ML20308A476
| ML20308A476 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 11/02/2020 |
| From: | Hunnewell S Tennessee Valley Authority |
| To: | Document Control Desk, Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation |
| References | |
| Download: ML20308A476 (38) | |
Text
Tennessee Valley Authority, Sequoyah Nuclear Plant, P.O. Box 2000, Soddy Daisy, Tennessee 37384 November 2, 2020 10 CFR 50.59 10 CFR 72.48 10 CFR 50.71 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Sequoyah Nuclear Plant, Units 1 and 2 Renewed Facility Operating License Nos. DPR-77 and DPR-79 NRC Docket Nos. 50-327, 50-328, and 72-034
Subject:
10 CFR 50.59 and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report and Commitment Summary Report
Reference:
TVA letter to NRC, 10 CFR 50.59 and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report and Commitment Summary Report, dated June 5, 2019 In accordance with 10 CFR 50.59(d)(2) and 10 CFR 72.48(d)(2), Enclosure 1 is the Sequoyah Nuclear Plant (SQN), Units 1 and 2, Summary Report regarding the implemented changes, tests, and experiments for which evaluations were performed in accordance with 10 CFR 50.59(c) and 10 CFR 72.48(c). The summarized evaluations provided in the enclosure were implemented since the Reference Letter through October 23, 2020. During review of 10 CFR 50.59 evaluations for submission, it was identified that an evaluation summary for a SQN Unit 2 design change notice 22499, had not been submitted during a previous reporting period wherein the similar Unit 1 design change notice had been submitted. This issue has been captured in our corrective action program.
Since last reported in the Reference letter, SQN has revised a regulatory commitment in accordance with NEI 99-04, the Nuclear Energy Institute's "Guidelines for Managing NRC
[Nuclear Regulatory Commission] Commitment Changes," as endorsed in NRC Regulatory Issue Summary 2000-17. The commitment change summary is provided in the Enclosure 2.
U.S. Nuclear Regulatory Commission Page 2 November 2, 2020 There are no new commitments contained in this letter. If you have any questions concerning this submittal, please contact Mr. Andrew McNeil, SQN Licensing Manager (Acting) at (423) 843-8098.
Scott Hunnewell Interim Site Vice President Sequoyah Nuclear Plant Enclosures 1.
10 CFR 50.59, and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report
- 2.
Commitment Change Report cc (Enclosures):
NRC Regional Administrator-Region II NRC Senior Resident Inspector - Sequoyah Nuclear Plant Director, Division of Fuel 'Management, Office of Nuclear Material Safety and Safeguards
ENCLOSURE 1 SEQUOYAH NUCLEAR PLANT 10 CFR 50.59 AND 10 CFR 72.48 CHANGES, TESTS, AND EXPERIMENTS
SUMMARY
REPORT
E1-1 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS 22501 Rev. A Evaluation Rev 0 Design Change Notice (DCN) 22501 re-gears the actuators for Containment Sump Isolation Valves 2-FCV-63-72 and 2-FCV-63-73. This will allow each valve to develop additional torque/thrust which is needed to overcome the expected differential pressure across the valve. This re-gearing results in a longer opening stroke time for these valves. The spring packs will be modified or replaced to preclude any potential issues associated with hydraulic lock as a result of grease infiltrating the spring pack as well as in support of developing the additional torque/thrust. DCN 22501 will ensure compliance to the Nuclear Regulatory Commission (NRC) Generic Letter (GL) 89-10/96-05 program including the new Joint Owner Group (JOG) Motor Operated Valve (MOV) program requirements.
Valves 2-FCV-63-72 and 2-FCV-63-73 are part of the Safety Injection System (SIS) and part of the Emergency Core Cooling System (ECCS). These valves provide the communication with the Containment Sump for suction to the Residual Heat Removal (RHR) pumps. These valves also serve as the containment isolation valve for containment penetration X-19A and X-198.
Valves 2-FCV-63-72 and 2-FCV-63-73 are normally closed and are interlocked with normally open valves 2-FCV-74-3 and 2-FCV-74-21. Valves 2-FCV-74-3 and 2-FCV-74-21 provide ECCS flow to the RHR pumps from the Refueling Water Storage Tank (RWST) during the injection phase of core cooling. Valves 2-FCV-63-72 and 2-FCV-63-73 go to the open position and valves 2-FCV-74-3 and 2-FCV-74-21 go to the closed position automatically during the switchover from ECCS injection to ECCS recirculation. The switchover occurs when the RWST low level setpoint is reached and the sump high level setpoint is reached. This switchover allows the RHR pumps to take suction from the Containment Sump to provide uninterrupted ECCS flow during the transition to the recirculation phase of core cooling to the Reactor Coolant System (RCS) and to isolate the emptied RWST from the RHR pump suction. The flow is uninterrupted since 2-FCV-63-72 and 2-FCV-63-73 travel to 5 percent open before valves 2-FCV-74-3 and 2-FCV-74-21 start to close which ensures a source of water supply to the RHR pumps. During the injection phase, all ECCS pumps take suction directly from the RWST. Following the swapover, the RHR The re-gearing of Containment Sump Isolation Valves 2-FCV-63-72 and 2-FCV-63-73 changes the maximum allowable stroke time of the valves from 45 seconds to 120 seconds.
Analysis shows that this is acceptable and will have no adverse effect on ECCS operations.
Sufficient net positive suction head (NPSH) will still be available to the RHR pumps during the switchover from ECCS injection to ECCS recirculation. For the limiting loss of coolant accident (LOCA), the ECCS sump water inventory present during the switchover from injection to recirculation mode, at the time suction is first taken from the sump, will continue to conservatively meet all ECCS flow requirements and will preclude unacceptable vortexing. The time to accomplish operator actions to complete the remainder of the switchover to the recirculation phase of ECCS core cooling is not affected by this change.
There will be no increase in the likelihood of accidents, malfunctions, or consequences due to this change; therefore, this activity does not require NRC approval.
E1-2 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS pumps take suction directly from the ECCS sump and the Charging and SIS pumps take suction from RHR discharge downstream of the RHR heat exchangers.
22703 Rev. 2 Evaluation Rev. 0 The existing SQN Unit 1 Turbine Driven Auxiliary Feedwater (TDAFW) speed governor system will be replaced in its entirety by this modification. The replacement governor system will replicate the functionality of the existing speed control and electrical overspeed trip components of the existing system, as well as incorporating the flow control function of the existing Yokogawa single-loop process controller (SLPC) located in panel 1-L-381. Incorporating the flow control functions within the new governor system will simplify the control system and reduce the number of active components required to perform the TDAFW design function, as well as allowing the use of a standard replacement governor design across the Tennessee Valley Authority (TVA) nuclear fleet.
The new governor system is configured to accept the existing flow signal and will perform the flow control function of the existing 1-FIC-46-57 Yokogawa controller as a cascade control function within the new Woodward 505 governor. The Yokogawa controller, as well as the associated power supply and status relay will be deleted from panel 1-L-381.
A new governor panel will be installed adjacent to the existing panel immediately outside the TDAFW room, and a new actuator positioner panel, to house the actuator positioner (controller) and associated components, will be installed on a common support on the rear of the new governor panel. The existing governor panel, located in the TDAFW room, will be modified to serve as a junction box. A new panel will also be installed to house the non-safety related Integrated Computer System (ICS) interface programmable logic controller (PLC) and associated components.
The new governor panel, positioner panel, and governor valve actuator will be powered from the existing governor 125 V Battery Board III breaker 321 feed, with the existing alternate feed from 125V Battery Board IV breaker 321, identical to the existing TDAFW governor. The new governor system will result in an additional load on this circuit.
This evaluation has determined that the TDAFW system will continue to meet its design and licensing bases requirements following the implementation of the proposed modification that converts to a digital governor control method for the system.
Since the new TDAFW System components are more reliable than the existing components and no new system level failure mode effects are introduced, the proposed modification does not result in more than a minimum increase in the frequency of occurrence of an accident previously evaluated in the Sequoyah Nuclear Plant Updated Final Safety Analysis Report (UFSAR).
The new equipment being installed will not initiate any new system malfunctions. Credit is taken for the TDAFW System for the successful mitigation of the following transients, special events, and accidents. The Auxiliary Feedwater (AFW) system supplies, in the event of a loss of the main feedwater supply, sufficient feedwater to the steam generators (SGs) to remove primary system stored and residual core energy.
It may also be required in some other circumstances such as the evacuation of the MCR, cooldown after a LOCA for a small break, maintaining a water head in the SGs following a LOCA, a flood above plant grade, Anticipated Transient Without Scram (ATWS) event, and 10
E1-3 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The existing two magnetic speed pickups on the Auxiliary Feedwater (AFW) turbine will be replaced with similar magnetic pickups and vendor supplied cables to the existing TDAFW skid mounted terminal blocks. New speed sensor cabling and raceway from existing panel to the new governor panel will be installed for the two speed pickup signals.
The existing TDAFW Main Control Room (MCR) speed indicator and speed potentiometer position indicator on panel 1-M-3 will be replaced with new indicators to accept a 4-20mA signal from the replacement system. The speed potentiometer position indicator will be re-labeled as a speed setpoint indication, and scaling will be unchanged.
The existing TDAFW MCR pump flow controller output indicator on panel 1-M-3 will be re-labeled and re-scaled. This indicator will now display the governor flow setpoint and will be rescaled as 0-1000 GPM versus the existing 0-100%.
The existing local governor demand signal isolator located in panel 1-L-381 is deleted by this modification as its function is no longer required with the revised governor controls.
The existing TDAFW MCR flow indicator on panel 1-M-3 and Auxiliary Control Room (ACR) flow indicator on panel 1-L-10 are unaffected by this modification.
The flow control function of the existing Yokogawa controller will be incorporated into the new TDAFW governor. The Yokogawa controller on panel 1 L-381 will be replaced with a new standard Electroswitch W2 module. This new local control switch will be similar to the existing control switch located in MCR panel 1-M-3. The new governor flow control setpoint will be adjustable locally and provide control functionally similar to the existing Yokogawa controller.
The existing hand switch, 1-HC-46-57-S, located in MCR panel 1-M-3 will be replaced with a functionally similar switch. In MCR panel 1-M-3 the replacement Electroswitch control switch will have Pull-to-Manual operation for CFR 50, Appendix R Fires. The TDAFW System will not adversely impact any of the systems that have a dynamic interface with the TDAFW System. Namely: Condensate Storage Tanks; Essential Raw Cooling Water (ERCW);
Main Steam; Feedwater; and 125 Volt DC Power Systems. Therefore, the modification does not result in more than a minimum increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the UFSAR.
