NOC-AE-12002838, Response to Request for Additional Information, RAI-01.1, Regarding the License Amendment Request to Revise the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability

Response to Request for Additional Information, RAI-01.1, Regarding the License Amendment Request to Revise the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability

ML12135A182
Person / Time
Site:	South Texas
Issue date:	05/03/2012
From:	Richards K South Texas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
G25, NOC-AE-12002838, STI: 33475111, TAC ME6346, TAC ME6347
Download: ML12135A182 (31)

Text

Nuclear Operating Company South Texas ProlectElectricGeneratingStation P.O Box 289 Wadsworth Texas 77483 I May 3, 2012 NOC-AE-12002838 File: G25 10CFR50.90 10CFR50.48 STI: 33475111 U. S. Nuclear Regulatory Commission Attention: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852 South Texas Project Units 1 & 2 Docket Nos. STN 50-498, STN 50-499 Response to Request for Additional Information, RAI-0 1.1, Regarding the License Amendment Request to Revise the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability (TAC Nos. ME6346 and ME6347)

References:

1. STPNOC letter dated June 2, 2011 from G. T. Powell to the NRC Document Control Desk, "License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability" (NOC-AE- 11002643) (ML11161A143)

2. STPNOC letter dated August 1, 2011 from Charles T. Bowman to the NRC Document Control Desk, "Supplement to the License Amendment Request for Approval of a Revision to the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability (TAC Nos. ME6346 and ME6347)" (NOC-AE-1 1002703) (ML11221A230)

3. NRC Document dated February 17, 2012, "South Texas Project, Units 1 and 2 -

Request for Additional Information Email, Round 2, License Amendment Request to Approve Revision to Fire Protection Program in Fire Hazards Analysis Report Related to Alternate Shutdown Capability (TAC Nos. ME6346 and ME6347)" (ML120470160)

NOC-AE-12002838 Page 2

4. STPNOC letter dated March 22, 2012 from G. T. Powell to the NRC Document Control Desk, "Response to Request for Additional Information, Round 2, Regarding the License Amendment Request to Revise the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability (TAC Nos. ME6346 and ME6347)" (NOC-AE-12002817) (ML12089A023)

5. STPNOC letter dated April 3, 2012 from Michael P. Murray to the NRC Document Control Desk, "Response to Request for Additional Information, RAI-0 1.1, Regarding the License Amendment Request to Revise the South Texas Project Fire Protection Program Related to the Alternative Shutdown Capability (TAC Nos. ME6346 and ME6347)" (NOC-AE-12002827)

(ML12101A223)

In Reference 1, STP Nuclear Operating Company (STPNOC) submitted a licensee amendment request (LAR) for approval of a revision to the South Texas Project (STP) Fire Protection Program (FPP) related to the Alternative Shutdown Capability. Reference 2 provided supplementary information in support of the LAR. Per Reference 3, the Nuclear Regulatory Commission (NRC) requested additional information to support review of the LAR. Reference 4 provided a response to the requested additional information with the exception of a response to RAI-0 1.1. In References 4 and 5, STPNOC stated that additional time was required to complete the analysis to support a technical justification for providing a response to RAI-0 1.1. Response to RAI-0 1.1 is provided in the Enclosure to this letter.

There are no regulatory commitments in this letter.

If there are any questions regarding this amendment request, please contact Ken Taplett at (361) 972-8416 or me at (361) 972-7017.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on -ý --)-'\_ 2 Date Kevin D. Richards President & Chief Executive Officer KJT

Enclosure:

Response to Request for Additional Information RAI-0 1.1.

