LR-N15-0232, Supplemental Information Needed for Acceptance of Requested Licensing Action Amendment Request Regarding Chilled Water System Modification
| ML15309A750 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 11/05/2015 |
| From: | Jamila Perry Public Service Enterprise Group |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LAR S14-04, LR-N15-0232, TAC MF6724, TAC MF6725 | |
| Download: ML15309A750 (33) | |
Text
LR-N 15-0232 LAR S14-04 PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, NJ 08038-0236 PSECi Nuclntr Ll,C 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Salem Nuclear Generating Station Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC Docket Nos. 50-272 and 50-311
Subject:
Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
References
- 1. PSEG letter to NRC, "License Amendment Request Modifying Chilled Water System Requirements," dated September 11, 2015 (ADAMS Accession No. ML15254A387)
- 2.
NRC letter to PSEG, " Salem Nuclear Generating Station, Unit Nos. 1 and 2Supplemental Information Needed For Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification," dated October 29, 2015 (ADAMS Accession No. ML15299A383)
In the Reference 1 letter, PSEG Nuclear LLC (PSEG) submitted a license amendment request for Salem Nuclear Generating Station (Salem), Unit Nos. 1 and 2. The proposed amendment would revise Technical Specification {TS) 3/4.7.1 0, "Chilled Water System-Auxiliary Building Subsystem," to allow (1) a reduction in the number of required components (two vs. three required chillers) and (2) use of the cross-tie capability between Unit 1 and Unit 2. A supporting change would also be made to the Control Room Emergency Air Conditioning System TS 3.7.6.1 (Unit 1) and TS 3.7.6 (Unit 2).
In the Reference 2 letter, the U.S. Nuclear Regulatory Commission staff requested that PSEG supplement the application with information necessary to enable the NRC staff to begin its detailed technical review. A conference call was held with the NRC on October 21, 2015, to clarify the supplemental information request. The requested information is provided in.
LRN150232 Page 2 10 CFR 50.90 PSEG has determined that the information provided in this submittal does not alter the conclusions reached in the 10 CFR 50.92 no significant hazards determination previously submitted. In addition, the information provided in this submittal does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.
There are no regulatory commitments contained in this letter.
If you have any questions or require additional information, please contact Brian Thomas at (856) 3392022.
I declare under penalty of perjury that the foregoing is true and correct.
Executed on NOV '05 2015 (Date)
Respectfully, Cl£F. 7f k; F. Perry Site Vice President Salem Generating Station Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
S-C-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment" Technical Evaluation 801 1 0953-01 05, "Chilled Water System Crosstie FMEA" cc:
Mr. D. Dorman, Administrator, Region I, NRC Mr. T. Wengert, Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator
LR-N15-0232 Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
Page 1 of 10
LR-N 1 5-0232 NRC Request 1
- 1.
Confirm whether the replacement of the six existing safety-related chillers is in the scope of this license amendment request. If the new chillers are in scope for replacement, provide the following information, as compared to the existing chillers. The information provided should include a form (shape, size, dimensions, etc.), fit (physical interface, connections, etc.) and function (designed to perform) evaluation. This should include, but not be limited to the following:
- Safety-classification
- Design and construction codes (American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers, etc.)
- Seismic Classification
- British thermal units per hour (BTU/hr) design rating (tonnage)
- Outlet temperature requirement of chilled water (range)
- Inlet temperature requirement of the service water (range)
- Chiller design pressure and temperature
- Chiller design flow rates
- Instrumentation and controls (alarm, permissives, and trips)- digital controllers vs analog
- Horsepower requirements of compressor (emergency diesel generator (EDG) loading differences)
- Cooling water requirements, pressure, flow
- Refrigerant type (address hazards)
- Refrigerant purge unit design (if utilized)
- Field modification for installation of the new chillers related to safety-related systems, structures, and components
- Control room habitability requirement and evaluation for the new refrigerant
- Fire protection evaluation for the new refrigerant
- Evaluation of the existing chiller water pumps/system relative to the new chillers
- Evaluation of the existing service water pumps/system relative to the new chillers
- Performance testing (shop/vendor)
In addition, provide a discussion related to testing of each replacement chiller following installation. Provide information describing testing of the new chillers to meet the design function as described in Appendix A to Title 10 of the Code of Federal Regulations, Generic Design Criteria (GDC)-45 and GDC-46, "Inspection of cooling water system," as applicable.
Information on testing should verify that the chillers can perform their safety-related design function before returning to Operable status.
PSEG Response The replacement of the chillers is being performed under 1 0 CFR 50.59 and is not in the scope of this License Amendment Request (LAR). The LAR is based on the current system Auxiliary Building Chilled Water (AB CH) System. The overall function of the AB CH is not altered by the replacement of the chillers.
The replacement chillers will meet or exceed the current chiller design requirements. As discussed with the NRC staff on October 1 5, 2015, the following information is provided regarding the planned replacement chillers.
Page 2 of 10
LR-N 15-0232 The design capacity of the proposed replacement chillers is 62.5 tons. This is slightly higher than the current chiller rating of 61 tons. Furthermore, the replacement chiller rating is based on a Service Water temperature to the condensers of g3oF, 3°F above the design value of gooF; thus the rating at gooF would be higher than 62.5 tons. Per the response to Question 3, the replacement chiller rating satisfies the heat load requirements with margin added.
The proposed replacement chiller refrigerant will be R-134a. According to the Environmental Protection Agency (EPA), this refrigerant has "low acute toxicity levels, and presents low risk to humans exposed to it in small amounts." Due to the physical location of the chillers with respect to the Control Room and control room ventilation intake dampers, the possibility of refrigerant entering the Control Room due to a loss of refrigerant is not considered credible. The chiller rooms are located in a separate ventilation system from the control room ventilation system.
This assessment will be documented in the DCP for the replacement chillers.
NRC Request 2
- 2.
Provide a detailed description of the Auxiliary Building Chilled Water (AB CH) System, describing how the AB CH system is currently designed, and how it operates during normal and accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system.
The NRC staff requires this information to fully understand and evaluate the proposed changes to the AB CH system and the associated TS revisions.
PSEG Response The Auxiliary Building Chilled Water (AB CH) System design is unchanged by the proposed license amendment request (LAR). Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
A description of the AB CH system design was previously provided in response to a June 12, 1gg7 (ADAMS g70618034g), Request for Additional Information (RAI) related to Salem Amendments 1gg and 182 (ADAMS ML01172014g). The following provides an updated description of the system.
Auxiliary Building Chilled Water System Description The Auxiliary Building Chilled Water (AB CH) System is a closed loop system that removes heat from various safety related and non-safety related equipment, and rejects the heat to the ultimate heat sink via the Service Water (SW) System. There is one loop for each Salem Unit.
Figure 4-1 of the LAR provides a simplified one line diagram of the AB CH System.
