ML20210K842

Rev 1 to Design Basis Rept

ML20210K842
Person / Time
Site:	Rancho Seco
Issue date:	09/12/1986
From:	Abbott D, Cap J SACRAMENTO MUNICIPAL UTILITY DISTRICT
To:
Shared Package
ML20210K770	List: ML20210K842 NL-86-672, Forwards Rev 1 to A-5415, Design Basis Rept, as Requested. Review of Current Emergency Feedwater Initiation & Control Sys Design Should Address Inconsistencies w/1983 SER Not Technical Adequacy
References
104415, A-5415, A-5415-R01, A-5415-R1, TAC-61635, TAC-64359, NUDOCS 8610010501
Download: ML20210K842 (53)

Text

l

'OSMUD C' .-- umm o.=cr DESIGN BASIS REPORT l I oATu 9-11-86

. y.

I&C 001 EcN A-5415. Rev. 2 N/A 104415

m. N., =nu ss REV No.

1. PURPOSE CF DESIGN CHANGE:

See Attached 11 . DESIGN CRITERIA USED:

See Attached C. CALCULATIONS & DESIGN INFORMATION:

See Attached IV. FAILUHE MODES:

O THIS CHANGE DOES NOT AFFECT CONTROL ROOM INSTRUMENTAllON

[XTHIS CHANGE AFFECTS CONTROL ROOM INSTRUMENTATION. SEE ANALYSIS V. SPECIAL MAINTENANCE REQUIREMENTS:

See Draft Test Spec. Surveillance Requirements; Reference 11

( VI. SPECIAL OPERATING REQUIREMENTS:

1 See Attached f

Vll. VERIFICATION CRITERIA:

Per Individual Sub-ECN Requirements Vill. COMMENTS:

See Attached 8610010501 860926 PDR ADOCK 05000312 l . -.

IX. APPROVALS:

O / DATt ELECT A

/

7tCAL !! fDs 9hA4 CIVEi(n n s~ Y~b~' T/ft l%

TC^"ika #n7h O T L ES 71 4 4  %/A^2

'i~'2D71M noNS DESNATED ENGC h W^5 DA

~WM?t~

i'J ^ E 9hils"

/[ DATE M r/Z_,

. t

. - .i._ 1 . . -

s TABLE OF CONTENTS PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 04 I. PURPOSE OF DESIGN CHANGE . . . . . . . . . . . . . .. . ... . . . 04 II. DESIGN CRITERIA . . . . . . . . . . .. . . . . . . . . . . . . . 06 II.A.

SUMMARY

OF CHANGE . . . . . . . . . . . . . . . . . . . . . . . 06 II.B. DESIGN BASIS . .. . . . . . . . . . . . . . . . . . . . . . . . 16 II.C. SCOPE . . . . . . . . . . . . . . . . . . . . . . .. . . . . . 20 II.D. EQUIPMENT CLASS & POWER REQUIREMENTS . . . . . . . . . . . . . 20 II.E. TESTING . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

. . . . . . . . . . .. . 21 III. CALCULATIONS AND DESIGN INFORMATION .

III.A.' DESIGN FEATURES . . . . . . . . . . . . . .. . . . . . . . . 21 III.B. FUNCTIONAL DESCRIPTION . . . . . . . . . . . . . . . . . . . . 22 III.C. DESIGN CALCULATIONS . . . . . . . . . . ... . . . . .. . . .22 III.C.l. AFW FLOW . . . . . . . . . . . .. . . . . . . . . . . . . . 22 III.C.2. CONDENSATE STORAGE TANK CAPACITY . . . . . . . .. . . . . . 22 III.C.3. EPIC SETPOINTS . . . . . . . .. . . . . . . . . . . . . . . 23 III.C.4. STEAM GENERATOR LEVEL CONTROLS . . . . .. . . . . . .. . . 23 III.C.S. MAIN FEEDWATER OVERFILL . . . . . . . . . . . .. . . . . . 24 III.C.6. LOMFW ANTICIPATORY TRIP . . . . . . . . . . . . . . . . . . 25 III.C.7. AFW PUMP RUNOUT . . . . . . . . . . . . . . . . . . . . . . 25 III.C.8. EPIC AFW POWER SOURCES . . . . . . . . . . . . . . . . . . . 26 III.C.9. UPGRADE AFW RELIABILITY , . . . . . . . . . . . . . . . . . 26

' . 27 III.C.10. HELBA & MISSIL3 STUDIES . . . . . . . . . . . . . . . . .

III.C.ll. EFIC SHUTDOWN BYPASS. . . . . . . . . . . . . . . . . . . . 28 5415MAJ Page 2 of 52 Rev. 1

TABLE OF CONTENTS IV. FAILURE MODES . . . . . . . . ... . . . . . . . . . . . . . . . 28 IV.A AFW VALVE FAILURE . . . . . . . .. ... . . . . . . . . . . . 29 l IV.B FAILURE OF FIBEROPTIC CABLES BETWEEN CHANNELS . . .% . . . . . . 29 IV.C FAILURE OF RPS-INPUTS TO EPIC . . . . . . . . . . . . . . . . . . 31 IV.D FAILURE OF SFAS INPUT TO EPIC . .. . . . . . . .. . . . . . . 32 IV.E FAILURE OF EPIC TRIP INTERFACE EQUIPMENT . . . . . . . . . . . . 32 IV.F EFIC POWER SOURCE FAILURES . . ... . . . . . . . . . . . . . 33 IV.G EPIC CONTROL FAILURE , . . . . ... . . . . . . . . . . . . . . 34 VI. SPECIAL OPERATING REQUIREMENTS . .. . . . . . . . . . . . . . . 37 VI.A OPERATING DESCRIPTION OF EFIC CONTROLLED DEVICES . . . . . . . . 37 VII. VERIFICATION CRITERIA . . . . ... ... . . . . . . . . . . . 41

.VIII. COMMENTS . . . . . . . . . ... . . . . . . . . . . . . . . . 41 VIII.A DESIGN VERIFICATION . . . . ... . .. . . . . .. . . . . .- 41 VIII.B DIFFERENCES BETWEEN R.S, CR-3, AND ANO EPICS . . . . . . . . . 42 VIII.C USE OF ORIGINAL PLANT VALVES .. .~. . . . . . . . . . . . . . 45 FIGURE VI - EFIC CONTROLS ON HISS (E) .. . . . . . . . . . . . . . . 47 TABLE VI - EFIC CONTROLS . . . . . ... . . . . . . . . . . . . . . 48 LIST OF REFERENCES . . . . . . . . .. . . . . . . . . . . . . . . . 50 5415MAJ Page 3 of 52 Rev. 1

ECN A-5415 MAJOR NCR Wark RIquszt 104415 Discipline- I&C MOD 001 Date 9-11-86 PREFACE This DBR covers the Emergency Feedwater Initiation and Control System (EFIC) and its functional ties to associated equipment. That is, it covers the concept and equipment design of EFIC and the Trip Interface Equipment (TIE) as well as the functional requirements imposed by EFIC on equipment which interfaces directly with EFIC or the TIE, or is otherwise included in Mod 1. Other than EFIC and TIE cabinets, this DBR does not attempt to address' component specific design criteria or design information associated with new equipment (or changes to existing equipment) except when such criteria or information directly impacts the function of EPIC. For instance, this DBR explains that EFIC requires Steam Generator level taps at 6", 156", and 619", but does not cover the-specific designs of the new level taps. That tap design and its attendant calculations is covered by the DBR for sub-ECN A-5415A.

Another example would be that this DBR covers required channel separation for cabling between EFIC and equipment connected to it. However, the actual cable routing and separation studies showing that the required separation has been. maintained, is to be covered by the appropriate sub-ECN. Another example is that this DBR covers the functional necessity to have two normally open, fail openI, control valves in parallel (each with a motor operated isolation valve in series) feeding AFW to each steam generator. However the seismic design of the modified piping and valves would be covered under the sub-ECN which installs the valves (A5jf5 J).

The scope of each sub-ECN can be found in the major ECN A-5415.

I. PURPOSE OF DESIGN CHANGE:

Several severe transients at nuclear power plants with Babcock &

Wilcox supplied NSS's which occurred during the 1970's were caused by inappropriate, post reactor trip, steam generator feedwater and/or steam pressure control. Reactor Coolant System overcoolings at f Rancho Seco and Crystal River 3, undercoolings at Davis-Besse and TMI-2, and others were investigated by the NRC in the spring of 1980. The transients and suggested plant alterations are summarized in.NUREG 0667, " Transient Response of B&W Designed Reactors." In summer 1980 following issuance of NUREG 0667, and in the hiatus between TMI Short-Term lessons learned (NUREG 0578) and the l clarification of TMI Action Plan Requirements (NUREG 0737) SMUD i agreed in discussions with the NRC to install "EFIC" and to upgrade the APW system to substantially comply with the NRC: " Standard Review Plan" for auxiliary Feedwater Systems (NUREG 0800, Section 10.4.9).

i i

t 5415MAJ Page 4 of 52 Rev. 1 l

ECN NCR W3rk Requ st 104415 A-54{lMAJOR DiEciplin? _ I&C MOD 001 Dats 9-11-86 A conceptional design for EFIC and its related plant modifications was submitted in draft form to the NRC in October of 1980 and a preliminary Safety Evaluation Report based on a point by point comparison with SRP 10.4.9 was received from the NRC in January 1981. The salient , features of the design at that time were to provide:

o Assured redundant availability of automatically initiated AFW for all AFW desi'qn basis events.

o Redundant safety grade control of AFW to assure sufficient but not excessive AFW flow.

o Isolation of Main Feedwater (MFW) and AFW to prevent continued feeding of a Steam Line Break (SLB) inside containment.

o Failsafe control ~of ADV's to prevent "mid-range" failure on loss of control power and to prevent common mode failure which would open ADV's on both main steam lines.

Following the District's initial commitment to install the Mod 1 changes, several licensing issues have been resolved by inclusion of the specific licensing requirement into the design base of Mod 1.

Thus, the Mod 1 (EFIC) responsibility to resolve NUREG 0737 II.E.1.1, II.E.1.2.1, and II.K.2.10 (AFW reliability, safety grade AFW initiate, and Anticipatory Reactor trip on loss of MFW), and portions of Reg Guide 1.97 (class I Steam Generator level and pressure indication).

Listed here is pertinent licensing correspondence:

1. SMUD to NRC letter dated May 6, 1980; Responds to IE Bulletin 80-04 Steam Line Breaks in Containment.

2. SMUD to NRC letter dated October 6,1980; Correction of ADV failure mode on loss of NNI or ICS power.

3. NRC to SMUD letter dated January 22, 1981; Preliminary Safety Evaluation Report of AFW upgrade.

4. NRC to SMUD letter dated July 10, 1981; Order letter to comply with NUREG 0737.

5. SMUD to NRC letter dated September 8, 1981; Submitted AFW System Description (B&W Document No. 15-1120580-01) as AFW upgrade design; also submitted upgraded AFW reliability analysis.

6. SMUD to NRC letter dated April 15, 1982; Clarifies use of Flux l

vs. MFW flow as ultimate Anticipatory Reactor Trip (NUREG 0737 II.K.2.10).

l l

5415MAJ Page 5 of 52 Rev. 1

, . ~ . _ _ - - - _ - - - _ . _ - - - _ -

Eck A-5415 MAJOR NCR Work R;quIst 104415 Discipline I&C MOD 001 Date 9-11-86

7. SMUDtoNRCletterdatedJuly6,1982;RespondstokEBulletin 81-14; seismic Qualification of AFW System.

8. NRC to SMUD letter dated September 7, 1982; Safety Evaluation

, Report of upgraded AFW system (per AFW System Description B&W Document 15-1120580-01).

9. SMUD to NRC letter dated October 22, 1982; Clarifies intent of DistrJct response to 0737 II.E.1.2.1 and 1.2.2; Asserts SMUD ability to alter design from SER'd version of AFW upgrade.

10. NRC to SMUD letter dated November 12, 1982; SER of Seismic design of the then " current" AFW system.

11. SMUD to NRC letter dated February 18, 1983; Supplies additional AFW design basis information.

12. NRC to SMUD letter dated April 7 1983; S.E.R. for 0737 II.E.1.1 with exceptions.

13. SMUD to NRC letter dated April 28, 1983; Submitted B&W Document 15-1120580-03 as latest design for AFW upgrade.

14. SMUD to NRC. letter dated January 17, 1986; Brief statement of Cycle 8 EFIC scope.

15. SMUD to NRC letter dated March 3, 1986; Clarification of Cycle 8 EPIC.

II. DESIGN CRITERIA II.A. Summary of Change II.A.l. This modification will place into service the l Emergency Feedwater Initiation and Control System (EFIC). EFIC is a four channel electronic logic and j

control system designed to meet IEEE 279 requirements for redundancy, channel independence, testability, etc. The principal functions of EFIC are to

" initiate" A'W, to control AFW flow to assure sufficient (and not excessive) flow, to detect a leak in the Main Steam System (as indicated by low pressure in either Steam Generator), to isolate Main Feedwater (MFW) to a depressurized or overfilled Steam Generator, to control the Atmospheric Dump Valves ( ADV's), and to assure that APW is fed only to an operable (ie. not depressurized) Steam Generator.