NOC-AE-12002838 Page 3 cc:

(paper copy) (electronic copy)

Regional Administrator, Region IV A. H. Gutterman, Esquire U. S. Nuclear Regulatory Commission Morgan, Lewis & Bockius LLP 1600 East Lamar Boulevard Arlington, Texas 76011-4511 Balwant K. Singal U. S. Nuclear Regulatory Commission Balwant K. Singal John Ragan Senior Project Manager Chris O'Hara U.S. Nuclear Regulatory Commission Jim von Suskil One White Flint North (MS 8 B1) NRG South Texas LP 11555 Rockville Pike Rockville, MD 20852 Kevin Pollo Senior Resident Inspector Richard Pena U. S. Nuclear Regulatory Commission City Public Service P. 0. Box 289, Mail Code: MN116 Wadsworth, TX 77483 C. M. Canady Peter Nemeth City of Austin Crain Caton & James, P.C.

Electric Utility Department 721 Barton Springs Road C. Mele Austin, TX 78704 City of Austin Richard A. Ratliff Texas Department of State Health Services Alice Rogers Texas Department of State Health Services

Enclosure NOC-AE-12002838 Page 1 of 28 Response to Request for Additional Information REQUEST FOR ADDITIONAL INFORMATION LICENSE AMENDMENT REQUEST FOR APPROVAL OF A REVISION TO THE SOUTH TEXAS PROJECT FIRE PROTECTION PROGRAM RELATED TO THE ALTERNATIVE SHUTDOWN CAPABILITY AT SOUTH TEXAS PROJECT, UNITS 1 AND 2 (TAC NOS. ME6346 AND ME6347)

By letter dated June 2, 2011 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML11161A143), as supplemented by letter dated August 1, 2011 (ADAMS Accession No. MLI 1221A230), STP Nuclear Operating Company (the licensee) requested approval of a license amendment request to revise the South Texas Project (STP) fire protection program related to the alternative shutdown capability. The U.S. Nuclear Regulatory Commission (NRC) staff has reviewed the information provided and requires the following additional information to complete its review.

RAI-01: Crediting of Actions Section 2.2 of letter dated June 2, 2011 states that, "Performing the additional actions inside the control room ensures that the RCS [reactor coolant system] process variables remain within those values predicted for a loss of normal a-c [alternating current] power," and that, "The proposed change assumes one spurious actuation to occur before control of the plant is achieved through the alternative or dedicated shutdown system." However, the licensee did not state whether operators can achieve safe shutdown in the event that some or all of the requested actions are not completed before evacuating the control room and a spurious actuation occurs before operators reach the alternate control station.

Also, the request does not describe what the postulated fire scenarios are that might necessitate the requested actions. For instance, it is not clear whether the actions would be required or feasible given a rapid fire within the fire area or within a particular piece of equipment or why a postulated fire would not damage more than one circuit.

RAI-01.1 Please provide a technical justification that plant safe shutdown is achievable in the event that some or all of the requested actions are not completed before evacuating the control room and a spurious actuation occurs before operators reach the alternate control station.

Enclosure NOC-AE-12002838 Page 2 of 28 STPNOC Response The defense-in-depth analysis provided in the STPNOC License Amendment Request (Reference 1) concluded that it is extremely unlikely that a fire would result in evacuation of the control room. However in the unlikely event that control room evacuation is required and some or all of the requested actions are not completed, automatic1 system control features in response to a reactor trip should successfully actuate due the separation features of Fire Area 1 (i.e. the control room) discussed below. The analysis discussion following the control room/relay room separation discussion below demonstrates that plant safe shutdown is achievable in the event that all of the requested actions are not completed before evacuating the control room and a spurious actuation occurs before operators reach the alternate control station.

Control Room/Relay Room Separation Fire Zone Separation The Control Room is divided into two main areas, the main control room and the relay room.

