ML19332F409

Proposed Tech Specs Re RHR Sys Autoclosure Interlock

ML19332F409
Person / Time
Site:	Sequoyah
Issue date:	12/08/1989
From:	TENNESSEE VALLEY AUTHORITY
To:
Shared Package
ML19332F406	List: ML19332F405 ML19332F409
References
NUDOCS 8912140391
Download: ML19332F409 (30)

Text

ny,,

\\

.m

,n v6 s

f

't ' ;.-

a 4

".s~ y..y a-. t -,

p,)

- ENCLOSURE 1

,n t

s J

PROPOSED TECHNICAL SPECIFICATION CHANGE j

SEQUOYAH NUCLEAR-PLANT UNITS 1 AND 2-l

-DOCKET NOS. 50-327.AND 50-328 (TVA-SQN-TS-89-18)

]

c,

- 1 e

u.

t

)

F

')

\\;

j).

"l s.

LIST OF AFFECTED PAGES.

i Unit 1 3/4 5-6 I

i Unit 2

,3/4 5-6 i

1

+

e f.

t o

1 i

_ t I

L l.. ?

i p

i t

', PDR;

• t

=- P7 1

-r

s. c

-w u

+,

.,.+r

-pre,.,,.

,.,,,----,,.%---w

,4 s.,,-,

y,-ry.ww vyn y,-=m e - c,.fmve v-ww-e--.'r'

c t

' EMERGENCY CORE COOLING SYSTEMS (ECCS) e T

SURVEILLANCE REQUIREMENTS (Continued) s Valve Number Valve Function Valve Position a.

FCV-63-1 RHR Suction from RWST open

- b.

FCV-63-22 SIS Discharge to Common Piping open b.

At least once per 31 days by:

1.

Verifying that the ECCS piping is full of water by venting the ECCS pump casings and accessible discharge piping high points, and 2.

Verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position, By a visual inspection which verifies that no loose debris (rags, c.

trash, clothing, etc.) is present in the containment which could be transported to the containment sump and cause restriction of the s

pump suctions during LOCA conditions.

This visual inspection shall be performed:

1.

For all accessible areas of the containment prior to y

establishing CONTAINMENT INTEGRITY, and 2.

Of the areas affected within containment at the completion of each containment entry when CONTAINMENT INTEGRITY is established, d.

At least once per 18 months by:

1. A '-

• ntnmatic 4enn+4nn ana u - ' a -- H a n ^ < n n"P

',[l ' l# ', f _ _ i.uw -

sy. i 'I.. '.'. E..s! 2, T..'. I ' n.. l i+!, "? _ _ s ' _.

t tr. _..

nrauwr uvvious w.

om ovv>=u+

Sycter pressure is ebvv. 700 poig.

R96 2.

A visual inspection of the containment sump and verifying that the subsystem suction inlets are not restricted by debris and that the sump components (trash racks, screens, etc.) show no evidence of structural distress or corrosion, At least once per 18 months, during shutdown, by:

e.

1.

Verifying that each automatic valve in the flow path actuates to its correct position on a safety injection test signal and.

automatic switchover to containment sump test signal.

9 f '

E=3 SEQUOYAH - UNIT 1 3/4 5-6 Amendment No. 92 December 29, 1988 1.

' EMERGENCY CORE COOLING SYSTEMS P

SURVEILLANCE REQUIREMENTS (Continued)

I i

Valve Number Valve Function Valve Position a.

FCV-63-1 RHR Suction from RWST open b.

FCV-63-22 SIS Discharge to Common Piping open b.

At least once per 31 days by:

1.

Verifying that the ECCS piping is full of water by venting the ECCS pump casings and accessible discharge piping high points, and 2.

Verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

1 By a visual inspection which verifies that no loose debris (rags, c.

trash, clothing, etc.) is present in the containment which could be transported to the containment sump and cause restriction of the pump suctions during LOCA conditions.

This visual inspection shall be performed:

l 1.

For all accessible areas of the containment prior to establishing CONTAINMENT INTEGRITY, and 2.

Of the areas affected within containment at the completion of each containment entry when CONTAINMENT INTEGRITY is established, d.

At least once per 18 months by:

3 f f". W - -..~ -,

<..,.,s..

. q s. u,.c

,,.s<...e s u oun sytt z... ;. r... :.r.. r,.. =... evv =... A.. r..... r... ;;,;;,; w um, m.

7 Syst a preiewim is sove 700 psig.

R82 2.

A visual inspection of the containment sump and verifying that the subsystem suction inlets are not restricted by debris and that the sump components (trash racks, screens, etc.) show no evidence of structural distress or corrosion, At least once per 18 months, during shutdown, by:

e.

1.

Verifying that each automatic valve in the flo path actuates to its correct position on a safety injection test signal and automatic switchover to containment sump test signal.

\\

SEQUOYAH - UNIT 2 3/4 5-6 Amendment No. 82 December 29, 1988

- m-

~ ~.... _.. _.

?'

4-

.s-

• s ENCLOSURE 2 e

'f

}..

PROPOSED TECHNICAL SPECIFICATION CHANGE I

SEQUOYAH NUCLEAR PLANT UNITS 1.AND 2 j

y i-DOCKET NOS. 50-327 AND 50-328 4

I- -

[::

(TVA-SQN-T3-89-18)

(

c.

[

DESCRIPTION AN'J JUSTIFICATION FOR l

DELETION OF RESIDUAL HEAT REMOVAL AUTOCLOSURE INTERLOCK i

r-c L

i l

h-F.

I

'i i:

F

!i

.I i ~'.

)

~}

i i

-l f

l T

~

A

i o

ENCLOSURE 2 i

l Description of Change J

Tennessee Valley Authority proposes to modify the Sequoyah Nuclear Plant (SQN) Units 1 and 2 technical specifications (TSs) to delete surveillance requirement (SR) 4.5.2.d.1.

This surveillance requires verification of the automatic isolation and interlock action of the residual heat removal (RHR) system from the reactor coolant system (RCS) when the RCS pressure is above 700 pounds per square. inch gage.

Reason for Change The spurious initiation of the autoclosure interlock function of the RHR system has been identified as a major contributor to accidents involving loss of RHR cooling capabilities during nonpower operations. As documented in Westinghouse WCAP-11736, studies have shown that loss of RHR cooling during nonpower operations is a major contributor to the likelihood of a core damage accident.

In order to reduce the likelihood of this accident, it is recommended that the autoclosure function of the RHR system be deleted.

Westinghouse Electric Corporation performed analyses (Westinghouse WCAP-11736) that evaluated the removal of the autoclosure interlock on a generic basis. NRC accepted the analyses in an August 8, 1989, letter to the Westinghouse Owners Group. The Westinghouse report demonstrated that the overall effect of the interlock deletion is a net improvement in plant safety and recommends the deletion for all Westinghouse Owners Group plants. TVA calculation SQN-SQS2-0097 demonstrates the applicability of the Westinghouse report to SQN. A copy of the calculation is attached to this enclosure.

Justification for Change A probabilistic analysis was used in WCAP-11736 to demonstrate that the deletion of the autoclosure interlock is acceptable from both a core safety and RER system overpressurization standpoint. The deletion of the autoclosure interlock and the addition of a control room alarm are beneficial in reducing the frequency of an interfacing systems loss of coolant accident (LOCA) c.nd the potential for a significant radionuclide release outside containment. Autoclosure interlock deletion reduces the number of spurious closures of the RHR suction valves, and this increases the availability of the RHR system. The major impact with respect to i

overpressure concerns is that removal of the autoclosure interlock will 4

significantly reduce the number of RHR letdown isolation transients.