Performance requirements associated with core cooling are unaltered such that fuel integrity will be maintained and the UFSAR analysis of radiological consequences remains bounding.
The TDAFW Systems ability to mitigate any postulated design basis accidents will not be decreased. The new equipment will not initiate any new accidents. The modification will not impair or prevent the ECCS from mitigating the consequences of any design basis accidents.
Therefore, this activity does not result in more than a minimum increase in the consequence of an accident previously evaluated in the UFSAR.
Failure or malfunction of the new equipment will not prevent or affect the ability of safety related systems or systems important to safety to respond to the accidents described in the UFSAR. Therefore, implementation of the proposed modification does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety
E1-4 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS manual speed control, and an accident signal reset function in the pushed position, identical to the existing control switch. A momentary spring return to center Raise and Lower position while pulled will be used to provide for manual control of the new governor speed setpoint when in the pulled position. The existing accident signal reset functionality is maintained on the new hand switch by either the left (Lower) or right (Raise) position while pushed similar to the existing hand switch.
A similar Electroswitch control switch will be used in the local control panel.
This will allow for adjustment of the governor flow control setpoint while in Auto, while the MCR control switch will only allow manual control of governor speed, which replicates the existing functionality of the existing controls. Both the MCR and local control switch will incorporate Red and Green indicating lights for Auto and Manual status indication, identical to the existing MCR control station. Panel modifications to the local panel will be required to mount the new control switch.
The existing servo amplifier and vertically mounted hydraulic actuator, associated oil tubing, and linkage assembly on governor valve, 1-FCV-1-52, will be removed. The replacement actuator will be a horizontally mounted electrical linear actuator. The installation of this electrical actuator will require replacement of the existing governor valve stem and the installation of an actuator mounting bracket on the governor valve bonnet.
The electronic over speed trip function currently provided by a tachometer is replaced by an overspeed trip output from the Woodward 505 governor. The existing electronic overspeed trip annunciator in the MCR will be relabeled and repurposed to alarm on either an electronic overspeed trip or a generic TDAFW control system trouble alarm. The existing 4300 revolutions per minute (RPM) electrical overspeed trip setpoint is not changed by this modification. The existing mechanical overspeed trip and associated annunciator are unaffected by this modification.
previously evaluated in the UFSAR. The potential malfunctions of the modified equipment are bounded at a system level in the UFSAR. Therefore, the possibility for an unanalyzed malfunction of an SSC important to safety or an accident of a different type than any previously evaluated in the UFSAR are not created.
As described in the UFSAR accident analysis, no malfunction of the AFW System can cause a transient sufficient to damage the fuel barrier or exceed the nuclear limits as required by the safety design basis. No new failure modes are created by replacement of the TDAFW governor valve controller. The proposed modification does not adversely impact the technical attributes supporting this conclusion. Therefore, the possibility for an unanalyzed malfunction of an SSC important to safety or an accident of a different type than any previously evaluated in the UFSAR are not created.
The new digital equipment does not necessitate a revision or replacement of any currently used evaluation methodology for the TDAFW System.
The modification does not result in a departure from the method of evaluation described in the UFSAR in establishing the design bases or in the safety analyses.
Guidance for evaluation of digital upgrades is contained in Nuclear Energy Institute (NEI) 01-01, Guideline on Licensing Digital Upgrades, March 2002. NEI discusses the use of a Failure
E1-5 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The existing function to transfer (force) the TDAFW flow control loop to Auto (flow control) on either an Accident Signal, TDAFW pump high flow, or Main Feed Pump Turbine trip is maintained with the replacement system.
The existing flow switch nominal setpoint of 985 gallon-per-minute (gpm) will be revised to 970 gpm to ensure the flow switch actuates within the flow loop range of 0-1000 gpm. The existing switch reset value of 1% (10 gpm) will be revised to be 2.5% (25 gpm) to provide for margin between the high flow setpoint and the nominal return to manual point. This revised logic will continue to provide the required pump runout protection function in manual control. The increased flow switch dead band will reduce the frequency of manual-to-auto swaps on decreasing SG pressure.
A new ICS data acquisition device, as well as an associated 24VDC power supply and fuses will be installed on elevation 669 of the Auxiliary Building in a dedicated junction box. This new data acquisition device will be connected to the existing ICS Data Acquisition (DAQ) network. The new equipment will be powered from an existing 120VAC Vital Power Board 1-III/1-VI breaker through a new 1E isolation fuse to provide a 1E/Non-1E class break.
A new interposing relay will be installed to provide for voltage level segregation of 125VDC and 24VDC to the existing control room control switch, to avoid a new cable pull to the MCR. This relay will allow the use of existing 125VDC cable for the hand control Auto/Manual switch function, which is then input to the 24VDC circuitry via normally open (auto) contacts from the new relay. This relay will be energized for manual operation of the TDAFW governor.
New class 1E signal isolators will be installed to provide for 1E/non-1E isolation of analog signals from the replacement system to the ICS. These signals will be connected to the new ICS data acquisition device.
Spare relay contacts in the new governor panel will be utilized to provide for digital status signals from the replacement system to the ICS. Coil-to-contact isolation will be used to provide non-1E status signals. These signals will also be connected to the new ICS data acquisition device.
Modes and Effects Analysis (FMEA) and in accordance with the graded approach referenced in NEI 01-01, a detailed component level FMEA was developed to identify those malfunctions important to safety which could be caused by the digital controls.
This evaluation concludes that implementation of the modification does not require a Technical Specification change, does not require a License Amendment, and therefore may proceed without NRC approval.
E1-6 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The new TDAFW control system is provided with local manual control capability at the TDAFW turbine requiring no electrical power (AC or DC) available by manual operation of the new governor valve actuator jacking screw. Although available, this Black Start capability is not credited for any design basis events. The governor valve can be manually positioned to control AFW speed with the actuator jacking screw, or the existing Black Start methodology of leaving the governor valve in the normal full open state and controlling AFW turbine speed by manually positioning the trip & throttle valve can be utilized.
Terminal blocks will be installed in the existing governor panel to allow connection of new cabling to the new governor panel for the two existing speed probes, the Trip and Throttle Valve trip solenoid, the ACR/MCR speed indication loop, and the Governor valve ramp initiate limit switch.
The existing junction box (JB) 5088 and associated raceway that contains the power supply voltage dropping resistor will be deleted by this change.
Two AFW indicators and associated cabling, raceway, and housing will be removed and their function incorporated into the new governor panel.
The functionality of the existing operator overspeed test controls will be incorporated into the new governor panel controls. The new actuator positioner panel will have no external indications or controls. Positioner demand and status signals will be connected back to the governor panel. A trip and throttle valve position signal is provided to the governor controller via the LS1 limit switch. As the governor valve unseats (not full closed) and engages the limit switch, the contact is made up and initiates the TDAFW governor start sequence. The output of this circuit will initiate a controlled startup of the governor control valve, which will minimize the potential for a possible electrical or mechanical overspeed trip. This limit switch signal, in parallel with a greater than 100 RPM speed contact from the 505 governor, will be used to enable the new actuator positioner. Enabling the actuator positioner will stroke the governor valve from its normally open/fail state of full open to the position demanded by the governor.
E1-7 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS New cabling and raceway will be installed from and to certain panels.
The new TDAFW control panel and associated components are installed in a similar location as the existing TDAFW equipment which ensures that the separation requirements between the TDAFW and Motor Driven AFW systems are maintained per the stations design bases documented in the UFSAR and design criteria. The cables routed between the TDAFW skid and the new TDAFW control panels are routed in existing and new conduits between the two end points. This also ensures the new control panel remains in the same fire zones to maintain separation required for a 10 CFR 50 Appendix R fire event.
23085 Rev. A Evaluation Rev. 2 This design change removes the existing Kirk Key interlocking scheme from the feeder breakers and tie breakers for Essential Raw Cooling Water (ERCW)
Motor Control Center (MCC) 1A-A, 1 B-B, 2A-A and 2B-B and replaces the existing exterior rotary style breaker handle and breaker mechanism on the main and alternate feeds with a model that will properly function with the replacement breakers. The existing ERCW Feeder Breakers are obsolete. The replacement breakers have been evaluated through the equivalency process, but the replacement breaker's physical footprint has slight variations which prevents the existing Kirk Key interlocking scheme to be mounted onto the breaker. This DCN is staged to replace the rotary handle and breaker mechanism as well as remove the Kirk-Key interlock on the ERCW MCC Feeder Breakers and tie breakers.
Due to the response on question 2 regarding system diversity/separation, prior approval from the NRC is required for DCN D23085A. This modification is safe with respect to nuclear safety and is in compliance with SQN design basis.
23638 Rev. A Evaluation Rev. 2 This DCN installs a new digital Distributed Control System (DCS) that will replace the existing obsolete analog control systems. The analog control components will be replaced with a digital control system and is also termed "DCS" for Distributed Control System. The new system will not only correct the obsolescence issue, but will also eliminate a multitude of single point failures (SPFs) which will improve the reliability of the major control systems on Sequoyah Nuclear Plant (SQN) Unit 1. The use of redundant power supplies, redundant signal processors, and redundant signal paths make the system more reliable from a hardware standpoint. The division of software processing tasks across multiple control processors maintains functional diversity within the The new digital DCS system replaces existing analog components for Balance of Plant (BOP) control systems and reduces many single point failure vulnerabilities existing in the current analog system. System reliability is improved through the use of automatic signal selection from multiple control signal inputs. The new system provides redundant inputs, redundant processors, networks, and power supplies. The new system is designated as "Quality Related"
E1-8 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS software. This DCN will replace balance of plant (BOP) analog controls associated with pressurizer pressure and level, rod control, pressurizer power operated relief valve (PORV) controls, Volume Control Tank (VCT) level control, low temperature over-pressure (LTOP), Boric Acid Blender control, Steam Generators (SGs) Atmospheric Relief Valve (ARV) pressure controllers, Steam Dump pressure and temperature controllers, Emergency Core Cooling System (ECCS) Cold Leg Accumulator (CLA) Nitrogen Vent controller, RHR heat exchanger flow controllers, SG Blowdown flow controller, Hotwell level dumpback and make-up controllers, Generator Hydrogen heat exchanger temperature controller, and Main Turbine Oil Tank (MTOT) temperature control systems and makes other changes to eliminate many existing SPFs present in the existing analog system.
