a spurious start of the pump or prevent the pump from being tripped are entirely contained inside the Control or Turbine Building. For all AVs requiring the RCP's to be tripped except Control Building, the RCPs are tripped from MCR panels. For Control Building fires resulting in MCR abandonment, the RCPs are tripped by control room switches, the RCP board normal and alternate supply breakers are also tripped at the Electrical Control Board (in the control room), and a local action at the 6.9KV RCP Board ensures the RCP's do not restart.

(Reference Scenario 4) 35.3.2. The PZR Spray valves 2-PCV-68-340B, and 2-PCV-68-340D could spuriously open in AV-025, -025C, -026, -037, -037C, -38, -115, and -117.

For each of these analysis volumes the RCPs are tripped via MCR operator action to prevent pressurizer spray.

35.3.3. The PZR Heaters are not credited to mitigate spurious opening of the pressurizer spray valves. However, as described in scenario 36, they could spuriously operate due to fire in the control building and in AV-032, AV-036, AV-037, AV-037C, AV-038, AV AV-042, AV-045, AV-048, AV-049, AV-050, AV-053, AV-057, and AV-1 17. They can be tripped from the MCR or from the 6.9kv shutdown boards (AV-042, AV-057) within 25 minutes. For fires in the 6.9KV shutdown board rooms (AV-042, AV-057) the board will be de-energized by tripping the supply breakers and the EDG.

35a.0 PWROG Scenario 35a: Primary Pressure Control - Spurious operation of auxiliary pressurizer spray valves with charging pumps in operations Note: PWROG Rev. 1 (6/5/09) Scenario No. 36 35a.1

Description:

Spurious opening of auxiliary pressurizer spray valve(s)

AND Inoperability of pressurizer heater(s).

PageA - 36 E1-45

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 35a.2 Notes:

" Scenario causes a RCS pressure transient, challenging the RCS Pressure Control Function. Typical PFSS analyses address this issue; PRAs often consider scenario negligible since there is no real threat of core uncovery.

" Potential candidate for generic analysis to evaluate various spray / heater combinations and show no adverse impact on safe shutdown capability.

" Note that spurious opening of failure to isolate pressurizer auxiliary spray would have similar consequence; however this is typically a single spurious scenario.

35a.3 WBN Unit 2 Safe Shutdown Compliance:

35a.3.1 The charging header isolation valves 2-FCV-62-90-A, B can be closed from MCR in all AVs except AV-099 to isolate the auxiliary pressurizer spray line. The auxiliary spray valve, 2-FCV-62-84-A, will not spuriously open due to fire damage in AV-099. Therefore the auxiliary pressurizer spray line can be isolated for all AVs and the pressurizer heaters are not needed to mitigate spurious operation of the auxiliary spray valve.

36.0 PWROG Scenario 36: Primary Pressure Control - Spurious operation of multiple pressurizer heater banks Note: PWROG Rev. 1 (6/5/09) Scenario No. 37 36.1.

Description:

Spurious operation of multiple pressurizer heaters AND Inoperability of pressurizer spray and auxiliary spray 36.2. Notes:

Scenario causes a RCS pressure transient, challenging the RCS Pressure Control Function. RCS pressure increase could cause PORV(s) and/or safety valve(s) to open.

36.3. WBN Unit 2 Safe Shutdown Compliance:

36.3.1. The PZR Heaters could spuriously operate due to fire damage in AV-032, -

036, -037, -037C, -038, -045, -048, -049, -050,-053, and -117. The heaters can be tripped from the MCR or the 6.9kv shutdown board rooms (AV-042 PageA - 3 7 El-46

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 and AV-057). For fires in the 6.9kv shutdown board rooms (AV-042, Av-057) the boards are de-energized by tripping all of the supply breakers (normal, alternate, maintenance) and the EDG. EDG kill switches are located on both MCR panel 0-M-26 and ACS panel O-L-4. Each EDG has a transfer switch located on 1,2-L-1 IA or 1,2-L-1 1B to select between MCR and ACS.

DCN 58383 relocated the transfer switches from the 6.9kv board rooms to the ACS transfer panels. The heaters can be disabled within 25 minutes.

36.3.2. WBN Unit 1 identified this condition in PER 227839.

37.0 PWROG Scenario 37: Reactivity Control - Inadvertent injection of undiluted makeup water / inadvertent injection of makeup water with very low boron concentration Note: PWROG Rev. 1 (6/5/09) Scenario No. 38 37.1.

Description:

Unborated water supply to the RCS can occur due to combinations of the following:

-Spurious start of reactor makeup pump(s) (supplies unborated water to the VCT),

-Spurious opening of valves between reactor makeup pump(s) and VCT,

-Spurious full opening of the reactor makeup flow control valve,

-Spurious closure of the boric acid flow control valve.

37.2. Notes:

0 Scenario decreases RCS boron concentration, potentially causing reactivity increase, and challenging the Reactivity Control Function.

0 The reactor makeup flow control valve would normally provide the setpoint flowrate instead of being fully open.

M Potential Solution: The maximum flow from the reactor makeup pump may be limited due to the plant specific design (e.g., installation of a flow orifice to limit the pump's maximum flow, boron dilution protection system, etc.).

0 Potential Solution: The reactivity increase may occur at a very slow rate, allowing operators sufficient time to mitigate.

37.3. WBN Unit 2 Safe Shutdown Compliance:

37.3.1. If the primary makeup pumps (2-MTR-81-3 and 2-MTR-81-7) spuriously start they can be tripped within 75 minutes from the main control room or from PageA - 38 El-47

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 their 480vac MCC to ensure the reactor coolant system boron concentration is maintained. Main control room trip capability is available for all fires except analysis volumes AV-005, AV-026, AV-038, and AV-057.

For AV-005, -026, -038, and -057 the 75 minute allowable time is conservative since the normal makeup path can be isolated from the MCR and the BIT outlet isolation valves (2-FCV-63-25-A and 2-FCV-63-26-B) are normally closed and their control circuits have been modified such that they cannot spuriously open except for a fire where their MCCs are located (AV-072, -073, & -074). Therefore a boron dilution event will not occur for these analysis volumes and the primary makeup pumps can be stopped at their MCCs in a timely manner.

For AV-072, -073, & -074 the normal makeup path can be isolated and the primary makeup pumps stopped from the MCR. Therefore, a boron dilution event will not occur for these analysis volumes. The BIT injection path can be isolated by closing the BIT inlet isolation valves (2-FCV-63-39-A and 2-FCV-63-40-B) from their MCCs within 18 minutes (reference Section 2.3).

For the remaining analysis volumes the normal makeup path can be isolated and the primary makeup pumps stopped from the MCR and the BIT outlet isolation valves remain closed. Therefore, boron dilution event will not occur.

38.0 PWROG Scenario 38: Reactivity Control - Fire prevents reactor trip Note: PWROG Rev. 1 (6/5/09) Scenario No. 39 38.1.

Description:

Fire damage to the reactor protection system (RPS) may prevent reactor trip. For example, hot shorts may prevent tripping of the RPS motor generator (MG) sets.

38.2. Notes:

" BWRs have identified scenarios where fire-induced hot shorts could prevent all control rod groups from inserting when required. Reference NRC Information Notice 2007-07.

" No cases at PWRs were identified by the survey results that supported this MSO list. However, each plant should consider performing a review to determine if scenario is plausible at their plant. Note that this review may have already been performed for the disposition of Information Notice 2007-07.

PageA - 39 E1-48

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 38.3. WBN Unit 2 Safe Shutdown Compliance:

38.3.1. The post fire safe shutdown analysis demonstrates that at least one train of the reactor trip switchgear can be tripped from the main control room for all AVs with the possible exception of AV- 115 where the reactor trip switchgear is located.

3 8.3.2. For AV- 115 reactor trip is confirmed by tripping the normal and alternate supplies to the control rod MG sets, 2-MTR-85-1A and 2-MTR-85-1B, at the 480vac unit boards in the turbine building within 15 minutes.

38.3.3. For Control Building fires resulting in MCR abandonment reactor trip is initiated and confirmed prior to evacuating the control room.

39.0 PWROG Scenario 39: Support Systems - Spurious loss of component cooling water (CCW) either as an entire system or to individual headers (including potential water hammer events)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 40 39.1.

Description:

CCW flow can be isolated via several combinations of spurious valve closures.