Removing the autoclosure interlock function of the RHR system will not

]

adversely impact any design basis event considered in SQN's Final Safety Analysis Report (FSAR). The RHR suction valves are closed during Modes 1 l

2, and 3 with the power removed from the motorized actuators. Autoclosure i

interlock deletion will not alter this feature of the RHR system. The i

only FSAR Chapter 15 event proposed to occur during Modes 4, 5, or 6 is l

the uncontrolled boron dilution event. Since rate of reactivity l -

insertion, not RER system overpressurization, is the concern in this l

accident, the autoclosure interlock function is not considered in the 1

analysis.

l

F 3

i A physical modification will be made to disconnect the autoclosure interlock during all modes of operation. Additionally, an alarm in the main control room will be installed to alert the operators when RCS pressure increases above the setpoint and double valve isolation between

'the RHR system and RCS is not maintained.

Environmental Impact Evaluation The proposed change request does not involve an unreviewed environmental question because operation of SQN Units 1 and 2 in accordance with this change would not 1.

Result in a significant increase in any adverse environmental impact previously evaluated in the Final Environmental Statement (FES) as modified by the Staff's testimony to the Atomic Safety and Licensing Board, supplements to the FES, environmental impact appraisals, or in any decisions of the Atomic Safety and Licensing Board.

2.

Result in a significant change in effluents or power levels.

3.

Result in matters not previously reviewed in the licensing basis for SQN that may have a significant environmental impact.

l

.a' g.

D e-ATTACHMENT TO ENCLOSURE 2 TVA CALCULATION SQN-SQS2-0097 (B04 891205 302)

F

~

^

~

~

)g M i vA 10697 (DNE-0A-6-86r DNF CALCULAfIONS t

+ -

l title Probabilistic Analysis Showing the Effects of Deleting the l Plant / Unit l;

^l Resttival Heat Removal (RHR) Auto:losure Interlock (ACI) l SON / Units I and 2 l

lPreparingOrganization lKEYNOUNS(ConsultRIMSDescriptorsList)

\\

l_NE/RPS l Probability. RHR. ACI l;l

.l Branch /P.*ojectIdentifiers lEach time these calculations are issued, preparers Pwst ensure that the l;

l l original (RO) RIMS accession number is filled in.

l' lSQN-5QS2-0097 lRev (for RIM 5' use)

RIMS ACCES$JON ' NUMBER l:

l l

l 1

l l-l R0 l 89100600012 i

BL1 890929 004 l

Applicable Design Docums:nt(s) l l g4

]Q

'I q C. 102' L-Na I

I l

1 iR I

i l5ARSection(s) l l_ S,5,7. 7.6.2. l UNIO System (s) l l

l l

74 IR l

l l~

-l_

Revision 0 l

R1 i

R2 l

R3 15afety-related?

Yes (X)

No ( )

l

~lECNNo.-(orIndicateNotApplicable)l l

l l5tatement of Problem l

l N/A I

I I

l l

l Prepared l 6. W l l

l Perfonn a probabilistic analysis u SQN l

l_ Oloria J. Over IM k:n I l

l units 1and2that: (1) shows the effects l

l Checked lW l l

lofdeletingtheRHRACIfunctioninordertol

.)

Fredrick K. Hoyos l% b-l l

lreducethelikelihoodofalossofRHR l

lRviewed

% /g4 l l

lcoolinJaccidentand(2)demonstratesthe l

l_ Mary 8. Townsend i

I l

ladequacyoftheACIdeletionfrombotha l

l Approved l

l l

l core safety standpoint and a RHR system l.

l-RichardJ.McMahon

,Mlsl l

loverpressurl24tionstandpoint.

l lDate l' /yhf I

'l l

l l' 5eptember 29. 1999 l

l/2 l

l lUSEFORMlListallpagesadded l

l l.

l l

irvA i0s3.in this re' "' "

i l-FOR INFORMrbiON ON lIFMORE lLlstallpagesdeleted l

l l

l

.lEPACE.

lbythisrevision l

l l

l

-} REQUIRED lListallpageschanged l

l l

l

j l-lby this revisic,o l All l

l

\\

'l

'lAB5 TRACT

[These calculations contain an unverified assumption (s) that must be verified later.

j l

Yes ( )

No(X)]l l This calculation provides 6 prc$nillstic detennination of the effect of deleting the RHR autoclos

.l lforSQNunitsIand2.

l l.

l

. l This calculation ctr:: pares the RHR systems of SQN units 1 and 2 and Salem 1 (the similar re I

lWCAP11736)andreviewstheWCAP11736analysesasapplicabletoSQNforRHRoverpressurl2atione l

-lRHRsystemunavailability.

l 5

l l

l U2 significant differences were found taat would invalidate the Salem WCAP 11736 an l

lSQN.

l

'l removal and O

overpressurization events.The deletion of the SQN R:lR autoclosure inteelock was l

1 l

1 1

I 1

I I

l l

l l

l-l l-l l(X)MicrofilmandstorecalculationsinRIMSServiceCenter l

l_()Microflimandreturncalculationsto:

Microfilm and d. troy. ()

l cc: RIMS, iiT SLE 26P-X Address:

l NPKI - RP7 - 1273L

,,N s.

a

,.n-

---v-

(

4

'. g REVISION LOG

_Probabilistic Analysis Showing the Effects of Deleting Title r the Residual Heat -Removal (RHR) Autoclosure Interlock (AC1)

SQNSQS2-0097 DESCRIPTION OF REVISION Ap ved 0

Initial issue.

9/29/89 1"

Major rewrite:

Expanded the calculation to include the comparison of the Sequoyah RHR system with Salem RHR system and a review of the probabilistic analysis used to determine the effect of deletion of the RHR autoclouure interlock.

-i 1

TV A 10534 (EN DEG-4 73)

~~

L..:

y:

1 NEP-3.1 Page 1 of 3 CALCULATION DESIGN VERIFICATION (INDEPENDENT REVIEW) FORM o.

$#-5052-oo??

U Calculation No.

Revision

+

Method of design verification (independent review) used (check method used):

1.

Design Review X

2.

Alternate Calculatien 3.

Qualification Test Jurtification (explain below):

Method-1: In the design review method, justify the technical adequacy of the calculation and explain how the adequacy was verified (calculation is similar to another, based on accepted handbook methods, appropriate sensitivity studies included for confidence, etc.).

Method 2: In the alternate calculation method, identify the pages where the alternate calculation has been included in the calculation package and explain why this method is adequate.

Method 3: In the qualification test method, identify the QA documented source (s) where testing adequately demonstrates the adequacy of this calculation and explain.

g)

&ltis/x& //Ntibt A fnhbYtNic LVdlutfd p/tb ferorafof b

_RtMt<J llCa& Nmud [$W ]IbdotltJuto iWV/focU b' E!#**><h AAuleoe flesP [lAd6 N 2 74 Assh kr-64 twkaa %/ w raiwd%bt t%!a-s e sat kW A de c.a At /d renovat AriwA e2 e cowits~

p/pt ab;/ih 9 h:idt s eterne.useMinnpf. W A/w/Lr //not IM i adv Cg'-,Ild /O forbroorile,x feriead fXe printv/crMicd wh//std/ms / Jeu.ved fr 1/r fff au re(4d

' fp/MJ &r6tn fit iwWrd %f t dh fi VAs a Parktn of scwr/os.k 4ec/tdo*..

es e anc ti,; c.drJJL h AW d<redsta re h m au nk couritire a.s sy mtMe nu w tious JArti /punary ad h dirdve. definneJ 1b be fe<4itJ17 ab de.

g y + ee-ue

.) Y htW 23fl')

/

Design Verifipr Da te' (Independent Reviewer) -

- i n; ;

u :