In addition to the DCS installation, the Cold Overpressure Mitigation System (COMS) settings implemented by this DCN are the setpoints for the replacement Pressurizer PORVs that will be installed by a separate DCN.
and is designed to meet Quality Related requirements. The reliability of the DCS is superior to the old analog system. The modification does not negatively impact any system, structure, or component (SSC) that is important to safety nor does it adversely impact the consequences or the frequency of a malfunction. The new DCS does not create a new type of malfunction or accident. The new DCS reduces the likelihood of failures and their consequences by providing a more reliable and redundant control system. In addition, this modification provides the capability to reduce manual operator actions and adds greater opportunity for assessment, monitoring, and response.
The upgrade to DCS results in overall improvement in the plant and the ability to function with individual devices out of service.
The DCS provides for use of additional input signals for control. The DCS will continue to maintain function with the loss of a single input for control loops with multiple inputs. In the case of failure of a single input, the last good value prior to the failure will be used. The DCS will provide an alarm on the DCS Visual Display Unit (VDU) for failure of any input.
The DCS is powered from redundant power sources, one being from battery-backed Vital power boards, thus for loss of any single power source, the DCS will continue to maintain control.
E1-9 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The signal outputs to plant control devices, such as valves, use redundant Field Bus Modules (FBM) such that should one FBM fail the other FBM maintains control of the device. Reliability data based on the operational history of these systems in service throughout a wide range of industrial applications is extremely high. A SPF analysis was performed to evaluate the failure modes and effects of the new components including software failures. Many of the SPFs existing in the analog system were eliminated by the DCS implementation. Because the two redundant processors in a control group have the same software in common, the software is considered a SPF. As previously discussed, the software is designed to limit the likelihood of software errors that could result in common cause failure. The SPF analysis concluded the software SPF is acceptable based on thorough testing of the software, software control by an approved QA program, and an extensive operating history.
Functional diversity and independence are provided through the segmentation of control functions in different control groups and processor pairs. For example, the SG ARV controls are segmented such that each SG ARV is on a separate DCS processor pair.
Segmentation of control functions also limits the impact of software common cause failures. A segmentation analysis has been prepared to further analyze the separation of signal processing and control. The segmentation analysis concluded that the design of the DCS
E1-10 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS does not introduce control system failures which could result in events not bounded by the UFSAR safety analysis or an event not analyzed in the UFSAR.
Therefore this modification may be implemented without obtaining a License Amendment.
10069 Rev. 0 Evaluation Rev. 0 The existing SQN Unit 2 Turbine Driven Auxiliary Feedwater (TDAFW) speed governor system will be replaced in its entirety by this modification. The replacement governor system will replicate the functionality of the existing speed control and electrical overspeed trip components of the existing system, as well as incorporating the flow control function of the existing Yokogawa single-loop process controller (SLPC) located in panel 2-L-381. Incorporating the flow controls functions within the new governor system will simplify the control system and reduce the number of active components required to perform the TDAFW design function, as well as allowing the use of a standard replacement governor design across the Tennessee Valley Authority (TVA) nuclear fleet.
The new governor system is configured to accept the existing flow signal and will perform the flow control function of the existing 2-FIC-46-57 Yokogawa controller as a cascade control function within the new Woodward 505 governor. The Yokogawa controller, as well as the associated power supply and status relay will be deleted from panel 2-L-381.
A new governor panel will be installed adjacent to the existing panel immediately outside the TDAFW room, and a new actuator positioner panel to house the actuator positioner (controller) and associated components will be installed on a common support on the rear of the new governor panel. The existing governor panel located in the TDAFW room will be modified to serve as a junction box (JB). A new panel will also be installed on the common support with to house the non-safety related Integrated Computer System (ICS) interface programmable logic controller (PLC) and associated components.
The new governor panel, positioner panel, and governor valve actuator will be powered from the existing governor 125 V Battery Board I breaker 321 feed, This evaluation has determined that the TDAFW system will continue to meet its design and licensing bases requirements following the implementation of the proposed modification that converts to a digital governor control method for the system.
Since the new TDAFW System components are more reliable than the existing components and no new system level failure mode effects are introduced, the proposed modification does not result in more than a minimum increase in the frequency of occurrence of an accident previously evaluated in the SQN UFSAR.
The new equipment being installed will not initiate any new system malfunctions. Credit is taken for the TDAFW System for the successful mitigation of the following UFSAR analyzed events. The AFW system supplies, in the event of a loss of the main feedwater supply, sufficient feedwater to the SGs to remove primary system stored and residual core energy. It may also be required in some other circumstances such as the evacuation of the MCR, cooldown after a LOCA for a small break, maintaining a water head in the SGs following a LOCA, a flood above plant grade, ATWS event, and 10 CFR
E1-11 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS with the existing alternate feed from 125V Battery Board II breaker 321, identical to the existing TDAFW governor. The new governor system will result in an additional load on this circuit.
The existing two magnetic speed pickups on the Auxiliary Feedwater (AFW) turbine will be replaced with similar magnetic pickups and vendor supplied cables to the existing TDAFW skid mounted terminal blocks. New speed sensor cabling and raceway from the existing panel to the new governor panel will be installed for the two speed pickup signals.
The existing TDAFW Main Control Room (MCR) speed indicator and speed potentiometer position indicator on panel 2-M-3 will be replaced with new indicators to accept a 4-20mA signal from the replacement system. The speed potentiometer position indicator will be re-labeled as a speed setpoint indication, and scaling will be unchanged.
The existing TDAFW MCR pump flow controller output indicator on panel 2-M-3 will be re-labeled and re-scaled. This indicator will now display the governor flow setpoint and will be rescaled as 0-1000 GPM versus the existing 0-100%.
The existing local governor demand signal isolator located in panel 2-L-381 is deleted by this modification as its function is no longer required with the revised governor controls.
The existing TDAFW MCR flow indicator on panel 2-M-3 and Auxiliary Control Room (ACR) flow indicator on panel 2-L-10 are unaffected by this modification.
The flow control function of the existing Yokogawa controller will be incorporated into the new TDAFW governor. The Yokogawa controller on panel 2-L-381 will be replaced with a new standard Electroswitch W2 module. This new local control switch will be similar to the existing control switch located in MCR panel 2-M-3. The new governor flow control setpoint will be adjustable locally and provide control functionally similar to the existing Yokogawa controller.
50, Appendix R, Fires. The TDAFW System will not adversely impact any of the systems that have a dynamic interface with the TDAFW System. Namely: Condensate Storage Tanks; ERCW; Main Steam; Feedwater; and 125 Volt DC Power Systems. Therefore, the modification does not result in more than a minimum increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the UFSAR.
Performance requirements associated with core cooling are unaltered such that fuel integrity will be maintained and the UFSAR analysis of radiological consequences remains bounding.
The TDAFW Systems ability to mitigate any postulated design basis accidents will not be decreased. The new equipment will not initiate any new accidents. The modification will not impair or prevent the ECCS from mitigating the consequences of any design basis accidents.
Therefore, this activity does not result in more than a minimum increase in the consequence of an accident previously evaluated in the UFSAR.
Failure or malfunction of the new equipment will not prevent or affect the ability of safety related systems or systems important to safety to respond to the accidents described in the UFSAR. Therefore, implementation of the proposed modification does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR. The potential malfunctions of the modified
E1-12 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The existing hand switch, 2-HC-46-57-S, located in MCR panel 2-M-3 will be replaced with a functionally similar switch. In MCR panel 2-M-3 the replacement Electroswitch control switch will have Pull-to-Manual operation for manual speed control, and an accident signal reset function in the pushed position, identical to the existing control switch. A momentary spring return to center Raise and Lower position while pulled will be used to provide for manual control of the new governor speed setpoint when in the pulled position. The existing accident signal reset functionality is maintained on the new hand switch by either the left (Lower) or right (Raise) position while pushed similar to the existing hand switch.
A similar Electroswitch control switch will be used in the local control panel.
This will allow for adjustment of the governor flow control setpoint while in Auto, while the MCR control switch will only allow manual control of governor speed, which replicates the existing functionality of the existing controls. Both the MCR and local control switch will incorporate Red and Green indicating lights for Auto and Manual status indication, identical to the existing MCR control station. Panel modifications to the local panel will be required to mount the new control switch.
The existing servo amplifier and vertically mounted hydraulic actuator, associated oil tubing, and linkage assembly on governor valve 2-FCV-1-52 will be removed. The replacement actuator will be a horizontally mounted electrical linear actuator. The installation of this electrical actuator will require replacement of the existing governor valve stem and the installation of an actuator mounting bracket on the governor valve bonnet.
The electronic over speed trip function currently provided by a tachometer is replaced by an overspeed trip output from the Woodward 505 governor. The existing electronic overspeed trip annunciator in the MCR will be relabeled and repurposed to alarm on either an electronic overspeed trip or a generic TDAFW control system trouble alarm. The existing 4300 RPM electrical overspeed trip setpoint is not changed by this modification. The existing mechanical overspeed trip and associated annunciator are unaffected by this modification.
equipment are bounded at a system level in the UFSAR. Therefore, the possibility for an unanalyzed malfunction of an SSC important to safety or an accident of a different type than any previously evaluated in the UFSAR are not created.
As described in the UFSAR accident analysis, no malfunction of the AFW System can cause a transient sufficient to damage the fuel barrier or exceed the nuclear limits as required by the safety design basis. No new failure modes are created by replacement of TDAFW governor valve controller. The proposed modification does not adversely impact the technical attributes supporting this conclusion. Therefore, the possibility for an unanalyzed malfunction of an SSC important to safety or an accident of a different type than any previously evaluated in the UFSAR are not created.
The new digital equipment does not necessitate a revision or replacement of any currently used evaluation methodology for the TDAFW System.
The modification does not result in a departure from the method of evaluation described in the UFSAR in establishing the design bases or in the safety analyses.
Guidance for evaluation of digital upgrades is contained in NEI 01-01. NEI discusses the use of a FMEA and in accordance with the graded approach referenced in NEI 01-01, a detailed component level FMEA was developed to
E1-13 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS The existing function to transfer (force) the TDAFW flow control loop to Auto (flow control) on either an Accident Signal, TDAFW pump high flow, or Main Feed Pump Turbine trip is maintained with the replacement system.
The existing flow switch nominal setpoint of 985 gpm will be revised to 970 gpm to ensure the flow switch actuates within the flow loop range of 0-1000 gpm.