II.A.2. To support the EFIC and its required functions the following changes will be made:

541SMAJ Page 6 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work Requsst 104415 Discipline I&C MOD 001 Date 9-11-86 II.A.2.1. Install level sensors'on the steam generators and pressure sensors on the main steam lines. Specifically, this includes:

II.A.2.1.1. Install level taps and root valves in two places on the secondary side of each steam generator at 156" abcVe the top of the lower tube sheet and two places at 619" above the top of the lower tube sheet.

II.A.2.1.2 Install four wide range level transmitters on each steam generator between taps at 6" and 619" (LT-20507A, B, C, D and LT-20508a, B, C, D).

/f(

Install four low range level transmitters on each steam generator between taps at 6" and 156". (LT-20505 A,B,C,D and LT-20506 A,B,C,D).

Transmitters shall be grouped as indicated on Fig. 3.1-1 sheet 2 attached to EFIC AFW System Description (Ref. 28).

II.A.2.1.3 Install four pressure transmitters to each main steam line (outside containment ) , (PT-20546 A,B,C,D and PT-20545 A,B,C,D). Transmitters grouped as shown on Fig.

3.1-1-Sheet 2 (Ref. 28).

i II.A.2.1.4 One wide range and one low range steam generator level transmitter, and one steam generator pressure transmitter will be connected to each of the four EPIC channels. Power for the transmitters is supplied by the respective EPIC channel.

I II.A.2.2 Provide non-interruptable Class 1, AC power to EPIC Cabinets H4FWA, H4FWB, H4FWC, H4 FWD and reliable AC power to the non-lE portion of H4FWC and H4 FWD. Provide power to the Trip Interface Cabinets H4EIAl and H4EIBl.

i 5415MAJ Page 7 of 52 Rev. 1

. ECN A-5415 MAJOR NCR Work Requs2t 104415 Dicciplin3 I&C MOD 001 Date 9-11-86 II.A.2.3 Install the electrical and fiberoptic connection between the EFIC cabinets (H4FWA, B,C and D) and to the Trip Interface Cabinets (H4EIAl, H4EIB1).

II.A.2.4 lE connections between the four EFIC cabinets and the plant computer (IDADS) shall be made to monitor all EPIC analog indications (24 total signals). - Isolated outputs of the EFIC and TIE annunciations will also require connection to the plant computer. Indication out of the TIE that EFIC has started the AFW pumps will be annunicated in the control room and indicated on H2SP. Indication out of the TIE that EFIC has isolated MFW will be annunicated in the control room.

4 II.A.2.5 Implementation of NI/RPS changes. B&W Field Change Package 3473 changes the RPS to accept MFW flow signals; to develop a reactor power to MFW flow reactor trip (See figure 4.2.1 or REF. 28); to output power /MFW flow trip, RCP running status, channel bypass, and loss of MFW Pump Anticipatory Reactor Trip information to EPIC. Although the power /MFW flow trip modules will be installed, it will not be used by EFIC at this time.

II.A.2.5.1 Modify the B&W NI/RPS Field Change Package FCP-3473 such that Reactor Power'vs. MFW flow trip logic does not trip the reactor.

II.A.2.5.2 Jumper the power /MFW flow inputs at EPIC so that they will not actuate EFIC.

i II.A.2.5.3 Adapt Field Change Package FCP-3473 to conform to existing NI/RPS module and terminal block layout. Modify RPS seismic and thermal analyses to conform to

! revised layout.

II.A.2.5.4 Install the RPS Field Change Package hardware.

II.A.2.5.5 Connect the NI/RPS outputs to their respective EFIC channels and to the Plant Computer (IDADS) as appropriate.

5415MAJ Page 8 of 52 Rev. 1

EC A-5415 MAJOR NCR Work Requ st 104415 Discipline I&C MOD 001 Date 9-11-86 II.A.2.6 Implement B&W SFAS field change package FC-3478 Revision 5'and upgrade seismic 1

analysis to conform to actual SFAS system configuration. The B&W Field Change Package Changes the SFAS to output to EFIC a signal to start AFW on low RC pressure

and/or high containment pressure.

- Indication that SFAS has signalled EPIC to start AFW and'that EFIC has started AFW will be displayed on H2SF.

j II.A.2.7 Delete SFAS control functions for P-319, SFV-30801, SFV-20577, and SFV-20578 from  ;

H2SF.

II.A.2.8 . Modify AFW pump P-319 to receive a priority i start signal from TIE cabinet H4EIAl. Manual l start /stop controls will be installed on HISS

' in the control Room. All other start /stop controls will be deleted except pump / motor protection and diesel generator N.S. Bus loading logic.

l II.A.2.9 The AFW pump turbine steam inlet valve HV-30801 (Formerly SFV-30801) controls shall be modified to receive a priority open signal from TIE cabinet H4EIBl. The SFAS auto start control for HV-30801 will be deleted.

j II.A.2.10 Implement miscellaneous changes to EPIC to accommodate Rancho Seco control configuration and to add initiation time delay module.

l Specifically, modify the EPIC to implement the following items:

j Make wiring changes necessary to provide for transfer of control from the Control ll Room to the shutdown panel and to provide isolation of EFIC from the control room to meet Appendix R requirements for safe shutdown in the event of fire in the control room.

Change the color of some of the LED I indicators on the EFIC panel fronts to improve readability.

j Make wiring changes to provide vector enable directly from the AFW trip initiate modules and to provide only control enable from the C/V Enable (to be renamed Control Enable) trip module.

This gives the capability to reset the Vector enable without resetting the i control enable.

5415MAJ Page 9 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work R;qu;2t 104415 Discipline I&C MOD 001 Date 9-11-86 Install jumpers on any unused inputs that are fail actuated (i.e. ARTS 1, ARTS 2 and power /MFW flow trip).

Make wiring changes necessary to provide separate annunciation for the non-lE power supply and the 1E power supplies.

Disconnect the overfill inputs from the vector logic. This will disable the automatic isolation of auxiliary feedwater on steam generator overfill.

Add the spare fiber optic cables between EPIC channels so thel will be installed spares.

Install time delay modules in each EFIC cabinet such that the outputs of the following bistables can be delayed by an adjustable time of 0.0 to 9.9 seconds:

SGA Low Level, SGB Low Level, SGA Hi Hi Level, SGB Hi Hi Level, SGA Low Pressure, SGB Low Pressure, SGA Pressure less than SGB Pressure, and SGB Pressure less than SGA Pressure.

Note chat installation of the time delay circuits is desirable but not critical to

• the operability of EFIC.

II.A.2.ll Modify controls for APW Flow Test Valve HV-31855 to allow modulating control from the control room with position indication and priority close commands from TIE Cabinets H4EIAl and H4EIBl upon AFW initiate. These modifications are desireable but not mandatory I

prior to EPIC initial operation.

II.A.2.12 Disconnect ICS control to the atmospheric dump valves and connect ADV's to EPIC control.

PV-20562 A,B and C will be connected to EFIC channel B. PV-20571 A,B and C will be connected to EPIC channel A. Existing manual / auto stations on HlRI will be removed.

New manual / auto pressure control stations will be mounted on the control room panels HlRI and the shutdown panels one set for SGA, one set for SGB.

5415MAJ Page 10 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work Requact 104415 Discipline IEC MOD - 001' De te 9-11-86 II.A.2.13 Reconfigure the AFW control and isolation valves to add isolation valves in series with existing AFW control valves FV-20527 and FV-20528. Add control valves in series with existing AFW valves SFV-20577 and SFV-20578. .

This gives for each Steam Generator redundant parallel control valves each with independent isolation. ,

II.A.2.13.1 Controls for air operated valves FV-20527 and PV-20528 shall be from EFIC Channel "A" only, via the Class 1 electric / pneumatic converters FY-20527 and FY-20528. Both valves will be normally open, fail open on loss of signal or loss of air. Actual valve position for both valves will be available in the control i

room on HISS.

Though normally supplied with regular plant instrument air, a seismic Class I (non-interrupted on loss of offsite power) source of air will power the valves for two hours if necessary.

II.A.2.13.2 controls for D.C. powered valves FV-20531 and PV-20532 shall be from EPIC Channel 1

• B" only, via transducers FY-20531 and FY-20532

! respectively. Actual Position indication will be l indicated in the control room on HISS, Both valves will be normally open, fail open on loss of control signal or power. Valve power and position indication shall be powered from the same D.C.

bus which suc lies power to EPIC channel *B".

' 5415MAJ Page 11 of 52 Rev. I

_ - - - - . _ , . ~ . _ . _ _ - - - . _ - - - _ - - - . _ _ . . . _ _ . . . _ . _ _ _ _ . _ _ _ _ _ - _ _ _ _ . _ . - _ ___...

. ECH A-5415 MAJOR NCR. Work Requ 3t 104415 Discipline I&C MOD 001 Data 9-11-86 II.A.2.13.3 Controls for valves HV-20577 (formerly SFV-20577) and HV-20582 will be from the control room and EFIC channel "D". Valves are normally closed. EV-20582 will be powered by a non-interruptable Class 1

D.C. power source. Power for RV-20577 will remain on its Class 1, "B" Diesel backed A.C. source.

II.A.2.13.4 Control for valves HV-20578 (formerly SFV-20578) and KV-20581 will be from the control room and EPIC channel "C". Valves are normally closed. RV-20578 will retain it's Class 1 "A" Diesel A.C.

power source. EV-20581 will be powered by a

' non-interruptable Class 1 D.C. power source.

II.A.2.14 Connections from EPIC "A" to the shutdown panel will be made to accommodate cooldown of the plant with a fire in the control room. Steam generator A and B pressure indication, full range level indication and hand / auto controls for valves FV-20527, 7V-20528, PV-20562A, B, C and PV-20571A, B, C will be required at the shutdown panel. Isolation switches for EPIC and EPIC controlled components will be added as appropriate for Appendix "R" isolation of components affected by a fire in the Control Room..

II.A.2.15 Modify control of the main feedwater control and block valves to accept a priority close signal from the Trip Interface Equipment (TIE). Class 1 Solenoid Valves which close PV-20525, PV-20575, PV-20526, and FV-20576 should be commanded from TIE cabinet H4EIA1. Valves RV-20529 and EV-20530 should also receive close commands from TIE Cabinets H4EIA1.

5415MAJ Page 12 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work Requ0st 104415 Discipline I&C MOD 001 Date 9-11-86 II.A.2.16 Add motor operators to valves FWS-015 and FWS-016; renumber valves to FV-20515 and FV-20516 respectively. These two motor operated valves should be operable from the main control room with a priority close signal from TIE cabinet H4EIB.

Class 1 power to these valves should be from a different diesel channel than that which powers HV-20529 or HV-20530.

II.A.2.17 Add a motor operated isolation valve on 10" line 20529 to isolate Turbine Bypass Valves PV-20561 and PV-20563. Valve power should be Class 1 backed by diesel with manual open/close controls from the control room.

II.A.2.18 Add a motor operated isolation valve on

-line 20530 to isolate Turbine Bypass Valves PV-20564 and PV-20566. Valve power shall be Class 1 backed by diesel with manual open/close controls from the Control room.

II.A.2.19 Add a motor operator to valve MSS-017 and valve MSS-018 to provide isolation of Atmospheric Dump valves PV-20562A and PV-20571A respectively. Valve power shall be Class 1 with manual open/close controls from the control room. Note: ADV manual isolation valves MSS-019, MSS-021, MSS-020, MSS-022 are to remain closed during normal operation until motor operators can be added to them.

II.A.2.20 Modiff MFW pump turbine steam valve HV-20565 control to receive a priority close signal from TIE cabinets H4EIAl and i H4EIBl.

II.A.2.21 In addition to control room indication

• required above, the following Class 1 indication and controls will be panel

mounted in the control room

II.A.2.21.1 SG "A" low level, wide range level and pressure from EFIC channels A and B (from cabinets H4FWA, H4FWB).

l 4

I 5415MAJ Page 13 of 52 Rev. 1

ECW A-5415 MAJOR NCR Work Requ;ct 104415 Discipline I&C MOD 001 Date 9-11-86 II.A.2.21.2 SG "B" low level, wide range level and pressure from EPIC channels A and B (from cabinets H4FWA, H4FWB).

II.A.2.21.3 SG "A" AND SG "B" level selection back lighted pushbuttons plus auto selected level setpoint indication lenses.

II.A.2.21.4 AFW flow rate indication (Channel A & Channel B) for both SG "A" and SG "B".