U SGi-CQS2-0097 R1 i

Table of Contents e

. 0 Purpose........................................................... 1 2.0 Background....................................................... 1-3.0 Methodology...................................................... 2 4.0 Residual' Heat Removal Functional Description....................'. 2 4.1 Normal Function.................................................. 2 4.1.1 Cooldown....................................................... 2 4.1.2 Refueling...................................................... 3 4.1.3 Reactor Startup................................................ 3 4.2 Safety Function.................................................. 4

4. 2.1 Emergency Core Cooling......................................... 4 4.2.2 RHR Containment Spray.......................................... 4 4,3 RHR Overpressurization Protection................................. 4 4.3.1 RHR Autoclosure Interlock...................................... 5 4.3.2 PIW Changes to the RHR Autoclosure Interlock.............. 5 5.0 Conparison BctWeen the Sequoyah and Salem RHR Systems............ 6 5.1 System Configuration and Mechanical Components................... 6 5.2 Autoclosure Interlock Ingic and Control Circuitry................ 6 6.0 Analyses......................................................... 7 6.1 Event V Analysis................................................. 7 6.210# Tw6ture Ovam..ssurization Events........................ 9 6.2.1 Heat Inputs Transients........................................ 9 6.2.1.1 Premature Opening of the RHR Suction Isolation Valves......... 9 6.2.1.2 Inadvertent Control Rod Withdrawal During Shutdown........... 10 6.2.1.3 Failure to Isolate RHR System During Startup................. 10 6.2.1.4-Inadvertent Pressurizer Heater Actuation..................... 10 6.2.1.5 Startup of.an Inactive Reactor Coolant Pump.................. 11 6.2.1.6 loss of RHR Cooling Train.................................... 11 6.2.1.7 Heat Input Transient Analysis................................ 11 6.2.2 Mass Input Transients.......................................... 12

'6.2.2.1 Opening of A m = 0ator Discharge Isolation Valve............. 12 6.2.2.2 Istdown Isolation.................-

........................ 12 6 ;2. 2. 3 Charging /Sa%j Inje,d..k. Am Actust an..................... 13

6. 2. 2. 4 Mass Input OZ i a.nt W-t................................. 13 6.2.2.4.1 Istdown Isolation-NHR Operable Analysis................... 13

6. 2.2.4. 2 Istdown Isolation-RHR Isolated Analysis................... 14 6.2.2.4.3 Charging / Safety Injection Pump Actuation Analysis.......... 14 6.2.3 Summary of Overpressurization Transients Analysis.............. 14

6. 3 RHR Unavailability Analysis...................................... 15 6.3.1 Failure to Initiate RHR........................................ 15

6. 3. 2 Failure of Short Term Cooling.................................. 15

' 6. 3. 3 Failure of Iong Term Cooling................................... 16 7.0 Conclusion....................................................... 16 8.0 References....................................................... 17 i

th

-a

+

.n.

-w.-,,,.,,

L. ;

\\.

SQN-SQS2-0097 R1 Page 1 of-17 Prepared 75 C Date u /3o/F9 Checked F K4 Date ntA/g1 1.0 Purpose This calculation is being prepared in response to programmed enhanoament recommendation 3a and 5 of Generic letter 88-17 as requested

. by Sequoyah Engir.eering Project in QIR SQPSQN89330 (reference 1) to provide a probabil4*in determination of the effect of deleting the RHR-autoclosure interlock (ACI) on the Sequoyah Nuclear Plant (SQN). This analysis will evaluate the combined effects of ACI deletion on the RHR decay heat removal functiuo and RHR system overpressurization protection.

l 2.0. BACKGROUND The Nuclear Regulatory Comm4==4m issued Generic Imtter 88-17 "Ioss Of Decay Heat Removal" (reference 2) as a result of increasing concern over the loss of decay heat removal during nonpower operation and the

+

consequences of such a loss. Generic Letter 88-17 requires a response.

which is to include:

1

1) A description of the actions taken to implement each of eight recommended expeditious actions identified in the attachment to the letter.

(2) A description of enhancements, specific plans, and a schedule for i

implementing each of the six programmed enhancement recommendations identified in the attachment to the letter.

l Two of these programmed enhancement recommendations specifically

- mention the RHR autoclosure interlock.

1 l-

1) Programmed enhancement recommendation No. 3a is,

~

" Assure that adequate operating, operable, and/or available l

equipment of high reliability is provided for cooling the RCS, (reactor cooling system], and for avoiding a loss of RCS coolinge l

1 Generic Letter 88-17 goes further in the discussion of this l'

recommendation by noting,

" Loss of DHR (decay hatt removal) due to unplanned activation of the autoclosure interlock function is not consistent with provision of reliable equipment. You should investigate this I

feature if in?allad in your plant and should consider changes to obtain a reliable heat removal system consistent with other L

requirements."

2) Programmed enhancement recommendation 5 is,

" Technical spacifications (TSs) that res'crict or limit the safety benefit of the actions identified in this letter should be identified and appropriate changes should be submitted."

m w

,.vt-4,ar- -e1r"'"w 9--t-'-'

W v #W ww-

"+

vr**e*

"**'T

' ' - = - " =

_. ~

. L ;.'

-1 SQN-SQS2-0097 R1 Page 2 of 17 Prepared 75c_

Date 8' /%/rt Checked GN#

Date o ve9 The discussion of this recommendation notes,

" Typical potential impacts include TSs that control... the autoclosure interlock;...."

This calculation. is a response to programmed enhancement recommendations 3a and 5 and will evaluate whether the proposed changes associated with the deletion of the SQN autoclosure interlock will enhance the r=14=h414+y of the decay heat removal system consistent with other requirements, such as overpressurizition protection.

3.0. M ETHODOLOGY This analysis presents a " comparison and bounding" study between SQN and the reference plant modeled in WCAP 11736, " RESIDUAL HEAT REMOVAL SYSTEM AUIOCLOGtRE INTERLOCK REMOVAL REPORP FOR THE WESTINGHOUSE OWNERS GROUP" (reference 3). Four reference Westinghouse plants were analyzed based on =4m41av RHR system configurations and design characteristics. The reference plant with a similar RHR configuation to Sequoyah is Salem 1.

WCAP 11736 presented a thorough probabil4*in evaluation of the effects of deleting the RHR ACI and adding overpressuW*lon alarms in the control room. The methodology used in the WCAP study was to model sequences involving RHR overpressurization and los s of RHR decay heat removal function both with and without the proposed RHR changes. The models ware quantified and evaluated to determine the combined effect of the RHR changes on minimum core cooling.

This calculation notes the similarities 'and differences of the RHR system configuration, logic, control circuitry, and proposed changes associated with the deletion of the ACI between Sequoyah Nuclear Plant units 1. : & 2 and Salem 1. These factors ars evaluated to determine whether the Salem 1 analysis and conclusions are valid for Sequoyah 1 &

2. The analyses usM in WCAP 11736 are then reviewed with applicable Sequoyah information included.

l 4.0 RESIDUAL HEAT REMOVAL SYSTEM FUNCTIONAL DESCRIPTION The primary purpose of the RHR system is to remove decay heat energy from the reactor core and Reactor Coolant System (RCS) during plant cooldown and refueling operations. (references 4

& 5) 4.1. NORM AL FUNCTION i.

l-4.1.1. COOLDOWN The initial phase of reactor cocidown is accorplished by transferring I

heat from the RCO to the Main Steam system through the use of the steam to approximately 350'F and 380 lb/in',tempe:mture and pressure are reducedg resp generators. When the reactor coolant

[

hours after reactor shutdown, the second phase of cooldown starts with the RER system being placed into operation.

p L

l

_ l.1 _. _ _, _ _ _

"J

, ~.

SQN-SQS2-0097 R1 Page 3 of 17.