The existing switch reset value of 1% (10 gpm) will be revised to be 2.5% (25 gpm) to provide for margin between the high flow setpoint and the nominal return to manual point. This revised logic will continue to provide the required pump runout protection function in manual control. The increased flow switch dead band will reduce the frequency of manual-to-auto swaps on decreasing Steam Generator pressure.
A new ICS data acquisition device, as well as an associated 24VDC power supply and fuses will be installed on elevation 669 of the Auxiliary Building (AB) in a dedicated junction box. This new data acquisition device will be connected to the existing ICS Data Acquisition (DAQ) network. The new equipment will be powered from an existing 120VAC Vital Power BD 2-I/2-II breaker through a new 1E isolation fuse to provide a 1E/Non-1E class break.
A new interposing relay will be installed to provide for voltage level segregation of 125VDC and 24VDC to the existing control room control switch. This is necessary to avoid a new cable pull to the MCR. This relay will allow the use of existing 125VDC cable for the hand control Auto/Manual switch function, which is then input to the 24VDC circuitry via normally open (auto) contacts from the new relay. This relay will be energized for manual operation of the TDAFW governor.
New class 1E signal isolators will be installed to provide for 1E/non-1E isolation of analog signals from the replacement system to the integrated computer system. These signals will be connected to the new ICS data acquisition device.
Spare relay contacts in the new governor panel will be utilized to provide for digital status signals from the replacement system to the integrated computer identify those malfunctions important to safety which could be caused by the digital controls.
This evaluation concludes that implementation of the modification does not require a Technical Specification change, does not require a License Amendment, and therefore may proceed without NRC approval.
E1-14 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS system. Coil-to-contact isolation will be used to provide non-1E status signals.
These signals will also be connected to the new ICS data acquisition device.
The new TDAFW control system is provided with local manual control capability at the TDAFW turbine requiring no electrical power (AC or DC) available by manual operation of the new governor valve actuator jacking screw. Although available, this Black Start capability is not credited for any design basis events. The governor valve can be manually positioned to control AFW speed with the actuator jacking screw, or the existing Black Start methodology of leaving the governor valve in the normal full open state and controlling AFW turbine speed by manually positioning the trip & throttle valve can be utilized.
Terminal blocks will be installed in the existing governor panel to allow connection of new cabling to the new governor panel for the two existing speed probes, the Trip and Throttle Valve trip solenoid, the ACR/MCR speed indication loop, and the Governor valve ramp initiate limit switch.
The existing JB 4848 and associated raceway that contains the power supply voltage dropping resistor will be deleted by this change.
Two AFW indicators and associated cabling, raceway, and housing will be removed and their function incorporated into the new governor panel.
The functionality of the existing operator overspeed test controls will be incorporated into the new governor panel controls. The new actuator positioner panel will have no external indications or controls. Positioner demand and status signals will be connected back to the governor panel. A trip and throttle valve position signal is provided to the governor controller via the LS1 limit switch. As the governor valve unseats (not full closed) and engages the limit switch, the contact is made up and initiates the TDAFW governor start sequence. The output of this circuit will initiate a controlled startup of the governor control valve, which will minimize the potential for a possible electrical or mechanical overspeed trip. This limit switch signal, in parallel with a greater than 100 RPM speed contact from the 505 governor, will be used to enable the new actuator positioner. Enabling the actuator positioner will stroke the
E1-15 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS governor valve from its normally open/fail state of full open to the position demanded by the governor.
New cabling and raceway will be installed from and to certain panels.
The new TDAFW control panel and associated components are installed in a similar location as the existing TDAFW equipment which ensures that the separation requirements between the TDAFW and Motor Driven AFW systems are maintained per the stations design bases documented in the UFSAR and design criteria. The cables routed between the TDAFW skid and the new TDAFW control panels are routed in existing and new conduits between the two end points. This also ensures the new control panel remains in the same fire zones to maintain separation required for a 10 CFR 50 Appendix R fire event.
100096 Rev. 2 Evaluation Rev. 2 This engineering change package (ECP) installs a time delay relay (TDR) in the actuation circuit for annunciator XA-55-4B window E-3, NC-46B Nuclear Instrumentation System (NIS) Power Range Channel Deviation, to reduce nuisance alarms. This change also increases the Power Range High Rod Stop setpoint (C-2) from 103% Reactor Thermal Power (RTP) to 105% RTP to reduce nuisance alarms on XA-55-4B window D-3, IPRS NIS Power Range Overpower Rod Withdrawal Stop. In addition, this change also replaces existing obsolete Quadrant Power Tilt Ratio (QPTR) time delay relays RLY-92-1 and RLY-92-2 associated with annunciator XA-55-4B windows B-3 and C-3 with equivalent currently available TDRs. All three TDRs (new and two existing) will be non-digital socket type allowing easy replacement. The TDRs will be energized and the normally open contact will be closed during normal operation. The contact will open to alarm. The design will cause an alarm if the power is removed. This arrangement is the same as the original contacts in the NIS equipment. The relays are non-safety related devices fed from a Class 1E safety related board and are isolated by qualified fuses selectively coordinated with the upstream safety related breaker. The fuses and fuse holders are seismically qualified.
This ECP changes the NIS power range signal select strategy from high select (highest of the four channels) to high median select (second highest signal).
The four channels of NIS power range signals are input to the plant DCS. The The C-2 interlock is designed to limit rod withdrawal and although not credited in the analysis of the Uncontrolled Rod Cluster Control Assembly Bank Withdrawal events described in UFSAR Sections 15.2.1 and 15.2.2 it is considered as an additional assurance that reactor power will not exceed the analytical limit.
This modification increases the NIS Power Range C-2 setpoint and results in a decrease in the margin to the NIS Power Range High Power Reactor Trip (109% RTP). However, based on the as-found tolerance for the associated bistables, sufficient margin remains between the C-2 setpoint and the NIS Power Range high power trip setpoint. This margin was further determined to be acceptable by evaluation of bistable test data which concluded that over a data set of 143 setpoint checks, the setpoint was consistently found within the 0.6% RTP as-left tolerance.
E1-16 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS DCS validates each of the inputs independently, then inputs the four power range signals to the signal select software block. The signal select block determines which signal to select, and outputs that signal to the DCS power mismatch logic to determine the automatic rod control outputs (speed and direction). This ECP modifies the DCS signal select software block to change the signal selection strategy from high select to high median select. This signal select strategy change does not affect NIS power range input validation or otherwise affect the Automatic Rod Control System (ARCS).
Based on this analysis and the responses to Questions 1 through 8 of this Evaluation, it is concluded that an increase in the C-2 interlock/alarm setpoint is within the design basis of the plant and is acceptable.
Additionally, vendor review of the impact of increasing the C-2 interlock/alarm setpoint concluded that increasing the C-2 setpoint would not affect the accident analysis.
Based on the analysis detailed in this evaluation, the ARCS NIS power range signal select strategy change from high select to high median select is bounded by the current plant accident analysis, and may be implemented without prior NRC approval.
100117 Rev. 3 Evaluation Rev. 1 Design Equivalent Change (DEC) 100117 replaces the Auxiliary Building High Energy Line Break Temperature (AUX BLDG HELB TEMP) Recorder 1-TR 810-A, which is installed on Main Control Room (MCR) Panel (PNL) 1-M-23A.
The existing recorder is a Yokogawa HR2400 digital recorder with a paper chart. The new recorder is a Yokogawa DX2048 Advanced series recorder.
The new recorder is configured with a Liquid Crystal Display (LCD) and a Compact Flash Memory Card (CF card) for data storage and data retrieval.
This recorder receives 5 Temperature Element (TE) inputs from Resistance Temperature Detectors (RTDs) located in RHR Pump Rooms 1A-A & 1B-B, RHR Heat Exchanger Rooms 1A & 1B, and the U1 Chemical and Volume Control System (CVCS) Letdown Heat Exchanger Room. The TEs are Environmentally Qualified (EQ) to operate 30 minutes after a Design Basis Accident (DBA) but are not impacted by this DEC.
The RTD input option for the DX2048 Advanced series recorder did not pass Electromagnetic Interference/Radio Frequency Interference (EMI/RFI) requirements; therefore, each of the 5 RTD signals are converted to a 4-20mA signal by 5 new, analog RTD transmitters (XMTRs). The 4-20mA signal is then The new digital Yokogawa DX2048 Advanced series recorder provides the same design functions as the existing recorder, the redundant, Safety Related, AUX BLDG HELB TEMP Recorder, 1-TR-30-820-B, is also a similar digital Yokogawa DX2020 series recorder and is located within the same PNL 1-M-23A. Therefore, this modification was evaluated for the potential introduction of a hardware and/or software Common-Cause Failure (CCF). However, this evaluation demonstrated that the possibility of a CCF is sufficiently low. Also, a failure of this recorder is detectable and diverse indication for HELB conditions within RHR Pump Rooms 1A-A & 1 B-B, RHR Heat Exchanger Rooms 1A & 1 B, and the U1 CVCS Letdown Heat Exchanger Room exist.
E1-17 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS processed through a 2500 dropping resistor at the input terminals of the recorder to generate a 1-5Vdc input to each qualified DC input channel of the recorder.
This recorder initiates alarm 1-XA-55-6D Window 29 "AUX BLDG HIGH ENERGY LINE BREAK" when temperature setpoints are reached that trigger Operator Actions to isolate the RHR and/or CVCS due to a potential pipe rupture event. Alarm Response Procedures provide instructions to enter the appropriate abnormal operating procedure (AOP) to implement applicable isolation actions.
Therefore, this modification may be implemented without obtaining a License Amendment.
22499 Rev. A Evaluation Rev. 1 The Nuclear Regulatory Commission (NRC) issued Generic Letter (GL) 96-05 to establish a periodic verification (PV) program to provide confidence in the long term capability of Motor Operated Valves (MOVs) to perform their design basis safety functions. The final GL 96-05 program is based on compliance with the Joint Owners Group (JOG) Topical Report MPR 2524-A and the NRC Safety Evaluation (SE) endorsing Report MPR 2524-A. Implementation of GL 96-05 is required in accordance with issuance of the NRC Safety Evaluation (SE), with licensees required to notify the NRC of deviations in the program or schedule.
DCN 22499A performs the following modifications on the subject MOVs in order to comply with the GL 96-05 program:
2-FCV-62-91: The Charging Flow Isolation valve is a Velan 3-inch, Class 1500 gate valve with a Limitorque SMB-00 actuator; the valve body is of stainless steel construction, with butt-weld end connections. This valve has a larger seat diameter than similar valves in the plant, which has led to issues with its capability. To address this condition, the double lead stem will be replaced with a single lead stem. Additionally, the existing 25 ft-lb, 1800 RPM motor will be replaced with a 15 ft-lb, 3600 RPM motor. With the stem pitch halved and motor speed doubled, the stroke time of the valve will remain unchanged.