The AB CH System includes three packaged liquid chillers and two Chilled Water pumps. Each pump circulates nominally 370 gpm of chilled water at 200 feet total head in a closed loop from the chillers to the heat loads and then back to the pump suction header. Each chiller evaporator removes heat from the returning chilled water and, in the chiller condenser, rejects the heat to the ultimate heat sink via the SW System. The chillers are designed to supply chilled water at 44°F, and cycle on and off as a function of chilled water return temperature. An expansion tank is installed at the suction of the pumps to accommodate chilled water inventory, thermal expansion and to provide adequate net positive suction head (NPSH) for the pumps. The chiller compressor motors are powered from separate 460 VAC Vital Buses. The two pumps Page 3 of 10
LR-N 15-0232 are powered from separate 230 VAC Vital Buses. The heat loads serviced by the AB CH System for each Salem Unit are as follows:
Safety Related Heat Loads:
Control Area Air Conditioning System (CAACS) Cooling Coils Control Room Emergency Air Conditioning System (CREACS) Cooling Coil Emergency Control Air Compressor (ECAC) Coolers Non-Safety Heat Loads:
Penetration Area Cooler Units (PACUs)
Miscellaneous Room Coolers (Unit 2 only), including the primary lab room cooler, secondary lab room cooler, counting room cooler and post-accident sampling room cooler The CAACS and CREACS are sub-systems of the Control Area Ventilation (CAV) System, which includes the Control Room Envelope (CRE), Relay Room and Electrical Equipment Room. The CRE is common for Salem Units 1 and 2. During normal operation, CAACS provides cooling for all the CAV System areas. During accident conditions, CREACS provides cooling for the CRE, and CAACS provides cooling for the Relay Room and Electrical Equipment Room. CAACS maintains the areas it serves at s; 76°F during normal and accident conditions.
CREACS maintains the CRE at s; 85°F during accident conditions, except for the Data Logging Rooms, which are maintained at s; 90°F.
The three-way control valve (CH74) located on the discharge side of the CAACS coils, originally designed to control flow through the coils, is fixed in the full open position to allow full flow through the coils all the time to simplify system operation and improve reliability. Similarly, the CH168 control valve located on the discharge side of the CREACS coil is fixed in the full open position for single failure concerns, allowing flow through the coil during all modes of operation.
Chilled water flow to the ECAC coolers is normally isolated and is provided when the ECAC is operating by an automatic isolation valve that opens when the compressor starts. The ECAC is normally aligned to chilled water but can be isolated from the chilled water system and provided cooling from the service water system.
Chilled water flow is provided to the PACUs as required to maintain the environmental conditions in the mechanical penetration area for protection of equipment. Room thermostats are provided to modulate three-way control valves to each PACU. The supply of chilled water to the PACU cooling coils is automatically isolated by redundant isolation valves (CH151 and CH30) on a safety injection signal.
The Salem Unit 2 AB CH provides chilled water to the miscellaneous room coolers in addition to the uses described above. Three-way control valves modulate flow to each room cooler based on room temperature. Chilled water flow to these non-safety room cooling coils is automatically isolated by redundant isolation valves on a safety injection signal.
Page 4 of 10
LR-N 15-0232 AB CH Operation A. Normal Configuration During normal plant operation, the AB CH System in each unit provides chilled water to the CAAC coils and PACUs. In addition to these loads the Unit 2 AB CH System supplies chilled water to the miscellaneous room coolers. The ECAC is normally in standby with cooling flow through the ECAC isolated. When the ECAC is operated for testing or when the Station Air Compressors are not available or not operating, the AB CH System provides chilled water to the ECAC coolers.
B. Accident Safety Injection (SI) Configuration During the accident Sl configuration, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. On an Sl signal, redundant isolation valves automatically isolate chilled water flow to the PACUs and the miscellaneous room coolers.
Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and each Unit's CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms. If one CREACS train is unavailable, the system is aligned in the single train filtration mode (also referred to as "Maintenance Mode"). A single CREACS coil is capable of maintaining the CRE at :5 85°F, except for the Data Logging Rooms, which are maintained at :5 gooF.
C. Accident High Radiation (RMS) Configuration During the accident RMS configuation, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. The PACUs and the miscellaneous room coolers are not automatically isolated by the RMS signal and continue to receive chilled water flow until manually isolated by procedure. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE. Chilled water to each Unit's CAACS coils provides cooling to their respective Relay and Electrical Equipment Rooms.
On initiation of an accident high radiation (RMS) signal when the CAV system is in the Maintenance Mode, a single CREACS coil is capable of maintaining the CRE at :5 85°F, except for the Data Logging Rooms, which are maintained at :5 gooF.
D. Loss of Offsite Power (LOOP) Configuration During a LOOP, chilled water flow is maintained to Units 1 and 2 CAACS coils to provide cooling to the CRE and their respective Relay and Electrical Equipment Rooms. Each Unit's ECAC is started and chilled water is supplied to the ECAC coolers. The PACUs and miscellaneous room coolers are isolated.
Page 5 of 10
LR-N 1 5-0232 E. Fire Outside Control Room Area (Recirculation)
During a postulated fire outside the control area, the CAV System is manually switched to the full recirculation configuration. This initiates the CREACS fans. The CAACS coils continue to receive chilled water. The PACUs and miscellaneous room coolers are manually isolated. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and the CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms.
AB CH Interfaces with other Systems The AB CH interfaces with the systems it supports through heat transfer across cooling coils.
Control air is required for operation of AB CH*control valves.
SW supplies cooling water to each packaged chiller condenser. The chillers reject heat to the ultimate heat sink via SW flow.
The Safeguards Equipment Controller (SEC) circuits provide automatic control of the AB CH during accident conditions. The interfaces between the AB CH and SEC circuits occur at the SEC contacts in the AB CH control circuits.
The Potable Water system provides make-up water to the AB CH Subsystem expansion tank.
Nitrogen is supplied to the expansion tank as a cover gas.
The Building and Equipment Drains system provides for transport and disposal of excess fluids from the AB CH Subsystem.
AB CH Cross-tied Operation The cross-tie piping connects the Unit 1 and Unit 2 Chilled Water Systems. The cross-tie piping is safety related seismic class 1 piping. The cross-tie piping enables the chillers from one unit to provide the cooling requirements for both units. Both the supply header cross-tie and the return header cross-tie contain one manual isolation valve that provides the boundary between unit one and unit two.
Calculations performed in support of the LAR have shown that from November 1 through April 30, one Chilled Water pump is capable of supplying the required cooling flow to both units, with the following conditions: (1 ) chilled water flow to the ECACs are isolated; (2) chilled water flow to the non-essential loads are isolated; (3) both CREACS trains are required (single filtration train alignment not permitted). The calculations also show that only 2 Chillers are required to remove the heat load.
The cross-tied LCO is requiring 3 chillers and 2 chilled water pumps to be operable. This requirement allows for the single failure of an electrical train that would lead to the loss of one chiller and one chilled pump. As documented in Section 4.3 of the LAR, the analysis shows that with 2 chillers and 1 chilled water pump remaining, the cross-tied system can support the accident heat loads on one unit and safe shutdown heat loads on the other unit, as required per GDC-5.
Page 6 of 1 0
LR-N15-0232 The ECAC and non-essential loads are required to be isolated from the chilled water system prior to operating in the cross-tied configuration as required by the restrictions placed in the TS.
Therefore, there is no reliance on the automatic or manual operator action to isolate these loads following a design basis accident or loss of offsite power (LOOP). When entering the cross-tie configuration the chillers and chilled water pumps on the unit that is not supplying the cross-tie are isolated from that Unit's chilled water system. The unit supplying the chilled water cross-tie will then provide cooling to both Unit's CAACS and CREACS coils.