Prepared 7s t Date HISo/F9 w

Checked J KM Date ludt9 During this phase of operation reactor coolant is withdrawn from RCS hot leg 4 through RHR suction LeM% valves FCV-74-1 and FCV-74-2 to the RHR pumps. The reactor coolant is pumped through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System and the reactor elmt is returned to the RCS through the cold legs. The rate of cooldown is controlled by regulating the reactor coolant flow through the RHR heat exchangers. As cooldown continues, the steam bubble in the pressurizer is collapsed and the RCS is operated in the water solid condition. At this stage, pressure control is accomplished by regulating the charging flow rate and the rate of letdown from the RHR system to the Chemical and volume Control System (CVCS).

After the reactor coolant pressu-is. Ac. d to atmospheric pressure,

.the temperature is 140'F or 2m N

e ctt.clant re etivity leve' 'a

- t: :.

.or - N t he been degast reduced to an acomptable the RCS may be ope..

n1' w or maintenance.

4.1.2. RE FUELTM; The refue

.' s O

. t c'.nsing RIW "

(solation valves, FCV-74-1 and *

', ene m.g A

• re^1r h, # -

wrage tank (RWST) isolation valve

'3-1 3 '<eter from v.h:. WT., cuen pumped into the reactor vessel t-

_gh t de i o* nl RHR syste s, urn. Lines and into the refueling cavity through th.

" rec.ctor ves.?l. After the water level reaches normal refueling level, the RHR irdet asc ation va ws rxe oprdad, the. refueling water storage tank supply valve (FCV-63-1).., closed, and normal RHR from the RCS hot leg is resumed.

Following refueling, the RHR pump (s) are used to drain the refueling L

cavity to the top of the reactor vessel flange by pumping water from the

. RCS hot-leg 4 to the RWST.

4.1.3. RE ACTOR STARTUP At initiation of plant startup, the RCS is in a water solid condition with the pressurizer heaters energized. The RHR system is operating in its normal decay heat remcVel configuration and is connected to the CVCS via l-the low pressure letdown line to control reactor pressure.

As heatup commences, the RHR system operates in conjunction with the RCS to control temperature and pressure. At approximately 350'F, the RHR system is p

isolated from the RCS system by closing valves FCV-74-1 and FCV-74-2. The l

RCS pressure is then controlled by normal letdown and the pressurizer spray and pressurizer heaters.

l I:

l 1

E

f}.: _;,

e SQN-SQS2-0097 R1

- Page 4 of J7 Prepared rs c-Date it Iso / tt Checked FK&

Data IA A/89 i

4.2. S AFETY FUNCTION

[

' 4.2.1.- EMERGENCY CORE COOLING SYSTEM L

During normal power operation and hot standby, the RHR systcm is aligned for standby operation as part of ECCS (Reference 6).

Following ECCS ar+n*irm in the injection mode, the residual heat removal pumps take suction from the RWST cnd deliver borated water to the RCS. These pumps begin to deliver water to the RCS only after the pressure has fallen below i

the pump shutoff head. When.a low level signal is received from the RWST in conjunction with a "S" (safety injection) signal and a high containment sump level signal, the recirculation mode is entered with the RHR pump -

suction automatically realigned from the RWST to the containment sump. The RHR block valves' (FCV-74-3 and FCV-74-21) are automatically closed coincident with the opening of the sump isolation valves (FCV-63-72 and FCV-63-73). In the recirculation mode the water from the sump is passed through the RHR heat exchangers and returned to the reactor vessel through the cold leg injection path. The RHR system can be aligned to provide suction to the high head centrifugal charging pumps of the CVCS or the safety injection pumps of the safety Injection System (SIS) during the recirculation phase.

4.2.2. RHR CONTAINMENT SPRAY SYSTEM The RHR system can be aligned as a containment spray system following i

a IOCA if conditions require it (reference 7). These conditions are: the containment pressure must exceed 9.5 psig; at-least one hour has elapsed since the beginning of the accident; RHR suction is aligned to the containment sump; and at least one component cooling water pump and one safety injection pump are running. In this configuration, water is drawn from the containment sump by the RHR pumps, cooled by the RHR heat exchangers, sprayed through the RHR spray headers and drains back to the

- containment sump.

4.3. RHR OVERPRESSURIZ ATION PROTECTION The RHR system is designed as a low pressure (600 psig) system that is isolated from the high pressure RCS by two high pressure motor operated isolation valves in series on the inlet line (FCV-74-1 and FCV-74-2) and two series check valves-on each of the discharge lines into the RCS (reference 4).

. The inlet idne to the RHR system is equipped with a pressure relief valve (74-505) sized to relieve the combined flow of the charging pumps at the relief valve set pressure (reference 5). The discharge lines to the RCS are equipped with a pressure 1elief valve (63-627,63-628, 63-637) to relieve the maximum possible back-leakage through the valves separauing the RHR system from the RCS. These relief valves are part of the ECCS.

i m.

.m.

.m.

i SQN-SQS2-0097 Rl.

Page 5 of 17 Prepared 7s c-Date u 6 /y, 3

Checked F Y#

Date u A H 9 The inist 4=^1*4m valves, FCV-74-1 and FCV-74-2, are normany closed and are only opened for residual heat removal after reactor coolant system pressure is reduced to approximately 380 psig and the RWST suction valve (FCV-63-1) and containment sump isolation valve (FCV-63-72) are funy closed.

4.3.1. RHR Autoclosure Interlock The RHR autoclosure interlock (ACI) was installed to prevent overpressurization of the RHR sy. stem which could lead to reactor coolant being discharged outside containment through a break in the low pressure system. The ACI win automaticany close the RHR inlet isolation valves on RCS pressure greater than 700 psig. The RHR system is vulnerable to this type of overpressurization during startup or during cooldown while the reactor vessel is closed. A d*a41M description of the overpressurization transients is presented in Section 6.2 ' Low Temperature overpressurization Ev ents. '

While the RHR ACI is designed to protect the RHR system, it is also a contributor to the unavailability of the RHR system due to the probability of its spurious actuation which would isolate the RHR system and could lead to a loss of decay heat removal transient. A detailed description of this-contribution is presented in Section 6.3 'RHR Unavailability An alysis. '

4.3.2. Proposed Changes to the RHR Autoclosure Interlock The-proposed change described in the WCAP 11736 analysis and in SQ-DCR-3365 (reference 9) removes the auvlamure interlock feature from the RHR suction i=^1*4m valves, FCV-74-1 and FCV-74-2. With removal of the autoclosure interlock feature, these valves will not automatically close on increasing pressure greater than 700 psig. However as stated in the DCR-3365 and in WCAP 11736 Section 6.1, an alarm will be addsd, fC each suction 4=^1*4m valve, that actuates in the main control room given a " VALVE NOT FULLY CICSED" signal in conjunction with a "RCS PRESSURE l

HIGH signal. The intent of the alarms is to alert the operator that one L

or both of the suction i=^1* ion valves is not closed with RCS pressure l

greater than 700 psig. The alarn must meet the same design criteria as other-safety-related function control room annunciation. Valve position indication to the alarm must be provided from the valve stem mounted limit L

switches and power must not be affected by power lockout to the valve. The l

proposed changes only affect the autoclosure inter 1cck feature; and the valve open permissive circuit will not be affected.

In addition to changing the valves' interlock circuitry, the Sequoyah plant operating procedures governing reactor cooldown and startup must be I

mMifiM to reflect the appropriate recognition and response to the new L

.r.

er e

.~

..,__.-e,.

e

.e.

.- -~

,T

,1...

s SQN-SQS2-0097 R1 Page 6 of 17 Prepared Ts c//$9-Date 88 Iso /e V

Checked GV#

Date a A/r9 added alarms. The procedures should be revised to direct the operator to take the necessary action to close the open suction isolation valve (s)-

following alarm actuation, or if this is not possible, to take appropriate

~

action to prevent RHR overpressurization.