2-FCV-63-25, -26, -39, and -40: The Centrifugal Charging Pump Injection Tank (CCPIT) isolation valves are Anchor Darling 4-inch, Class 1500, Screw and Yoke gate valves with Limitorque SMB-0 actuators; these valves are made of The screening review determined that the increase in maximum stroke time limit portion of the proposed change is potentially adverse to the UFSAR described design function of the subject valves and requires evaluation under 10 CFR 50.59.
It is has been determined that the increase in the maximum stroke time of the proposed changes do not result in the possibility of new accidents or malfunctions, and do not result in increased frequency of accidents or malfunctions evaluated in the UFSAR. The changes do not result in more than minimal increases of the consequences of an accident or malfunction and do not result in an unacceptable departure from methodologies used to establish the design basis and safety analysis. In addition, no fission product barriers design basis limits are exceeded or altered by this change, and the Technical Specifications are not affected.
E1-18 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS stainless steel with butt-weld end connections. The internals of these valves will be replaced (modified discs, upper and lower wedge set, stem, stem nut, wedge pin and replacement Electric Power Research Institute (EPRI) packing and bonnet gaskets) to ensure the valves' weak link capabilities have sufficient margin based upon the more rigid JOG guidelines. Additionally, the existing 15 ft-lb, 3600 RPM motors (with an Overall Gear Ratio (OAR) of about 89) will each be replaced with 40 ft-lb, 1800 RPM motors (with an OAR of about 39).
As a result, the Maximum Allowable Stroke Time (MAST) will be extended from 10 seconds to 25 seconds.
2-FCV-63-156 and -157: The Safety Injection Pump Isolation valves are Anchor Darling 4-inch, Class 1500, Screw and Yoke gate valves with Limitorque SMB-0 actuators, similar to the CCPIT valves. These valves are potentially subject to pressure-locking conditions, in which the inlet and outlet of the valve disc are depressurized with pressure remaining in the valve bonnet, preventing it from opening. To address the potential of this condition for these valves, this DCN will revise the pressure locking calculation and required thrust calculations to demonstrate that sufficient margin exists to ensure operation of the valves. No parts are replaced on these valves.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
DCN SQN 647 Rev. 0 Evaluation Rev. 0 Design Change (DC) SQN-19-647 is a documentation only DC that resolves a condition identified in Condition Report (CR) 1507644. This CR documented that during the Root Cause Analysis (RCA) investigation for Sequoyah's (SQN's) April 14, 2019 Unit 1 trip it had been determined that the cause of the trip was a modification performed upon the Main Feedwater Pump (MFWP) turbine hydraulic control system coupled with an un-validated turbine runback set-point. The direct cause was determined to be the MFWPs' operating range have insufficient margin to ensure adequate Steam Generator (SG) level make up for the loss of a MFWP. The modification the RCA is referring to was an increase in the Hand Speed Changer cup valve diameter size from 0.750 inches to 0.839 inches performed in the late 1980s. The cup valve diameter change limited each pump's top end performance preventing it from being able to fully perform its design function. As a consequence, the operating range of the MFWP turbine was reduced such that it had insufficient margin to ensure adequate SG level make up for the loss of a MFWP. As stated in CR 1507644, the cup valve modification was performed through a vendor manual change, In summary, the modification performed to the MFWP Hand Speed Changer impacted the ability of the MFWPs to perform their design function following a loss of one MFWP. This resulting degradation in pump performance potentially increases the reactor trip frequency by approximately 2.78%, which is less than minimal. This activity does not result in more than a minimal increase in the frequency of occurrence of an accident or likelihood of occurrence of a malfunction of an SSC important to safety that has been previously evaluated in the UFSAR. The activity does not result in any increase to the expected radiation releases or operator doses evaluated in the UFSAR. The cup valve modification does not
E1-19 of E1-33 DESIGN CHANGES DESCRIPTION SAFETY ANALYSIS which was not the appropriate process for such a change. As a consequence, the modification was not properly evaluated and not all impacted documents were identified and revised. This proposed activity resolves this legacy issue by formally evaluating and approving the modified Hand Speed Changer cup valve. This screening review / evaluation also supports the revision to impacted Operations procedure AOP-S.01, "Main Feedwater Malfunction."
Abnormal Operating Procedure AOP-S.01 is revised to add steps for a pre-emptive reactor trip above a threshold power (95%) determined by Operations.
The current guidance in AOP-S.01 directs initiating a manual reactor trip if an automatic trip (on low-low SG level) is imminent. This effectively forces operators to wait until SG level is abnormally low (approaching the trip setpoint) prior to initiating the manual trip. Modifying this guidance to pre-emptively initiate a manual trip above a threshold power level is appropriate based on the following considerations:
- 1. This avoids an unnecessary delay in a (likely) inevitable reactor trip following a loss of one MFWP from full power.
- 2. This avoids a potential unnecessary reliance on the automatic reactor function if operators do not manually trip quickly enough.
- 3. This avoids an unnecessary reduction in SG level prior to the manual trip initiation.
result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR. The modification also does not create the possibility for a new type of event that has not been previously evaluated in the UFSAR.
This activity does not have any impact upon the three fission product barriers described in the UFSAR. Based on this evaluation, it is acceptable for this activity to be performed without prior NRC approval.
DESCRIPTION SAFETY ANALYSIS SQN-1-2019-085-002 Rev. 0 Evaluation Rev. 0 The full-length Control Rod Drive (CRD) System maintains a programmed average reactor temperature compensating for reactivity effects associated with scheduled and transient load changes. The shutdown rod banks along with the full-length control banks are designed to shut down the reactor with adequate margin under conditions of normal operation and anticipated operational occurrences.
On March 11, 2015 and again on August 27, 2019, the H-8 Control Rod in Control Bank D unexpectedly dropped to the bottom of the reactor resulting in a negative The Rod Urgent Failure Alarm affects the plant in Condition II - Faults of Moderate Frequency and specifically the Uncontrolled Boron Dilution events. The reactor maintains the function to trip due to overpressurization in the unlikely event of an Uncontrolled Boron Dilution event.
While the Rod Urgent Failure Alarm is active, Control Bank D control rods will
E1-20 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS rate reactor trip. The change being evaluated mitigates the potential for dropping H-8 by energizing both the stationary and movable gripper coils of the Control Rod Drive Mechanisms (CRDMs) for Group 2 Control Bank D rods in the 2BD power cabinet.
This change temporarily installs a momentary pushbutton at the terminal block interface between the rod control logic cabinet and 2BD power cabinet. This pushbutton electrically shorts an AC voltage being sent from the logic cabinet to the power cabinet movable gripper circuitry. When the pushbutton is pressed and held, closing the contact, the voltage will be shorted and the movable gripper circuitry will demand firing of the movable silicon controlled rectifiers (SCRs) to generate full current. This will latch the movable grippers of the currently selected group of rods into the CRDM driveshafts. Subsequently, a regulation failure will be generated within the 2BD power cabinet due to full current being generated for longer than allowed resulting in an urgent failure alarm. An urgent failure alarm in a Rod Control power cabinet forces reduced current on the movable gripper coils of the selected group of rods. Once this takes place, the Group 2 Control Bank D rods will be held by both the stationary and movable grippers with both the stationary and movable gripper coils at reduced current. The pushbutton can then be released, opening the contact. This condition will prohibit movement of Control Bank D in either automatic or manual as long as the urgent failure alarm is active, although the rods are still able to drop upon a reactor trip. The urgent failure alarm is capable of being reset by Operator Action by the Rod Urgent Failure Alarm reset pushbutton, 1-RCAS, on panel 1-M-4 in the Main Control Room (MCR). Once Operator Action reset is completed, the reduced moveable gripper current is eliminated, and the Rod Control System will again be fully capable of automatic or manual rod motion. The addition of the pushbutton adds a new failure mode of the contact failing closed when the pushbutton is released after inducing the urgent failure alarm. If the contact remains closed, the urgent failure alarm will not be able to be cleared by pushbutton 1-RCAS. This will prohibit movement of Control Bank D in either automatic or manual. The contact remaining closed would only be identifiable to the operators when pressing 1-RCAS does not clear the urgent failure alarm. This does not create a new failure effect since the purpose of the pushbutton is to simulate a condition that would bring in the urgent failure alarm, energizing the movable grippers along with the not unexpectedly drop resulting in a negative rate reactor trip. Disabling the Rod Urgent Failure Alarm will allow the Control Bank D control rods to be placed back in manual or automatic via a simple operator action of pressing reset pushbutton 1-RCAS.
If the pushbutton contact fails closed, the Rod Urgent Failure Alarm will not be able to be cleared by pressing pushbutton 1-RCAS. This situation does not impact the ability of the rods being inserted during a reactor trip. This change does not increase the frequency of any accident or malfunction evaluated in the UFSAR. It does not increase the consequences of any accident or malfunction. It does not create the possibility of a new type of accident or a malfunction with a different result than previously evaluated. It does not alter the design basis limit for any fission product barrier.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
E1-21 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS stationary grippers, thus providing a double gripper hold. This does not have an impact on the rods being capable of dropping upon opening of the reactor trip breakers and safely shutting down the plant.
SQN-2-2018-067-001 Rev. 1 Evaluation Rev. 0 This Temporary Modification (TMOD) is being prepared for use in the event of inoperability of motor-operated valve (MOV) 2-FCV-67-146. The valve 2-FCV 146 regulates Essential Raw Cooling Water (ERCW) discharge from the 2A1 and 2A2 Component Cooling System (CCS) heat exchangers, and affects ERCW flow to other ERCW loads, including the 2A Containment Spray (CS) heat exchanger.
In this 50.59 Screening Review/Evaluation, use of "2-67-146" references MOV 2-FCV-67-146 and "2-67-551" references manual valve 2-VLV-67-551. Valves 2-67-146 and 2-67-551 control ERCW flow through the 2A1 and 2A2 CCS heat exchangers (HX), and are located in the ERCW outlet piping, prior to Discharge Header A. Valves 2-67-146 and 2-67-551 are in series in the common ERCW outlet piping section (after the individual HX outlet piping joins).