The chilled water valve alignment to the various coolers at both units is not impacted by operation of the cross-tie with exception for pre-isolation of the aforementioned loads. The chiller control valves for the CAACS and CREACS coils are fixed in the full open position, and thus chilled water flow to these coils is maintained in both accident and normal conditions. The CAV System operating modes are not impacted by the chilled water cross-tie and no changes are being made to the CAV control circuits for the operation of the chilled water cross-tie.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
NRC Request 3
- 3.
Provide a detailed explanation of how the current AB CH system heat loads/components currently interface with the AB CH system, how the system is designed, how the system operates during normal operations, and how the system operates during accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system. The NRC staff requires this information to fully understand and evaluate any proposed changes to the heat loads/components that are served by the AB CH system and any associated TS revisions.
PSEG Response The AB CH System design is unchanged by the proposed LAR. Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
The AB CH System provides cooling to various essential and non-essential loads. The essential loads include the CAACS, CREACS, and ECAC on both units. The non-essential loads include the PACUs on both units and miscellaneous lab and room coolers on Unit 2 only.
The following are the current heat loads for these components for normal and accident conditions based on design summer ambient conditions. Heat loads are also provided for the single filtration train alignment (also known as Maintenance Mode) of the control area ventilation where one unit is cooling the entire CRE. The control area ventilation can be operated in either normal alignment (both trains operating) or Maintenance Mode (single train operating). As described in the LAR, the control room ventilation is a shared system with each Salem Unit providing one train of the two train system. During normal operation, the CAACS is supplying Page 7 of 10
LR-N 15-0232 the CRE with the CREACS system isolated and in stand-by. During an accident, the CREACS system is actuated and supplies the cooling to the CRE and the CAACS is isolated from the CRE. In the tables below for the Maintenance Mode (single train) alignment, during normal operation the CAACS on one unit is cooling the entire CRE and for accident conditions the CREACS on one unit is cooling the entire CRE. The values listed for Unit 1 and Unit 2 CAACS in Normal Operation in the Maintenance Mode include the entire CRE heat load in both the Unit 1 and Unit 2 columns (the Unit that is not supplying the CRE would actually have a lower heat load). The values listed for Unit 1 and 2 CREACS in Accident Conditions during Maintenance Mode reflects the heat load if that Unit is supplying CRE.
Normal Operation
- Based on three chillers running During accident conditions, the PACUs and Miscellaneous coolers are either automatically isolated or isolated by procedure.
Accident Conditions
- Based on two chillers running For the proposed TS changes, the above heat loads apply to the current configuration (3.7.10.a). For the new TS configurations, Two Chiller (TS 3.7.10.b) and Cross-tied (TS_ 3. 7.1 O.c), the above system heat loads will be less. The CAACS and CREACS loads will be less than the above values since they are based on summer design conditions, and the new TS configurations will only be applicable during the colder parts of the year (from November 1 to April 30). The ECAC load will be zero since the TS restrictions will require the ECAC to be isolated from the Chilled Water System for both the two chiller and cross-tied Page 8 of 10
LR-N 15-0232 configurations. For the two chiller configuration, the non-essential loads (PACUs and miscellaneous coolers) remain aligned with both trains of CAV operable and are isolated when transitioning to Maintenance Mode. For the cross-tie configuration the non-essential loads will be isolated on both units prior to entering the cross-tie configuration; therefore, these heat loads are zero for the cross-tie configuration.
The specification for the replacement chillers includes a 10% margin added to the heat loads in the above two tables. Adding 10% to the bounding normal operation value of 55.5 tons/chiller yields 61.1 tons per chiller. Adding 10% to the bounding accident value of 50.3 tons/chiller yields 55.3 tons per chiller. The proposed replacement chillers are rated at 62.5 tons, so they will be capable of providing the required cooling for both normal and accident conditions with 10% heat load margin. In addition, this rating is based on a SW temperature to the condensers of 93°F, which is a 3°F margin above the design value of 90°F.
NRC Request 4
- 4.
GDC-5, "Sharing of structures, systems, and components," states the following:
Structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and coo/down of the remaining units.
Provide a failure modes and effect analysis or suitable summary table, applicable to GDC-5, to describe the analysis and conclusions for the effects of the cross-tie between units. In addition, provide a discussion describing the interactions during a design basis accident (loss of off-site power, loss of cooling accident) related to electrical power, and EDG loading sequencing that supports both units, when the units are in the cross-tied configuration.
PSEG Response The existing failure modes and effect analysis (FMEA), S-C-CH-MEE-1139, was assessed in a Technical Evaluation (TE) that determined that the cross-tied configuration does not introduce any new failure modes. The existing FMEA and the TE are provided as Enclosure 1 and 2 respectively. During the review of S-C-CH-MEE-1139, PSEG identified the following items that will be addressed during the update of the FMEA:
Section 3.0, the main steam line radiation monitors were permanently removed from the chilled water system.
Section 4.1.2 and Attachment 8.2, the CH? 4 chiller control valves for the CAACS coils are fixed in the full open position as discussed in response to Question 2.
Section 4.2, during the two chiller configuration the ECAC will be isolated from chilled water for the Unit in the two chiller configuration and during cross-tied configuration the ECACs will be isolated from chilled water for both Units.
Section 4.4, during the two chiller and cross-tied configuration the Maintenance Mode alignment is not allowed.
Page 9 of 10
LR-N 15-0232 Section 5.0, describes chilled water system vulnerabilities without the details of the vulnerabilities. These vulnerabilities are associated with the CREACS and CAACS temperature control valves which are discussed in Section 4.1.1 and Section 4.1.2, respectively, and the safety related isolation discussed in Section 4.3. These discussions are not impacted by the two chiller and cross-tied configuration.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
Page 10 of 10
LRN 150232 SC-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment"
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 14 *1212 EENo.: S-C-CH-MEE-1139 Rev No.: 1 DECEMBER 10, 199M TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 1.0 Revision Summary Revision 1 -The CH168 valve modulating function is now inoperative. TI1e control air to the valve has been removed in order to keep the valve permanently in the full open (fail-safe) position. The associated temperature controller is also disconnected. This evaluation is being revised lAW CD P517 ofDCPs lEE-0371/1 Rev. 0 and 2EE-0317/1 Rev. 0. The following changes were incorporated into the evaluation:
- 1.
Section 4.1.1 was revised to describe the condition which now exists as stated above.
- 2.
Section 5.0 has been revised to describe the modifications made to CH168.
- 3.
Section 7.0 has been revised to update the effects on other technical documents.
- 4..2, page 4 has been revised to delete the effects of a control malfunction.
Note 2 of the attachment has also been removed.
2.0 Purpose The purpose of this evaluation is to document single active failure vulnerabilities of the safety related portion of the Salem Units 1 and 2 Chilled Water System. Specifically, this evaluation will document the Chilled Water System's capability to perform its design function after sustaining a single active failure, measures to minimize the risk of an unmitigated single failure, and compensatory measures in the event of an unmitigated single active failure.
3.0 Scope The chilled water system perfonns both safety and non safety related functions. The system is primarily non safety related except for the Auxiliary Building Subsystem, which provides chilled water to the following areas.
- 1.
Control Area Ventilation System;
- 2.
Control Air System (Emergency Air Compressors);
- 3.