The removal of the ACI will require changes in TVA's documentation of Sequoyah Nuclear Plant. A partial list of documents which will need revising includes the: Design Criteria, Final Safety Analysis Report, Technical Specifications, surveillance Instructions,- Maintenance Instructions, TVA Drawings and other sources. The design change process will identify the specific documents to be revised.

5.0. COMPARISON BETWEEN THE SEQUOYAH AND S ALEM RHR SYSTEMS 5.1. Systum Configuration and Mechanical Components Both Salcm 1 and Sequoyah have similar vintage RHR systems consisting of two separate RHR trains of equal capacity, each independently capable of meeting the safety analysis design basis. Each train consists of one-heat exchanger, one motor driven pump and associated piping, valves and instrumentation namaaaan for operational control. The inlet line to each train of the RHRS is connected to a common letdown line from the hot leg of reactor cooling loop (loop 4 for SQN and loop 1 for Salem), while return lines are connected to the cold legs of all four reactor cooling loops via the SIS accumulator discharge lines downstream of the cross-connect (for SQN-train A discharges to loops 2 and 3, train B -

discharges to loops 1 and 4. For Salem, train A discharges to loops 1 and 3, train B ' discharges to loops 2 and 4).

'Ihe RHR system for Salem 1 and Sequoyah are normally isolated from the RCS by two, serie.s,-MOVs, suction isolation valves in r.he single letdown line connecting the low pressure RHRS to the high pressure RCS. The RHRS j'

discharge lines are isolated from the RCS by two check valves in serfas for each.line. The RHRS suction ian1* inn valves, the inlet line pressure i.

relief valve, the return lines to the RCS cold legs downstream of the L

appropriate valves and the hot leg injection lines are located incide containment whdie the remainder of the system is located outside containment. Based on this evaluation, there are no significant differences between the system configuration and mechanical components of 17 Salem 1 and Sequoyah.

j.

j.

5.2 Autoclosure Interlock Logic and Control Circuitry Salem 1 and Sequoyah use similar designs to protect the RHR system from overpressurization. The first protective feature is the decreasing low pressure permissive inter 1cck for opening the valves (below 380 L

psig); the second feature is the passive relief valve located on the RHR inlet piping within the containment which maintains the system pressure I.

.below the design pressure of the RHRS for most overpressure events, and l'

t

,, ;. g ;_

J 4

SQN-SQS2-0097 R1 Page 7.of 17 Prepared r 5 Mate aIn/et e

Checked GKM-Date a/w/rcr

.the third protective feature for both plants is the RHR autoclosure-interlock which closes both inlet isolation valvas by the appropriate train ~ ( A for train A valve and B for train B valva) instrumentation that is set above the RHR design pressure. This control-logic and control l

circuitry is typical for both SQN and Salem.

l In addition to the above scheme, the SQN inlet isolation valves.

(FCV-74-1 and FCV-74-2) have the power administrative 1y romoved once the valves are ciceed (breaker locked in trip position). Since the SQN valves have backup contzuls, pressure switches sensing RCS pressure above 700 psig automatically close the valves in the backup control mode. In adMt%, the SQN valves have their local control switches disconnected to preclude inadvertent operation-due to the effects of a LOCA- (reference

10).

In summary, there are no significant differences between the design and Configuration, mechanical and electrical, of the RHR overpressure prr+=+% features for Salem 1 and Sequoyah. Therefore,the use of the WCAP analysis performed for deletion of the RHR autoclosure interlock is reasonable for SQN.

6.0. ANALYSES WCAP 11736 (reference 3) presents a thorough analysis of the RER 4

overpressurization events and system unavailability which would be

'affected by the deletion of the autoclosure interlock. The analyses sections of this cal:ulation are a review of those analyses for Salem 1 with applicable sequoyah information included. For further information on the analyses, the~ WCAP should be consulted.

i 6.1. Event.V-Analysis An interfacing IDCA, referred to as Event V in Wash-1400, (reference

11) is a breach of the.high pressure RCS boundary et an interface with a low pressure system, in this case the RHR system. This event-has the potential to cause a non-isolatable LOCA outside containment. It is assumed to occur if the RER suction inlet valves (FCV-74-1 and FCV-74-2) fail open when the reactor is at normal operating pressure (2250. psia).

Since the RHR system is designed for a lower pressure (600 psig), the result is overpressurization of the RHR system with gross failure of the RHR boundary and an uncontrolled LOCA outside containment.

In the analysis performed in WCAP 11736 for Salem 1 several failure combinations are considered which would result in both inlet isolation valves being open. These failure modes are defined as : 1) rupture of the two series suction valves and 2) failure to have closed one suction valve or spurious opening of the valve and subsequent rupture of the other valve. Failure to close both inlet valves was not considered because the condition would become apparent as the RCS increased in pressure (see soction 6.2.1.3) and corrective action would be uken thus precluding system overpressurization.

I p

i w

.n,.w-,-

b,

,1 ;

,p _. -

q SQN-SQS2-0097 R1 Page 8 of 17-Prepared - rc c-Date u holet Checked 7XN-Date 1Uw/881 The general equation used to calculate the frequency of an Event V (F(VSEQ)) with the above failure modes is:

(f ) Q(V R))

F(VSEQ) = X ((f ). Q(Y ) + (f ) Q(Y ) +

2 1

1 1

2 2

where the frequency of an Event V sequence F(VSEQ)

'=

the number of RHR suction lines (1 for Salem & Sequoyah)

X

=

failure rate per year of RCS valve due to rupture (f )

=

2 failure rate per year of RHR valve due to rupture (f )

=

i probability that the RHR valve is open

'Q(V )

=

1 probability that the RCS valve is open Q(V )

2 Q(V R)

=. probability of rupture of RHR valve 1

Fault trees were developed to determine the probabi.lity that one of the inlet isolation valves is open at power conditions (Q(V )

1 Q(V )). These: fault trees are shown in Appendix B of WCAP 11736 2

(reference 3 )

Two fault trees were developed to determine the probability that the

. valves were open for this sequence. One with ACI in place and the secend with the ACI removal changes made.

.i 1

The scenarios examined in the fault tree for tne case with the AC_

are: 1) the Operator fails to remove power to the valve by racking out th e circuit 'bwxer and subsequently the valve spuriously opens during power L.

operation or 2a) the operator fails to close the valve during startup (or l D the operator attempta to close the valve but due to some component failure, the valve does not close) and 2b) the autoclosure interlock fails to. perform its runction and does not close the valve and the operator fails to detect that the valve is not closed during startup or power

~

operation.

For the case with the autoclosure interlock ren.oved, the scenarios developed in the fault trees are: 1) the operator fails to remove power to the valve by racking out the circuit breaker and subsequently the valve i

opens during power operation (note: this is identical to scenario 1 above) or 2a)'the operator fails to close the valve during startup (or the operator attempts to open the valve but it does not close) (note:

E identical to scenario 2a above) and 2b) the operator fails to detect that the valve is not closed and then clcos it when the overpressure alarm is received -(or the slarm fails to operato).

R 1

u,

,,,..n

~.

.L p.i 4

SQN-SQS2-0097 R1 Page 9 of 17 Prepared :nc-Date n ho / e 3 Checked %KW Data le A AR Essentially the difference between these two fault trees is scenario 2b whezu the autoclosure interlock is replaced by a contrcl room alarm which must be detected by the operator (s) who, then, must close the inlet isolation valves. These fault trees are quantified and the probability of the suction valves being open during operation is 1.48 E-04 with the autoclosure interlock and 1.10 E-06 without the auMWare interlock. The.

fault trees indicate that the alarm circuitry with the required operator action are less likely than the auwWare interlock to fail to close the inlet suction valves.