II.A.2.21.5 One shutdown bypass back lighted pushbutton for each EFIC channel.

II.A.2.21.6 EPIC channel A and channel B manual trip / reset pushbutton matrices.

II.A.2.21.7 EFIC channel A and channel B AFW control valve control reset switches.

II.A.2.21.8 Open/close switches for HV-31826 and HV-31827 mounted with other APW controls.

II.A.2.21.9 Condensate Storage Tank level indication (A and B Channels). (Not required for initial operation of EPIC.)

II.A.2.22 Control Room modifications required to implement the above changes include:

II.A.2.22.1 Removal from HlRC the ICS l hand / auto control stations I for FV-20527 and FV-20528.

Add EPIC hand / auto controls for FV-20527, FV-20528, FV-20531 and FV-20532 to HISS.

II.A.2.22.2 Removal of AFW flow indication from H2PS.

I 5415MAJ Page 14 of 52 Rev. 1

. ECN A-5415 MAJOR NCR Work RequOct 104415 Dicciplin3 I&C MOD 001 Dato 9-11-86 II.A.2.22.3 RemCval of AFW control valve hand controllers (HC-20527 and HC-20528) from H2PS.

II.A.2.22.4 Removal of steam generator level indicator LI-20503B and LI-20504B from H2PS.

II.A.2.22.5 keplacement of ICS, ADV hand / auto control station with EFIC ADV hand / auto control station on (HlRI).

II.A.2.22.6 Removal of ICS power failure ADV failure mode select switch (HS-20562C) from HlRI.

II.A.2.22.7 Removal of Steam Line Failure Logic " Enable / Bypass" switches from HISS.

II.A.2.22.8 Removal of ICS AFW control override switches (HS-20527 and HS-20528) from HlSS.

II.A.2.22.9 Addition of open/close hand switches for HV-20515, HV-20516 on HlRI.

II.A.2.22.10 Changing location of open/close hand switches for AFW cross-tie valves HV-31826 and HV-31827 from H2PS to HISS.

II.A.2.22.ll Install an extension panel on the end of panel BlSS to be called HISS (E). This panel will contain all of the AFW controls. The layout of this panel is~shown in Figure VI.

II.A.2.22.12 Add motor operators to valves MSS-022, MSS-020, MSS-021 and MSS-019 to provide isolation of Atmospheric Dump Valves PV-20562B, PV-20562C, PV-205171B and PV-20571C res pectively. Valve power shall be Class 1 with manual open/close controls from the control room. No required for initial operation, see II.A.2.19.

5415MAJ Page 15 of 52 Rev. 1

c ECN- A-5415NAJOR NCR Work Requ:st 104415 Discipline- I&C MOD 001 Date 9-11-86 II.A.3. Changes which are part of Mod 1, but which are to be implemented at the next refueling following implementation of the above modifications.

II.A.3.1 Modify the NI/RPS Field Change Pack &ge PCP-3473 to include the Reactor Power vs.

MFW flow Anticipatory Reactor Trip into the RPS trip string. Modify the NI/RPS Field Change Package FCP-3311 to delete the " Loss of Both Main Feedwater Pumps with Reactor Power greater than 20%"

Anticipatory Reactor Trip. Implement these changes in the NI/RPS.

II.A.3.2 Removal of existing HlSS console and the new HISS (E) extension and replacement with a new one of same cross section but 24" longer. Console structure is Class 1 seismic. Console layout consolidates AFW controls, MFW controls, Condensate Controls, Turbine Controls and Generator Controls,.as required by the Control Room Design Review. Console layout is shown on Specification N25.08 drawing sheets 1 thru 8.

II.A.3.3 Using operating data gathered during fuel Cycle 8, develop a procedure for setting and maintaining the EPIC MFW overfill level bistable and delay setpoints.

II.B. Design Basis II.B.l. Design Basis for the AFW system (including MFW isolation following Steam Line break) is ,

fundamentally based upon NUREG-0800 10.4.9, Standard l Review Plan Auxiliary Feedwater System (PWR).

Specific exceptions to NUREG 0800 are:

II.B.l.1 The AFW system at Rancho Seco does not normally operate (provide. flow to the steam generator) during start-up, hot standby and shutdown. The AFW system is ,

an emergency back-up to the Main Feedwater System, or may be used at the control room operator's discretion. The AFW system

' will initiate and function in the fully automatic mode when required (see section 4

2.1.4.2 Actuation Requirement; System l

Description; Reference 28) if the pressure in both Steam Generators had been ll operating at 750 psig or greater. It shall be possible to initiate the AFW System manually (in the fully manual or fully automatic mode) at any time that the f Decay Heat Removal (DHR) system is not the l

principal core cooling system.

I

, ECJ A-5415 MAJOR NCR Work Requcct 104415 Dicciplin] I&C MOD 001 Dats 9-11-86

'II.B.l.2 Plant cooldown from hot standby to the DHR cut-in temperature using only safety grade equipment controlled from the control room (NUREG 0800 10.4.9 I.18) assuming worst case single active failure is not a design basis for Rancho Seco. This is however a design objective (as opposed to requirement) for the EPIC system and its controls in the control room.

II.B.l.3 AFW system unreliability as analyzed using methods and data presented in NUREG-0611 and NUREG-0635 may not meet the absolute requirements of NUREG 0800 II.5.C. This is discussed in SMUD letter to NRC dated September 8, 1981, " Auxiliary Feedwater System upgrade Reliability Analysis dated April 1981 (See I.8) and NRC's SER of EPIC dated April 7, 1983 (Ref. 3). Using methods appropriate to the specific design F of the " upgraded" AFW system at Rancho Seco, B&W concluded that unavailability of full auto initiation was 9 x 10-5 per

demand. The unavailability per demand as calculated for the NRC by Brookhaven National Labs was 7.6 x 10-4. The differences are discussed in section II.B.6 (page 49) of the SER (Ref. 3).

II.B.2. Additional Design Bases for EPIC and EPIC Related Changes per MOD 1 Section 2.0 System Requirements of the EPIC AFW System Description (Ref. 28) lists design bases for the AFW system.

The EPIC AFW System Description is the most recent l

evolution of the documentation which forms the licensing base for the EFIC concept. The EFIC AFW System Description is a direct descendent of B&W J document 15-1120580. Revision 00 of that document was the basis for the NRC's positive preliminary Safety Evaluation Report of the AFW Upgrade issued to the District by letter dated January 22, 1981.

L I

i l

{

5415MAJ Page 17 of 52 Rev. 1 l

l

' ECN A-5415 MAJOR 'NCR Work Requ:st 104415 Discipline I&C MOD 001 Date 9-11-86 As the design of EFIC and related system upgrades were fleshed out, revision 01 of the AFW System Description (15-1120580-01) was sent to the NRC September 8, 1981 (Ref. 25). The NRC subsequently issued on September 7, 1982, on S.E.R. against that revision of the System Description. Following issuance of that S.E.R. there was some confusion within the NRC as to whether they had acted upon sufficient infotsation.

So, in a letter dated December 8,1982 (Ref. 7) the NRC requested additional ~EFIC and APW information.

Subsequent letters from SMUD to the NRC (references 1 and 2) supplied aoditional information and on April 7, 1983 the NRC issued the SER (Ref. 3) which stands today as the official approval of the EPIC and related system upgrades.

On April 28, 1983 (Ref. 6) the District sent a revised AFW System Description to the NRC (15-1120850-03). That document is the last revision of the B&W System Description sent to the NRC.

B&W revised document 15-1120850 one more time (Rev.4), however, the only substantial change to the document was the addition of Rancho Seco specific EFIC setpoints for S.G. low level initiate, etc. The EF'C AFW Syst1m Descripcion, which is attached to and forms a part of this D.B.R., is a SMUD Nuclear Engineering revision of B&W document 15-1120580-04.

SMUD letters to the NRC dated January 17, 1986 and March 3, 1986 (References 26 and 27) briefly describe the Mod 1 (EFIC) scope particularly for fuel cycle

8. The latter reference contains, for the NRC, a brief description of the substantive differences between the last official system description sent to them and the design as stated in the most recent EPIC AFW System Description.

Significant permanent changes to AFW upgrade design as compared to the status of design described in System Description Doc. 15 1120580-03:

A) AFW pump P-319 will be actuated by EPIC channel A, and will continue to be connected to an emergency electrical bus powered by the existing "A" diesel generator. Likewise AFW pump P-318 will be actuated by EFIC channel B. using it's turbine driver, and it's turbine steam admission valve will continue to be powered from a "B" train, battery backed, D.C. bus.

B) The use of time delay circuits in the initiate logic will be utilized to minimize spurious actuations. See Figure 2.2-4.

l l

l l

5415MAJ Page 18 of 52 Rev. 1 I

L

ECN A-5415 MAJOR NCR Work Requ3st 104415 Discipline I&C MOD 001 Date 9-11-86 C) The shutdown bypass permissive signal has been altered to allow '

bypass when either steam generator secondary pressure is below 725 psig. (See Figure 2.2-4). This simplifies operator action during a tube rupture scenario.

D) Position indication of manual valves in the AFW flow path is not to be provided since each is locked in its safety position during plant operation.

II.B.3 Appendix R - Components used in various appendix "R" procedures are impacted by this modification, this includes Atmospheric Dump Valves (ADV's), AFW control valves and AFW pumps. Also hand / auto stations to control ADV'S and AFW control valves are being added to the Appendix "R" shutdown panel to facilitate plant control in the event of fire in the control room.

II.B.3.1 It shall be possible to electrically isolate any EFIC control circuit which passes through the control room such that after isolation has occurred no adverse EPIC control action can occur due to fire in the control room. No damage to the EFIC circuitry shall occur due to fire in the control room.

II.B.3.2 Automatic initiation of AFW and/or automatic isolation of MFW is acceptable but not necessary to mitigate the effects of a fire in the plant. Manual initiation of the AFW via EFIC is sufficient.

II.B.3.3 Controlled AFW flow and pressure control via the ADV's shall be possible for at least one steam generator for all Appendix "R" scenarios.

II.B.3.4. EPIC powered control parameters (S.G.

level, S.G. Pressure) shall be indicated at the place where the controlling EPIC hand / auto station is located. Indication shall be from the same EFIC channel as the Controls.

l

?

4 5415MAJ Page 19 of 52 Rev. 1

ECW A-5415 MAJOR NCR Work Requ t 104415 Disciplina I&C MOD 001 Date 9-11-86 II.B.3.5. Those portions of EFIC, its controls and indication which are used to mitigate Appendix "R" scenarios need not (for Appendix "R" reasons) be Class I, but must operate operate with or without the availability of offsite power. Assured power sources including both battery backed electrical power and compressed air bottle back-up instrument air must be available for at least 2 (two) hours following loss of offsite power. After two hours, local manual control is permitted.

II.B.4 EQ Requirements - Some components in Mod 001 are subject to the EQ requirements of 10CFR50.49. The specific components and requirements are identified in the DBR's for each sub ECN.

II.C. Scope Scope of design criteria is covered in II A and II B above.

II.D. Equipment Class and Power Requirements The classification of equipment and their power sources is covered in the EFIC APW System Description section 3. Seismic classification of AFW piping is specifically covered in a SMUD letter to the NRC dated January 14, 1983 (Ref. 2).

The design of EPIC and it's relationship to components it interface with, assumes that an emergency diesel generator and it's associated emergency bus is independent of any other.

i.e. failure of a diesel generator and/or its bus will not cause failure of any other. Also, loss of a diesel generator cannot cause loss of a battery powered bus for as long as the batteries are able to power the bus.

II.E. Testing II.E.1. Surveillance Testing for safety critical systems and components is covered by the Rancho Seco Technical Specifications as amended to include the Draft Tech

- Specs, B&W document 05-0004 dated March 25, 1985 (Ref. II).The draft tech specs cover only the EPIC, i SFAS, and RPS.

II.E.2. Start-Up Testing 5415MAJ Page 20 of 52 Rev. 1

!= ECN A-5415 MAJOR NCR Work Requsst 104415 Discipline I&C MOD 001 Date 9-11-86 II.E.2.1. Insitu testing of the EFIC circuitry is required to assure that the CMOS Devices have not altered since the system test was performed at the Vitro factory in February 1984. Vitro Equipment Test Procedure TP-3801-4009 functionally tests each circuit and is available for our use.

j II.E.2.2. Test specifications for the RPS and SFAS changes (B&W Field Changes Packages

FC-3473 and PC-3478 respectively) are included in the change packages. In addition, the Reactor Power vs. MFW flow Anticipatory Reactor Trip (ART) will not j

be used to trip the reactor until it has been tested for a fuel cycle under normal l operating conditions. (See Section III C) i II.E.2.3- Test specifications for other specific components will be addressed by the specific Sub-ECN design package.