The 2A1 and 2A2 CCS HXs are supplied by ERCW Supply Header 2A (ERCW Train A). Flow from the ERCW Supply Header 2A also supplies the 2A CS HX, and other plant cooling loads. During some plant accidents and events, the 2 146 valve is throttled to ensure correct ERCW flow balance to the accident unit's CCS and CS HXs.
Valve 2-67-146 is an MOV that is controlled from Main Control Room (MCR) handswitch 2-HS-67-146A. The handswitch has four (4) positions: Close, the "35" position, the "50" position, and Open. The 2-67-146 valve position is changed by remote manual operator action during some plant events and accidents to adjust the balance of ERCW flow between the non-accident and accident unit. In the event of a Unit 1 accident the 2-67-146 valve is set to "35" position (ensures adequate flow to the accident unit). In the event of a Unit 2 accident the 2-67-146 valve is set to the "50" position (ensures adequate flow to the 2A1/2A2 CCS HXs and other ERCW loads, including the 2A CS HX). The ERCW system flows are modeled and adequate ERCW flow to safety-related components are determined by calculations. The "35" and "50" positions of 2 The valves are not able to initiate any UFSAR accident, thus do not increase the frequency of an existing UFSAR evaluated accident.
For control of CCS HX 2A1 and 2A2 ERCW flow this TMOD activity changes from a remote manual action (2-67-146) to a local manual action (2-67-551). This local manual action has been evaluated, and does not result in more than a minimal increase in the likelihood of malfunction of a system, structure, or component (SSC) important to safety.
This activity does not affect the radiological consequences of any UFSAR evaluated accident or the radiological consequences of malfunction of an SSC important to safety.
All possible valve malfunctions (full open, full closed, or midposition) are fully bounded by the existing UFSAR analysis.
This activity does not create the possibility of an accident of a different type than any previously evaluated in the UFSAR or the possibility of a malfunction of an SSC important to safety with a different result.
E1-22 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS 146 are verified, and the valve limit switches are set, in procedure 0-PI-SFT-067-006.0, ERCW Performance Testing.
Valve 2-67-551 is a manual valve that is set to a throttling position and functions as a balancing valve for ERCW flow through 2A1 and 2A2 CCS HXs. Valve 2 551 is not modulated for any plant events. The throttled position of 2-67-551 is determined in procedure 0-PI-SFT-067-006.0 and verified in procedure 0-SI-OPS-067-682.M, ERCW Flow Balance Valve Position Verification.
Valves 2-67-146 and 2-67-551 have the same hydraulic performance characteristics. The valves are located approximately twenty feet apart in the same 24" pipe. Therefore the pressure drop and associated ERCW flow rates in the CCS HX 2A1 and 2A2 discharge line remain the same independently of which valve is in the fixed throttle position and which valve is positioned for the plant event.
In the event of valve 2-67-146 being inoperable, the functions of the two valves are switched by this TMOD. The 2-67-146 valve will be set to a fixed throttled position (equivalent to the normal balancing position of 2-67-551) and power will be removed by opening the breaker. The 2-67-551 valve will be manually modulated to the required position for plant events and accidents. Inoperability of the 2-67-146 valve potentially renders the 2A1 and 2A2 CCS HXs inoperable and may cause the 2A CS HX to be inoperable. Inoperability of the 2-67-146 valve also has the potential to affect the operability of the ERCW system.
The 2-67-146 valve is removed from the active valve list, and the 2-67-551 is added to the active valve list.
This activity screens in for evaluation due to the change from remote manual action to control 2-67-146 to local manual action to control 2-67-551. The change to local manual action adversely affects how FSAR described design functions are performed or controlled: additional time is required to operate 2-67-551 locally; operators are potentially exposed to increased dose during the local manual action; potential for human error; isolation of ERCW during an ERCW This activity does not affect any fission product barriers or UFSAR methods of evaluation.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
E1-23 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS pipe rupture; and reliance on a local action without adequate permanently-installed lighting.
SQN-2-2019-063-001 Rev. 1 Evaluation Rev. 0 Temporary modification (TMOD) SQN-2-2019-063-001 installs a temporary continuous pressure relief line from the Safety Injection System (SIS) cold leg discharge piping to the suction side of the Centrifugal Charging Pumps (CCPs).
This TMOD is needed due to Reactor Coolant System (RCS) primary and secondary check valve leakage pressurizing the SIS cold leg discharge piping.
This condition was documented by CR# 1472802 following the Unit 2 Cycle 22 refueling outage (U2R22). A troubleshooting work order determined that the leak path is through check valves 2-VLV-63-557 and -563. The negative effect of the SIS discharge piping pressurizing is that the relief valves in the line will lift at 1750 psig. Once, the relief valves lift, it is possible for them to be problematic getting them to reseat. There are also negative effects from having to vent the SIS discharge piping frequently. Currently, Operators are having to manually vent the piping about every 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> using procedure 2-SO-63-5, Emergency Core Cooling System, when header pressure increases to about 1600 psig. The venting requires stroking flow control valves (FCVs), 2-FCV-63-23 and -84. There is a chance that the frequent stroking of the valves could cause degradation resulting in a valve failure. Also, having to vent frequently is a burden to the Operations Department. In the event that one of the FCVs fails, procedure 2-SO-63-5 has contingency actions to vent the header using alternate methods.
The relief line will connect to the flange downstream of 2-VLV-63-539 on the SIS side and the 1" pipe nipple coming from 2-VL V-62-765 on the Chemical and Volume Control System (CVCS) side. The relief line will be connected to each end of the existing piping with a flex hose to reduce the impact to existing seismic qualification. Two 1/4" globe valves will be installed to allow for isolation as needed. A 1/2" check valve will be installed in the line as well. The check valve will serve the dual purpose of preventing the CCP suction flow from being diverted and prevent the possibility for RWST water draining into the CCP suction during normal operation. This is due to the RWST head pressure and normal Volume Control Tank (VCT) pressure being approximately equal. The check valve is a spring loaded piston check with an adjustable cracking pressure. The cracking pressure will be set at its maximum cracking pressure of about 100 psid, The temporary relief line is acceptable from a design, fabrication, and testing, standpoint. The line will be fully qualified to TVA Class B (ASME B&PV Section Ill Class 2) requirements like the existing portions of ECCS. The continuous relief line only has the passive function of maintaining a pressure boundary in the event of an accident. During normal operation it has the functions to maintain pressure boundary, prevent RWST inventory loss and back flow from CVCS.
No new accident initiating events are created by this change, and there is no increase to the frequency of previously evaluated accidents. There is no increase in the likelihood of a malfunction due to this change. If the line were to fail it does not increase the consequences of any accident described in Chapter 15 of the UFSAR. This change does not create the possibility of an accident not already described by the UFSAR. This change will not result in the design basis limit for any fission product barrier being exceeded or altered.
Therefore, it is acceptable to implement this modification per plant procedures without obtaining a License Amendment.
E1-24 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS per the manufacturer's drawing, to maintain the SIS discharge header at a pressure greater than RWST head pressure. All new material will be TVA Class B (American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel (B&PV) Code Section Ill Class 2).
ECCS is impacted by this change due to the fact that the modification will create a new flow path in the SIS. The diverted flow will be a reduction in flow from the SIPs providing core cooling. The modification also impacts the CVCS because it has the ability to cause a negative reactivity event.
WOs 116644794 and 120712590 Evaluation Rev. 3 The full-length Control Rod System maintains a programmed average reactor temperature compensating for reactivity effects associated with scheduled and transient load changes. The shutdown rod banks along with the full-length control banks are designed to shut down the reactor with adequate margin under conditions of normal operation and anticipated operational occurrences. On March 11, 2015, the H-8 Control Rod in Control Bank D unexpectedly dropped to the bottom of the reactor resulting in a negative rate reactor trip. The change being evaluated mitigates the potential for dropping H-8 by energizing both the stationary and movable gripper coils of the Control Rod Drive Mechanisms (CRDMs) for all Group 2 Control Bank D rods in the 2BD power cabinet. This change momentarily installs a jumper at the terminal block interface between the rod control logic cabinet and 2BD power cabinet. This jumper electrically shorts an AC voltage being sent from the logic cabinet to the power cabinet movable gripper circuitry; this voltage is approximately 12 VAC during normal operation to demand zero movable gripper current. When the jumper is installed the voltage will be shorted, and the movable gripper circuitry will demand firing of the movable silicon controlled rectifiers (SCRs) to generate full current; this will latch the movable grippers of the currently selected group of rods into the CRDM drive shafts. Subsequently, a regulation failure will be generated within the 2BD power cabinet due to full current being generated for longer than allowed resulting in an urgent alarm. An urgent alarm in a Rod Control power cabinet forces reduced current on the movable gripper coils of the selected group of rods. Once this takes place, the Group 2 Control Bank D rods will be held by both the stationary and movable grippers with both sets of coils at reduced current. The jumper will then be removed. This condition will prohibit movement of Control Bank D in The Rod Urgent Failure Alarm only affects the plant in the Condition II - Faults of Moderate Frequency and specifically the Uncontrolled Boron Dilution events. Since the reactor will maintain the function to trip due to overpressurization, in the unlikely event of a Uncontrolled Boron Dilution event. Engaging this alarm ensures the Control Bank D control rod will not unexpectedly drop resulting in a negative rate reactor trip. Disabling the Rod Urgent failure Alarm will allow the Control bank D control rods to be placed back in Manual or the preferred setting of automatic and is a simple operator action.
Based on the response to all Evaluation questions being "no", this activity may be implemented per plant procedures without obtaining a License Amendment.
E1-25 of E1-33 TEMPORARY MODIFICATION (TMOD)
DESCRIPTION SAFETY ANALYSIS either automatic or manual as long as the urgent alarm is active. The urgent alarm is capable of being reset by Operator Action by the Rod Urgent Failure Alarm reset push button in the Main Control Room. Once Operator Action reset is completed, the reduced movable gripper current is eliminated, and the Rod Control System will again be fully capable of automatic or manual rod motion.
Additionally, including the urgent alarm has no impact on the rods being capable of dropping upon opening of the reactor trip breakers and safely shutting down the plant.
ACCEPT AS-IS DESCRIPTION SAFETY ANALYSIS Accept As-Is for CR 1560796 Evaluation Rev.
0 A volume knob was noted to be missing from one of the communications headsets in use by the Unit 1 Refuel Floor (RFF) crew in containment. Due to the unknown location of the knob and time it was lost during refueling (after the fuel was back in the core), this Evaluation will consider the knob is either located somewhere in upper containment, the equipment pit, or has made its way into the open reactor.