These probabilities are substituted into the general equation for Event V and quantified for the frequency of occurrence with and without the a"Winalm interlock. The frequencies are: 8.35 E-07/ year with ACI and 5,77 E-07/ year without ACI. The frequency of Event V decreases by approximately 31% as a result of removing the ACI.

6.2. Low Temperature Overpressurization Events A number of events have occurred during startup or shutdown (low temperature events) which heve the potential c,r overpressurizing the RHR syst.em. The effect of these transients will be altered by the removal of t.he autoclosure interlock. WCAP 11736 examines these transients and analyzes the effect of ACI removal for Salem 1. Sequoyah 1 & 2 are expected to respond the same as Salem 1 due to the aimnadty in desien of the two plants.

The overpressurization a".alysis uses event trees to model the mitigating actions (both manual a:.3 automatic) following the occurrence of low temperature overpressurization events.

Two general categories of low temperature overpressurization events L

have occurred in the industry and are analyzed: 1) events that' affect the the balance between mass addition and mass letdown; and 2) events that affect the heat input / removal balance.

o 6.2.1. Heat Input Transients i.

L 6.'2.1.1 Premature Opening of the RHR Suction Isolation Valvos 1

If the suction inn 1* inn valves (FCV-74-1 & FCV-74-2 ) were opened l

prior to reducing the RCS pressure below the RHR design pressure then overpressurization of the RHR system could cccur. However these valves are equipped with an open permissive interlock which prevents the opening of L

these valves above RHR design pressure. Also, the motor operators for these valves are sized with insufficient torque to open against the RCS

' high pressure. This event has been prevented in the past due to this insufficient torque feature. Because of this design feature, this type of i

transient is not considered likely and is not analyzed in WCAP 11736.

~

h

.'t _;.;.

q 1

SQN-SQS2-0097 R1 Page 10 of J.7 L.

Prepard 7sc-Date o b / M Checkod F Y#

Date.jl/_y/jL*L L

6.2.1.2 Inadvertent Control Rod Withdrawal During Shutdown l

The withdrawal of one or more banke of control rods dGring RER L

operation would result in a' power excursion in the reactor and would be terminated-by automatic features of the Ree.ctor PIMM System. The RHR relief valva (74-505) would help mitigate the transient and the RER system-wculd not pressurize above 110% of the RHR dasign pressure or the ACI.

setpoint. The removal of the ACI would not have an impact on this transient, and, therefore, it was not analyzed.

6.2.1.3 Failure to Isolate RHR System During Startup During plant stcrtup, the RCS is water solid and the pressurizer heaters are energized. The RHR suction isolation valves are open and the RHR pumps are discharging the excess reactor coolant to the CVCS. Aft 4r the reactor coolant pumps are started, prsssure is controlled by + he RHR system until the pressurizar bubble is formed. Following bubble ir.'.aation, the RHR system is isolated from the RCS by closing the suction isolation valves (reference 5).

If the RHR system is not isolated as directed in the procedures, as the RCS pressure increases above 450 psig, the RHR relief valve- (74-505) would discharge into the pressurizer relief tank (PRT) slowing the i

increase in pressure and sounding en alarm on increasing tank level. This transient is not considered to be a credible event past this point and is not analyzed in this calculation or WCAP 11736. Note: if one of the auction relief valves were left open, this event would fall under the Event V analysis presented earlier.

6.2.1.4 Inadvertent Pressurizer Heater Actuation If the pressurizar heaters are inadvertently energized during shutdown while the reactor is cloemd and the RHR system is operating, pressure will increase in the RCS and RHR system until the RHR. relief valves open and dirharge into the PRT, acunding an alarm. If the relief valves fail to open,-the RHR system vould overpressurize until the heaters are automatically shut of t at 10% pressurizer volume.

This event would be slow developing and annunciators in the control room would alert the operator of PRT level increase and instrumentation would inform the operators of increasing reactor pressure. Due to the pace of this transient and indication in the control room, the operators should recognize this transient and mitigate it before the autoclosure interlock setpoint is reached. This transient has not happened at a Westinghouse plant.and is not analyzed in this calculation or WCAP 11736.

L

M;

,t.

• 6 SQN-SQS2-0097 R1 Page 11 of 17 Prepared fI c-Date e, ho /yv Checked E Y &

Date RA /F*l j

6.2.1.5 Startup of an Inactive Reactor Coolant Pump

.During the cooldown of the reactor, the reactor coolant pumps are

_ stopped when the reactor coolant temperature ic below 160'F and the RHR heat exchangers are used to continue lowering the coolant temperature.

Since the flow thtwgh the steam generators stops when the reactor coolant pumps are stepped, t!'; 14vtor coolant in the steam generators may remain at a temperature gree r roan the RCS temperature _ since there is little ci 6. through the steam generators. If a reactor coolant pump is started, the sudden heat input into the reactor coolant from the steam generators would cause a rapid increaso in reactor coolant temperature.

Another transient caused by the startup of the 1-eactor coolant pump would occur if a reactor coolant pump was 44=d during heatup while the RHR system was in operation, but the charging and seal injection water continuad in service. This water-would collect in the vortical pipe loop below the reactor coolant pumps. When the inactive reactor coolant pump

'Jaa started, this water would be injected into the reactor, expand as the density decreased and cause a pressure increase in the RCS and RHR systems. Depending on initial RCS pressure, this increase could' 3

overpressurize the RHR system. The startup of an inactive reactor coolant l

pump transients are considered in Section 6.2.1.7 " Heat Input Transient i

Analysis."

l o

i 6.2.1.6 Loss of RHR Cooling Train

. An increase in ter."perature and pressure would result due to loss of one of the two RHR cooling trains during the early stages of plant cooldown,l when heat generation from the reactor core exceeds the heat removal capacity cf the remaining train of the RER system. During this phase of cooldown, the operators are closely monitoring the RCS parameters and would mitigate this transient before the RHR system exceeded design pressure. This transient is not analyzed further in this calculation or L

WCAP 11736.

6.2.1.7 Heat Input Transient Analysis The heat input transient with the potential for the greatest overpressurization of the RHR system is the startup of an inactive reactor coolant pump with higher temperature coolant residing in the steam generator. WCAP 11736 references another Westinghouse analysis, WCAP 10529, which indicates that foHowing startup of a reactor coolant pump, L

the peak pressure change of approW*aly 1500 psi would occur in roughly i:

90 seconds witaout relief valve actuation. Because the RHR suction inlet valves have a two ndnute closing time, the RHR system would be subjected to high pressure before the valves could close which could lead to an L

interfacing IDCA. The low tenperature overpressurization system (IJIOPS) is a

e

?

^ y :: ;;

i Q

^

SQN-SQS2-0097 R1 Page 12 of ).7 Prepared 1s c-Date o/b /P9 Checked 7f4-Date i A AM 5

designed to prevent this type of RCS pressure surge by opening the pressurizer PORV. Both the RHR relief valve and the low temperaturs

- 1 I

overpressurization system would have to fail in order for this event to

)

y L

occur and the probability of both these systems failing is small.

The next nost severs heat input transients are loss of an RHR train, reactor coolant pump startup-with injection of cold seal water, or a+"*ian of the pressurizer heaters. These transients evolve quickly but would not raise the RCS pressure above 450 psig. The low temperature overpressurization system and RHR relief valve would be-used to mitigate these transients. Since the RHR autoclosure interlock setpoint would not -

be reached, the ACI would not be involved in mitigating these transients.