1 II.E.2.4. A test specification for the entire upgraded AFW system including EPIC, Main Feedwater Isolation and ADV control is presented in B&W Document 62-1149372-00 (Ref. 10). The Test Specification was prepared prior to the start-up of the EFIC system at Arkansas Nuclear One and Crystal River 3 and therefore could not

! reference that operating experience. It

! is recommended that those portions of the r test spec requiring high decay heat rates j

not be performed if RCS and secondary i

system response has been demonstrated at other B&W operating plants. Rather, the i

adequacy of equipment response should be j verified using a test procedure adapted l from TP-3801-4009 (Ref. 29).

III. Calculations and Design Information III.A. Design Features i

1 The design features of the EPIC AFW upgrade are covered by l, section 3 of the System Description (Ref. 28). Additional specific information concerning the EPIC and T.I.E. can be i

obtained from the vendor drawings. A listing of the Vitro I (EFIC) and Consolidated Controls Co. (T.I.E.) vendor drawings

j. is included as reference 9. Equipment instruction manuals j are also available.

i 5415MAJ Page 21 of 52 Rev. 1 i

-.-_.-.--_-2 . _ _ , , - _ _ . - _ _ . . _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ . . . . _ . . _ . , _ . .__ _

ECW A-5415MAJoh ECR Work Requ:st 104415 Disciplin3 IaC MOD 001 Dato 9-11-86 A study of the " human factors" associated with operation of the EFIC is available; see reference 13.

III.B. Fun.:tional Description A functional description of the EFIC AFW upgrade is found in the EFIC AFW System Description (REF. 28).

III.C. Design Calculation III.C.l. AFW Flow - The minimum required APW flow required even under the worst case single failure assumption which would limit AFW flow to the steam generators is 760 gpm total flow to the SG's within 70 seconds of loss of Main Feedwater (LOMF). Reference 43 summarizes tne calculation input and results for the 760 gpm case with a 50 second delay. Reference 45 extends the delay to 70 seconds. Another B&W calculation (Ref. 52) shows that 560 gpm of AFW would be sufficient. However that calculation was not a " safety grade

• calculation and did not employ fully defensible calculational methods. It serves I, to show that the 760 gpm number acknowledged by the NRC as sufficient is not the absolute minimum required AFW flow at Rancho Seco.

References 1 and 2 give considerable detail concerning the 760 gpm analysis. The NRC SER (Ref.

3) page 60, 61, and 62 specifically accepts the 760 gpm at 70 seconds value.

A value for' mar.imum (uncontrolled) AFW flow to a single SG was calculated to be approximately 2130 gpm at a SG pressure of 600 psig; see Ref. 41.

III.C.2. Condensate Storage Tank capacity - The required AFW flow calculation cited above recognizes that not only decay heat, but also Reactor Coolant Pump (RCP)

heat input must be considered for AFW cooling requirements. A calculation showing the effective l cooling capacity of the CST which takes this into consideration is shown in reference 44. This shows i that at a minimum initial level approximately 10.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of water are available to cooldown to the Decay Heat Removal cut-in temperature.

I 5415MAJ Page 22 of 52 Rev. 1

- _ . _ . . - - - _ . _ - . - . - . - _ . _ - - -_ ~ -._ . _ _ -

ECN A-5415 MAJOR NCR ,

WJrk Requzat 104415 Discipline I&C MOD 001 Date 9-11-86 III.C.3. EFIC Setpoints - There are several EFIC setpoints which are of interest due to their potential impact on normal and emergency operating procedures. These

' include S.G. low level initiate, S.G. low pressure initiate, ADV pressure control setpoint, and AFW level control setpoints. The various setpoints (see Table 4.2-1 of the System Description) were calculated based on operating experience, transmitter error, special S.G. fluid condition calculations, containment environment, etc. The calculations which are the basis for the setpoints are collected in one B&W calculation 32-1155738-00 dated 1/22/85 (Ref. 48). References 30 and 31 became the basis for environmental temperature range input for level transmitter and liquid filled reference legs inside containment. Reference 39 dcruments the accuracy of the level transmitters to be used. Reference 46 documents the basis for the 4 "ECC Level Setpoint". Note that the level transmitter string accuracies assume that the reference legs are insulated and therefore never exceed 145'F; even during accident conditions in containment.

III.C.4. Steam Generator Level Controls - The EFIC steam generator level controls have the requirement to assure sufficient but not too much cooling water flow. This requirement must be fulfilled with two redundant flow paths. EFIC employs for each S.G.

two independent control trains each utilizing the same but independently measured feedback parameters. This raises several control stability questions, particularly during natural circulation conditions in the RCS. These questions were investigated by B&W. Reference 40 establishes the preference for a " rate limited" level rise control and Reference 38-investigates control stability 2 and the ability of the controls to act in the full automatic mode for at least 10 minutes for all expected decay heat scenarios without requiring operator action to keep pressurizer level within limits.

5415MAJ Page 23 of 52 Rev. 1

. ~ - - - - -_ _ . -- .

• ECW A-5415 MAJOR NCR Work R:qu3st 104415 Disciplin3 I&C _ MOD 001 Date 9-11-86 III.C.5. Main Feedwater Overfill (MPWOF) Overfilling the Steam Generator has been a concern for several years. However since the required action to mitigate overfill produces a LOMPW event, there has i been reluctance to protect against it.

Additionally, there are with the OTSG design two distinctly different " overfill" problem regimes.

The one is excessive feedwater flow at high power levels. This regime has the potential to produce hydraulic instability in the SG's and to send wet steam to the first stage of HP turbine blades. The other regime could occur at low power levels and would literally fill the SG's with liquid. RCS overcooling and weight of water in the steam lines

are concerns for this event. Reactor power excursions due to moderator temperature feedback are of interest but of no concern.

B&W investigations specifically aimed at proving out the EFIC MFW overfill concept are presented in reference 35, 36 and 37. Reference 36 is the confirmatory calculation showing that isolation of MPW within 15 to 30 seconds is sufficient to prevent excessive moisture from carrying over into the steam lines. Reference 35 and 37 were investigations into more elaborate MFWOF detection schemes than that used by EFIC. Their so called

" variable overfill limits" were rejected as ineffectual or not cost effective.

I The original EFIC concept included MPW and AFW I overfill isolation logic. However that design l utilized a common bistable in each EFIC channel to i " decide" to isolate both MPW and AFW. Even though the particular failure would have required four independent failures (or eight bistables to be grossly mis-calibrated by a single technician) the j

" commonality" aspect led to deletion of the AFW l overfill portion of the designs; See also P55 of the NRC EPIC SER, Ref. 3.

I I Having no automatic protection for APW overfill is justified since it is a slow developing transient which would allow time for operator intervention.

The operator will still be alerted to an overfill I

via the MFWOF circuits, and controls and indications are available to the operator to isolate APW from the control room.

l l

5415MAJ Page 24 of 52 Rev. 1 l

l

ECN A-5415 MAJOR NCR Work R qusst 104415 Discipline I&C MOD 001 Date 9-11-86 III.C.6. LO,MFW Anticipatory Trip - As noted in several submittals to the NRC (e.g. References 6 and 24) the District intends to install as its response to NUREG 0737 II.K.2.10 an Anticipatory Reactor Trip (ART) based on a comparison of reactor power and MFW flow. This is described as the Reactor Power vs. MFW Flow ART's, the Flux /MFW flow ART's, or the 0/MFW Flow ART's. The Trip is developed in the RPS in a comparitor module which compares measured reactor flux to total measured MFW flow.

Since MFW flow tends to be a fairly noisy signal, there was initial concern that this scheme might '

- lead to spurious trips of the reactor. Therefore,

" operability" evaluations were undertaken to collect data from Rancho Seco and other operating plants to assure that spurious trips would not be a problem. References 21 and 23 transmit B&W studies 51-1135242-01 and 51-1141558-00 res pectively.

These studies show that spurious trips should not be expected. Reference 1S, 19, 20 and 22 transmitted Rancho Seco operating data to B&W as a partial basis for the studies.

Despite the assurances of the existing studies, it seems prudent to collect some operating data with the new hardware prior to its use as a reactor trip. In the interim the existing LOMFW ART based upon MFWP Turbine EHC pressure will continue.

However, the Flux /MFW flow trip may be used to tell EPIC to start AFW. This is acceptable since based upon the considerable existing data we expect there to be no problem, and starting the APW will not produce flow to the SG's as long as sufficient inventory actually exists.

III.C.7. AFW Pump Runout - EPIC and the upgraded AFW system have provision for automatically isolating APW to a depressurized steam generator. However, various probable scenarios can have one or both AFW pumps pumping for a short time to depressurized S.G.'s.

A study performed by Emergency Research &

Consultants Corp. (Report No'. ERCO-693 dated February 16, 1984) shows that the Rancho Seco AFW pumps could be operated in the full " runout" condition for at least 30 minutes without destruction (Reference 12).

5415MAJ Page 25 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work R;qusst 104415

. Discipline I&C MOD OG1 Date 9-11-86 S /

III.C.8. EPIC AFW Power Sources - The EFIC system initiates AFW Via-two 100% trains of AFW. That is, either train is sufficient to supply the required AFW to both steam generators. The A channel of EFIC starts P-319 and controls flow to both SG's through FV-20527 and PV-20528. The B channel starts P-318 by opening valve HV-30801 and controls flow to both SG's through FV-20531 and FV-20532. Either channel is sufficient to assure sufficient AFW flow, but care must be taken to assure that the failure of a common electrical source will not prevent A?W from both trains from reaching at least one SG. .Another EPIC function is to isolate AFW to a steam

~

generator which has experienced a major steam line failure. This is accomplished using four channel logic which acts directly on the AFW isolation and i control valves. As with the AFW initiation and control function, care must be taken to assure that a common electrical power source doesn't prevent required APW isolation. Additionally, care must be taken that single electrical power failures common to more than one piece of equipment cannot prevent flow or isolation when required.

This theme is addressed in a study (Ref. 25) which shows that with power and logic channelized per the

, APW system description, single failure will neither prevent feed nor isolation of AFW flow.- Note that at the time the power sources study was done, valves HV-20581 and HV-20582 were not planned to be operational for initial EFIC APW upgrade operation. This has now changed. The study is valid, but there will be no interim limited

, functionality.

III.C.9. Upgrade AFW Rellability - There,are several sources of information concerning reliability analysis for the Rancho Seco AFW system. The sources which figure prominently in the licensing of the upgraded AFW system are:

• A generic AFW reliability analysis for all B&W plants; BAW 1584, Dec. 1979.

This was used in early evaluations of the AFW i system, including NUREG 0667. It also formed the analytical basis for requiring auto loading of P-319 on the emergency bus following LOOP.

5415MAJ Page 26 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work RIquist 104415 Discipline I&C MOD- 001 Date 9-11-86

• A Rancho Seco specific AFW Reliability Analysis performed by B&W (Ref. 33). This analysis was sent to the NRC in fulfillment of NURG 0737 II.E.1.1. (Ref. 26). It assumed EPIC and an AFW configuration like that which we will have after completion of MOD 1.

• A Rancho Seco specific AFW Reliability Analysis was performed by Brookhaven National Labs under contract to the NRC. This Analysis forms the analytical basis for the EFIC S.E.R. issued in April 1983, and is discussed and compared in the SER (Ref. 3) to both the B&W prepare analysis (Ref. 26) and the requirements of the Standard Review Plan (Ref. 4).

• A reliability and fault tree analysis for the EFIC system above was produced by Vitro, the manufacturer (Ref. 34). This is a very detailed and conservative analysis showing the relationship and dependability of the electronic circuits within EFIC. However, it measures success in a narrow fashion concerned only with the electronics. Therefore, its use in measuring broader mission success (e.g. not boiling the core) requires additional analytical input.

• An additional reliability analysis which may be of benefit to the District but which is not a part of the licensing base for MOD 1 is a set of analyses which investigates various power sources in combination with a third AI pump.

(See B&W analysis BAW-1722 dated March 1982.)

A good summary of the various reliability analysis i and their worth is contained in a B&W 1etter to SMUD dated July 9, 1984 (Ref. 5).

III.C.10. Helba & Missile Studies - The NRC APW SER dated April 7, 1983 (Ref. 3) notes that at that time three unresolved items remained: AFW internal missiles study, CST protection and an AFW HELBA analysis. These open items were resolved by References 53, 54 and 57.

An additional HELBA analysis which looked i

specifically at the AFW upgrade piping changes was produced by Bechtel (Bechtel Calc M21.30-363, dated 6-14-83; Ref. 32).

I j 5415MAJ Page 27 of 52 Rev. I

"_ - - __.,_.4 -. _._ _ _ . _ . , _ _ ,, _ _ . . _ _ _ _ _ _ _ _ _ _ . , - _ _

. ECN 'A-5415 MAJOR NCR Work Rtqusst 104415 Dicciplins I&C MOD 001 , Date 9-11-86 Hazards reviews of each sub-ECN submitted under this major will also be performed.