Various Non SafetyUsers.
Note that the Main Steam Radiation Monitors do not require chilled water cooling during an accident and are considered to be a non-safety related load for this evaluation.
The scope of this evaluation will be confined to the system and component interfaces noted in I and 2 above. Only single active failures will be evaluated.
A component is subject to an active failure if the component may be required to change state or position in order for the system to perform ito; safety function. Typical active failures include valves failing to move to the proper position when required, or a relay failing to energize when required. A component is subject to a passive failure if the position or state of the component is immaterial to the postulated failure. A typical passive failure is a pipe crack or rupture.
USER RESPONSIBLE FOR VERIFYING.REVISION, STATUS AND CHANGES PRINTED2014 1212 Page £01< 1 EE No.: S-C-CH-MEE-1139 Rev No,: 1 NOVEMBER 16, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 4.0 4.1 Discussion A Failure Modes and Effects Analysis (FMEA) was perfonned for Unit 1 to identifY the active components subject to single failure. The Unit 2 CH system is similar, with additional non-safety related loads for the counting room, laboratory unit coolers and PASS room cooler.
Refer to attachment 8.2 for the FMEA. The results are summarized below, and are divided into functional support areas.
Control Area Ventilation System (CAV)
Chilled water is supplied to the portion of the CA V System that includes the Control Area Air Conditioning System (CAACS) and the Control Room Emergency Air Conditioning System (CREACS). The CA ACS supplies conditioned air during normal plant operation to the combined Unit 1 and Unit 2 Control Room Envelope, each unit's Relay Room, and each unit's Electrical Equipment Room. The CREACS provides conditioned air to the combined Control Room Envelope (CRE) during emergency operation. The CAACS continues to cool the Electrical Equipment room and Relay Room for each unit during an accident. The chilled water system provides coolant to cooling coils in both these subsystems. Refer to Attachment 8.1 for the system schematic diagram. The following single active failures are evaluated.
4.1.1 Failure of Control Valve 1CH168 (2CH168)
The CH168 valve modulating function is now inoperative. The control air to the valve has been removed in order to keep the valve pennanently in the full open (fail-safe) position. The associated temperature controller is also disconnected.
As a result of these modifications, an evaluation of a failure ofCH168 is no longer applicable.
4.1.2 Failure of Three Way Valve 1 CH7 4 (2CH7 4)
Three Way Valve CH74 is located in the inletloutletlbypass piping to the CAACS cooling coil which, during an accident serves the Relay Room and the Electrical Equipment Room. The valve has a pneumatically operated actuator to modulate chilled water flow through the CAACS coil or through the bypass line to control cold deck air temperature. On a loss of air, the valve will spring actuate to direct all flow to the CAACS cooling coil. The control circuitry has redundant solenoid valves that
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 141212 BE No.: S-C-CH-MEE-1139 Rev No.: 0 Page 3 of 7 Date: February 4, 1997 TITLE: Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment exhaust the air on a loss of power and as a consequence the spring wouid fail the valve to the full flow to the cooling coil position. Therefore the controls for this valve are redundant, enhancing the capability to endure a single failure.
A postulated failure scenario is that with the valve aligned in the bypass position during the winter time (cold makeup air and little or no heat load on the cooling coil), a mechanical malfunction may bind the valve in the bypass position. With the valve stuck ht this position, chilled water flow would bypass the CAACS and temperatures in the Relay Room and Electrical Equipment Room could increase.
This malfunction is not credible. Even in winter, the heat loading from the control area is high enough to require some cooling water flow, thus it is unlikely that the CH74 valve will ever be in the full bypass position. Also, the valve is modulating to control CAACS temperature which will require the valve to move to compensate for the 24 hr. day/night cycle. Therefore, the valve does not remain in one position for a long period of time.
If the valve were to bind in an intennediate position, adequate cooling is assured, because the CAACS heat load would drop due to the CRE load shifting to the CREACS. In addition, this valve is periodically stroke tested under S 1(2).0P-ST.CH-0003(Q). (Refs. 6.1 and 6.2) Regular preventive maintenance (PM Task Nos. 100011, 411320, 411323, 100599, 461320, 461327) is perfonned as well.
4.2 Emergency Control Air Compressor The chilled water system is the preferred source of cooling water for the Emergency Control Air Compressor (ECAC) in each unit. Because both ECACs (one in each unit) are cross-tied, and provide back-up for each other, there is no credible single failure of the CH system that will cause both ECACs to fail. In addition, for operational flexibility service water is available as a backup cooling water source for each air compressor.
4.3 Safety Related System Isolation The safety related portion of the chilled water system is separated from the non safety portions in some instances by a single safety related check valve. The following locations fall into this category:
Valve No.
Size 1CH61 (2CH61) 3"
- 1CH132, 2"
1 CH260 (2CH260) 1" 1CH55 (2CH55) 1" Description Return from the PACU's Return from Unit 2 Lab Coolers Return from Radiation Monitor Enclosure Potable Water Supply To Chilled Water In these cases, the referenced check valves are safety related components, located in safety related seismically supported piping and separate the return piping from the non-safety class portions of the chilled water system.
By itself, a failure of a check valve to fully close does not affect the operation ofthe chilled water system. Redundant isolation valves are provided on the supply line to the nonsafety related loads.
These valves will isolate flow to the nonsafety related heat loads. The only time that a failure of a
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 141212 BE No.: S-C-CH-MEE-1139 RevNo.: 0 Page 4 of 7 Date: February 4, 1997 TITLE: Chilled Water Systgm (CH)- Single Failure Criteria Vulnerability Assessment check valve will impact the CH system is if the pressure boundary associated with the non-safety related loads also fails, allowing leakage that could drain the CH system. This scenario requires two failures, the check valve failing to close, and a failure of the piping system. This does not constitute a single failure point during normal operation or during a Loss of Coolant Accident (LOCA).
However, because some of t.he piping to the non-safety related loads is non-seismic class, failure of the piping is assumed during a safe shutdown earthquake (SSE). If an SSE occurred (without a LOCA), the Unit(s) would be shut down. If the earthquake caused a failure of the non-safety related chilled water piping, and a check valve failed open, procedure S2/S LOP-AB.CAV-0001 Loss of Control Area HV AC" provides guidance to establish alternate cooling (References 6.9, and 6.10).
The chilled water system does not connect to or interface with the primary coolant pressure boundary, the nuclear fuel or the reactivity control system. Therefore, any failure of the chilled water system is not a UFSAR Chapter 15 type accident initiator. Because the primary coolant system is designed to withstand an SSE and still maintain pressure integrity (UFSAR Section 5.2.1.2, Ref.
6.5), an SSE cannot initiate a LOCA. Therefore, a Loss of Coolant Accident (LOCA) and an SSE are independent events.
Per 50.59 Safety Evaluation number S96-177 (Ref. 6.6), Salem station is not designed for a LOCA coincident with a safe shutdown earthquake. This safety evaluation also demonstrates that a SSE within seven days following a LOCA is not credible. Therefore, a LOCA concurrent with a seismic event is not a postulated event. After the immediate stabilization phase of the postulated LOCA, there are sufficient resources of time and personnel available to manually isolate the affected piping. This will preclude any loss of function ofthe chilled water system due to an SSE.