Therefore, the removal of the RHR auv!=lre interlock will not have an effect on these heat input transients. In the case of the reactor coolant pump startup, t.e low temperature overpressurization system works to limit the pressure surge or RHR system overpressurizes before the ACI has time to function. For the other heat input transients the RHR relief valve prevents the RHR pressure from reaching the ACI setpoint.-

6.2.2. Mass Input Transients 6.2.2.1 Opening Of Accumulator Discharge Isolation Valve Plant procedures require that the accumulator discharge valves be cicaed and de-energized during plant cooldown. If these valves were to open, water would be forced into the reactor coolant system causing a pressure transient in the RHR system. The peak pressure reached during this transient would be between the initial RCS pressure and the accumulator pressure (700 psig). An event tree was not constructed for this transient because the peak pressure would be below the ACI setpoint.

6.2.2.2 Letdown Isolation During cold shutdown, a letdown path is established through the RHR system to control pressure in the RCS. If this letdown path is lost through: 1) closure of the lotdown control valve, 2) isolation of the RHR/CVCS crossover, or 3) closure of the RHR inlet isolation valves, pressure control is lost ard the pressure transient must be controlled by the hMR relief valve or the low temperature overpressurization system. If the inlet isolation valves close, the use of the RHR relief valve is lost.

This transient is analyzed in Sections 6.2.2.4.1 and 6.2.2.4.2 i

I

-s,-

,,c,-

m.m-,-

m--

i

%TM f 4

, y~

SQN-SQS2-0097 R1 ge 13 of 17 I

Prepared _ 75 Date "/e/ri Checked-4 Date n /w /g *1 6.2.2.3 Charging / Safety Injaction Pump Actuation When the actor vessel is water solid during cold shatdown, the safety injection signal is blocked to prevent high pressure injection by the high head safety injection pumps or the charging pumps. The inadvertent a@*4^n of one of these pumps when the RCS is water solid

- without an increase in letdown would result in a prescure transient. This transient is' analyzed in Section 6.2.2.4.3 6.2.2.4 Mass Input Transient Analysis Event trees were constructed in the WCAP analysis to determine the consequences of these mass input transients. The safety functions which were questioned for transient mitigation, i.e. the top eve:lts were: 1) mass input initiating event, 2) RHR isolated, 3) RHR relie' valves lift,

4) low temperature overpressurization system works, 5a) RHR inlet isola +: ion valves auMmeim11y cbse (present design), 5b). operator closes RHR jnlat 4=^1* inn valves (proposed ACI deletion changes), 6) operator stops safety injection or charging pump 7) operator opens. a PORV, 8) RH3

' l rel',ef valve ressats, 9) pressurizer PORV reseats. The success criteria for each of these top events was determined and the failure probability was m1mlated. Consequence categories were determined for the initiating events, given that top event failure (s) did not prevent overpressurization of the RHR system.

6.2.2.4.1 Letdown Isolation Analysis--Loss of CVCS Letdown l

For this event, it was assumed that one charging pump was operating at its maximum flow rate and only one RHR relief valve or one PORV must operate to mitigate this transient. The initiating event was loss of letdown by 1) closure of the letdown control. valve or 2) isolation of the RHR/CVCS crossover path. Two event trees were constructed, with and without the pu,-:rd ACI deletion changes, _ and the trees quantified. The results showed that with the proposed ACI changes there was a slight decrease in the_"MSCI" consequence category and that there is an increase in the "HOPV" category ficm 5.66E-15/ shutdown year to 1.49E-11/ shutdown year.

The "MSCI" category is lan1* inn of the RHR cystem with the running charging pump not stopped; pressure control is performed by the low temperature overpressuviv* inn system having opened a PORV. There is a loss of coolant and the operator must take action to stop the running pump and then check that the PORV resented completely.

l The "HOPV" consequence category is a high overpressure with the RHR system open to ths RCS. The running charging pump is not stopped and no relief valves have actuated. The RHR system integrity is lost and an interfacing IDCA has occurred. The operator must attempt to isolate the RHR system.

f w,'

-- ~

e

-s ve.,

w

- - - - - - ~

~,,.

+

-<w-

,-,-v,,-.

---r a

[

'@g N

j SQN-SQS2-0097 R1 Page 14 of 17 Prepared TG c--

Date0/13/f9 Checked FK 4 Date R A /M The'"HOPV" is a severe consequence accident with reactor coolant being ralaaM outside containment, however the frequency of 1.49E-11/ shutdown year is very remote and thus the overall increase in the frequency of an interfacing IDCA for this ini+4*ing event as a result of naking the ACI deletion changes is not significant.

6.2.2.4.2 Letdown Isolation-- RHR Isolated Analysis The ini+4*ing event for this transient is the inadvertent closure of the RHR inlet isolation valve (s). In this caso, if the autoclosure intarinnk were removed, the initiator frequency would be reduced. WCAP 11736 assumes the frequency would be reduced by one half. The result of reducing the ini+4*ing event frequency decreases'the challenges to the mitigating safety systems and reduces the frequencies of all the adverse consequence categories by a total of 5.89E-02/ shutdown year which is a significant reduction.

6.2.2.4.3 Charging / Safety Injection Pump Actuation Analysis

-In this event, it is assumed that one charging pump and one safety injection pump are started. The success criteria was determined to be two

-ICRVs or one FORV and one RHR relief valve. The event tree was constructed and quantified for an RHR system with and without the ACI changes. There

.was a total increase in the frequencies of the adverse consequences for this event of 2.4E-10/ shutdown year as a result of the ACI deletion changes. This increase, even though it includes the most severe consequence of an intaWaning IDCA outside containment, does not represent a significant increase due to its low (2.4E-10/ shutdown year) frequency.

6.2.3. Summary of Overpressurization Transients Analysis The Overpressu** inn analysis censidered the Event V sequence where the RHR inlet isolation valves fail open during power operation which' allows high pressure reactor coolant to overpressurize the RER system leading to an interfacing LOCA. The results of the Event V analysis indicate that making the ACI deletion change reduces the frequency of this event.

The overpressurization analysis also considered transients that occur during reactor cooldown and startup. These were divided.into heat input and mass input transients. The deletion of the ACI was not considered to l

impact the heat input transients because they either happen so fast that the inlet valves can not close fast enough to mitigate the transient even if the' ACI were inea1W, or the transient did not increase RCS prescure to the ACI setpoint.

L

[ :.

l c

T.

~.

l

.1

y.:

}

s3.

J SQN-SQS2-0097 R1 Page 15 of ).7 Prepared 't5 C Date u /so/M Checked GKN-Date la A #9 The mass input transients wars analyzed by constructing event tross to determine the change in frequency of the consequence categories for several mass input ini+4ating events. There was a slight increase in some adverse consequence categories as a result of making the ACI deletion changes but this increase was probab414*iem11y insignificant compared to the decrease caused by reducing the initiating event frequency of the spurious actuation of the RHR inlet isolation valves, j

6.3 RHR Unavailability Analysis The RHR system was analyzed to determine its unavailability due to the i

spurious closure of the inlet isolation valves (FCV-74-1 & F CV-74-2)..

Separate faalt trees wars developed in WCAP 11736 to dMamine the system unava41=h411+y for startup of the RHR system, for short term cooling (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />), and long term couling (6 weeks). The short term and long term cooling fault trees were constructed both with and without the autoclosure of the inlet isolation valves to show the change in system unavailability due to removal of the autoclosure interlock.

6.3.1 Failure to Initiate RHR

- A single fault tree was developed for this phase of RHR operation to identify those faults that could drapact the startup and first two hours of operation of the RHR system. The autoclosure interlock does not play a role in RPR startup, rather the inlet valves' open permissive prevents the -

valve opening until RCS pressure is below 380 psig and this festaue is not being-modified by the proposed ACI changes.

The fault tree for Salem was developed from the Salem operating procedures. The Sequoyah procedures for RHR startup, SON SOI-74.1, Section A (reference 2.:), are funccionally similar to the Salem procedure described in the WCAP analysis and the fault trees are therefore applicable.