III.C.ll. EFIC Shutdown Bypass - There are four conditions i which can cause EFIC to auto initiate AFW and/or isolate MFW which need to be manually bypassed for a normal plant. shutdown condition. Bypassing a safety system on a system level requires a coincident permissive signal (See IEEE-279). In the original EFIC hardware specification two of the conditions (low SG pressure, and loss of'all 4 RCP's) were bypassed on a system basis, but required ' individual manual action locally at the four EPIC cabinets at different times during cooldown. The other two (low level in a SG, and high level in a SG) were to be handled procedurally by pulling breakers on the AFW pumps, etc. These 1

shutdown bypassing methods were not acceptable to the District due to complexity and remote location of the EPIC cabinets.

A shutdown bypassing concept acceptable to B&W and the District was incorporated into the EPIC hardware. The-concept uses a single bypass permissive (pressure in the Steam Generator less than 725 psig), and can be enacted from the control room by pushbuttons on the HISS console. The correspondence _ which documents the design is found in Reference 14, 15, 16, 17 and 49.

II.C.12 Single Failure Analysis - An analysis was performed by vitro (Reference 55), in accordance with IEEE-279-1971 and IEEE-379-1977, that shows that the EFIC System meets the single failure criterion.

IV. FAILURE MODES Many of the operating modes of EFIC are discussed in detail in

! section 6.0 of the EPIC System Description (ref. 28). The plant casualty events discussed include the following: Loss of MFW (LMFW),

LMFW with loss of offsite AC' power, LMFW with loss of onsite and offsite AC power, plant cooldown requiring AFW, turbine r ip with and without bypass, main feedline break, main steamline break /AFW

' line break, small break LOCA, fire outside control room, fire in the control room. In addition to these, various EFIC system failures

. are discussed in the following paragraphs.

1 l

l l 5415MAJ Page 28 of 52 Rev. 1

ECh A-5415 MAJOR NCR Work RIqusst 104415 9

Discipline I&C MOD 001 tate 9-11-86 IV.A. AFW Valve Failure Since each OTSG is supplied auxiliary feedwater from a line which is controlled by a parallel combination of series sets of valves, there is no single failure which will prevent the isolation of or the feeding of the appropriato OTSG. Each of the four valves is powered and controlled by a separate EFIC Channel and power source. . Consequently, a single channel failure will only cause the failure of one valve of the parallel combinations, (i.e. one valve per OTSG). Each series set of valves is comprised of an isolation valve and a control valve. The control valves fail open on a loss of power or signal. The isolation valves, being motor operated, fail as-is. Since only one valve in the. parallel combination 4

of the series set of valves fails, each OTSG can be either fed or isolated. For failure modes of the individual valves see the DBR of the appropriate sub-ECN.

IV.B. Failure of Fiberoptic Cables Between Channels The fiberoptic communication between EFIC channels is designed such that a single failure (such as a loss of all

! ' fiberoptic cables going into.one EFIC cabinet) shall not result in a failure of EFIC functions to actuate when needed. A single event, however, can cause an inadvertent actuation of either AFW initiation or MFW Isolation if the event affects more than one channel of initiation logic.

l Initiation of AFW is of little consequence because it will only supply water to the steam generators if the levels are low and they need. water. Isolation of MFW is more serious and can lead to a plant trip, but this condition is acceptable because AFW is available to cool the plant.

To meet this criteria interchannel fiberoptic cables do not require the same kind of separation that would be required of electrical cables. The difference is that the cables entering a common EFIC cabinet 'do not require separation from each other'even though they belong to different (A, B, C and D) safety channels. There are two reasons why this is so.

The first reason is that fiberoptic cables, unlike electrical cables, cannot propagate energy along the cable in large enough quantity to damage adjacent cables. Consider a cable running between the A and the B cabinets. A disturbance to the cable in Cabinet A can in no way damage an adjacent cable in Cabinet B.

' The other reason why the fiberoptic cables that enter a common EFIC cabinet do not require separation is that the communication system is designed so that a failure of any cable can only cause that signal to revert to an actuated l' state. In all cases this is the safe state which is shown in the following list of fiberoptic cable types:

5415MAJ Page 29 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work RIqusst 104415 Discipline I&C MOD 001 Date 9-11-86

1. Test Results These cables are used to indicate at the other three channels that a test is in progress on either A or B channel. The purpose of this indication is to warn l technician / operators at the EFIC cabinets that testing is in progress. A failure of these cables will cause the test confirm (i.e.,- test in progress) light to turn on. This is the safe condition.

2. Channel Bypass These cables transmit information used to prevent more

~

than one channel of EFIC being placed in maintenance bypass and to prevent other channels of.EFIC being placed in maintenance bypass when an RPS channel is in bypass. A failure of these cables will both prevent placing of channel in maintenance bypass and will take out of maintenance bypass any channel that was already ,

i in bypass. The latter of these can cause a half trip of

the EFW initiation and/or the Generator A and/or B MFW solation if work in another EFIC cabinet were in progress.

3. Vector Enable and Control Enable These cables are used to " enable" or start the vector and control modules when EFW initiation occurs, and allows automatic level control to begin. When the cables are damaged the associate control and/or vector modules'are enabled. This is the safe condition since these modules are dormant during normal plant operations only to decrease valve stroking.

4. Trip Inputs These cables transmit the outputs of the initiate modules from the four channels to the trip modules in Channels A and B to give the four channel initiation of trips. A failure in these cables can cause a half or a

full trip of the EFW initiation and/or the Generator A and/or B MFW Isolation.

IE Information Notice 86-15 addressed the failure of some fiberoptic cables due to Radio Frequency Interference. The memo from Daniels to Lewis (Reference

56) explains why this should not adversely affect the EFIC fiberoptic cables and states that EPIC will be

!. tested for this problem during start-up testing.

i 5415MAJ Page 30 of 52 Rev. 1

. ECN A-5415 MAJOR NCR Work RequSet 104415

-Discipline I&C MOD 001 Date 9-11-86 IV.C. Failure of RPS Inputs to EFIC I'

Bach channel of EPIC receives an actuation signal from the corresponding channel of RPS for the condition when both MPW pumps tripped at greater than 20 percent reactor power'. The function of this signal is to initiate AFW.

Each channel also receives four Reactor Coolant Pump (RCP) trip signals from the corresponding channel of RPS. when all four RCP's have tripped, EPIC initiates AFW and the channels A and B control modules raises their steam generator level setpoints to a level appropriate for natural circulation. In both of these cases, EFIC looks at the inputs as four channel and actuates based on one out of two taken twice logic. Because of this, any single failure of the inputs to one EPIC channel will not prevent actuation of EFIC functions nor will it, by itself, cause inadvertent actuation.

Each channel of EPIC also receives a channel bypass signal from the corresponding channel of RPS. The function of this signal is to prevent other channels of EPIC from being put into bypass when one channel of RPS is in bypass. A failure of this signal to actuate could allow one channel of EFIC to be put in to bypass while a different channel of RPS was in bypass. In this condition it is possible to have two channels of RPS giving the signals for an EFIC initiation with both being bypassed. This does not prevent EFIC initiation, though, because there are two other channels of RPS that can initiate EFIC. Also, this event is extremely unlikely because the bypass of both RPS and EFIC channels will be under strict administrative control.

A failure of the channel bypass causing bypass actuation will simply prevent other channels of EFIC from being 3

placed in bypass or if any channel was in bypass it will take it out of bypass. The latter of these can cause a half trip of APW initiation or a half trip of the generator A or B MFW Isolation.

The failure modes of the RPS inputs to EriC are listed below:

1. Loss of Power - A loss of power in one channel od RPS will force the MFW pumps tripped and the RCP's tripped inputs to the actuated state and will force the channel bypass to the not bypassed state. A loss of the EFIC power used to sense the contacts in RPS will cause the MFW Pump Trip to appear actuated and the channel bypass to appear bypassed but will have no 4 af fect on the RCP's tripped signals.

5415MAJ Page 31 of 52 Rev. 1

EC'N A-5415 MAJOR NCR Work Requsat 104415 Discipline I&C MOD 001 Data 9-11-86

2. Loss of Signal - a loss of signal will cause the MFW pumps tripped and the RCP's tripped signals to appear actuated. A loss of signal will cause the channel bypass to appear to be in the bypassed state.

~

IV.D. Failure of SFAS Input to EFIC The SFAS inputs to EFIC are designed so that a single i failure will not stop EPIC from initiating AFW when SFAS actuates. There are channel A and channel B initiate signals sent to EFIC from SFAS, two signals per channel, each delivering a half trip to the AFW trip module. Either channel will initiate EFIC if both of its signals are actuated (i.e. two out of two taken once). In each channel

.of SFAS there are two unit modules that supply the inputs to the corresponding channel of EFIC. These inputs are open contact to trip EPIC and energize to open the contacts in SFAS.

The following paragraphs summarize the failure modes:

4

1. Loss of Power -

A loss of power in a SFAS channel will prevent that channel from initiating the corresponding channel of EPIC but will have no affect on the other channel. A loss of power in an EFIC channel will prevent that channel of EPIC from initiating.

2. Signal Failure -

A loss of the closed contact signal integrity in one input to EPIC will cause a half trip of EPIC and a loss of both signals in one channel will cause a full trip. Similarly, a withdrawal of a unit module from SFAS will cause a half trip in its corresponding input to EPIC.

Since the SFAS signal is an energize to actuate a failure of an SFAS module to actuate will result in a failure of receiving the half trip input in EPIC.

IV.E. Failure of EPIC Trip Interface Equipment EPIC actuates v&rious components through the trip outputs of the train A and B Trip Interface Equipment (TIE) cabinets. These components actuate in response to an AFW Initiation or a steam generator A or B MFW Isolation. The outputs of train A are redundant to train B; therefore, a single event will not cause tne failure of a required actuation. A loss of power to the TIE cannot prevent an output in that train. A loss of signal between the TIE and EPIC or between the TIE and a device will prevent actuation of the device.

5415MAJ Page 32 of 52 Rev. 1

. _ - - - _ n_ _

ECp A-5415 MAJOR NCR W3rk Request 104415 Dicciplina I& C MOD 001 Dtta 9-11-06 IV.F. Power Sources Failures for EPIC and EPIC Related Hardware As addressed in Section III.C.8. and in Reference 25, a single failure of an electrical power source will not prevent controlled feeding of AFW to either steam generator t nor prevent isolation of AFW to a steam generator.

Discussed here are some specific failures and their effects.

IV.F.1 Failure of Diesel Generator A (GEA)

Without GEA power the AFW pump P-319 would not operate. P-318 is sufficient for all cooling requirements and would be available in either its turbine on motor driven form.

Without GEA power AFW isolation valve HV-20578 would fail in it's last position. If closed, AFW flow to S.G. B would still be -possible through FV-20528 and HV-20582. If open, controlled feed to S.G. B would occur normally or be isolatable using FV-20532.

Without GEA power MFW block valve HV-20530 would not function. The EFIC MFW isolation function would still be assured by HV-20516.

The above scenarios hold for a minimum of two hours regardless of whether only the old or the old and the new diesel generators are in service.

IV.F.2 Failure of Diesel Generator B (GEB)

Without GEB the motor driver for P-318 will not be available. P-318 might still be functional on its turbine driver, and P-319 would still be functional.

Without GEB the AFW isolation valve HV-20577 will fail in it's last position. If closed, AFW flow to S.G. A would still be possible through FV-20527 /k\

and HV-20581. If open, controlled flow to S.G. B would occur normally or be isolatable by using FV-20531.-

Without GEB the normally closed HV-20565 would fail in its last position. If closed, its EPIC function would be correct. If open, and a major steam leak were occurring, both main steam lines would de-pressurize. In this event, P-318 would j{(

not fur.ction. EPIC would feed both SG's. To avoid overcooling, operator action would be required either to close HV-20560 or to regulate AFW flow manually.

5415MAJ Page 33 of 52 Rev. 1

'ECN A-5415 MAJOR. NCR Work Requsst 104415 Discipline IEC MOD 001 Date 9-11-86 '

Without GEB HV-20529, HV-20515 and HV-20516 would fail in their last position. 'However, without offsite power, the condensate pumps fail and flow through these valves will not occur.

The above scenario holds for the existing (old) diesel generator only. If new diesel generators are put into service, HV-20515 and HV-20516 will be powered of f of GE-B2.

IV . F . 3.' Failure of EPIC and AFW indication in the Control Room Power for control circuits and for backlighting of pushbuttons which control EPIC comes from the EPIC '

channel affected e.g., if power to .EFIC Channel "A" is lost, the "A" channel EFIC control circuits on HISS will go dark and controls will be non-functional.

The Class I analog indication on HlSS requires two .

inputs to be functional; signal and power. If the signal is lost, the display will go "off scale low". That is, the digital readout will be at it's lowest possible value, and the bargraph will flash a single LED in the lowest position. If the 120 VAC power is lost the indicator will go dark.