Therefore, the proposed activity is to allow the communications headset knob to remain inside Unit 1's Upper Containment or Reactor Coolant System (RCS).
According to site procedures foreign material in an SSC that is not retrieved is considered an "accept-as-is" disposition of a degraded or nonconforming condition and must have 10 CFR 50.59 applied.
SSCs that could be affected by this change are the RCS, CVCS, RHR, and the Containment Sump Sub-System of ECCS and components within each system.
This Screening Review/Safety Evaluation (SR/SE) postulated all credible locations for where the foreign material could travel within these systems. This activity was screened in because the presence of this item in the reactor vessel or Upper Containment has the potential to change RCS and/or ECCS chemistry, increase risk of corrosion or damage to any RCS, RHR, CVCS or ECCS component and fuel cladding. The change also has the potential to result in a Steam Generator (SG) or RHR Heat Exchanger tube being blocked. The effects of this activity on the SSCs important to safety within these systems were evaluated and whether they could The evaluation concludes that the postulated foreign material left in the Unit 1 Reactor Vessel or Upper Containment at the restart from the U1R23 outage will not adversely affect nuclear safety. The knob is expected to break apart into pieces such that its size is of no concern, become trapped somewhere that it cannot cause any credible failure such as below the lower core plate or lower tie plate, within a heat exchanger or filter, or melt and become diluted into the bulk RCS. If the knob remains a solid, it lacks the volume, mass, or rigidity to cause any physical damage by impacting any component before becoming trapped.
There is no postulated location the knob could become trapped that would prevent any design function from being performed.
If the knob melts, based on the low concentration associated with this size of foreign material, no measurable effects
E1-26 of E1-33 ACCEPT AS-IS DESCRIPTION SAFETY ANALYSIS perform their intended design functions. Due to the potential to impact the nuclear fuel, Framatome was contacted to provide additional input on this aspect of the activity and effects to reactor coolant chemistry due to potential degradation of the knob.
are expected on RCS water chemistry.
There will also be no effect on the fuel due to chemical attack. Therefore this activity does not result in more than a minimal increase in the frequency of occurrence of an accident or likelihood of occurrence of a malfunction of an SSC important to safety that has been previously evaluated in the UFSAR. The activity also does not result in any increase to the expected radiation releases or operator doses evaluated in the UFSAR. This activity does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR. The modification does not create the possibility for a new type of event that has not been previously evaluated in the UFSAR. This activity does not have any impact on the three fission product barriers described in the UFSAR. Question 8 was not required to be addressed. Based on this evaluation, it is acceptable for this activity to be accepted as-is without prior NRC approval.
Accept As-Is for CRs 1601718 and 1602267 Evaluation Rev. 0 The proposed change is an accept-as-is evaluation for Condition Reports (CRs) 1601718 and 1602267. The condition being evaluated is the possibility of foreign material being left either in the Unit 2 Reactor Vessel or Reactor Cavity at the conclusion of Unit 2 Refueling Outage 23.
As documented in CR 1601718, a broken bolt was discovered on the power cord outrigger of the Unit 2 refuel machine auxiliary hoist during inspection. One half of the 1/4"-20 bolt was recovered, but the remaining half of the bolt and attached nut were unable to be located. At the time the broken bolt and nut were discovered to be missing, the Reactor Vessel head had been removed with the upper internals This evaluation concludes that it is acceptable for the debris items identified in CRs 1601718 and 1602267 to be left in the Unit 2 Reactor Vessel at the restart from the U2R23 refueling outage. The responses to the 10 CFR 50.59(c)(2) determined that there is no increase in the frequency of an accident or likelihood of a malfunction; there is no increase in the consequences of an accident or
E1-27 of E1-33 ACCEPT AS-IS DESCRIPTION SAFETY ANALYSIS remaining in place. Thus, the item is either in the equipment pit, the reactor cavity, on the upper reactor internals, or in the open reactor. On April 15, 2020, a submarine was deployed in an attempt to locate the broken bolt / nut. The sub searched the upper cavity, equipment pit, and upender area but was unable to locate the items. Additional inspections over the course of the refueling outage include: visual inspection of upper internals for the debris, four-face inspection of each fuel assembly, inspection of the lower core plate, and inspection below the lower core plate. The broken bolt / nut was not located.
It was documented in CR 1602267 that two paint chips were discovered during a lower core plate inspection. One paint chip was knocked away before determining its location, and the paint chip was not able to be located again. The other paint chip is near core location K-10. It was stated in CR 1602267 that Westinghouse did not have the equipment available at the time to retrieve or attempt to retrieve the paint chips.
malfunction; there is no possibility of a new accident; there is no possiblity of a malfunction with a different result; and there are no changes to any design basis limits for fission product barriers.
Therefore, this change may be accepted as-is without obtaining a License Amendment.
PROCEDURE DESCRIPTION SAFETY ANALYSIS ES-1.3 Rev. 24 & E-2 Rev. 18 Evaluation Rev. 0 The proposed change consists of revisions to two Emergency Operating Procedures (EOPs) in response to CR 1496213, which identified a conflict between the existing EOP guidance and the UFSAR-described analysis for a main steam line break with a concurrent or consequential rupture of the RWST. UFSAR Section 6.2 states that the RWST basin (moat) ensures that a minimum of 20,000 gallons of borated water is maintained if the tank is ruptured by a tornado. As described in the Prompt Determination of Operability (PDO) for this CR, the same storage capacity is credited if the RWST is ruptured by pipe whip following a main steam line break in the yard area near the RWST. The PDO clarified that, in addition to a tornado, a seismic event or postulated failure of the non-safety related main steam (MS) piping outside of containment may result in loss of RWST in parallel with a MS line failure. The problem is that the credited 20,000 gallon water volume following an RWST rupture is less than the volume corresponding to the low-low level setpoint (8%), at which existing EOPs require Emergency Core Cooling System (ECCS) pumps to be stopped to prevent loss of suction.
Also, a postulated RWST rupture may result in loss of all the tank level instruments due to submergence of the level transmitters when the RWST The proposed changes modify the EOP guidance which applies after a MS line break accident has already occurred with a concurrent or consequential RWST rupture. These changes cannot cause another accident and will not increase the frequency of any accident evaluated in the UFSAR. The impact of the proposed EOP changes has been evaluated; these changes do not result in a more than minimal increase in the likelihood of a malfunction in ECCS or any other UFSAR-described function. The proposed changes do not increase the radiological consequences of any accident, including a design basis MS line break, nor do they increase the consequences of any malfunction to systems, structures, or
E1-28 of E1-33 PROCEDURE DESCRIPTION SAFETY ANALYSIS basin floods. Based on the PDO analysis, the indicated RWST level is expected to fail high when the transmitters are submerged. However, if one or more of the RWST level transmitters remains available, operators could take action to stop all running ECCS pumps in response to low indicated level. This could make the credited 20,000 gallon water volume unusable with the existing EOP guidance. EOP changes are needed to address these plant-specific concerns.
ES-1.3, Transfer to Residual Heat Removal (RHR) Containment Sump, provides instructions for transferring the ECCS and CS system to the sump recirculation mode. This EOP is entered when RWST level reaches the low level setpoint (27%) and is based on the Westinghouse Owners Group (WOG) Emergency Response Guideline (ERG), with various deviations documented in the plant-specific basis document. The steps in this EOP are also based on UFSAR tables which summarize the plant-specific sequence of actions for sump recirculation. The following changes are incorporated in ES-1.3:
- Revised Section 1.0 (Purpose) to clarify the applicability of the plant-specific time critical action (TCA) to stop all pumps taking suction from the RWST within 1.5 minutes after RWST level reaches 8%. This section contains an informational table which lists all of the TCAs in ES-1.3. The table row for stopping ECCS and CS pumps within 1.5 minutes is modified to state that this action does not apply during a RWST rupture with the Reactor Coolant System (RCS) intact.
- Revised the Foldout Page (FOP) action which stops the ECCS pumps (with suction aligned to the RWST) and CS pumps when tank level is less than or equal to 8%. The FOP conditional action is modified to designate that it does NOT apply during an RWST rupture with the RCS intact. The existing FOP action is a deviation from the generic WOG ERG, which contains a caution warning operators that any pumps taking suction from the RWST should be stopped if RWST level lowers to setpoint U03; the generic caution was previously converted to a FOP action to improve usability and to comply with the SQN EOP Writer's Guide. The proposed change to the FOP action expands the scope of the existing deviation by exempting this action during components (SSCs) important to safety.
The proposed changes cannot create the possibility for any different type of accident nor any unanalyzed combination of accidents. The proposed changes do not create the possibility of a malfunction of ECCS nor any other SSC important to safety with a different result. These EOP changes do not impact any design basis limits for the RCS, reactor fuel, or containment. These changes have no impact on evaluation methodologies described in the UFSAR.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
E1-29 of E1-33 PROCEDURE DESCRIPTION SAFETY ANALYSIS an RWST rupture with the RCS intact. This deviation is justified based on the plant-specific RWST design vulnerability described above.
- Revised Step 3 (CHECK sump recirculation capability) to incorporate new contingency actions if containment sump level is less than the required setpoint (11%, setpoint T93) due to an RWST rupture with the RCS intact (containment conditions normal). The existing response not obtained (RNO) action directs operators to resume implementation of any applicable Function Restoration Procedures (FRPs) and to transition to Emergency Condition Action Procedure ECA-1.1, Loss of ECCS Sump Recirculation. ECA-1.1 is intended for beyond design basis accidents involving a loss of coolant accident (LOCA) with a loss of both trains of ECCS recirculation capability; ECA-1.1 is not the desired/optimal mitigating strategy for a design basis steam line break with the RWST ruptured because it may delay ECCS termination. If ES-1.3 was entered due to an RWST rupture with the RCS intact (based on containment conditions normal), the revised RNO action directs performing new Appendix B, Contingency Actions for RWST Rupture with RCS Intact. Appendix B provides information and guidance on the potential effects on the RWST of a steam line break in the yard area. This appendix directs ensuring that only one CCP and no more than one Safety Injection (SI) pump are running to conserve the remaining RWST inventory and to reduce the vulnerability to air entrainment. The CCP and SI pump steps are worded differently because it is possible to enter ES-1.3 Appendix B with no SI pump running (if SI pumps were stopped in ES-1.1 prior to the initiation of switchover); therefore, the SI pump step directs stopping one pump if both are running. If indicated RWST level is less than the empty setpoint (U03) or less than two wide range RWST level instruments are available, this appendix conservatively requires monitoring the running ECCS pumps for signs of cavitation and loss of suction.