Pertinent valves include:

-CCW pump discharge valves,

-CCW pump crosstie valves,

-CCW heat exchanger inlet valves,

-CCW heat exchanger outlet valves,

-CCW heat exchanger crosstie valves,

-Etc.

39.2. Notes:

" Scenarios cause failure of CCW function to provide cooling to safe shutdown loads.

" Review P&IDs to identify relevant valve combinations.

PageA - 40 E1-49

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 39.3. WBN Unit 2 Safe Shutdown Compliance:

39.3.1. Spurious loss of Component Cooling System (CCS) is prevented by removing power from the motor operated valves that could isolate CCS flow or provide flow diversion. The CCS pump supply (inlet) and discharge are open with power removed. CCS heat exchanger inlet and outlet valves are open with power removed. Cross tie valves between units and heat exchangers are closed with power removed. Isolation valves in supply lines serving the charging pumps, safety injection pumps, RHR pumps and Containment Spray pumps are open with power removed.

39.3.2. The following individual load valves are powered and are evaluated for spurious operation in the post fire safe shutdown analysis:

CCS Heat Exchanger B (Unit 2 train A loads):

0-FCV-70-194-B, normally open supply to spent fuel pool heat exchanger B.

The valve control circuit has been modified such that only fire damage in the electrical board room (AV-072 or AV-073) could cause spurious closure.

Spurious valve closure would not prevent the CCS pump from providing the needed flow to safe shutdown equipment.

2-FCV-70-156-A, normally closed RHR heat exchanger 2A outlet valve. The valve control circuit has been modified to minimize spurious opening of the valve. For a fire in the electrical board room (AV-074) the valve could open and divert CCS flow through the RHR heat exchanger, but normally open valve 0-FCV-70-194-B can be closed from the MCR to ensure adequate CCS flow is available for the fire safe shutdown equipment.

2-FCV-70-87-B, 2-FCV-70-90-A, 2-FCV-70-133-A & 2-FCV-70-134-B, normally open thermal barrier cooling isolation valves. Thermal Barrier Cooling (TBC) is only credited for AV-005, AV-104, and AV-106 (See section 1.3). The valves will not spuriously close due to fire damage in these AVs except for AV-106 where the TBC differential flow transmitters are located. MCR operator actions are credited to bypass the differential flow signal and re-open the valves that may have spuriously closed.

CCS Heat Exchanger C (both units train B loads):

2-FCV-70-153-B, normally closed RHR heat exchanger 2B outlet valve.

Valve control circuit has been modified to prevent spurious opening except for a fire in the Unit 2 train B RMOV board room. If the valve spuriously opens the Unit 1 valve can be closed from the MCR.

1-FCV-70-153-B, RHR normally open heat exchanger 1B outlet valve.

PageA - 41 E1-50

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Valve control circuit has been modified to prevent spurious closing except for a fire in the Unit 1 Train B RMOV board room. If the valve spuriously closes, the Unit 2 valve can be opened from the MCR.

40.0 PWROG Scenario 40: Support Systems - Spurious loss of component cooling water (CCW) to individual critical loads (including potential water hammer events)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 41 40.1.

Description:

Spurious isolation of CCW cooling to individual redundant loads including lube oil coolers, RHR heat exchangers, etc.

40.2. Notes:

" Scenario isolates CCW cooling to credited loads causing safe shutdown equipment inoperability of credited trains.

" For example, a plant may have two redundant charging pumps. Each charging pump may have a lube oil system that is cooled by the corresponding train of CCW. If CCW flow to both lube oil coolers spuriously isolates, then both charging pumps would become inoperable.

" All credited CCW loads should be reviewed.

40.3. WBN Unit 2 Safe Shutdown Compliance:

40.3.1. See scenario 39.

41.0 PWROG Scenario 41: Support Systems - Component cooling water (CCW) flow diversion to non-credited loop(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 42 41.1.

Description:

Flow diversion can occur via several combinations of spurious valve operations in the CCW pump discharge and CCW loop crosstie flowpaths. Review P&IDs to identify relevant combinations.

41.2. Notes:

• Scenario causes CCW flow to be diverted to the non-credited loop. This ultimately prevents CCW cooling of credited safe shutdown loads.

PageA - 42 El-51

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Review P&IDs to identify relevant valve combinations.

41.3. WBN Unit 2 Safe Shutdown Compliance:

41.3.1. Spurious loss of Component Cooling System (CCS) is prevented by removing power from the motor operated valves that could isolate CCS flow or provide flow diversion. The CCS pump supply (inlet) and discharge are open with power removed. CCS heat exchanger inlet and outlet valves are open with power removed. Cross tie valves between units and heat exchangers are closed with power removed. Isolation valves in supply lines serving the charging pumps, safety injection pumps, RHR pumps and Containment Spray pumps are open with power removed.

41.3.2. The following individual load valves are powered and are evaluated for spurious operation in the safe shutdown analysis (See Scenario 39):

CCS Heat Exchanger B (Unit 2 train Aloads):

0-FCV-70-194-A, normally open supply to spent fuel pool heat exchanger B.

2-FCV-70-156-A, normally closed RHR heat exchanger 2A outlet valve.

2-FCV-70-133-A, 2-FCV-70-134-B, 2-FCV-70-87-B, & 2-FCV-70-90-A normally open thermal barrier cooling valves CCS Heat Exchanger C (both units train B loads):

2-FCV-70-153-B, normally closed RHR heat exchanger 2B outlet valve.

1-FCV-70-153-B, RHR normally open heat exchanger lB outlet valve.

41.3.3. CCS normally closed valves 1-FCV-70-143-A, B (Excess Letdown Heat Exchanger Containment Isolation Valves) are not included in FSSD analysis because the additional 232 gpm load would not impact the CCS pumps.

42.0 PWROG Scenario 42: Support Systems - Spurious loss of safety-related service water (SW) either as an entire system or to individual headers (including potential water hammer events)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 43 42.1.

Description:

Safety related service water (sometimes called, "essential," service water) flow to credited loads can be isolated via several combinations of spurious valve closures.

PageA - 43 E1-52

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Pertinent valves include:

-SW pump discharge valves,

-SW pump crosstie valves,

-SW heat exchanger inlet valves,

-SW heat exchanger outlet valves,

-SW heat exchanger crosstie valves, Review P&IDs to identify relevant combinations.

42.2. Notes:

" Scenario causes isolation of ESW, which can fail cooling to the CCW system and other safe shutdown components directly cooled by ESW (e.g., EDG cooling).

" All credited ESW loads should be reviewed for spurious isolation.

42.3. WBN Unit 2 Safe Shutdown Compliance:

42.3.1. ERCW pump availability is evaluated in the FSSD analysis to ensure that at least 2 of the 4 pumps of the credited train are available for all fire scenarios. Note: when ERCW header lB is supplying header 2A (1-FCV-67-458-A open) 3 train B pumps are credited to ensure adequate flow for both headers.

42.3.2. Pump discharge (strainer inlet) and header isolation valves are open with power removed to prevent spurious closure and ensure ERCW flowpath.

42.3.3. FCV-67-66-A and FCV-67-67-B, emergency diesel generator heat exchanger supply valves from ERCW headers, for both units are normally closed and open upon emergency diesel generator start. The valves, their control and power circuits, and power sources are included in the FSSD analysis to ensure ERCW flow to emergency diesel generators when needed.

42.3.4. FCV-67-127-A and FCV-67-128-B for both units are open with power removed to ensure ERCW flow to critical air conditioning equipment.

42.3.5. Potential flow diversion to Containment Spray heat exchangers due to spurious opening of in-series valves FCV-67-123-B and -124-B or FCV 125-A and -126-A for both units is evaluated in FSSD analysis.

PageA - 44 El-53

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 42.3.6. Supply and discharge valves for each of the three CCS heat exchangers are evaluated in the FSSD analysis to ensure ERCW flow is available for the credited safe shutdown components. Valve control circuits are modified to minimize spurious operation potential.

43.0 PWROG Scenario 43: Support Systems - Spurious loss of safety-related service water (SW) to individual critical loads (including potential water hammer events)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 44 43.1.

Description:

Spurious isolation of safety related service water (SW) cooling to redundant loads including component cooling water (CCW) heat exchangers and emergency diesel generator cooling (EDG) cooling.