The dominant contributors to RHR startup were operator errors of failure to energize control boards for valves which had been de-energized for power operation and failure to open other valves required for RHR operation.

6.3.2 Failure of Short Term Cooling Both pump trains of RHR are required for short term cooling due to the decay heat generation immediately following shutdown. Failure to supply

. cooling flow from two RHR pump trains into three of four RCS cold legs constitutes RHR system failure. Two fault trees were developed to determine the impact of the removal of the ACI.

.... ~..

P l

.T p ec-o

,S SQN-SQS2-0097 R1 Page 16 of 17 Prepared Trc.

Date si/n/rt Checked G W%

Date ILMt9

~

~

The dominant failure contributor for loss of short term cooling fo both fault trees (with and without ACI) was the failure of one of the two RHR pumps to run for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the Salem plant, the failure probability for short term cooling was reduced 13 percent with the deletion of ~ the ACI. The reduction in RHR short term cooling' unavailahility for Sequoyah would be similar following deletion. of the A CI.

6.3.3 Failure of Long Term Cooling long term cooling requires cooling flow injection into any two RCS cold legs from two of four RHR trains for 6 'feaks. This fault-tree pnmarily features spurious closing of various valves over the six week period and failure of the first pump with failure of the second pump to start and run.

The dominant failure contributor for Salem during long term cooling was RHR pump failure. For the fault tree with ACI present,-the other top contributors-involve the single failure of a component associated with the ACI such as the' power supply, signal comparator or pressure'tra.nsmitter which causes spurious closure of one of the RER inlet isolation valvos.

The deletion of the ACI resulted in a 67 percent reduction in system unavailability for Salem. The Sequoyah long term ecoling unavailability would be reduced by a similar amount following removal of the ACI.

7.0. CONCLUSION This mimlation examined the impact of the removal of the autoclosure interlock (ACI) feature on the inlet isolation valves (FCV-74-1 &

FCV-74-2) of the RHR system for Sequoyah 1

2. This calculation referenced WCAP 11736 " Residual Heat Removal System Autoclosure Interlock-Removal Report for the Westinghouse Owners Group" and is a review of that report and a comparison -between the reference plant,. Salem-1, and

,~

l Sequoyah. The-two plants have very similar RER system configuration, l

control logic, and design for the autoclosure interlock feature. By virtue of this similarity, the analysis for Salem is considered valid for Sequoyah.

The overpressurization transients which have the potential for an l-uncontrolled loss of coolant outside containment were examined to L

determine the effect of ACI deletion. The Event V sequence, heat input and mass input events were analyzed. A reduction in event frequency (a net positive result) was the result of removing the ACI for these transients.

J The RHR system unavailability to remove decay heat from the reactor core was mF'nlated with fault trees constructed both with and without ACI. The' analysis showed that the removal of the ACI resulted in an i

(

improvement in RER availability.

l l

(

7 I,,, j y ;;

ts.4 O

~*

3 SQN-SQS2-0097 R1 Page 17 of 17 Prepared fre-Date v/vo/k+

Checked GWN-Data it/4 /M Therefore, it is the conclusion of this calculation that making the design, Technical Spa"Wmtion, and procedure changes associated with the removal ~of the auW=mt interlock as outlined in this calculation and WCAP 11736 will' reduce the frequency of an RHR overpressurization' event and increase the RHR system availability at Sequoyah.

i

8.0 REFERENCES

1. Quality Information Request, QIR SQPSQN89330 RO, RIMS NO.

B25'890828002.

2. NRC Generic Letter NO 88-17, " Loss of Decay Heat Removal",

i October 17,1988.

3. WCAP 11736, " Residual Heat Removal System Autoclosure Interlock Removal Report For The Westinghouse Owner.s Group", Volumes I & II, Rims No. B26 '88 0714 364 B26 '88 0714 365.

4. Sequoyah Design Criteria, SQN-DC-V-27.6 R3, " Residual Heat Removal i

Sy stem".

5. Sequoyah FSAR Section 5.5.7 R6, " Residual Heat Removal System".

6. Sequoyah FSAR Section 6.3 R6, " Emergency Cors cooling System".

7. Sequoyah Emergency Instruction E-1 R7, " Loss of Reactor or Secondary coolant, page 12.

8. Sequoyah FSAR Section 7.6.2 R6, " Ret.1 dual Heat Removal Isolation Valves".

9. Sequoyah Design Change Request, SQ-DCR-3365.

10. TVA Sequoyah Drawings, 45N779-11 RV, 2-47W611-74-1 RO, i

1,2-45N765-13 RO, 45W657-32 RG, 45N779-12 RY,1-47W611-74-1 RO, 47W610 1 RN, 1,2-47 W810-1 R6.

11. WASH 1400, NUREG 75/014, " Reactor Safety Study, An Assessment Of

. Accident Risks In U.S. Commercial Nuclear Power Plants", October 1975.

12. Sequoyah System Operating Instruction, SOI-74.1 R 51, " Residual Heat Removal System".

fl

---

.ae.-.<-

,w,ea e.

-en

-y y

,.w-ww e y age p

.+.-.-9 p

p

.e?,4 i^

h Jg 4..s.

- c-6 L

ENCLOSURE 3 PROPOSED TECHNICAL SPECIFICATION CHANGE tr SEQUOYAH NUCLEAR PLANT UNITS 1 AND 2 DOCKET NOS. 50-327 AND 50-328 (TVA-SQN-TS-89-18)

DETERMINATION OF NO SIGNIFICANT HAZARDS CONSIDERATIONS l.

l i

j

r k

.i l

f i

i i

6

fi

! ( j '..

Ag^

o' ENCLOSURE 3 Significant Hazards Evaluation i

TVA has evaluated the proposed TS change and has determined that it does not represent a significant hazards consideration based on criteria established in 10 CFR 50.92(c). Operation of SQN in accordance with the proposed amendment will not:

.(1) ' Involve a significant increase in the probability or consequences of an accident previously evaluated.

The proposed deletion of the autoclosure interlock feature in conjunction with the plant modification to add the main control room alarm to eiert the operator if either RHR suction valve is not in the closed position when RCS pressure is greater than the setpoint will decrease the frequency of an interfacing systems LOCA. Additionally, the availability of the RHR system will increase. The removal of the i

autoclosure-interlock function does not adversely impact any design basis event considered in SQN's FSAR.

(2) Create the possibility of a new or different kind of accident from any previously analyzed.

The design basis.of the autoclosure interlock feature is to prevent the occurrence of an interfacing systems LOCA. iThe: proposed. alarm in the main control room will alert the operator if^either RHR suction valve is not in the closed position when RCS pressure is greater than the setpoint. Also, SQN's General Operating Instruction (GOI) 1 requires the operator to isolate the RHR suction valves during plant heatup to provide a double barrier between the RCS and RHR systems at normal operating conditions. These features ensure that the intended function of the autoclosure interlock is provMed and the intent of Regulatory Guide 1.139 is met.

Therefore, no new or different accident will be created.

(3) Involve a significant reduction in a margin of safety.

The autoclosure interlock feature is designed to prevent an interfacing systems LOCA by ensuring that a double valve barrier exists between the RHR system and the RCS. Double barrier protection

'is maintained by administrative controls of the system and by the addition of an alarm. Overpressurization protection remains available because of the relief capabilities of the RER pressure relief valves along with the low-temperature overpressurization protection currently in place.

Based on TVA's evaluation and the analyses performed by Westinghouse, TVA considers the proposed autoclosure interlock modification to be acceptable for satisfying the basic safety requirements of the RER system. The autoclosure interlock deletion provides a net safety enhancement for SQN.

!