Power to the Channel "A" indicators is from the same battery backed inverted power which powers EPIC. Channel "A". Power to'the Channel "B"

, indicators is from the same battery backed inverted power which powers EPIC Channel "B".

Since all Class I indications except AFW pump discharge pressure have redundant indicators of a dif ferent channel, the only process indication lost on lose of a single power source would be one of the pump discharge pressures. Control lights to the back lighted pushbuttons and the ammeter would be back-up indication showing pump operation.

IV.G. EPIC Control Failure The EPIC has six points of process control; two AFW flow control and one main steam bleed off control per steam generator. These six points are controlled by process control circuits within the A and B EPIC channels which send signals to the modulating control valves on the APW and Main Steam Systems. The function, logic, and control setpoints are discussed at length in the EPIC Auxiliary Feedwater System Description.

i 5415MAJ Page 34 of 52 Rev. 1

(

a

---,-,--_-.c_ , . , , _ _ _ _ _ _ , .,,,,_-,,__.,m . _ m--_ .y v_ y -.,m,.,.~.,y- - - - - --

ECN A-5415 MAJOR NCR Work' R:qu;st 104415 Discipline I&C MOD 001 Date 9-11-86 The failure of any process control, by its nature, will cause the process variable to move away from its desired value. Failure of EFIC controls would cause the controlled variable (s) to move away from the desired value(s) causing process changes which ultimately shfft the point of control. Preciseness, responsiveness, and stability of control are kinds of control failures. They are addressed in Sections III.C.3 and III.C.4. What we are talking about F

here is gross control failure which will cause the swiftest shift in control point (i.e., what happens if a single event causes valve (s) to fail open or closed).

It should be noted that for the failures below, the rate of change of RCS and Secondary System parameters is not different than would be expected for similar control failures to the existing AFW and ADV controls.

IV.G.1 Atmospheric Dump Valve Fails Closed If not controlled by Turbine Bypass Valves main steam pressure would rise in the worst case and be controlled by the main steam relief valves. In the event the other steam generator was available, and has pressure control, RCS cooling would proceed through it and steam pressure in the impacted generator would follow saturation. pressure consistent with RCS hot leg temperature.

IV.G.2 Atmospheric Dump Valve fails open The energy release would cause main steam pressure to decrease with a resulting decrease in S.G. secondary temperature. The RCS would in turn decrease in temperature. Operator action to isolate. the open ADV(s) using the motor operated ADV isolation valves is the best response. However if S.G. pressure drops below 600 psig, EFIC will isolate MFW and AFW to the affected generator.

IV.G.3 APW Valve Fails Closed If an AFW control valve fails-closed, the process control point would shift rapidly to the parallel control valve.

IV.G.4 AFW Valve Fails Open The energy required to heat the cold AFW to saturation will cause a temperature and subsequent pressure decrease in the steam generator. Operator action to isolate the open AFW valve using the series aligned motor operated isolation valve is the best operator response. Actual valve position indication is available to identify the errant valve Page 35 of 52 Rev. 1.

5415MAJ

EC A-5415 MAJOR NCR Work Request 104415 Discipline I&C MOD 001 Date 9-11-86 If only one S.G. is impacted, the EPIC will automatically-isolate AFW to that S.G. if pressure drops below 600 psig. In the event that the excess AFW develops to an overfill condition, the MFW overfill protection and annunciation would alert the operator to the need to isolate the errant valve.

Note, however, that for initial operation of EFIC the MFW overfill setpoint will be at its uppermost setpoint in order to avoid spurious MFW closure.

IV.G.5 Single EFIC Control Failures The four bounding EFIC control failures are: , loss of power to EPIC "A" or "B" channel, loss of a control module within EFIC "A" or "B" Channel, failure of a pressure or level sensing circuit, wacko signal to a single device. A single failure cannot simultaneously cause f ailure of control signals from both Channel "A" and Channel "B", and control failures for either channel would be similar. Therefore, only failures of Channel "A" will be discussed below.

Loss of power to Channel "A" would cause the ADV(s) on one main steamline to fail closed, and one AFW control valve to each S.G. to fail open. During normal plant operation no change in operation would result. If APW has been initiated, the ADV closure would play a minor roll initially as cooling from excess AFW flow would eventually dominate secondary pressure. Manual

. closure of the series AFW isolation valves is required. Following re-pressurization, the failure of the ADV(s) will become apparent and the course of i action is as described in IV.G.I.

Loss of one of the two control modules within EPIC Channel "A" will cause either a control valve to the "B" S.G. to fail open (see IV.G.4.) or a control valve and the ADV (s) of the "A" S.G. to fail open and closed respectively. This latter failure becomes a subset of loss of channel power.

Failure of a pressure sensor signal, though possible in either direction, would be expected to fail low.

This would cause the ADV(s) on one S.G. to fail closed and one AFW valve on the same S.G. to fail closed (due to F.O.G.G. logic). Manual control of both valves, through EFIC, would still be possible.

Failure of a low range level sensor, though possible in either direction, would be expected to fail low.

If it failed low, and AFW has been initiated, one AFW control valve would fail open (see IV, G.4). If it failed high one AFW control valve would fail closed (see IV.G.3).

-5415MAJ Page 36 of 52 Rev. 1

ECW A-5415 MAJOR NCR Work Riqusst 104415 Disciplina I&C MOD 001 Data 9-11-86 Failure of a wide range level sensor, though possible in either direction, would be expected to fail low.

This would lead to like scenarios for a failed low level sensor, but only if all RCP's were not running.

A failed signal to a single controlled component could cause a valve to open or clore. Those events are described in IV.G.1 to IV.G.4. However, due to the nature of the 4-20ma control circuits used, failures which produce 4 ma or less are the expected failure modes. Therefore, the expected fail state for a single component would be closed for an ADV(s) or open for an AFW control valve.

This control failure discussion assumes loss of only one sensor or loss of power to all sensors in one channel. EFIC sensors may share process sensing lines with other EFIC channel sensors or other system sensors depending upon specific sensor installation details. If more than one EPIC sensing parameter can be effected by a single sensing line failure, those failures must be analyzed as a part of the sub-ECN, and the acceptability of installation detail judged therein. See sub-ECN's 5415A, 5415B, and 5415C.

VI. Special Operating Requirements

' VI.A. Operating Description of EFIC Controlled Devices VI.A.l. EFIC indicators - EFIC control room indicators display a comprehensive set of information on the status and condition of the steam generators and the Auxiliary Feedwater System. During the following discussion of these, refer to Figure VI and Table VI for panel BlSS.

VI.A.l.l. For both steam generators A and B there are redundant (channels A&B) meter indications of low range level (items 2&3 and 7&8), high range level (items 4&5 and 9&l0), pressure (items 27&28 and 32&33) and AFW flow to the steam generators (items 29&30 and 34&35).

l l VI.A.l.2. The Hand / Auto (H/A) stations for the four flow control valves, FV-20527,28,31 and 32, each

.contain a meter that indicates the position l

j demand signal for its associated valve (items 85,87,89 and 91). Also actual position l indications for each valve (items 84,86,88 and

90) are located directly above the associated H/A station.

5415MAJ Page 37 of 52 Rev. 1

, ECN 'A-5415 MAJOR NCR W3rk Requsst 104415 Dicciplina I&C MOD 001 Date 9-11-86 VI.A.1.3. The two H/A stations for ADV control (located on HlRI not shown on Figure VI) contain a meter that indicates the position demand for the ADV's.

Actual position indications for these valves are not a part of MOD 1.

VI. A.l.4. For the AFW pumps there are meter indications of discharge pressure for each pump (items 119 &

124). Also there is a digital readout of the AFW test line flow and a meter indication of the flow valve's actual position (items 121 and 148).

VI.A.l.5. The " Remote / Manual / Reset" pushbutton matrices which are mounted on the control room consoles (see items 6 and 31 of figure VI of section VI.A.) provide channelized indication of automatic actuation of EPIC functions. They also provide capability of operator manual actuation of some EFIC functions. To assure that manual action at these two matrices could not cause all feedwater to be inadvertently isolated, nor that /\

an overfill situatica could be inadvertantly 4

caused, a study was performed. It looked at all possible manual actions at the matrices, without regard to reason for the action, and combined those actions with all automatic EFIC functions which might affect or be affected by that action . The results (Ref. 58) show that

! following EPIC actuation no action or combinations of actions at the matrices will prevent all feedwater from reaching the steam generator. Also no overfill can be similarly i

automatically or manually commanded.

It is theoretically possible for an operator.to inhibit automatic actuation of AFW or MFW j isolation. This requires simultaneously pressing at least two buttons which are spacially separated by at least eight inches. This i " correct" combination of buttons must be depressed prior to receipt of a valid actuation and held continuously in order to inhibit actuation. It is also possible for the operator to place the AFW initiate in manual after AFW initiation. This would not prevent AFW initiation, but it would prevent subsequent " feed only good generator" logic from isolating AFW to a depressurized Steam Generator. This selection of the manual mode is indicated at the matrix and does not prevent the operator from manually isolating AFW to the affected generator. Any manual bypass or manual inhibit of an initiate l

can be immediately reversed by operator selection l

of the actuation mode.

5415MAJ Page 38 of'52 Rev. 1

. ~ . , , . . _ . . . _ . _ , _ _ _ , _ . . , , . . , ,

ECN A-5415 MAJOR NCR Work R1 quest 104415 Dicciplina I&C MOD 001 Date 9-11-86 VI.A.1.6. In addition to analog indications, backlighted pushbuttons indicate status of EFIC ir.itiation/ manual operation, channel bypass, control enable and the steam generator level setpoints selected. Also backlighted pushbuttons indicate the status or position of the AFW pumps, isolation valves and crosstie valves.

VI.A.2. AFW control without auto Initiation of EPIC - Without auto initiation of EFIC all of the AFW controls can be directly operated manually.

VI.A.2.1. AFW pumps can be started or stopped manually (items 117, 118 and 123). Also the AFW test flow valve can be manually operated (item 120) to increase or decrease test flow to the condenser.

VI.A.2.2. AFW flow to the steam generators can be started manually by starting an AFW pwmp, opening the isolation valves (item 56, 57, 62 and 63), placing the H/A stations for the flow control valves (item 85, 87, 89 and 91) in manual and running the valves open to obtain the desired flow.

VI.A.2.3. AFW flow to the steam generators can also be obtained by manually initiating EPIC channels A and/or B (items 6 and 31).

This causes starting of the AFW pumps, opening of isolation valves and initiation of automatic level control in the steam generators. In this state an operator can place the control valve H/A's in manual if desired to manually regulate the AFW flow to the steam generators.

VI.A.3 AFW control with Auto Initiation of EFIC - With an automatic initiation of EFIC the AFW and related controls will be automatically positioned to supply AFW regardless of their manual position at the time VI.A.3.1. When EPIC initiates, the following equipment is automatically positioned with override of their manual controls: AFW pumps start, AFW isolation valves open, AFW test valve closes, Main Steam cross tie valve, EV-20565, closes. In order for these to be manually controlled, except the APW isolation valves, EFIC must first

' be placed in manual or if the EFIC initiating signals have cleared then EPIC must be reset (items 6 and 31).

Page 39 of 52 Rev. I 5415MAJ

ECN A-5415 MAJOR' NCR Work Raquset 104415 Discipline I&C MOD 001 Date 9-11-86 VI.A.3.1.1 The AFW isolation valves can be manually controlled while EFIC is initiated by first

' pressing the override button (combined with the open and close button, items 56, 57, 62, and 63) and then pressing the open or close button to position the valve. When EFIC is reset or placed in manual the override automatically resets.

VI.A.3.2 When EFIC initiates AFW, the AFW flow control valves begin to automatically control the level in the steam generators. At any time H/A stations for these valves can be put in manual and the valves manually positioned. When EFIC is placed in manual or reset-these valves continue to automatically control steam i

generator level until the control enable j switches are reset (items 59 and 61).

VI.A.3.3. Vector logic (Feed only good generator)

can cause isolation of AFW to either, but not both, steam generators by closing the appropriate isolation valves. These valves then can be manually opened .if desired as described in Section VI.A.3.1.1.

VI.A.4. EFIC isolation of the Main Feedwater (MFW) - The MFW flow can be shut off to the steam generators by EFIC, either automatically or manually.

VI.A.4.1 The MFW isolation valves can be controlled manually to isolate or allow MFW flow to the steam generators. These controls are overridden by the actuation of the EFIC I Main Feed Water Isolation (MFWI) for either steam generator which causes the valves for the operator to close. MFWI.

can also be manually initiated (item 6 and

31) for either steam generator causing an isolation of MFW to that generator, 5415MAJ Page 40 of 52 Rev. 1 e-.. , -- - _ . - . -

ECN A-5415 MAJOR NCR Work R;qusst 104415 Dicciplina I&C MOD 001 Data 9-11-86 VI.A.4.2. An actuation of MFWI causes the MFW isolation valves to close, as stated above, and also overrides the ICS control of the MFW flow control valves causing the valves to shut. These valves cannot be operated in manual until MFWI is placed in manual or reset (item 6 and 31). When MFWI is placed in manual or reset the isolation valves will remain closed until manually opened, not the MFW flow valves revert back to ICS control.