43.2. Notes:

" Scenario isolates ESW cooling to redundant loads causing safe shutdown equipment failure on redundant trains.

" For example, redundant EDGs may be cooled by ESW. If ESW flow to both EDGs spuriously isolates, then both EDGs could fail.

" All credited ESW loads should be reviewed.

43.3. WBN Unit 2 Safe Shutdown Compliance:

43.3.1. See Scenario 42.

44.0 PWROG Scenario 44: Support Systems - Safety related service water (SW) flow diversion to non-credited loops / loads Note: PWROG Rev. 1 (6/5/09) Scenario No. 45 44.1.

Description:

Flow diversion can occur via several combinations of spurious valve operations in the service water pump discharge and loop crosstie flowpaths. Review P&IDs to identify relevant combinations.

44.2. Notes:

• Scenario causes ESW flow to be diverted to a non-credited loop or system. This ultimately prevents ESW cooling of credited loads.

PageA - 45 E1-54

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 N Review P&IDs to identify relevant valve combinations.

44.3. WBN Unit 2 Safe Shutdown Compliance:

44.3.1. The only significant potential flow diversion are the Containment Spray heat exchangers each of which is isolated by 2 normally closed motor operated valves. These valves are included in the FSSD analysis and evaluated for spurious opening. If both valves for a heat exchanger could spuriously open additional ERCW flow capacity is ensured. The Unit 2 valves are modified to minimize spurious opening potential.

45.0 PWROG Scenario 45: Support Systems - Non-critical components inadvertently loaded onto credited emergency diesel generator(s) (EDGs)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 46 45.1.

Description:

Additional components load onto credited diesel generator 45.2. Notes:

" Scenario causes diesel generator overloading and failure.

" Scenario very site specific. Interlocks may prevent this from occurring.

45.3. WBN Unit 2 Safe Shutdown Compliance:

45.3.1. See scenario 46.

46.0 PWROG Scenario 46: Support Systems - Emergency diesel generator(s) (EDGs) overloading Note: PWROG Rev. 1 (6/5/09) Scenario No. 47 46.1.

Description:

Emergency diesel generator (EDG) overloading 46.2. Notes:

" Scenarios cause diesel generator overloading and failure.

" Scenarios very site specific. Interlocks may prevent these from occurring.

PageA - 46 E1-55

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 In addition to Scenario 45, overloading may also occur if proper load sequencing is bypassed via hot shorts, causing simultaneous loading of multiple components onto the EDG.

46.3. WBN Unit 2 Safe Shutdown Compliance:

46.3.1 An investigation was initiated to determine the effects of MSOs on each EDG with respect to overloading the EDG. This was accomplished by revising calculation WBPEVAR9503001, Appendix R - Diesel Generator Load Study to change the methodology from an evaluation of a worst-case steady state loading applied to EDG lA-A to an evaluation of each EDG during each Appendix R fire that credits the EDG. All cables that could cause any load to spuriously connect to its EDG or prevent required load shedding was included in the Appendix R Analysis. Failure of any of these cables resulted in the associated loading addition being evaluated in WBPEVAR9503001. This evaluation considers both steady state loading and load pickup capability. Steady state loading is evaluated for the short time rating (<2 hours) and at the continuous rating (>2 hours) of the EDG.

Load pickup capability is evaluated for the worst case loading for each EDG for three conditions: (1) Maximum starting plus running (transient) loading, 0 to 180 sec, compared to cold engine capability, (2) Maximum starting plus running (transient) loading, 180 sec to end, compared to hot engine capability, and (3) Maximum step load increase (excitation), 0 sec to end, compared to generator step load capability. Spurious loading that resulted in an overloaded EDG resulted in cable reroutes that were necessary to bring the EDG within its ratings.

Results for each EDG requiring reroutes are as follows:

2A-A For fire in 737-A7, 737-A8, 737-AlAN, 737-A1BN and 737-A1CN (AV-37C)

Relocating cables 2PL5133A and 2PL5145 out of these fire zones was accomplished by PIC 56638 as part of DCN 54912.

1B-B For fire in 772-A2A1, 772-A2A2 and 772-A2A3 (AV-059)

Relocating cables 1B27G, 1B32G, 1PL5396B and 1PL5398B out of these fire zones was accomplished by DCN 58383 which also changed their cable numbers to 1B20G, 1B21G, 1PLl191B, and IPL1 192B.

46.3.2 Overall long term resolution has been accomplished by including in the FSSD analysis all cables that could spuriously start or prevent removing loads to/from an EDG. These cables are analyzed with the specific EDG for which they are associated as described in 46.3.1 above.

PageA - 47 E1-56

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 46.3.3 WBN Unit 1 identified this condition in PER 227839.

47.0 PWROG Scenario 47: Support Systems - Spurious start of an emergency diesel generator(s) (EDGs) with concurrent failure to provide required cooling Note: PWROG Rev. 1 (6/5/09) Scenario No. 48 47.1.

Description:

Fire spuriously starts an emergency diesel generator(s)

AND MOVs providing required cooling water to the emergency diesel generator(s) either fail to open or spuriously close 47.2. Notes:

The fire causes startup of the Emergency Diesel Generator and spurious isolation of ESW cooling (See Scenarios 43 & 45). Running the Emergency Diesel Generator with a loss of cooling water could trip and/or damage the diesel on high temperature.

47.3. WBN Unit 2 Safe Shutdown Compliance:

47.3.1. The ERCW valves supplying the EDGs (1/2-FCV-67-66-A and 1/2-FCV 67-B) are normally closed and automatically open upon EDG start. The valves, their power supplies, and associated cables are included in the FSSD analysis to ensure that cooling water is available for each fire zone where the EDGs are credited.

48.0 PWROG Scenario 48: Support Systems - Non-synchronous paralleling of emergency diesel generator(s) (EDGs) with on-site and off-site sources through spurious circuit breaker operations Note: PWROG Rev. 1 (6/5/09) Scenario No. 49 48.1.

Description:

Non-synchronous paralleling of emergency diesel generator(s) (EDGs) with on-site and off-site sources through spurious circuit breaker operations.

PageA - 48 E1-57

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 48.2. Notes:

Non-synchronous paralleling of EDG with on-site and off-site sources through spurious breaker operations 48.3. WBN Unit 2 Safe Shutdown Compliance:

48.3.1. EDGs cannot be connected to other on-site EDGs except through multiple spurious offsite feeder breaker closures. The EDG breaker cannot be closed spuriously to parallel a running DG with offsite power for the credited boards for all fires zones. Cables associated with the EDG breaker CLOSE circuit that could spuriously close the breaker are routed outside all fires zones that credit the associated board. Similarly, neither the normal feeder breaker, alternate feeder breaker, nor maintenance feeder breaker can be closed spuriously to connect offsite power to a board that is receiving power from a running EDG. Cables associated with these offsite breakers' CLOSE circuits that could spuriously close the breaker are routed outside all fire zones that credit the associated board. All of the 6.9kV shutdown board feeder breaker control circuit cables that could spuriously close a board feeder breaker are modeled in the FSSD analysis.

The following specific cables, wires, fire zones, and Analysis Volumes are used to demonstrate the above statements for board 1-BD-21 1-A-A; the other boards are similar:

To spuriously close Emergency Feeder Breaker (1912)(Onsite source) with a running EDG while operating on Offsite Power, wire SA6C3 in cable 1PP475A must experience a hot short (positive battery) AND wire SA6GA in cables 1PP478A OR PP1715A OR wire SA6GA1 in cable 1PP474A must experience a hot short (negative battery). The latter energizes permissive relay AX allowing the positive short on SA6C3 to close the breaker. Cable 1PP475A is located in fire zones 737-AlA, 757-A2, and control building. The control building is eliminated by the operation of the Norm/Auxiliary transfer switch 1-XS-57-46 in the event of a control building fire resulting in MCR abandonment. Other affected analysis volumes are AV-036, AV-042, AV-042D AV-042E, AV-042F, and AV-042G. None of these analysis volumes takes credit for board 1-BD-211-A-A. Cable damage on 1PP478A, PP1715A and 1PP474A alone cannot spuriously close the EDG breaker.