See Figure A. The main control room is an independent fire zone from the relay room fire zone. The zone boundary between the main control room fire zone 034 and the relay room fire zone 032 is separated by a 12 inch concrete wall with dampers to isolate, the main control room from the relay room. The wall dampers close on actuation of the fire suppressant halon system in the relay room and prevent halon from entering the main control room. All penetrations in the wall are sealed to prevent the spread of fire. In Unit 1 only, there is a 1-1/2 hour rated fire door between the main control room and the relay room. The separation of the two fire zones should result in successful performance of the requested actions in the main control room should a fire initiate in the relay room. Likewise, the automatic functions in the relay room should be successful should a fire initiate in the main control room. Discussion below further describes the defense-in-depth layout of the main control room and relay room.

Main Control Room Layout The main control room consists of the main control panels and overhead cable trays. Fire detectors are installed in each main control panel. The main control room is continuously manned. A fire within the control room will be detected in its incipient stages and alarm in the control room. Additionally, the South Texas Project (STP) Fire Protection Program 1For purposes of addressing this beyond licensing basis question, automatic functions within the control room are assumed to occur. The STP Licensing Basis Fire Hazards Analysis does not credit the automatic function of valves and pumps whose circuits could be affected by a control room fire consistent with Question 3.8.4 in Enclosure 2 to NRC Generic Letter 86-10, "Implementation of Fire Protection Requirements".

Enclosure NOC-AE-12002838 Page 3 of 28 does not allow for transient of flammable liquids within the control room boundary. In summary, fires within the main control room should be short-lived.

The separation requirements for the control panel circuits are in accordance with Section 5.6 of the IEEE 384 standard and NRC Regulatory Guide 1.75. The methods for achieving the separation requirements consist of any of the following methods or a combination thereof:

• Mounting the Class lE devices on physically separate control bench boards.

• Providing a fire retardant barrier or air space for redundant Class 1E devices in close proximity. This separation consists of:

1. Six-inch physical separation between devices, or

2. Rigid metal barrier.

• Enclosed metal wireways.

• Metallic Conduit.

The Class 1E logic and control circuits, reactor trip and engineered safety features (ESF) actuation barrier switches, Class lE instrumentation circuits, and the non-Class 1E circuits meet the separation criteria described above. The separation between redundant Class 1E devices and between Class 1E and non-Class 1E devices mounted in close proximity is achieved by a flame retardant barrier. Redundant Class 1E circuits that are located in close proximity to one another are routed in either an all-metal wireway system that has removable covers or metallic conduit between the first wire connection point (within a few feet of the board-mounted device) and the control board termination area. For any exposed wiring up to a termination point, a minimum distance of six inches is maintained between separation groups. If spatial separation criteria cannot be met, a physical barrier is utilized. The wiring for the Class lE and non-Class lE circuitry is flame retardant as required by IEEE 383, Section 2.5 and IEEE 420, Section 4.3.

The main control room overhead area is provided with a seismically designed catwalk to provide easy access. The combustible material in the overhead is IEEE 383 cable which is fire resistant and has a very low flame spread rating. Therefore, a fire in the overhead should be short-lived because the fire should slowly progress and the area is easily accessed from the continuously occupied main control room operating area below. The generation of any smoke can be easily removed by the control room smoke purge system without adversely impacting control room habitability.

Enclosure NOC-AE-12002838 Page 4 of 28 Relay Room Layout A fire in the relay room progressing to a point where control room evacuation is necessary is unlikely due to cable and panel layouts. In the remote possibility that a fire occurred within the relay room and progressed to where the fire started affecting circuits and challenging continued operation of the plant, the requested actions can be performed from within the main control room because this area is independent from the relay room. In addition, the robust separation between the main control room and the relay room should prevent the propagation of the fire from one fire zone to the other.

Assuming a fire in the relay room started to adversely impact circuits, automatic functions can be assumed to be successful in at least one safety train due to relay room layout that provides a robust separation of solid state protection system (SSPS) and engineered safety features (ESF) actuation trains cabinets. See Figure B.