VI.A.4.3. When Main Steam Line Isolation (MSLI) is actuated its only function is to actuate the same devices as MFWI. The came functions of manual and reset will apply to MSLI as are described above for MFWI.

VI.A.4. EFIC Control of Atmospheric Dump Valves ( ADV's) -

Automatic control of the ADV's is always active in EFIC regardless of whether EFIC is initiated or not.

'The ADV's can be placed in manual control at any time from the H/A stations located on panel HlRI and manually positioned.

VII. VERIFICATION CRITERIA:

See VIII. A below.

VIII. C[MMENTS:

VIII.A. Design Verification The functional design of the Emergency Feedwater Initiation and Control System was developed by Babcock &

2 Wilcox. As a part of the design process, B&W included a j formal independent verification of EPIC and its i

relationship to the Rancho Seco upgraded APW system. At B&W the independent verification is performed and documented by a Design Review Board. The members of that board are selected based 'upon their technical background, their germain experience and their lack of prior inve'vement in the task. The positive findings of the Design Review Board are documented in reference 8.

5415MAJ Page 41 of 52 Rev. 1

. ECN A-5415 MAJOR NCR Work R2quIst, 104415 Disciplina I&C MOD 001 Date 9-11-86 7

VIII.B. Differences Between the Rancho Seco and SR-3, ANO-l EPIC's Though known by several dif ferent names, all B&W Nuclear Plants have Emergency Feedwater Initiation and Control Systems which are independent from the ICS. The form and features of these systems differ as required for site specific reasons. Three of the utilities operating B&W plants have system designs of their own or an A/E's design (Toledo Edison, GPU Nuclear, and Duke Power). The B&W l late model (205 FA) plants have systems designed into the safety grade plant protection systems delivered with the plant (Supply System, Bellefont, and Muelheim -Kaerlich).

The remaining three operating B&W 177 FA plants purchased the "EFIC" design from B&W (Crystal River-3, Arkansas Nuclear One, and Rancho Seco).

Each of the three EPIC plants uses the same basic concept. Hardware for the three plants was purchased under a generic specification from the vitro. corporation.

However, some differences in hardware and its application do exist. The' specific differences between the EPIC as it

will be utilized at Rancho Seco (RS) and the EFIC installation at one or both of the other EPIC plants are listed below

1

. B.l. R.S. uses a single remote shutdown bypassing feature which will. allow bypassing of EFIC initiation of the following: low SG level, low SG pressure, high-high SG level loss of all 4 RCP's.

This is only possible if SG pressure is less than 725 psig.

ANO bypasses the low S.G. pressure and loss of all 4 RCP's locally (individually) at the EPIC cabinets. They don't " bypass" the low and high-high initiates. They prevent operation by pulling the trip breakers located in EPIC cabinets A and B.

CR-3 has a remote shutdown bypass for the low S.G.

pressure only. Bypassing of the loss of all 4 RCP's is done locally at the cabinets. Bypassing of low S.G. level and high-high S.G. level are not 4 provided, but (like ANO) are blocked by pulling breakers in the EPIC A&B cabinets.

B.2. R.S. utilizes a shutdown. bypass permissive such that shutdown bypassing is possible if either S.G.

pressure goes below and stays below 725 psig. ANO will use a similar permi9sive for bypassing their low S.G. pressure initiate. CR-3 will use S.G.

pressure less than 725 psig in both S.G.'s.

5415MAJ Page 42 of 52 Rev. 1

, ~ ECW A-5415 MAJOR NCR Work Riquest 104415 Dicciplina I&C MOD 001 Date 9-11-86 1

CR-3 and ANO use a shutdown bypass permissive for loss of all four (4) RCP's based on reactor power being less than 10%.

B.3. R.S.'s EFIC uses a latch-in feature for the control enable circuits such that placing the EPIC Trip circuits in manual will not drop out the automatic

]

level controls. This simplifies the operating procedures by not requiring manual control of APW valves prior to placing EFIC in manual. Conversely it still allows the operator to take manual control of the control valves at anytime. CR-3 and ANO do not at this time have this latch-in feature.

B.4. The EFIC A & B channels have control signals for the AFW control valves emerging from both their level control and their Vector (P.O.G.G.) logics.

RS's EFIC prioritizes these signals internal to EPIC so that only one set of control signals (from one power source) is necessary to convey all EFIC information to the valve controller. CR-3 and ANO require additional relay logic external to EFIC to perform the same function.

B.S. The R.S. EFIC has provision for altering the ADV opening setpoint from the control room. CR-3 and ANO do not have this designed into their'EFIC.

This feature will not be used at R.S.

B.6. The low range S.G. level at R.S. is between 6" and 156" above the lower tube sheet (TS) with the upper tap extending thru the downcomer annulus to sample

- pressure in the tube bundle. The high or wide range tapa extend between 6" above the lower TS to

. 6" below the upper TS (6" to 619" above the lower TS). No composite full range is necessary.

At ANO the low range S.G. level is between 6" and l 156" above the lower TS with 7 of the 8 upper taps l

sampling downcomer pressure and the eighth

extending through the downcomer into the tube bundle. The high range S.G. level extends between j 102" and 500" above the lower TS with lower tap measuring downcomer pressure, and upper tap measuring tube bundle pressure. A composite full

range level ulitilized by the control module is generated with signal conditioning and switching logic.

5415MAJ Page 43 of 52 Rev. 1

, ECN A-5415 MAJOR NCR Work Requrat 104415 Dicciplina I&C MOD 001 Dato 9-11-86 CR-3 uses low range S.G. level taps at 6" and 277" above the lower TS. The upper tap samples downcomer pressure. The low range span is 150" between 6" and 156" above the lower TS. The high range level taps are coincident with the operate range level taps at 102" and 384" above the lower T.S. A composite full range signal is utilized by the control module.

ANO uses separate S.G. sensing taps for each of it's 16 EFIC level t'ransmitters whereas ANO and R.S. share some taps. For the R.S. Specific tap scheme see sub-ECN 5415B.

B.7. R.S. will be using Gould type PD 3200 level transmitters. ANO and CR-3 use Rosemount transmitters B.8. All three EPIC's have relay switching internal to the cabinets, available to isolate and switch valve control commands to either the main control room or an alternate shutdown panel. CR-3 and ANO do not use the switching capability. At R.S. the

-switching is used to switch and isolate EFIC hand / auto control from the Control Room to the shutdown panel for fires in the Control Room.

Also, the " manual / reset", bypass, and Channel DC power circuits to EPIC from the Control Room will be isolatable for the same fire scenario.

B.9. The SPAS signals which command EPIC to start AFW originate in two separate unit modules per SFAS actuation channel. This prevents failure of a single SFAS module from spuriously initiating AFW.

CR-3 and ANO designs use only one unit control module per SPAS actuation channel.

B.10. CR-3 and ANO use EPIC to command closure of Main Steam Isolation valves. This function is available in the R.S. EFIC but is not used.

B.ll. The EPIC cabinets at R.S. are located in four (4) separate rooms in the NSEB. ANO has the four (4) cabinets adjacent to each other in the control room. CR-3 has the cabinets located in four (4) rooms in the building which houses the control room.

B.12. At R.S. each SG has parallel AFW feed arrangements of one air operated control valve (from original installation) and one Target Rock modulating solenoid control valve. CR-3 and ANO utilize two target Rock manufactured modulating solenoid control valves in parallel per S.G.

i 5415MAJ Page 44 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work Requsst 104415 Dicciplina I&C MOD 001 Date 9-11-86 B.13. At R.S. loss of IE and non-IE power within the C or D EPIC channels is annunciated separately. Loss of non-IE power to the C or D channels at CR-3 and ANO is not annunciated. l B.14. R.S. will utilize an administratively set time l delay to filter pressure transients from S.G. low j level, S.G. low pressure, S.G. high-high level, and i S.G. differential pressure bistable initiate signals. CR-3 utilizes a time delay filter for their S.G. low level initiate only. ANO currently uses no time delays.

B.15. R.S. and ANO have Trip Interface Equipment (T.I.E.)

which forms a part of the EFIC actuation logic.

These interposing relay arrays are not used at CR-3.

B.16. R.S. utilizes automatic MFW overfill isolation, but not AFW overfill. CR-3 utilizes Automatic AFW overfill isolation, but not MFW overfill. ANO does not use its automatic overfill isolation capability.

VIII.C. Use of Original Plant Valves Of the twenty-five active fluid system components which receive direct commands from EPIC, onl*/ four are new; the AFW Control valves FV-20531 and FV-20532, and AFW isolation

/fi valves HV-20581 and HV-20582. Additionally, new motor operators are being installed on the previously manually operated gate valves FWS-015 and FWS-016. Clearly, the newly installed items are purchased, designed, and installed to the applicable codes as required by the EFIC AFW system description. Similarly the signals from EFIC and the transducers which receive those signals are designed and installed to the applicable codes. However, the valves and valve actuators which receive EFIC commands but which were installed as original plant equipment, and which have been performing the same safety function, will not require re-certification or other pedigree or qualification upgrade.

5415MAJ Page 45 of 52 Rev. 1

_ _ . . - . . _ - . . _ . _ _ __--_.__ _ ,_ -. .. . - - . . - ~

I

- ECW A-5415 MAJOR NCR Work Requsst 104415 f Discipline I&C MOD 001 Date 9-11-86 l

Specifically, the MFW control and start-up valves though not seismically qualified (Fv-20525, HV-20575, PV-20528, HV-20576) have always been used for MFW isolation. The AFW Control valves have always been used to isolate and control And the ADV's have always been used to isolate and

/fi AFW.

control main steam release. The functions of each of'these ,

valves has not changed, and since initial-operation _ the l valves have provided precise, reliable fluid control. What  !

is changed with the upgraded design is that signals and transducers which tell the valves how to respond will now be safety grade, as will their motive power sources. Also, in each case, a safety grade, emergency power backed isolation valve will have been installed in series with each valve. And except for the ADV's the safety grade function of each of these proven dependable valves is also performed redundantly by newly installed safety grade equipment.

l i

l I

5415MAJ- Page 46 of 52 Rev. 1

.ECN

• A-5415 MAJOR NCR Work RIqusst 104415 DicciPlins I T4 C MOD 001 Date 9-11-86 TY 4 4 G 7 3 e to 91 T7 28 M M 27 W M M l$ l d Te rel - -

'% 97 et de 51 .EE 5 51.9: R 90 97 Mt

!2t 1 2

\ -

w -

F m 151 ira J azu

.Li? "8! '2*

i 12, ,

_)

I O

Il7A l

I FIGURE VI - EFIC CONS 0t.E HISS (E) 5415MAJ Page 47 of 52 Rev. 1

.- = .- . . . . -_ - --

ECN A-5415 MAJOR NCR Work Rsquant 104415 Disciplina I&C MOD 001 Date 9-11-86 DESCRIPTION ,1NSTR TAG NQl NO.

l l CONCENSATE STORAGE TANK T-556 LEVEL INCICATOR CH A l LI-35509 l 2 STM GEN. A LOW RANGE LEVEL, CHANNEL A INDICATOR LI-20505A l 3 STM GEN. A LOW RANGE 1.EVEL, CHANNEL 5 IN0!CATCR , LI-205055 l A STM GEN. A HIGH RANGE LEVEL, CHANNEL AINotCATOR CI-205074

- E LI ZO5075 5 STM GEN. A HIGH RANGE LEVEL, CHANNEL SINDICATOR 6 J41TIATE/ TEST MATRIX, EPIC CHANNEL A 7 STM GEN. 5 LOW RANGE LEVEL, CHANNEL A INotCATOR LI-2050fsA S l STM GEN. 5 LOW RANGE LEVEL, CHANNEL 5 IN0!CATOR lLT.-2050 fos!