To spuriously close the Normal Feeder Breaker (1713)(Offsite source) while operating on Onsite Power, wire SA16T6 (energizes relay R716) and wire SA16C5 (completes close circuit through R716 contact) must experience a hot short (positive battery). Both wires are in cable 1PP462A. Cable 1PP463A contains wire SA16C4 which could complete the close circuit if R716 were energized by hot short on cable PageA - 49 E1-58

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 1PP462A wire SA16T6. However, cable 1PP463A is routed entirely in the control building and is eliminated by Norm/Auxiliary transfer switch 1-XS-57-41 in the event of a control building fire resulting in MCR abandonment. Cable 1PP462A is located in fire zones 737-AlA, 757-A2 and control building. The control building is eliminated by the operation of the Norm/Auxiliary transfer switch 1-XS-57-41 in the event of a control building fire resulting in MCR abandonment. Other affected analysis volumes are AV-036, AV-042, AV-042D AV-042E, AV-042F, and AV-042G. None of these analysis volumes takes credit for board 1-BD-21 1-A-A.

To spuriously close the Alternate Feeder Breaker (1932)(Offsite source) while operating on Onsite Power, wire SA1T6 (energizes relay R932) and wire SA1C5 (completes close circuit through R932 contact) must experience a hot short (positive battery). Both wires are in cable 1PP440A. Cable 1PP442A contains wire SA1C4 which could complete the close circuit if R932 were energized by hot short on cable 1PP440A wire SALT6. However, cable 1PP442A is routed entirely in the control building and is eliminated by Norm/Auxiliary transfer switch 1-XS 97 in the event of a control building fire resulting in MCR abandonment.

Cable 1PP440A is located in fire zones 737-AlA, 757-A2 and control building. The control building is eliminated by the operation of the Norm/Auxiliary transfer switch 1-XS-57-97 in the event of a control building fire resulting in MCR abandonment. Other affected analysis volumes are AV-036, AV-042, AV-042D AV-042E, AV-042F, and AV-042G. None of these analysis volumes takes credit for board 1-BD-21 1-A-A.

To spuriously close the Maintenance Feeder Breaker (1718)(Offsite source) while operating on Onsite Power, wire SA 11T6 (energizes relay R718) and wire SA 11C4 (completes close circuit through R718 contact) must experience a hot short (positive battery). Both wires are in cable 1PP450A. Cable 1PP451A contains wire SAlC3 which could complete the close circuit if R718 were energized by hot short on cable 1PP450A wire SA 11T6. However, cable 1PP451A is routed entirely in the control building and is eliminated by Norm/Auxiliary transfer switch 1-XS 44 in the event of a control building fire resulting in MCR abandonment.

Cable 1PP450A is located in fire zones 737-AlA, 757-A2 and control building. The control building is eliminated by the operation of the Norm/Auxiliary transfer switch 1-XS-57-44 in the event of a control building fire resulting in MCR abandonment. Other affected analysis volumes are AV-036, AV-042, AV-042D AV-042E, AV-042F, and AV-042G. None of these analysis volumes takes credit for board 1-BD-21 1-A-A.

PageA - 50 E1-59

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 48a.0 PWROG Scenario 48a: Emergency Power - Inadvertent paralleling of normal and alternate offsite power sources through the onsite busses and breakers Note: PWROG Rev. 1 (6/3/09) Scenario 49.1 48a. 1

Description:

Similar to non-synchronous paralleling-inadvertent crosstie breaker operation between opposite divisions or non-synchronous paralleling-inadvertent cross tying the offsite power sources through the onsite busses and breakers, with synchronous faults. Spurious closure on alt feeder and failure of normal to open (i.e. parallel supply) + circuit fault could result in short circuit currents above withstand/interrupt ratings.

48a.2 Notes:

May apply to Electrical Boards with normal and alternate feeder breakers without physical mechanical interlocks.

48a.3 WBN Unit 2 Safe Shutdown Compliance:

48a.3.1 Normal and alternate offsite power sources cannot be connected in parallel through any onsite busses and breakers by multiple spurious operations.

Each 6.9 kV shutdown board can be connected to an offsite source through a Normal, Alternate, or Maintenance feeder breaker. Each of these feeder breakers close circuits are interlocked with the other two breakers through series 52b switches (52b is closed when its associated breaker is open). This arrangement will only allow a close signal (close coil energized) for a given breaker if both of the other breakers are open. (Anticipatory trip fast transfer scheme is not utilized on these boards.) All wiring for these interlocks is contained within the board, thus not subject to fire damage external to the board. All other busses can only be fed from either one offsite source or through mechanically interlocked breakers.

49.0 PWROG Scenario 49: Other Scenarios - Spurious isolation of various combinations of pump(s) suction valve(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 50 49.1.

Description:

Note: Spurious operation of powered (i.e., MOVs, AOVs, SOVs) pump(s) suction valve(s) is most likely already included in the PRA logic and the safe shutdown cable analysis.

PageA - 51 E1-60

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 49.2. Notes:

" Suction flow paths for all credited pumps should be reviewed for MSO scenarios causing loss of suction and pump failure. An example of a pump suction MSO was previously identified in which both the VCT outlet valve(s) and RWST outlet valve(s) spuriously close.

" Another example involves pump suction cross-connect valves. Three pumps may be supplied from a common suction header that includes several cross connect valves. If two valves spuriously isolate, the pump drawing suction from the common header between the two isolated valves can lose suction and fail.

" The spurious operation of idle pumps after suction has been spuriously isolated should also be considered. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal.

49.3. WBN Unit 2 Safe Shutdown Compliance:

49.3.1. The primary pumps including associated suction and cross-connect valves that should be evaluated are the CCPs, CCS Pumps, and TDAFW/MDAFW Pumps, and ERCW Pumps. The CCPs are addressed in scenarios 10 (1, 3, 11, 12); the CCS pumps are addressed in scenarios 39, 42; the ERCW Pumps are addressed in scenario 42, and TDAFW/MDAFW are addressed in scenarios 26, 28, 31.

50.0 PWROG Scenario 50: Other Scenarios - Spurious isolation of various combinations of pump(s) discharge valve(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 51 and PWROG Rev. 3 (10/11) Scenario No. 53 50.1.

Description:

Spurious isolation of pump discharge flow OR Spurious operation of various valves causing flow diversion Note: Spurious operation of powered (i.e., MOVs, AOVs, SOVs) pump(s) discharge valve(s) are most likely already included in the PRA logic and the safe shutdown cable analysis.

PageA - 52 E1-61

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 50.2. Notes:

" Scenario causes pump operation at shutoff head and subsequent inoperability. All credited pumps should be reviewed for this scenario.

" Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause inoperability of additional pumps.

Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESFAS signal.

" All credited flow paths should be reviewed for MSO scenarios that can divert flow away from desired location. An example is AFW pump flow diversion through the recirculation flow path back to the emergency Feed water storage tank failing the AFW makeup to steam generator function.

50.3. WBN Unit 2 Safe Shutdown Compliance:

50.3.1. The primary pumps including associated discharge and cross-connect valves that should be evaluated are the CCPs, CCS Pumps, ERCW Pumps, and TDAFW/MDAFW Pumps. The CCPs are addressed in scenario 9; the CCS pumps are addressed in scenario 39; the ERCW Pumps are addressed in scenario 42, and TDAFW/MDAFW are addressed in scenario 27.

50.3.2. The primary pumps associated with valves causing flow diversion that should be evaluated are the CCPs, CCS pumps, ERCW pumps and TDAFW/MDAFW pumps. The CCPs are addressed in scenarios 2, 35a; the CCS pumps are addressed in scenario 41; the ERCW pumps are addressed in scenario 44; and the TDAFW/MDAFW pumps are addressed in scenarios 29, 31.

51.0 PWROG Scenario 51: Other Scenarios - Pump failure due to spurious closure of discharge valve(s) concurrent with failure to open or spurious closure of required minimum recirculation flow path(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 51 and PWROG Rev.3 (10/11) Scenario 52.

51.1.

Description:

Spurious isolation of pump discharge flow path AND Spurious isolation of recirculation valve(s)

Page A - 53 El-62

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 Spurious operation of various valves causing flow diversion 51.2. Notes:

a Scenario causes pump failure. All credited pumps should be reviewed for this scenario.

0 Operation at shutoff head can occur, for example, if pump discharge flow spuriously isolates with the recirculation valves closed. Run-out can occur, for example, if the discharge header is at reduced pressure conditions.

M Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause failure of additional pumps.

Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS signal.