Additionally failure of a check valve is unlikely because all valves are regularly tested as part of the plant ISI!IST program (Ref. 6.1, Ref. 6.2, Ref. 6.3, and Ref. 6.4) along with regular scheduled preventive maintenance.
4.4 Operational Considerations for Chiller and Pump Alignments The chilled water system consists of three 50% capacity chillers and two 100% capacity circulating pumps in each Salem unit. Each chiller is powered from a separate Diesel backed bus, and each of
- the circulating pumps is also powered from a separate Diesel bus. During emergency operation, two chillers and one pump will meet all the safety related chilled water cooling load requirements for that respective unit. This provides some flexibility for back*up and maintenance. The common control room envelope provides additional flexibility by cooling the CRE with a single CREACS coil using the maintemi.lui mode (Reference 6.7).
For a complete discussion of the various operational modes and system operating requirements, see the CH System Mode¬Ops calculation SCCH-MDCl629 (Reference 6.8) 5.0 Conclusions l11e CH system has several single failure vulnerabilities. Although not ideal compared to today1s standards, the design of the chilled water system is consistent with other Salem HV AC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. However, because calculation S-C-CAV-MDC-1640 (Reference 6.11) has determined that the consequences of the CH168 valve failing to open are unacceptable, temporary modifications are
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS.AND CHANGES PRINTED20 14 1212
- u EENo.: S-C-CH-MEE-1139 Rev No.: 1 NOVEMBER 16, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 5.0 Conclusions The CH system has several single failure vulnerabilities. Although not ideal compared to today's standards, the design of the chilled water system is consistent with other Salem HVAC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. The consequences of the CH168 failing to open have been addressed as described above. Consequences of all other identified failures are acceptable, as discussed above.
The ongoing testing and maintenance programs provide confidence that the auxiliary building chilled water system will continue to provide the required heat removal for the control room area (CAACS and CREACS), and the ECAC.
To enhance the post LOCA availability of the CH system in the event of a seismic event, the following suggestion is made:
Modify the EPIPS such that within seven days after a LOCA the non-safety related chilled water loads are manually isolated (AR 970204152 to track implementation).
6.0 References 6.1 St.OP-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.2 S2.0P-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.3 SH.RA-IS.ZZ-0151(Q) REV. 1; Non-Intrusive Check Valve Testing Data Collection 6.4 SC.RA-AP.ZZ-0021(Q) REV. 5; lSI Group Examination and Test Activities 6.5 Salem Updated Final Safety Analysis Report.
6.6 50.59 Safety Evaluation Number 896-177.
6.7 S-C-CAV-MDC-1570 Revision 1; Units 1 & 2 Control Room Envelope Equilibrium Temperatures 6.8 S-C-CH-MDC-1629, Revision 0; Mode Ops Analysis Aux. Bldg. Chilled Water System Units 1 & 2 (Draft) 6.9 S1.0P-AB.CAV-0001 "Loss of Control Area HV AC" (Draft) 6.10 S2.0P-AB.CA V-0001 Loss of Control Area IN AC" (Draft) 6.11 S-C-CAV-MDC-1640 EACS Operation with Single Failure of Cooling Coil" Rev 1.
(In approval cycle)
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 1412 12 Page 6 OF 7 EENo.: S-C-CH-MEE-1139 RevNo.: 1 NOVEMBER 16,1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 7.0 Effects On Other Technical Documents None 8.0 Attachments 8.1 Sketch of Chilled Water Flow Path 8.2 Unit 1 Failure Modes and Effects Analysis 8.3 10 CFR 50.59 Applicability Review for S-C-CH-MEE-1139/Revision 1
USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20141212 Page 7 OF 7 EE No.: S-C-CH-MEE-1139 Rev No.: 1 NOVEMBER 17, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 9.0 Signatures
!1/J{q?
KURT DOTEN NAME (PRINT) 14:/!fY RAYMOND RUNO\\NSKI NAME (PRINT)
/.((! ({9 NEAL MOTLEY DATE NAME {PRINT)
I '2./J_fE 9 t)
JOHNZUDANS NAME (PRINT)
1 CHI 68 (2CH1 68) 1 Chilled Water Flow Sketch.1 to S-C-CH-MEE-11 39 Page 1 of 1 Lab, PASS, and Count Rm. Coolers (Unit 2 only) 1 CH74 (2CH74) 1 CH132 (Unit 2 only)
\\..-
'(
.... r.....
\\.
P Q
.......,.,.I I J
11 1..'
"*r-"
1 CH61 (2CH61 )
1 CH260 (2CH260)
I
'i lit - -,.1 l
.r
... N.. _..
i i i
i CH150 (Unit 2 only) 1 CH117 (Unit 2 only) 1 CH 1 51 (2CH151) 1 CH252 (2CH252) 1CH30 (2CH30)
I CH253 (2CH253) i 1 CH21 6 (2CH216)
Potabe Water Supply 1 1 (21 )
Chiller 1 2 (22)
Chiller 1 3 (23)
Chiller 1 CH2 (2CH2) i CH55 (2CH55) i 1 CH 1 3 (21CH 1 3) 1 1 (21 ) Chilled Water Pump 1 2CH1 3 (22CH13) 12 (22}
Chilled Water Pump Expansion Tank I
u c
/O Ul z r-rl
-l ;;o fTl o AJ N r'l o Ul O u
-l'- 0 O z
, Ul N rn r
fTl
'l 0
- o fTl
- o
'l z
GJ
- o fTl l7i 0
z Ul
-1
)>
-1 c
Ul
)>
z 0
()
I
)>
z GJ fTl Ul
.2 to S-C-CH-MEE-1139 Component Failure Mode 11CH13 (Check Fails Closed Valve)
Fails Open (with Pump 1CHE5 Off)
- 13 Chiller Trips/fails to start Chiller operates with degraded performance Failure Mech.aiDsm Mechanical Binding Mechanical Binding Control malfunction Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Onlf)
Effects Detection Loss of flow from 1CHE5. Loss FL-1652 of cooling to all safety related Alarms loads. Trip of operating chiller(s) from low flow switch. or low chilled water outlet temperature.
Possible pump damage if operated for long period of time at shut-off.
Reduced flow from Pump FL-1652 1 CHE6 due to short cycling flow Alarms through idle pump 1CHE5. May cause chillers to trip on low flow.
Loss of one 50% capacity chiller Chiller Trip local indicating light Diesel Power train Loss of one 50% capacity chiller Chiller Trip Malfunction local indicating light Loss of service Loss of one 50% capacity chiller Chiller Trip water flow local indicating light Control Less than full capacity of chiller Incidental malfunction available. reduced cooling to observation safety related loads Single Failure No No No No No No A dive Yes Note (1)
Yes Note (1)
Yes Yes Yes Yes Page 1 of 9 Mitigation! Comments Pump 1CH6 and check valve 12CH13 provides 100% redundancy Opeiator action to manually close Valve 11CH14 Remaining two 50% capacity chillers can provide cooling for all safetv related loarls.
Remaining two 50% capacity chillers can provide cooling for all safety related loads. Remaining chillers powered from independent diesel sources.
Remaining two 50% capacity chillers can provide cooling for all safetv related loads.
Remaining two 50% capacity chillers can provide cooling for all safety related loads.