At least two RWST level channels are required in this step to ensure that operators can confirm a valid tank level indication through comparison of the available indications and considering that Technical Specifications (TS) only allow one of four RWST level instrument to be inoperable. During a steam line break with a ruptured RWST, air entrainment resulting in cavitation or loss of suction is NOT expected based on the analyzed water volume. The
E1-30 of E1-33 PROCEDURE DESCRIPTION SAFETY ANALYSIS changes described above are a new deviation from the generic WOG ERG but are justified based on the plant-specific RWST design vulnerability described above.
Condition Report 1521279 -
EA-67-8 Rev. 5 EA-32-2 Rev. 5 0-SO-32-1 Rev. 106 1-SI-OPS-000-002.0 Rev. 127 2-SI-OPS-000-002.2 Rev. 115 AOP-M.02 Rev. 25 AOP-M.05 Rev. 11 AOP-M.08 Rev. 6 AOP-N.04 Rev. 12 AOP-P.01 Rev. 41 Evaluation Rev. 0 These revisions are required in response to CR 1521279. This CR identified that plant procedures currently direct or allow establishing ERCW flow to the station air compressors (SACs) by opening motor-operated isolation valve 0-FCV-67-205 (Train A) or 0-FCV-67-208 (Train B) following a loss of offsite power (LOOP) or other conditions in which the normal cooling water supply to the SACs (from non-safety related Raw Cooling Water [RCW]) is lost.
Establishing ERCW to the SACs allows restarting the air compressors to restore or maintain non-essential control air pressure. Non-essential control air is needed for the CVCS letdown flowpaths and to allow remotely controlling charging flow to prevent pressurizer overfill. Design documents currently state that the maximum ERCW temperature with flow established to the SACs is 82°F (for Train A) or 85°F (for Train B). These temperature limits exist because some of the safety-related components (such as Main Control Room [MCR] and Electric Board Room [EBR] chillers) may have inadequate flow if ERCW flow is established to the air compressors above the applicable temperature limit.
Current procedures identify these design output temperature limits but allow operators to continue with establishing ERCW flow to the SACs while entering the applicable TS action for the affected ERCW train. Therefore, if off-site power or RCW is lost with ERCW temperature above the applicable limit, current procedures may result in operators taking a deliberate action which makes one train of safety-related systems/components inoperable. This condition potentially violates the single failure criterion because a postulated single failure on one ERCW train (either before or after the operator action to align ERCW flow) could result in the second (remaining) train of safety-related equipment being inoperable. Note that when a TS Limiting Condition for Operation (LCO) condition/action which limits the duration of continued plant operation is entered due to one train of equipment inoperable, a subsequent single failure on the remaining operable train is normally NOT required to be postulated. However, suspending the single failure criterion when ERCW is aligned to SACs is NOT appropriate because the inoperability occurs due to a preplanned action, which applies anytime offsite power or RCW is lost. Also, The proposed changes modify the procedural guidance for aligning ERCW flow to the SACs; these changes cannot cause another accident and will not increase the frequency of any accident evaluated in the UFSAR. The impact of the proposed procedure changes has been evaluated; these changes do not result in an increase in the likelihood of a malfunction of ERCW or any other supported UFSAR-described function.
The proposed changes do not increase the radiological consequences of any accident, nor do they increase the consequences of any malfunction to systems, structures, or components (SSCs) important to safety. The proposed changes cannot create the possibility for any different type of accident nor any unanalyzed combination of accidents. The proposed changes do not create the possibility of a malfunction of ERCW nor any other SSC important to safety with a different result. These EOP changes do not impact any design basis limits for the RCS, reactor fuel, or containment. These changes have no impact on evaluation methodologies described in the UFSAR.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
E1-31 of E1-33 PROCEDURE DESCRIPTION SAFETY ANALYSIS this involves deliberately entering an LCO action for operational convenience (to allow restoring non-safety related CVCS functions), which is contrary to the bases for LCO 3.0.2. This condition was evaluated in the Prompt Determination of Operability (PDO) for CR 1521279. This PDO included a new interim analysis that justified that ERCW flow may be supplied to the SACs from either train up to a maximum ERCW supply temperature of 85°F.
The PDO states that this interim temperature limit is applicable with the ERCW yard header crosstie, the 6 ESF header crosstie, and the 16 Auxiliary Building header crosstie open or closed, in any combination. The PDO requires revising affected procedures to incorporate this modified temperature limit.
These changes have the following potential adverse impacts:
- This interim limit deviates from the current temperature limits specified in design output documents and is designated as being applicable regardless of the status of the ERCW header cross-ties. These changes have potential adverse impacts on ERCW design functions (reduced system cooling capacity).
- The proposed revisions also incorporate more restrictive guidance which may prevent establishing ERCW flow to the SACs if temperature is above the interim temperature limit. This additional restriction may prevent restoring non-essential control air pressure which, subsequently, would prevent restoration of a CVCS letdown flowpath and may challenge control of RCS inventory (pressurizer level).
Core Operating Limits Report DESCRIPTION SAFETY ANALYSIS SQN Unit 1 Cycle 24 Core Operating Limits Report (COLR)
This Screening Review/Evaluation addresses the Sequoyah (SQN) Unit 1 Cycle 24 (S1C24) reload core design and Core Operating Limits Report (COLR) needed to support operation in all modes to a core average cycle burnup of 21,214 Megawatt-Days per Metric Ton of Uranium (MWD/MTU). All of the fuel assemblies loaded for S1C24 are Framatome Adv. W17 HTP design. This is unchanged from the previous cycle.
The removal of the H-08 RCCA does not impact the frequency or likelihood of an accident or malfunction because an RCCA is being removed and can no longer fail.
There are no dose consequences associated with the removal of an RCCA.
E1-32 of E1-33 Core Operating Limits Report DESCRIPTION SAFETY ANALYSIS Evaluation Rev 0
The H-08 rod cluster control assembly (RCCA) is being removed for Unit 1 Cycle 24 to prevent a dropped rod during the cycle. The removal of the H-08 RCCA adversely impacts the design function of the RCCA by reducing the trip reactivity worth and available shutdown margin. The removal of the H-08 RCCA also increases bypass flow which adversely impacts the thermal and hydraulic design of the reactor core. The reactor coolant boundary is not modified with the removal of the H-08 RCCA.
The accidents analyzed in the UFSAR are independent of the number of control rods.
The cycle-specific nuclear design parameters with the H-08 RCCA removed were confirmed to be bounded by the conservative input values used in the UFSAR accident analyses. Therefore no design basis limits were violated, and no malfunctions with a different result are possible.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
SQN Unit 2 Cycle 24 COLR Evaluation Rev 1
This Screening Review/Evaluation addresses the Sequoyah (SQN) Unit 2 Cycle 24 reload core design and Core Operating Limits Report (COLR) needed to support operation in all modes to a core average cycle burnup of 21,562 MWD/MTU.
Information in the SQN UFSAR and TSs were reviewed in the preparation of this Screening Review/Evaluation. During SQN Unit 2 Refueling Outage 23 (S2RFO23),
it was determined that removal of the H-08 RCCA was necessary due to the Control Rod Drive Mechanism (CRDM) stationary gripper's wear condition. All of the fuel assemblies loaded for Sequoyah Unit 2 Cycle 24 (S2C24) are Framatome Adv. W17 HTP design. This is unchanged from the previous cycle.
Sequoyah Unit 1 Cycle 24 reduced the number of operating RCCAs from 53 to 52.
During the evaluation for this change, a bounding bypass flow for both units was created to apply to both Unit 1 and Unit 2. Based on the increase in core bypass flow, the UFSAR was evaluated to confirm that no safety/accident analysis, SSCs, or downstream additional accidents were impacted due to this change. The increase in core bypass flow does not increase the total core flow, but impacts the departure from nucleate boiling (DNB) analyses as the flow through the guide tubes has been increased. The flow restrictor ensures that the thermal hydraulic characteristics are equivalent and therefore will not create any new failure modes of The core bypass flow increase does not require obtaining a License Amendment based on the responses to the 10 CFR 50.59(c)(2) evaluation questions. No UFSAR Chapter 15 accident analysis need to be reevaluated to address core bypass flow. The activity can be implemented per plant procedures.
The removal of the H-08 RCCA does not impact the frequency or likelihood of an accident or malfunction because an RCCA is being removed and can no longer fail.
There are no dose consequences associated with the removal of an RCCA.
The accidents analyzed in the UFSAR are independent of the number of control rods.
The cycle-specific nuclear design parameters with the H-08 RCCA removed
E1-33 of E1-33 Core Operating Limits Report DESCRIPTION SAFETY ANALYSIS other SSCs. The removal of the H-08 RCCA adversely impacts the design function of the RCCA by reducing the trip reactivity worth and available shutdown margin.
were confirmed to be bounded by the conservative input values used in the UFSAR accident analyses. Therefore, no design basis limits were violated, and no malfunctions with a different result are possible.
Therefore, this activity may be implemented per plant procedures without obtaining a License Amendment.
DOCUMENT NUMBER/72.48 EVALUATION TRACKING NUMBER DESCRIPTION SAFETY ANALYSIS None
ENCLOSURE 2 SEQUOYAH NUCLEAR PLANT COMMITMENT CHANGE REPORT
E2-1 of E2-1 Commitment Evaluation No./
Commitment Tracking No.
Source Document Summary of Original Commitment Summary of Commitment Changes Basis/Justification for Changes NCO0900026001 TVA letter to NRC dated February 7, 1990
- 1. A corporate standard describing TVA's vendor manual control program will be issued by July 31, 1990.
- 2. The standard will standardize efficient and effective ways of performing site activities and functions related to vendor manuals and associated vendor information.
- 3. The standard will incorporate the guidance supplied in NUTAC/VETIP (INPO 84-010),
INPO Good Practice 87-009, and the guidance provided in the February 1987 letter from NRC.
TVA is no longer maintaining this commitment as a Regulatory Commitment. Therefore, TVA may change the vendor manual control process NPG-SPP-09.20, Vendor Manual Control to not meet the past industry guidance.
This commitment is redundant to other programs, processes and tools that are standard today, but were not available in 1990.
The technological and process advancements in equipment performance information exchanges and other operating experience sharing meet the intent of GL 83-28, Required Actions Based on Generic Implications of Salem ATWS Events and GL 90-03, Relaxation of Staff Position in Generic Letter 83-28, Item 2.2 Part 2 "Vendor Interface for Safety-Related Components" and have obviated the need for direct periodic contact with some vendors.