51.3. WBN Unit 2 Safe Shutdown Compliance:

51.3.1. The primary pumps including associated discharge and recirculation valves that should be evaluated are the CCPs, CCS Pumps, ERCW pumps, and TDAFW/MDAFW Pumps. The discharge valves for CCPs are addressed in scenario 9; CCS pump discharge valves are addressed in scenario 39; the ERCW pump discharge valves are addressed in scenario 42; and the auxiliary feedwater pump discharge valves are addressed in scenario 27. The CCPs recirculation valves 1-FCV-62-98-A, B are Locked Open. The CCS pumps and the TDAFW/MDAFW recirculation lines contain only normally open manual valves.

51.3.2. RHR pump spurious start concurrent with closure of the recirculation valves is evaluated in the FSSD analysis.

51.3.3. CCP run out is addressed in scenario 13a and MDAFW pump run out is addressed is scenario 30.

51a.0 PWROG Scenario xx: Other Scenarios - Spurious start of high head charging pump(s) concurrent with closing of required minimum flow path valve(s) results in failure of the pump(s) 51a.1

Description:

High head charging pump(s) spuriously starts AND Recirculation flow path valve(s) fails to open OR transfers closed PageA - 54 El-63

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 51a.2 Notes:

This scenario results in failure of the high head charging pump(s).

5 1a.3 WBN Unit 2 Safe Shutdown Compliance:

51 a.3.1 The centrifugal charging pump recirculation valves, 2-FCV-62-98-A and B are open with power removed.

51a.3.2 Overheating of the charging pump suction due to loss of component cooling system (CCS) flow to the seal water return heat exchanger has been addressed in the FSSD analysis.

51a.3.3 Loss of suction to the CCP has been reviewed and determined that one CCP will always survive considering multiple spurious of either VCT suction valve , loss of either RWST suction valves, loss of or multiple spurious start of CCPs, spurious SI, and loss of CCP HVAC. For AV-106, fire on the RWST suction valves, VCT must be isolated and RWST established by opening either suction valve within 70 minutes.

51b.0 PWROG Scenario 51b: Other Scenarios - Spurious start of high pressure safety injection pump(s) concurrent with closing of required minimum flow path valve(s) results in failure of the pump(s) 51b.1

Description:

High pressure safety injection pump(s) spuriously starts AND Recirculation flow path valve(s) fails to open OR transfers closed 51b.2 Notes:

This scenario results in failure of the high head injection pump(s).

5 lb.3 WBN Unit 2 Safe Shutdown Compliance:

51b.3.1 The safety injection pumps are intermediate head injection pumps and are not actively credited in the FSSD analysis. The FSSD analysis ensures that the pumps are stopped prior to decreasing RCS pressure below the SI pump injection pressure (60 minutes).

Page A - 55 El-64

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 51c.0 PWROG Scenario 51c: Other Scenarios - Spurious operation of residual heat removal (RHR) shutdown cooling (SDC) / low pressure safety injection pump(s) concurrent with failure of associated minimum flow path valve(s) to open results in failure of the pump(s) 51c.1

Description:

Residual heat removal (RHR) / shutdown cooling (SDC) / low pressure safety injection pump(s) spuriously starts AND Recirculation flow path valve(s) fails to open OR transfers closed 51c.2 Notes:

None 51c.3 WBN Unit 2 Safe Shutdown Compliance:

51c.3.1 RHR pump spurious start concurrent with closure of the recirculation valves is evaluated in the FSSD analysis.

52.0 PWROG Scenario 52: Other Scenarios - Loss of credited heating, ventilation and air conditioning (HVAC) to component(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 54 52.1.

Description:

Spurious isolation of HVAC to credited loads 52.2. Notes:

" Perform review to identify spurious failures that could cause isolation of HVAC to credited loads. Credited loads may include pump rooms, switchgear rooms and rooms containing solid state control systems. Examples of spurious failures include spurious damper isolation and spurious isolation of cooling flow to chillers.

" One should expect to find disconnects between PRA and safe shutdown success criteria with respect to HVAC requirements. While one might expect to find instances where the safe shutdown analysis requires HVAC and the PRA does not (i.e., where the safe shutdown analysis is more conservative),

we have encountered at least one instance where the opposite was true (i.e.,

PageA - 56 E1-65

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 the PRA was more conservative and required pump room HVAC that the safe shutdown analysis did not require).

52.3. WBN Unit 2 Safe Shutdown Compliance:

52.3.1. The HVAC systems (including ERCW supply, temperature control valves and dampers) listed below are included in the FSSD analysis to ensure adequate cooling for credited equipment for each fire scenario:

Lower Compartment coolers Control Rod Drive Mechanism coolers Main Control Room coolers RHR Pump Room coolers Centrifugal Charging Pump Room coolers TDAFW Pump Room Exhaust Fan CCS & MDAFW area coolers Diesel Generator Building exhaust fans Shutdown Board Transformer Rm exhaust fans 53.0 PWROG Scenario 53: Other Scenarios - Spurious motor operated valve (MOV) operation concurrent with fire-induced failure of torque and / or limit switches Note: PWROG Rev. 1 (6/5/09) Scenario No. 55 53.1.

Description:

Spurious motor-operated valve operation AND Wire-to-wire short(s) bypass torque and limit switches 53.2. Notes:

• General scenario is that fire damage to motor-operated valve circuitry causes spurious operation. If the same fire causes wire-to-wire short(s) such that the valve torque and limit switches are bypassed, then the valve motor may stall at the end of the valve cycle. This can cause excess current in the valve motor windings PageA - 57 El-66

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 as well as valve mechanical damage. This mechanical damage may be sufficient to prevent manual operation of the valve.

E This scenario only applies to motor-operated valves.

N This generic issue may have already been addressed during disposition of NRC Information Notice 92-18. This disposition should be reviewed in the context of multiple spurious operations and multiple hot shorts.

53.3. WBN Unit 2 Safe Shutdown Compliance:

53.3.1. WBN's standard MOV control circuit design provides full compliance with IN 92-18. Damage from a control building fire cannot bypass the valve end of travel limit/torque switch.

53.3.2. For all MOV's required to be manually operated to achieve cold shutdown following a fire outside the control building, a review has been performed to ensure that, if fire damage could cause spurious valve operation and the limit/torque switch could be bypassed, the MOV motor stall torque could not damage the valve operator such that the valve could not be manually operated. Modifications have been incorporated as needed to prevent valve stalling and ensure that the valve can be manually operated.

53.3.3. WBN Unit 1 identified this condition in PER 227808.

54.0 PWROG Scenario 54: Other Scenarios - Spurious engineered safeguards actuation signal (ESFAS)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 56 54.1.

Description:

Fire induced spurious ESFAS signal 54.2. Notes:

Fire-induced spurious ESFAS signals (e.g., safety injection, containment isolation, etc), combined with other fire-induced failures, can adversely affect safe shutdown capability. An example of a fire-induced ESFAS signal is a fire causing open circuits on 2/3 main steam pressure instruments on one loop resulting in a spurious safety injection signal. ESFAS signals can result from open circuits, shorts to ground, and/or hot shorts. Fire-induced failure of instrument inverters may also cause spurious ESFAS signals. The plant should perform a systematic review to assess the potential for fire-induced spurious ESFAS to adversely affect safe shutdown capability. Some PageA - 58 E1-67

TVA Unit 2 Multiple Spurious Operation Evaluation R- 1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 examples are shown in PWR Owners Group scenarios 54a, 54b, 54c, 54d and 54e.

54.3. WBN Unit 2 Safe Shutdown Compliance:

54.3.1. FSSD design changes have been incorporated to provide adequate physical separation between redundant sensing instruments and cables such that fire damage cannot cause a spurious ESFAS except for a control building fire. The control building is an alternative shutdown area. For control building fires that could cause a spurious ESFAS the control room will be abandoned and safe shutdown achieved from the auxiliary control system stations.

54a.0 PWROG Scenario 54a: Other Scenarios - Spurious start of makeup / injection pump(s) due to a spurious safety injection signal with concurrent spurious isolation of pump suction valve(s)

Note: PWROG Rev. 1 (6/5/09) Scenario No. 56a 54a. 1

Description:

Spurious safety injection signal AND Spurious isolation of makeup pump suction 54a.2 Notes:

Safety injection signal starts multiple RCS makeup pumps. Fire causes makeup pump suction valves to fail closed. Scenario results in cavitation / inoperability of multiple RCS makeup pumps.