I l
I I
i I
u c
- Q lll z rrl
-l ;;o r'1 o ;;o N r'l o lll 8 --o
-1>-- 0 8 z C l/l N -
[JJ I
r'1
'l 0
- o r'1
- o
'l z
GJ
- o r'1 lJl 0
z lJl
---1
)>
z 0
0 I
)>
z GJ r'1 lJl
.2 to S..C-CH-MEE-1139 Component Failure Mode
- 12. Chiller Trips/fails to start Chiller operates with degraded performance
- 1 1 Chiller Trips/fails to start Chiller operates with degraded performance 1CH151 (Air Fails Open Operated Valve)
Failure Mecllanism Control malfunction Salmt Unit 1 Auxiliary Building Chilled Water Systmt Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detcrlion Loss of one 50% capacity chiller Chiller Trip local indicating light Diesel Power train Loss of one 50% capacity cru1ler Chiller Trip Malfunction local indicating light Loss of service Loss of one 50% capacity chiller Chiller Trip water flow local indicating liht Control Less than full capacity of chiller Incidental malfunction available. reduced cooling to observation safety related loads Control Loss of one 50 % capacity chiller Chiller Trip malfunction local indicating light Diesel Power train Loss of one 50% capacity chiller Chiller Trip Malfunction local indicating light Loss of service Loss of one 50% capacity chiller Chiller Trip water flow local indicating light Control Less than full capacity of chiller Incidental malfunction available. reduced cooling to observation safety related loads Mechanical If during DBE loss of cooling to Position binding safety related loads, from leakage indication in in non-seismic portion of system CR.
Control Signal If during DBE loss of cooling to Position failure safety related loads, from leakage indication in in non-seismic portion of system CR.
Page 2 of 9 Single Active MitigationlCommeuts Failure No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loads.
No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loads. Remaining chillers powered from independent diesel sources.
No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loods.
No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loads.
No Yes Remaining two 50 % capacity chillers can provide cooling for all safety related loads.
No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loads. Remaining chillers powered from independent diesel sources.
No Yes Remaining two 50% capacity chillers can provide cooling for all saf related loads.
No Yes Remaining two 50% capacity chillers can provide cooling for all safety related loads.
No Yes Redundant isolation valve 1 CH30 No Yes Redundant isolation valve 1CH30 LJ C
- 0 Ul z rrl
--1 ::::0 fTl o :::o N f'l o lfl O u 0
O z C Ul N m I
fTl
'l 0
- 0 fTl
- 0
'l z
Cl
- 0 fTl U) 0 z
Ul
--1
)>
--1 c
Ul
)>
z 0
n I
)>
z GJ fTl Ul
.2 to S-C-CH-MEE-1 139 Component Failure Mode Failure Mechanism 1CH30 (Air Fails Open Mechanical Operated Valve) binding Control Signal failure 1CH232 (Check Fails Closed Mechanical Valve) binding 1CH216 (Air Fails Closed Mechanical Operated Valve) binding Controls
. Malfunction 1CH218 (air Fails Closed Mechanical operated valve) binding Controls malfunction 1 CH74 (Air Fails full bypass Mechanical operated 3-way flow binding TCV)
Controls malfunction Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detection If during DBE loss. of cooling to Position safety related loads, from leakage indication in in non-seismic portion of system CR.
If during DBE loss of cooling to Position safety related loads, from leakage indication in in non-seismic portion of system CR.
Loss of cooling to Emergency High Control Air Compressor, failure Temperature of compressor alarm on compressor Loss of all cooling to one ECAC.
High Failure of compressor.
Temperature alarm on compressor Loss of all cooling to one ECAC.
High Failure of compressor.
Temperature alarm on compressor Loss of cooling to one ECAC High after cooler and cylinders.
Temperature alarm on compressor Loss of cooling to one ECAC High after cooler and cylinders.
Temperature alarm. on compressor Loss of cooling to CAACS High temperature in Electrical Equipment and Relay rooms.
Loss of cooling to CAACS High temperature in Electrical Equipment and Relay rooms.
Page 3 of9 Single Active Mitigation!Commt!llts Failure No Yes Redundant isolation valve 1CH151 No Yes Redundant isolation valve 1CH151 No Yes Redundant compressor for Unit 2.
Note Operator action to line-up service (1) water cooling.
No Yes Redundant compressor for Unit 2.
Operator action to line-up service water cooling.
No Yes Redundant compressor for Unit 2.
Operator action to line-up service water cooling.
No Yes Redundant ECAC cross tied from other unit. Operator action to open manual bypass valve 1CH219.
No Yes Redundant ECAC cross tied from other unit. Operator action to open manual bypass valve 1CH219.
Yes Yes Valve modulates to control temperature. unlikely to be full bypass. Testing and.PM increase reliability. Operator action to repair/restore flow to CAACS No Yes Redundant controls u c
- 0 (!)
z [Tl.
---1 :::0
[Tl o :::o N f'l o l/)
M u
^ 0 M z
':::;'(/)
N -
OJ r
[Tl
'l 0
- 0
[Tl
- 0
'l z
G)
- 0
[Tl i:fi 0
z l/)
---1
)>
---1 c
l/)
)>
z 0
n I.
)>
z GJ
[Tl l/)
.2 to S-C-CH-MEE-1139 Component Failure Mode Failure Mechanism 1 CH168 {Air N/A N/A operated temperature control valve) 1CH55 (check Fails closed Mechanical valve) binding Fails open Mechanical binding Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detection Single Failure NJA N/A N/A Loss of make-up capability.
LA-4156 Yes Alarms. Also S1/S2.0P-DL.ZZ-0006{0)
Primary logs.
If concurrent with a seismic LA-4156 Yes event, draining of expansion Alarms. Also tank via the non-safety related S1/S2.0P-potable water make-up piping.
DLZZ-Loss of make-up capability.
0006(0)
Pump damage from low NPSH.
Primary Loss of cooling to safety related Logs.
. loads. _
Active Mitigation/Comments NJA Control air as well as the temperature controller have been disconnected from CH 168. The fail is now in permanently in the full open (fail-safe) position.
Yes Loss of inventory will be Note (1} slow with only normal leakage. Operator action to provide alternate make-up source.
Yes Passive failure of non-Note (1) safety class piping is not an accident initiator. The CH system is not required to withstand a LOCA concurrent with a DB E.
Operator action to close valves 1 CH3 or 1 CH 1.
Page 4 of 9 I
-o c
- 'Q VJ z r'l
-1 ;::o r'1 o :::o N r'l o UJ 8 -o
.P. O 8 z
- Vl N -
CD r
r'1
'1 0
- o r'1
- o
'1 z
C)
- o r'1 Vi 0
-1
)>
-1 c
Vl
I 0
n J:
)>
z
- C) r'1 Vl
.2 to S-C-CH-MEE* 1 139 Component Failure Mode Failure Mechanism 1CH2 (air Fails closed Loss of air operated LCV)
Mechanical binding Control malfunction Fails open Mechanical binding Control
roo Satan Unit 1 Auxiliary Building Chilled Warer System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detection Loss of automatic make-up LA-4156 capability.
Alarms. Also SliS2.0P-DL.ZZ-0006(Q)
- "L" Logs.
Loss of automatic make-up LA-4156 capability.
Alarms. Also S IIS2.0P-DL.ZZ-0006(Q)
Primarv Lo_gs.