9 l STM GEN. 5 HIGH RANGE LEVEL, CHANNEL A IN0!CATOR l LI-20508A l to l STM GEN. S HIGH RANGE LEVEL, CHANNEL SIN 0!CATOR lLI-205088 l 27 l STM GEN. A PRESSURE, CHANNEL A IN0!CATOR l PI-205 A5A l 28 l STM GEN. A PRES 5URE CHANNEL 5 INDICATOR l PI-205455 l 29 AFW M.0W TO STM GEN. A, CHAMNEL A INDICATOR .

l FI-51801 l 30 AFH RAW TO STM GEN. A CHANNEL 5 INDICATOR FI-il605 3I INITIATE / TEST MATRi% EFIC CHANNEL 5 '~ ' ~ ~~

STM GEN. & PRESSURE, CHANNEL A.INCICATOR PE2054A 32 STM GEN. 5 PRESSURE, CHANNEL S IN0!CATOR PI-2054fe6 33 34 AFW PLOW TO STM GEN. 5, CHANNEL A INotCATOR- l FI-3tS02 l SS l APN PLOW TO STM GEN. 5, CHANNEL 5 INDICATOR l FI-!!903 l l

~

51 EPIC CHANNEL A SYPASS (MSC)-1 l 52 l Epic CHANNEL 5 SYPA55 (MSC)-l l l l l 55 l SPIC CHANNEL C SYPA55 (HSC)-I l l 54 l SPlc CHANNEL 0 SYPA55 (MSci-I l l 55 l VOLTAGE REGULATOR SUPP'.Y SREAKER (MSC)-2 l HS-ZO531 l Sie AFW TO STM GEN. A ISOL. VALVE HV-20581 (MSC)-2 HS-20577 57 APH TO STM GEN. A I5CL. VALVE HV-20S77 (MSC)-2 56 STM GEN. EPIC LEVEL CONTROL CHANNEL A l

59 , EPIC CHANNEL A CONTROL INITIATED (MSC)-1 60 STM GEN.EPICLEVEL CONTROL CHANNEL 5 l l 61 EPIC CHANNEL 5 CONTROL INITIATED (MSC)-(

l 62 APH TO STM GEN. 5 ISot VALVE. HV-20582 (MSC)-2 l HS-20581 63 AFW TO STM GEN. 5 ISOL. VALVE HV-20575 (MSC)-Z l HS-20575 l TABLE VI - EFIC CONTROLS ON HISS (E) PANEL 5415MAJ Page 48 of 52 Rev. 1 l

ECN A-5415 MAJOR NCR Work Rsqusst 104415 Dicciplina I&c MCD 001 Date 9-11-86 SMUD '

ITEM DESCRIPTION ,1NSTR. TAG NO.

NO.

2Z-20S 27

$4- AP'A CONTROL i/ALVE PV-20527 POSITION INCICATOR

' HS-20527 85 APW TO STM GEN. A CONTROL VALVE PV-2CS27 APW CONTROL VAU/E PV-20511 PO5m0N IN0!CATCR ZZ-20 SS.I.

Sfs 87- APW TO STM GEN. ACCMTROL J&LVE PV-20551 . :H5k20!51_

Sill APH CONTROL VALVE PV-20528 POSITION IN0lCATCR lZI-20928 M5 -20S28 83 APW TU STM GEN. 5 CONTROL VALVE TV- Z0528

.ZI-20552 30 , APW CONTROL VALVE W-20531 PO51 TION IN0!CATOR lH5-20552 Si l APW TD STM GEN. 5 CONTROL VALVE PV-E551 10A APW CROSSTIE VALVE HV-51326 (MSC)-2 l HS -518Z's l l HS- 51817 l 105 l APW CROS5 TIE VALVE HV-Sl827 (MSC)-2 l

!!b l APW PUMP P-$lo AMMETER 11 7 AFW PUMP P-518 (MSC)-2 H5-31801 11 6 APW PUMP P-518 STM STOP VALVE IW-50 Sol (MSC)-t FI-3tSol .

113 APW PUMP P-518 015 CHARGE PRES 5URE INDICATOR 12 0 APW TEST PLOW VALVE HV-58155 (MSC)-E III APW TEST PLOW DiOICATOR (OlGITAL) 12 2 APW PUMP 8-319 AMMETER 125 APW PUMP P-519 (MSC)-Z l l PI-31801 l 124 l AFW PUMP P-319 015 CHARGE PRESSURE 'ND'.CATOR l l ISS l SECONDARY SYSTEMS ANNUNC!ATOR/PlR57 CUT RESET (MSC)-4 l 21-$1855 l l

14e l APW TEST PLOW VALVE HV-31855 PC$1 TION INDICATOR i

l TABEL VI (CONT) - EFIC CONTROLS ON HISS (E) PANEL Page 49 of 52 Rev. 1 5415MAJ

.ECN A-5415MAJiOR NCR Work RequIst 104415 Dicciplin3 I&C MOD 001 Date 9-11-86 LIST OF REFERENCES

1. Letter; SMUD to NRC; Feb. 18, 1983; AFWS review - NUREG 0737 II.E.1.1; Additional info requested; seismic, Tornado, pipe break, control valve control air; AFW pump protection.

2. Letter; SMUD to NRC; Jan. 14, 1983; upgraded AFW Sys-Nureg 0737 II.E.1.1.; responds to request from 12-8-82 for additional info .

3. SER; NRC to SMUD; April 7, 1983; Rancho Seco - Status of the AFWS upgrade Review (NUREG 0737 item II.E.1.1).

4. Standard Review Plan; NUREG 0800, 10.4.9 AFW System (PWR)

5. . Letter; B&W to SMUD; July 9, 1984; EFW Third Pump; explains reliability data dif ference between NRC & B&W.

6. Letter; SMUD to NRC; April 28, 1983; EFIC upgrades AFWS; 0737 Items II.E.1.2 and II.K.2.10. Sent 15-1120850-03 Rev 3 of System Description.

7. Letter; NRC to SMUD; Dec. 8, 1982; AFW upgrade Additional Information Request.

8. Emergency Feedwater System, B&W Design Review Board (Doc.

480-1125704-00).

9. Drawing List of EFIC, TIE, B&W Vendor Drawings.

10. EFW upgrade for R.S. ; Test Spec. ; 62-1149372-00, Apr. '84

11. Draft Tech Specs. EFIC/RPS/SFAS; B&W Doc. 05-0004; Mar. 25, 1985

12. Anticipated Performance Behavior of the AFW Pumps under extreme conditions with A MSLB with both Nuclear Steam generators at Atmospheric Pressure, Elemer Makay, Report ERCO - 693, Feb. 16, 1984.

13. Control Room Implementation of EPIC; July 9, 1984 End Extension review.; Starkey: SMUD memo from J. Williams to Listribution.

14. Letter SMUD to B&W; Mar. 2, 1982; EPIC Shutdown Bypass; Rejects original shutdown bypass concepts.

15. Letter; SMUD to B&W; Dec. 13, 1982; Shutdown Bypass. Says to go w/ single shutdown bypass (& Reset)

16. Memo, Oubre to Whitney, August 10,1982; OA.82-003; MSL Shutdown bypass.

i 5415MAJ Page 50 of 52 Rev. 1

ECN _ A-5415 MAJOR NCR Work Riqusst 104415 Dicciplina I&C MOD 001 Date 9-11-86

17. Memo; Wichert to Redeker Oct. 4,1982; Evaluation of OA.82-003; acceptability of Shutdown bypass release.

818. Letter SMUD to B&W (Whitney to Holt); April 6,1982; Feedwater Flow Versus Reactor Power Comparator Anticipatory Trip Operability Study; Shows F.W. flow data for normal shutdown. from Apr. 2, 1982.

19. Letter SMUD to B&W; Aug. 30, 1982; FW flow vs. Reactor Power Comparator Anticipatory Trip Operability Study; Startup FW flow from .

August 19, 1982.

20. Letter SMUD to B&W; Sept. 27, 1982; FW flow vs. Reactor Power Comparator Anticipatory Trip operability Study; shows FW flow vs.

Power for the return to power of Sept. 17, 1982.

21. Operability Evaluation of proposed Power to Main Feedwater Flow Trip; B&W Doc. 51-1135242-01; Sent w/B&W letter SMUD-82-227 dated Oct. 20, 1982. Says it works.

22. Letter SMUD to B&W, Nov. 24,1982i Flow Signal for Flux /MFW Flow Trip.

23. Letter B&W to SMUD: Apr. 5, 1983; (SMUD-83-ll3); Transmits B&W 51-1141558-00.

24. Letter SMUD to NRC; July 20, 1983; NUREG 0737 II.K.2.10 ARTS; gives details of Flux /MFW flow ARTS.

25. -SMUD Memo; Beebe to Daniels; 12-18-85; AFW Power Sources.

26. Letter SMUD to NRC; January 17, 1986; Status of EPIC Implementation; Brief statement of Cycle 8 EFIC System.

27. Letter SMUD to NRC; March 3,1986; EPIC Cycle 8 Scope; Clarification of cycle 8 EFIC.

28. EPIC AFW System Description.

! 29. EFIC Test Procedure, Vitro Doc. TP3801-4009, SMUD DOC. N28.02-309.

30. Containment Transmitter Enclosure, Inside Temperature Transmitted l

During MSLB; Z-ZZZ-M1795,17 pages; 12-24-85; Bechtel.

l

31. Temperature Rise in level- Transmitter Reference Leg Under Transient condition. (LT-20001 A/B; LT20002 A/B); Calc. Z-RCS-I-0059; l

3-28-84; Bechtel.

32. HELB Analysis - AFWS changes: ECN A-2806A, ?.-2912, A-3094, A-3622, A-3653; Bechtel Calc. M21.30-363, 34 pages; 6-14-83.

5415MAJ Page 51 of 52 Rev. 1

. ECN A-5415 MAJOR NCR Work Requnst 104415 Dicciplins I&C MOD 001 Date 9-11-86

33. AFW upgrade Reliability Analysis for R.S.; Document dated April 1981.

34. Reliability / Availability Analysis for EFIC (Vitro); May 1, 1984; Vitro Doc 903801-4340 Rev. A; B&W Doc 932-1010496 01.

35. Overcooling effects of a Variable Overfill Protection System for SMUD dated 11-5-82; Cale; B&W doc. 951-1138358-00.

36. BAW-1655, Jan. '81; Main Feedwater Overfill; Evaluates OTSG Differential Pressure overfill parameter.

37. B&W Study; 86-1134596; An Improved Concept for Controlling Main Feedwater Overfill (36 pages).

38. BAW-1686; Aug. '81; Emergency Feedwater Level Rate Control-Control Evaluation sent W/B&W letter SMUD 81-120, Apr. 3, 1981. Evaluates Rate Limited follower concept.

39. B&W Doc. 77-1151127-00; Steam Generator Level Accuracy w/Gould Transmitter; sent w/ letter April 30, 1984.

40. BAW-1612 Rev. 1; March '80; Conceptual Design Study for AFWS feed rate control for B&W 177 FA plants.

41. Estimates of max AFW flow rates for RS; dated 6-15-82; B&W Doc.

51-1134742-00.

42. AFW flow rate Flow Orifice Calc.; SMUD Memo; Wichert to Stephenson; 9-28-81.

43. Summary of EFW upgrade LOFW analysis; April 29, 1981; B&W No.

86-1123794-00.

44. Heat Removal Capability of SMUD Condensate Storage Tank; Mar 29, 1983; B&W No. 32-1141727-00.

45. Letter; B&W to SMUD; 11-5-82 and memo Toney to Myers,11-1-82; AFW Upgrade Implementation.

46. ECCS Analysis; EFW System Upgrade; B&W doc. 177-1125999-01 Substar.iiates 80% (actual equipment height) as absolute minumum level.

47. Intentionally left blank.

48. AFW upgrade Setpoints; B&W Calc 932-1155738-00; l-22-85.

49. EPIC shutdown bypass - operator action; B&W 51-1138803-00; Nov. '82.

Shows at least 10 mins. to initiate AFW if MFW lost 9 750 psig during normal cooldown.

50. MFW Flow Element Differential Pressure; calc. Z-FWS-M1600.

51. MFW Flow Element Pressure; cale. Z-M1615.

5415MAJ Page 52 of 52 Rev. 1

ECN A-5415 MAJOR NCR Work Requaat 104415 g

Disciplina I&C MOD 001 Dats 9-11-86

52. Reanalysis of Minimum Required APW Flow Rate, Calc. Z-FWS-IO102; B&W Doc. 86-1151208-00.

53.' Letter NRC to SMUD; September 26, 1983; " Rancho Seco - Status of the Auxiliary Feedwater (AFWS) Upgrade heview (NUREG-0737 Item II.E.1.1)".

54. Letter NRC to SMUD; April 1, 1985; " Status of Auxiliary Feedwater (AFWS) Upgrade Review".

55. Single Failure Analysis of EPIC, B&W Doc. 32-1010482-01, prepared by Vitro, March 1983, Vitro No. 3801-1330.

56. Memorandum from R. Daniels to V. Lewis; May 28, 1986; RED 86-169; "IE Information Notice 86-15: loss of offsite power caused by problems in Fiberoptic Systems."

57. Letter J. J. Mattimoe to J. F. Stolz of NRC dated May 3, 1984 transmitting report on "Ef fect of Internally Generated Missiles on the Auxiliary Feedwater System Outside Containment" for Rancho Seco Nuclear Generating Station Unit 1".

58. Memo; H.I. Beebe to John Shively, Operator Actions at EFIC console Matrix, dated 9/11/86.

l /r\

5415MAJ Page 53 of 52 Rev. 1

\_