54a.3 WBN Unit 2 Safe Shutdown Compliance:

54a.3.1 FSSD design changes have been incorporated to provide adequate physical separation between redundant sensing instruments and cables such that fire damage cannot cause a spurious ESFAS except for a control building fire. The control building is an alternative shutdown area. For control building fires that could cause a spurious ESFAS the

,control room will be abandoned and safe shutdown achieved from the auxiliary control system stations.

PageA - 59 El-68

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 54b.0 PWROG Scenario 54b: Other Scenarios - Spurious isolation of reactor coolant pump(s) thermal barrier cooling due to a spurious containment isolation signal with a concurrent isolation of seal injection Note: PWROG Rev. 1 (6/5/09) Scenario No. 56c (similar) 54b. 1

Description:

Spurious containment isolation signal isolates component cooling water (CCW) to the thermal barrier heat exchangers for all reactor coolant pumps (RCPs)

AND Spurious isolation of seal injection header flow 54b.2 Notes:

Scenario causes loss of all RCP seal cooling and subsequent RCP Seal LOCA.

54b.3 WBN Unit 2 Safe Shutdown Compliance:

54b.3.1 FSSD design changes have been incorporated to provide adequate physical separation between redundant sensing instruments and cables such that fire damage cannot cause a spurious ESFAS except for a control building fire. The control building is an alternative shutdown area. For control building fires that could cause a spurious ESFAS the control room will be abandoned and safe shutdown achieved from the auxiliary control system stations.

54c.0 PWROG Scenario 54c: Other Scenarios - Spurious isolation of reactor coolant pump(s) thermal barrier cooling due to a spurious containment isolation signal with a concurrent isolation of charging Note: PWROG Rev. 1 (6/5/09) Scenario No. 56c 54c. 1

Description:

Spurious containment isolation signal isolates CCW to the thermal barrier heat exchangers for all RCPs AND Spurious opening of charging injection valve(s) causing insufficient flow to seals PageA - 60 El-69

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 54c.2 Notes:

Scenario causes loss of all RCP seal cooling and subsequent RCP Seal LOCA.

54c.3 WBN Unit 2 Safe Shutdown Compliance:

54c.3.1 FSSD design changes have been incorporated to provide adequate physical separation between redundant sensing instruments and cables such that fire damage cannot cause a spurious ESFAS except for a control building fire. The control building is an alternative shutdown area. For control building fires that could cause a spurious ESFAS the control room will be abandoned and safe shutdown achieved from the auxiliary control system stations.

54d.0 PWROG Scenario 54d: Other Scenarios - Spurious start of containment spray pump(s) due to a spurious containment spray signal Note: PWROG Rev. 1 (6/5/09) Scenario No. 56d 54d.1

Description:

Spurious high containment pressure on multiple channels causing spurious containment spray signal 54d.2 Notes:

Scenario causes a pumped RWST drain down via the containment spray pumps and containment spray ring.

54d.3 WBN Unit 2 Safe Shutdown Compliance:

54d.3.1 FSSD design changes have been incorporated to provide adequate physical separation between redundant sensing instruments and cables such that fire damage cannot cause a spurious ESFAS except for a control building fire. The control building is an alternative shutdown area. For control building fires that could cause a spurious ESFAS the control room will be abandoned and safe shutdown achieved from the auxiliary control system stations.

54d.3.2 For all AVs except AV-042 and AV-057, either the containment spray pumps can be tripped from the main control room or the containment spray header isolation valves are closed which will prevent RWST drain down via the containment spray ring. For a fire inside the 6.9kv shutdown board room A (AV-042) and B (AV-057), the board is de-energized by tripping the feeder breakers (normal, auxiliary, PageA - 61 E1-70

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 maintenance) and the EDG within 10 minutes. De-energizing the board stops the containment spray pump.

54e.0 PWROG Scenario 54e: Other Scenarios - Spurious opening of PORV(s) due to spurious high pressurizer pressure signals on multiple channels Note: PWROG Rev. 1 (6/5/09) Scenario No. 56e 54e.1

Description:

Spurious high pressurizer pressure on multiple channels causes high pressurizer pressure signal 54e.2 Notes:

Spurious high pressurizer pressure on multiple channels causes high pressurizer pressure signal 54e.3 WBN Unit 2 Safe Shutdown Compliance:

54e.3.1 Spurious opening of the PORVs is evaluated in the FSSD analysis. The pressure sensing instrumentation and cables are included in the analysis.

For every fire scenario either the PORV or its in-line block valve is credited for maintaining RCS pressure. See scenarios 17 and 18 for additional details.

54".0 PWROG Scenario 54f: Other Scenarios - Spurious Recirculation Actuation Signal (RAS) starting and aligning pumps to a dry containment sump.

Added on 6/5/09 NEI 00-01 Rev 2 list (Item 560 54f.1

Description:

Spurious Recirculation Actuation Signal (RAS) starting and aligning pumps to a dry containment sump.

54f.2 Notes:

None 54f.3 WBN Unit 2 Safe Shutdown Compliance:

54f.3.1 WBN design, upon a high containment sump level, in conjunction with a low RWST level and SI signal, will initiate closure of the RHR pump suction valve and open the containment sump valves (concurrently).

There are no AVs where a high containment sump level will occur. In PageA - 62 E1-71

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX A Rev. 2 addition, a Unit 2 spurious SI signal can only occur with a fire in the Control Building. For a control building fire that could cause a spurious ESFAS control of the containment sump level and RHR pump suction valves will be transferred to the auxiliary control system stations.

54f.3.2 There are no AVs where a spurious start of RHR pump occurs concurrently with a spurious closure of the respective suction valve (2-FCV-74-3-A, B). The common suction valve from the RWST (2-FCV-63-1) is open with power removed.

PageA - 63 E1-72

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX B Rev. 2 Appendix B UNIT 2 RESOLUTIONS PageB- 1 E1-73

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX B Rev. 2 MSO# Resolutions Comment 5 Resolution RCP Seal Leakoff valves have been added to the FSSD Unit 1 PER 227833 Section analysis. Plant modifications have been incorporated to ensure MCR EDCR 57938 5.3.2 operator actions for reactor building non-essential control air header DCN 58390 isolation (2-FCV-32-1 1 -B) and venting (2-XSV-32-112A1, -112A2, -

1122B1, & -1122B2) to fail open the seal leakoff valves on loss of control air.

5 Resolution Relocate the cables for 2-FCV-62-22 and 2-FCV-62-48 out EDCR 53421 5.3.3 of AV-057.

22 A third "C" solenoid of opposite train from the existing "A & B" solenoid Previously identified Section valves has been added to Unit 2. It is located in a separate fire zone design change 22.3.1 and its cables are routed separately from the "A & B" solenoid valves EDCR 53178 for each PORV.

26 For AV-038 the cables listed below have been relocated out of AV-038 EDCRs 54631, Section to prevent spurious isolation of the steam supply to the TDAFW pump. 54636, 55494, 26.3.1 56638, 57938 Cables 2V2635B, 2V2633B, 2V2623A, 2V1831 A, 2PV83A, 2V1832A, 2V1833A, 2V2625A, 2V2621A.

26a Resolution: Evaluation of non-credited TDAFWP steam supply Unit 1 PER 227804 Section isolation is included in the As-Designed FSSD analysis.

26a.3.2 32 Resolution: Evaluation of steam generator overfill scenario has been Complete Section added to the FSSD to document compliance.

32.3.1 32 Based on the baseline FSSD analysis a design change has been Previously identified Section incorporated to modify the bypass feedwater line isolation and design change 32.3.5 regulating valve control circuits to ensure line isolation for all postulated fire locations.

46 Implementation of DCN 54912 relocated cables 2PL5133A and Unit 1 PER 227839 Section 2PL5145 out of AV-037C to ensure that fire damage in AV-037C could 46.3.1 not overload EDG 2A-A..

53 For all MOV's required to be manually operated to achieve cold Unit 1 PER 227808 Section shutdown following a fire outside the control building, a review has 53.3.2 been performed to ensure that, if fire damage could cause spurious valve operation and the limit/torque switch could be bypassed, the MOV motor torque will not damage the valve operator such that the valve cannot be manually operated. Valve circuit modifications have been incorporated as needed to prevent valve stalling and ensure that the valves can be manually operated.