Loss of automatic make-up LA-4156 capability.
Alarms. Also SliS2.0P-DL.ZZ-0006(Q)
Primary Logs.
Overfill of expansion lank, LA-4156 possible flooding of expansion Alarms. Also tank area Sl/S2.0P-DL.ZZ-0006(Q) wu.y Logs.
Overfill of expansion tank, LA-4156 possible flooding of expansion Alarms. Also tank area S11S2.0P-DL.ZZ-0006(Q)
Primarv Logs.
Page 5 of 9 Single Activ:e Mitigation/Comments Failure Yes Yes Loss of inventory will be slow with only normal leakage. Operator action to open manual bypass valve ICH57 Yes Yes Loss of inventory will be slow with only normal leakage. Operator action to open manual bypass valve 1CH57 Yes Yes Loss of inventory will be slow with only normal leakage. Operator action to open manual bypass valve 1CH57 Yes Yes Operator action to close valves 1CH3 or lCHl Yes Yes Operator action to close valves 1CH3 or lCHI
-o c
- o ())
z f'l
---j/0 fTl o /0 N f'l 0 ())
8 -o
-1:>- 0 8 z C ())
N m I
fTl
'1 1 0
- o fTl
- o
'l z
Cl,
i
- o J f'l.
())
6 '
z
())
-l
- r>
-l c
())
- r>
z 0
n I
- r>
z Cl fTl
())
.2 to S-C-CH-MEE-1 139 Component Failure Mode 1CH616 (Air Fails Closed operated PCV)
Fails open 1CH147 {Air Fails open operated PCV)
Fails Closed 1CH416 (check Fails open valve)
Fails closed 1 CH61 (check Fails open valve)
Failure Mechanism Mechanical Control malfunction Mechanical Control malfunction Mechanical Control malfunction Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detection Loss of capability to vent None nitrogen to conqolpressure.
Loss of capability to vent None nitro to control pressure.
Venting of nitrogen blanket.
None Increased corrosion in system Venting of nitrogen blanket.
None Increased corrosion in system.
Increase expansion tank pressure None to float on N2 header pressure.
May overpressurize portions of system.
Increase expansion tank pressure None to float on N2 header pressure.
May overpressurize portions of system.
Mechanical faJ.1ure Loss of ability to pressurize None expansion tank Control Loss of ability to pressurize None malfunction expansion tank Mechanical If concurrent with a seismic None binding event, venting of nitrogen blanket via the non-safety related nitro<>en supply piping.
Mechanical Loss of ability to pressurize None binding expansion tank Mechanical If concurrent with a seismic LA-4156 binding event, draining of system Alarms. Also through non-safety related piping S11S2.0P-to the Penetration Area Cooling DL.ZZ-Unit piping. Loss of cooling to 0006(Q) saf related heat loads Primary Logs.
Single Active Failure No Yes No Yes Yes Yes Yes Yes No Yes No Yes Yes Yes Yes Yes Yes Yes Note (1)
Yes Yes Note
{1)
Yes Yes Note (1)
Page 6 of 9 Mitigation/Comments Relief valve 1CH143 will open at 24 psi g.
Relief valve 1CH143 will open at 24 psig.
The required NPSH for the CH pumps is 11 ft, without N2 approximately 30 ft is available.
The required NPSH for the CH pumps is 1 1 ft, without N2 approximately 30 ft is available.
Relief valve 1CH143 will open at 24 psig Relief valve 1CH143 will open at 24 pSig The required NPSH for the CH pumps is 1 1 ft, without N2 approximately 30 ft is available.
The required NPSH for the CH pumps is 1 1 ft, without N2 approximately 30 ft is available.
The required NPSH for the CH pumps is 11 ft, without N2 approximately 30 ft is available..
The required NPSH for the CH pumps is 11 ft, without N2 approximately 30 ft is available..
Operator action to close 1 CH60.
u c
- 0 VJ >
z l'l
-j :::O 1'1 o :::o N i'l o Vl
- u
+>- 0 8 z 7 (/)
N CO r
1'1
'l 0
- 0 f'l
- 0
'l z
C)
- 0 f'l Vi 6
I c
(/)
)
()
I
)>
z C) 1'1
(/)
.2 to S-C-CH-MEE-1139 Component Failure Mode 1CH260 (Check Fails closed valve)
Fails open 1CH253 (Air Fails closed operated isolation valve)
Fails open Failure Mechanism Mechanical binding Mechanical binding Salan Unit 1 Auxiliary Building Chilled Water Systtm Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Effects Detection Loss of cooling to rad monitors Temperature alarms on rad monitors If during a DBE draining of CH LA-4156 system through non-safety related Alarms. Also piping to rad monitors. loss of Sl/S2.0P-cooling to safety related loads DL.ZZ-0006(Q)
Primary Logs.
Mechanical failure Loss of cooling to rad monitors Temperature alarms on rad monitors Control Loss of cooling to rad monitors Temperature malfunction alarms on rad monitors Mechanical failure If during a DBE draining of CH LA-4156 system through non-safety related Alarms. Also piping. Loss of cooling to safety SliS2.0P-related loads.
DL.ZZ-0006(Q)
Primary Logs.
Control If during a DBE draining of CH LA-4156 malfunction system through non-safety related Alarms. Also piping. Loss of cooling to safety Sl !S2.0P-related loads DL ZZ-0006(Q)
Prima_!)'_ Logs.
Single Active Failure Yes Yes Note (1)
Yes Yes Note (1)
Yes Yes Yes Yes No Yes No Yes Page 7 of 9 Mitigation/Comments The radiation monitors are not required to function during a LOCA. or a DBE. The only function that they provide is for detection of a steam generator tube rupture.
Passive failure of non-safety class piping is not an accident initiator. The CH system is not required to withstand a LOCA concurrent with a DBE. Operator action to close manual valves ICH260 or 1CH261.
The radiation monitors are not required to function during a I
LOCA. or a DBE. The only function that they provide is for I
detection of a steam generator tube rupture..
I The radiation monitors are not I
required fo function during a LOCA, or a DBE. Safety function is 1 only for detection of a steam generator tube rupture.
I Redundant valve 1CH252 will be I I able to isolate on low pressure to rad monitors I
I i
Redundant valve 1 CH252 will be I
able to isolate on low pressure to rad monitors I
u c
- s! Ul z 1'1.
---1 :;u '
1'1 o :::o N I'l o Vl M u
.P. O M z Ul N
OJ 1'1 0
- u 1'1
- u z
C)
Fg; Ul 6
z Ul
---1
)>
---1 c
Ul
)>
z 0
n
- r::
)>
z C) 1'1 Ul
.2 to s-c-CH-MEE-1139 Component Failure Mode
. 1CH252 (Air Fails closed operated isolation valve)
Fails open
- 1 1 Chilled Pump stops water pump 1CHE5
- 12 Chilled Pump stops water pump 1CHE6 Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Failure Effects Detection Mechanism Mecbaillcal failure Loss of cooling* to rad monitors Temperature alarms on rad monitors Control Loss of cooling to rad monitors Temperature malfunction alarms on rad monitors Mechanical failure If during a DBE draining of CH LA-4156 system through non-safety related Alarms. Also piping to rad monitors. loss of Sl/S2.0P-cooling to safety related loads.