PageB- 2 E1-74

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear P1lant APPENDIX B Rev 2 MSO# Resolutions Comment 54 Modifications have been incorporated to provide adequate physical Previously identified 54a separation between redundant sensing instruments and cables such design change 54b that fire damage cannot cause a spurious ESFAS except for a control 54c building fire. The control building is an alternative shutdown area. For 54d control building fires that could cause a spurious ESFAS the control Sections room will be abandoned and safe shutdown achieved from the 54.3.1 auxiliary control system stations.

54a.3.1 54b.3.1 54c.3.1 54d.3.1 Page B - 3 E1-75

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX C Rev. 2 Appendix C UNIT 1/COMMON RESOLUTIONS Page C- I E1-76

TVA Unit 2 Multiple Spurious Operation Evaluation R-1976-20-001 Watts Bar Nuclear Plant APPENDIX C Rev. 2 MSO# Resolutions Comment 15 Modification DCN 58383 added a switch to L-1 1A and/or L-1 1B that will Unit 1 PER 227839 Section select between main control room and auxiliary control room and the 15.3.1 EDG trip circuit is powered from a 125V Vital Battery Board feed 15a whose cable is not be routed in the board room. Associated cables to Section the MCR and DG building kill switches are routed outside the board 15a.3.1 room. This modification has been done for each of the four EDGs.

36 Section 36.3.1 46 Implementation of DCN 58383 renamed cables 1B27G, 1B32G, Unit 1 PER 227839 Section 1PL5396B, and 1PL5398B to 1B20G, 1B21G, 1PL1191B, and 46.3.1 1PL1 192B and relocated them out of AV-059 to ensure that EDG-1 B-B could not be overloaded due to fire damage in AV-059.

Page C- 2 E1-77

Enclosure 2 Summary of Changes WBN Unit 2 Multiple Spurious Operation Evaluation Report R1976-20-01, dated January 2013 Revision 2 E2-1

Report R1976-20-01, dated January 2013 Revision 2 Summary of Changes (Refer to Section 8.0, "Record of Revisions" of Enclosure 1) 1 Updated Multiple Spurious Operation (MSO) evaluations based on the As-Designed Fire Safe Shutdown (FSSD) analysis and Unit 1 and Unit 2 MSO design changes.

2. Updated and added references.

3. Replaced "backup control" with "Auxiliary Control System" per NRC commitment tracking item 112331509. (Affected Appendix A sections: 22.3.1, 23.3.1, 32.3.5. 33.3.1, 54.3.1, 54a.3.1, 54b.3.1, 54c.3.1, 54d.3.1, 54f.3.1, Appendix B).

4. Clarified statements crediting the Auxiliary Control System for control building fires "resulting in Main Control Room (MCR) abandonment" per NRC commitment tracking item 112384277 which noted that some control building fires would not result in MCR abandonment (affected Appendix A sections 4.3.1, 22.3.1, 23.3.1, 32.3.5. 33.3.1, 35.3.1, 38.3.3, 48.3.1, and Appendix B).

5. Added references 7.5 thru 7.8 as support information for scenario 21.

6. Updated MSO scenarios descriptions as needed based on NEI-00-01 Revision 3, Table G-2 while maintaining original scenario numbering to match WBN Unit 1 MSO evaluation.

Added scenario 48a (49.1) and expanded scenarios 50 and 51 to include Table G-2 scenarios 52 and 53.

7. Replaced reference to White Paper on Westinghouse Reactor Coolant Pump Seal Behavior for Fire Scenarios with Revision 2 (Westinghouse Letter LTR-RAM-1-10-053).

8. Removed comparison of Unit 2 and Unit 1 compliance strategies

9. Other changes to specific Appendix A Sections:

a. 1.3.2, 4.3.1, 5.3.1, 9.3.1, 10.3.1, 39.3.2 -- Identified AV where Thermal Barrier Cooling (TBC) is credited.

b. 2.3.1, 20.3.2 - Credited MCR closure of 2-FCV-62-89 rather than local manual valve.

c. 2.3.2, 20.3.3, 37.3.1 - Credited closure of 2-FCV-63-39-A and 2-FCV-63-40-B from Motor Control Center (MCC) rather than local manual valve operations.

d. 5.3.2, 6.3.1, 7.3.1, 13.3.1 - Credit reactor building non-essential control air header isolation and venting to fail valves open/closed.

e. 8.3.1, 9.3.1, 12.3.1, 13.3.2, 14.3.1, 14.3.2, 19.3.1, 22.3.1, 24.3.1, 29.3.2, 32.3.2; 32.3.5, 37.3.1, 39.3.2, 48.3.1 - Expanded compliance evaluation for clarity.

E2-2

Report R1976-20-01, dated January 2013 Revision 2 Summary of Changes (Refer to Section 8.0, "Record of Revisions" of Enclosure 1)

f. 13a.3.1 - Revised CCP run out evaluation..

g 27.3.1, 27.3.2, 28.3.3, 29.3.4, 30.3.2 - Credited backup motive air supply (nitrogen) for MCR operation of Steam Generator (SG) level and Auxiliary Feedwater Pump (AFWP) pressure control rather than local valve operation (both units).

h. 42.3.3, 47.3.1 - Changed Emergency Diesel Generator (EDG) cooling water valves from normally open with power removed to normally closed, automatic opening on EDG start.

i. 46.3.1 - Credited revised EDG loading calculation methodology.

j. 48.3.1 - Expanded evaluation of potential paralleling EDG with offsite sources through spurious breaker operation.

k. 53.3.2 - Updated to include results of Motor Operator Valve (MOV) stall analysis.

10. Updated Appendices B and C resolutions to reflect those that have been incorporated or are no longer needed.

E2-3

Enclosure 3 Fire Protection Commitments Open Commitments to be Completed for the Submittal of the As-Constructed Fire Protection Report (FPR)

Date of TVA Letter Commitment that Made Commitment Description Number Commitment & NRC Accession Number*

Generic Letter 06 Potentially Nonconforming Hemyc and MT Fire Barrier Configurations September 7, 2007 The Fire Protection Corrective Action Program will ensure Watts Bar Unit 2 conforms with NRC NCO080008020 requirements and applicable guidelines prior to fuel load. The fire barrier configurations are ML072570676 documented in facility design basis documentation that are controlled and maintained in accordance with TVA's Design Control and Quality Assurance Programs.

Item 18 of Enclosure 23 of letter T90 070911 002 August 20, 2010 The resolutions contained in Appendix B of the Multiple Spurious Operation (MSO) Evaluation Report 111905993 shall be implemented prior to Unit 2 fuel load.

ML102360283 August 20, 2010 PWROG Scenario 13a: "Charging Pump Runout" shall be confirmed to be within the bounds of CCP 111905994 operation during the large break LOCA analysis prior to Unit 2 fuel load.

ML102360283 112068531 March 16, 2011 Figures representing the as-constructed plant configuration will be provided after construction completion. [RAI FPR General - 4]

Upon performing the final plant walkdowns as prescribed in FPR Sections 2.1.1, 2.4.3, and 2.3, TVA will review the information and submit the results for NRC approval if they differ from the 112068578 March 16, 2011 assumptions and details provided in Part V or the other parts of the FPR. Otherwise, TVA will inform the NRC when the walkdowns are complete and that no revisions to the FPR were required.

[RAI FPR V-3]

The barriers separating the Unit 2 Reactor Building from the Refueling Floor will be configured and controlled the same as the Unit 1 Reactor Building Equipment Hatch. [RAI FPR VII-l]

The operator manual action timelines shall include the time required for getting the lantern.

Enclosure 4, Question 12. NRC Question (RAI FPR V-10)

May 26, 2011 Additionally, it has been determined that the RES M-20A & M-20C materials are no longer available 112331325 and Unit 2 will be replaced with a compatible material, such as 3M E54, that will provide equal or ML111520119 greater protection than the M-20A & M-20C. Enclosure 1, Letter Item 2. NRC Question (RAI FPR

.11-42)

E3-1

• Letters without accession numbers could not be located in ADAMS

Enclosure 3 Fire Protection Commitments Open Commitments to be Completed for the Submittal of the As-Constructed Fire Protection Report (FPR)

Date of TVA Letter Commitment that Made Commitment Description Number Commitment & NRC Accession Number*

WBN design criteria WB-DC-30-13, "10CFR50, Appendix R, Type 1,11, and III Circuits - Unit 1 / Unit May 26, 2011 2" will be revised to define the evaluation methodology and specify the applicable circuit failure 112331447 criteria in accordance with NEI-00-01 Revision 2 and RG 1.189, Revision 2. Enclosure 1, Letter Item 29. NRC Question (RAI FPR MSO-1)

May 26, 2011 The term "backup control stations" should have been "auxiliary control system" and the WBN Unit 2 112331509 MSO Report Revision 1 will be revised to state "auxiliary control system."

ML111520119 Enclosure 1, Letter Item 33. NRC Question (RAI FPR MSO-6)]

As resolution of this RAI, TVA commits to completing prior to Unit 2 fuel load the modifications and 112345687 June 7, 2011 document revisions required to resolve the common MSOs identified in Appendix C submitted in TVA letter to NRC dated August 20, 2010 (Reference 3).

TVA will complete the resolution actions for the MSO scenarios affecting Unit 2 prior to the Unit 2 fuel 112384234 June 17, 2011 load.

Letter Item # 15, [NRC RAI FPR MSO-10]

The statement in FPR Part IV, Section 1.0, "fires in the building that could result in abandonment of the main control room (MCR)," is correct. There are fires in the control building that will not result in 112384277 June 17, 2011 MCR abandonment. The WBN Unit 2 MSO Report, Revision 1, will be revised to eliminate this apparent contradiction.

Letter Item # 16, [NRC RAI FPR MSO-11]

112444565 July 1,2011 Validation tto Unit of the ntfe2 fuel od Unit 2 Operator Manual Action (OMA) performance times will be demonstrated prior load.

Emergency lighting and communications for the Unit 2 OMAs will be demonstrated during the Unit 2 112444572 July 1, 2011 OMA validation walkdowns.

The post fire safe shutdown procedures [Abnormal Operating Instruction (AOI) 30.2] will be revised for dual unit operation prior to Unit 2 fuel load.

The feasibility and reliability evaluation will be reviewed and modifications, as needed, incorporated 112444581 July 1, 2011 when the combustible loadings are finalized. These actions will be completed prior to Unit 2 fuel load.

112488301 July 22, 2011 Piping and hose stations will be added in the following areas for Unit 2 operation:

a. Two sprinkler systems in the Unit 2 Reactor Building. These are pre-action sprinkler systems, E3-2

• Letters without accession numbers could not be located in ADAMS

Enclosure 3 Fire Protection Commitments Open Commitments to be Completed for the Submittal of the As-Constructed Fire Protection Report (FPR)

Date of TVA Letter Commitment that Made Commitment Description Number Commitment & NRC Accession Number*

normally dry with an air supervision of the piping.

b. Two sets of hose stations in the Unit 2 Reactor Building. These hose stations are fed from a sprinkler system type deluge valve thus they will normally be dry also but will not have air supervision.

c. Sprinkler system for the protection of the charcoal beds in the Unit 2 Containment Purge Air filter housing. This will be a pre-action sprinkler system but will not have air supervision.

[Letter # 2. NRC Question (RAI FPR VII-2.2)]

Existing Unit 1 hose stations that presently are not required by the FPR to provide protection to 112488384 July 22, 2011 operating equipment will be re-classified to providing protection for operating equipment when Unit 2 goes on line. Letter # 2. NRC Question (RAI FPR VII-2.2)

The following design changes will be implemented prior to Unit 2 fuel load or startup, as applicable:

August 5, 2011 EDCR 53217; EDCR 53287; EDCR 53288; EDCR 53290; EDCR 53291; EDCR 53292; 112549702 EDCR 53293; EDCR 53296; EDCR 54103; DCN 52606; EDCR 54795; EDCR 54796; ML11227A257 EDCR 54797; EDCR 54798; EDCR 54799; and EDCR 54819 Letter Item # 15, NRC Question RAI FPR 111-17 "Additional piping and hose stations will be added in the following areas for Unit 2 operation.

Letter Item # 27, NRC Question RAI FPR VII-2.2

a. Two sprinkler systems in the Unit 2 Reactor Building. These are pre-action sprinkler systems, normally dry with an air supervision of the piping.

August 5, 2011 b. Two sets of hose stations in the Unit 2 Reactor Building. These hose stations are fed from a 112550136 sprinkler system type deluge valve, thus they will normally be dry, but will not have air ML11227A257 supervision.

c. Sprinkler system for the protection of the charcoal beds in the Unit 2 Containment Purge Air filter housing. This will be a pre-action sprinkler system, but will not have air supervision."

Item 19 of Enclosure 2 of letter T02 110805 004 TVA confirms there will be procedures for each affected room that address each OMA. The OMAs 112783894 September 30, 2011 identified in the FPR are to be verified by walkdowns and documented in AOl 30.2 prior to fuel load.

The statement that a room does not have dedicated procedures for fire safe shutdown will be deleted E3-3

• Letters without accession numbers could not be located in ADAMS

Enclosure 3 Fire Protection Commitments Open Commitments to be Completed for the Submittal of the As-Constructed Fire Protection Report (FPR)

Date of TVA Letter Commitment that Made Commitment Description Number Commitment & NRC Accession Number*

for the evaluations. These revised evaluations will be included in the next FPR submittal.

Letter item # 16. NRC Question (RAI FPR VII-22)"

Item 14 of Enclosure 2 of letter T02 110930 001 Performance demonstration walkdowns described in Section 2.2.1 of part V will be performed for alternate shutdown operator manual actions, and the timing of those walkdowns for Unit 2 will consider that the control room operators will need to travel from the Main Control Room to the October 28, 2011 Auxiliary Control Room or other Auxiliary Control System (ACS) locations, as applicable. These 112868246 performance demonstration walkdowns will be performed prior to Unit 2 fuel load.

ML11306A090 Letter Item # 2. [2] (RAI FPR IV-5)

Item 2 of Enclosure 2 of letter T02 111028 001 TVA will ensure that the as-constructed FPR conforms to the as-constructed configuration of the 113461862 April 26, 2012 plant. Based on the current completion schedule for WBN Unit 2, the as-constructed FPR will be submitted to NRC no later than October 15, 2014.

In order to prevent this condition, bypass switches will be added on the 6.9 kv shutdown boards to be used during Appendix R events which will allow a second ERCW pump to be loaded on one of the 113950905 September 13, 2012 Train B diesels.

Item 1. of Enclosure 7 of letter T02 120913 002 Plant modifications will be made to provide spent fuel pool cooling pump kill switches in the main 113950915 September 13, 2012 control room.

Item 2. of Enclosure 7 of letter T02 120913 002 The review of the building information identified that only the use of the name Temporary Storage 114303784 December 20, 2012 Office Building (TSOB) in Section 10.1, "Overview of Evaluation Methodology," of Part III, "Safe Shutdown Capabilities," needed to be updated to the current name of Modification Building. For non-technical issues, such as a building name that does not affect the fire safe shutdown (FSSD)

E3-4

• Letters without accession numbers could not be located in ADAMS

Enclosure 3 Fire Protection Commitments Open Commitments to be Completed for the Submittal of the As-Constructed Fire Protection Report (FPR)

Date of TVA Letter Commitment that Made Commitment Description Number Commitment & NRC Accession Number*

analysis, TVA intends to collect these changes and submit them as part of the as-constructed dual unit FPR.

Item 1. of Enclosure 7 of letter T02 121220 001 The schedule for the implementation of the organizational corrective actions has not been finalized.

Since this is a non-technical change, the required updates for Part II will be provided in the as-114303791 December 20, 2012 constructed dual unit FPR.

Item 2. of Enclosure 7 of letter T02 121220 001 The Deviation statement will be removed from Section 3.60.3 as part of the submittal of the as-114303801 December 20, 2012 constructed FPR.

Item 3. of Enclosure 7 of letter T02 121220 001 E3-5

• Letters without accession numbers could not be located in ADAMS

Enclosure 4 Commitment List

1. The commitment made in Reference 2 regarding the resolutions contained in Appendix B of the MSO Evaluation Report remains valid, and it is TVA's intent to confirm the fulfillment of the commitment as part of the submittal of the as-constructed version of the dual unit Fire Protection Report (FPR).

E4-1