DLZZ-0006(Q)
Primary Loi:!:S.
Control If during a DBE draining of CH LA-4156 malfunction system through non-safety related Alarms. Also piping to rad monitors. loss of Sl/S2.0P-cooling to safety related loads.
DL.ZZ-0006(Q)
Primary LQgs.
Mechanical failure Loss of flow to chillers. Loss of Flow alarm FL-cooling to safety related heat 1652 loads.
Electrical failure Loss of flow to chillers. Loss of Flow alarm FL-cooling to safety related heat 1652 loads.
Mechanical failure Loss of flow to chillers. Loss of Flow alarm FL-cooling to safety related heat 1652 loads.
Electrical failure Loss of flow to chillers. Loss of Flow alarm FL-cooling to safety related heat 1652 loads.
NOTES Page S of 9 Single Active MitigationlComments Failure Yes Yes The radiation monitors are not required to function during a LOCA. or a design basis earthquake. The only function that they provide is for detection of a steam generator tube rupture..
Yes Yes The radiation monitors are not required to function during a LOCA, or a design basis earthquake. The only function that they provide is for detection of a steam R'enerator tube rupture.
No Yes Redundant valve 1CH252 will be able to isolate on low pressure to rad monitors No Yes Redundant valve 1CH252 will be able to isolate on low pressure to rad monitors No Yes Redundant pump 1 CHE6.
No Yes Redundant pump 1 CHE6.
No Yes Redundant pump 1 CHE5.
No Yes Redundant pump 1 CHE5.
--o c
- OVl z l'l
-j :::O l'l o :::o N i'l o Vl L --o
-JO>. O l z 7 Vl N -OJ I
l'l
---1 0
- 0 l'l
- 0
'l z
C)
- 0 l'l Ul 0
z
)>
z 0
i
Vl,
.2 to S-C-CH-MEE-1 1 39 Salem Unit 1 Auxiliary Building Chilled Water System Failure Modes and Effects Analysis-LOCA Condition (Active Failures Only)
Note 1 : At the time of the Salem design, check valves were considered as "passive" devices, this position was accepted by the NRC. Current design standards do not permit a single check valve to function as the class boundary between safety and non-safety related piping.
Note 2: Deleted Page 9 of 9 u c AJ (J) z l'l
--j :;o 1'1 o AJ N i'l 0 (/)
8 u
-J0.- 0 6 Bi t N m l 1'1
'l 0
- o rrJ
- o
'l z
GJ
- o 1'1
(/)
0 z
(/)
--1
)>
--1 c
I n
I
)>
z GJ 1'1
(/)
LRfN15-0232 Technical Evaluation 801 10953-0105, "Chilled Water System Crosstie FMEA"
1 Revis ed to include Licensing comments
- * * * * * * * * * * * * *Long Text Obj ec t Ident i f i cation* * * * * * * * * * * * *
- Order 0 0 0 0 8 0 1 1 0 9 5 3 Operation 0 1 0 5 Confi rmat ion 0 0 1 2 7 0 2 4 3 8 Confirmation counte r 0 0 0 0 0 0 0 5 Long text DOCUMENT # :
8 0 1 1 0 9 5 3 - 0 1 0 5 TITLE :
Chi l led Water Sys tem Crosstie FMEA REASON FOR EVALUATION / SCOPE :
LAR S 1 4 - 0 4 i s being prepared to reques t a change to the Chi l led Water
( CH )
System Technical Spec i f i ca t i on 3. 7. 1 0.
One of the reque s ted changes i s to allow use of the exis ting CH Sys tem c ros s t ie between the two unit s to allow one uni t 1 s chi l l ers to be removed from s ervic e in order to perform maintenance on c ommon l ine components on that uni t.
Thi s evaluat ion performs a Failure Modes and E f fects Analys is
( FMEA) over use of the c ro s s t i e.
The scope o f thi s Techni cal Evaluation was reviewed under procedure HU-AA - 1 2 1 2 as part of the pre - j ob brief.
The result ing Risk Rank was 1, which cal l s for exist ing process reviews.
In thi s c as e.
the Technical Evaluat ion i s safety-related,
s o an independent review i s performed.
DETAILED EVALUATION.:
General Des ign Criterion 4 4,
11 Cool ing Water 11 s tates that 11 suitable redundancy in components # sha l l be provided to assure that # the sys tem s af ety func t ion can be accomp l i shed,
assuming a s ingl e fai lure 11
The evaluation addre s s e s s ingle act ive fai lure vulnerab i l i t i e s.
Use of the CH cros s t ie doe s not impac t the funct ion of the components current ly addressed in the evaluat ion or the impac t of a fai lure of any of these component s.
The current FMEA i s cons istent with draft Standard Review Plan 9. 2. 7,
11 Chi l l ed Water11
System analyse s in support of LAR S 14 - 0 4,
whi ch inc ludes evaluation o f the CH sys tem cro s s tie alignment.
The analyses addres s a single fai lure o f a chil ler or pump on the uni t with the available chi l lers.
The c :ro s s t i e l ines thems e lves do not c ontain any act ive components, and thus no new act ive fai lure mechani sms are introduced.
Both the supply and return l ines contain a s ingle manual i s olation valve.
Once opened,
there is no fai lure mechanism that wi l l cause e ither of thes e valves to go c losed.
Admini s t rat ive cont ro l s wi l l be es tabl i shed to ensure the valves s tay open for the duration the
. c ros s t i e i s needed.
2 The CH system i s a medium ene.rgy sys tem.
Medium Energy Line Breaks
( MELB )
for all medium energy systems <;.re addres sed by Reference 4 1 and thus thi s i s not a new fai lure mechanism.
CONCLUSIONS/ FINDINGS :
Use of the CH System cross t i e does not impact the failure e f fects of CH System act ive and pas s ive fai lures current ly analyzed.
The cros stie l ines do not contain any active components and do not introduce any new fai lure mechani sms.
The results.of thi s Technical Evaluat ion wi l l be incorporated into S - C - CH-MEE - 1 1 3 9 upon NRC approval of LAR S 1 4 - 0 4
[ 8 0 1 1 0 9 5 3 - 0 1 0 6 ].
REFERENCES :
1.
S - C - CH-MEE - 1 13 9, Revi s ion 1, Chil l ed Water System Single Fai lure Criteria Vulnerability Asses sment 2.
Revi s ion 2, Chi ller Service Water Flow Requirements
[is sued per Tecb,nical Evaluation 8 0 1 1 0 9 5 3 - 00 1 5 ;
pending NRC approval of LAR S 14 - 04 ]
3.
S - C - CAV-MDC - 2 3 2 0, Revi s ion 1, Evaluat ion o f the Control Area Vent i lation System During Chi l led Water System Chil ler Replacement
[ is sued per Technical Evaluat ion 8 0 1 1 0 9 5 3 - 0 0 1 5 ;
pending NRC approval of LAR S 1 4 - 0 4 ]
4.
S - C - Z Z - SDC - 12 0 3,
Revis ion 3 1 Moderate Energy Break Analy s i s BREPARER :
Kevin King Date :
See SAP INDEPENDENT REVIEWER:
Robert Garver Date :
See SAP LICENSING REVIEWER ;
Brian Thomas Date :
See SAP APPROVED :.
See SAP Date :
S ee SAP