The SSPS is comprised of two redundant logic trains (R and S) and three ESF actuation trains (A, B, and C) that are physically and electrically independent. Inputs to the SSPS logic trains are derived from various sensors that monitor nuclear and non-nuclear variables. Most of these signals are processed in the analog protection system racks and result in bistable outputs to the SSPS. Inputs to ESF actuation trains are derived from those plant components which prevent or mitigate damage to the reactor core and which prevent or mitigate the release of radioactivity to the environment. The ESF actuation train cabinets take inputs from both SSPS logic train cabinets and actuate specific components.

Both physical and electrical separation of redundant analog channels is maintained from the process sensors to the analog protection equipment racks using separate cable trays, conduit, and penetrations. The separation is maintained through these equipment racks to the input compartments of the SSPS logic circuits. Separate cable trays are used to carry the interconnecting wiring between the bistable output and the input compartment of each logic train. Separation and isolation between the analog and logic systems are achieved by way of the electrical and physical separation between the coil and contact of the input relays.

The redundant SSPS logic train actuation cabinets are separated by approximately 36 feet.

The ESF actuation train cabinets are located between the SSPS logic train cabinets. The cabinets are heavy gauge (1/4")steel and separated from each other by a 2-inch air gap with no intervening combustibles. The "A" train circuits in the relay room enter the room from below the room while "B" and "C" circuits are routed from the top and rear of the room.

Enclosure NOC-AE-12002838 Page 5 of 28 Figure A Fire Area 1

Enclosure NOC-AE-12002838 Page 6 of 28 Figure B Relay Room SSPS and ESF Cabinet Separation/Layout

Enclosure NOC-AE-12002838 Page 7 of 28 Analysis To address the impact of the operators failing to perform any or all of the requested operator actions prior to leaving the control room, analyses were performed to determine the impact of the limiting spurious actions on the ability of the plant to achieve safe shutdown conditions.

The analyses assumed the operators did not perform any of the requested operator actions.

This defense-in-depth analysis is beyond the STP Licensing Basis and differs from the STP Fire Hazards Analysis in that automatic functions within the control room area relay room are assumed to function because of the control room/relay room separation discussed previously.

An overview of each of the requested operator actions is presented in Table A as follows:

a. Requested operator action

b. The spurious action the requested operator action protects against

c. The plant response as a result of the spurious action

d. The time required to perform the operator action at the alternate shutdown station.

The operator action at the alternate shutdown station is assumed to be successful because control is transferred to local control station outside the control room. The transfer electrically isolates the circuits in the control room from the alternative shutdown circuits so that any circuit failures in the control room after transfer will not adversely affect the safe shutdown function.

Enclosure NOC-AE-12002838 Page 8 of 28 Table A Requested Operator Actions and Associated Spurious Actions Operator Action Spurious Action Plant Response Alternate Shutdown Station Response Time (Minutes)

Main steam line Spurious opening of Rapid cool down of the 10 isolation (MSIV) one bank of steam reactor coolant system dump valves (RCS) due to steam generator (SG) depressurization Closing the Spurious opening of Rapid depressurization of 10 pressurizer power- one pressurizer PORV the RCS operated relief valves (PORV) block valves Securing all Spurious opening of a Rapid depressurization of 30 reactor coolant pressurizer spray valve the RCS pumps (RCP)

Secure centrifugal Spurious opening of Rapid depressurization of 10 charging pumps the pressurizer the RCS auxiliary spray valve Feedwater Spurious opening of a Rapid cool down of the 10 isolation feedwater regulating RCS and overfilling a SG valve (FWRV) with due to excess feedwater actuation of the startup feedwater pump Secure startup Spurious opening of a Rapid cool down of the 10 feedwater pump feedwater isolation RCS and overfilling a SG valve and a FWRV due to excess feedwater Letdown isolation Maintains pressurizer Loss of indicated 10 water level to ensure pressurizer water level level does not go off-scale low due to other spurious actions.

Enclosure NOC-AE-12002838 Page 9 of 28 A review of the spurious actions presented in Table A shows that the events can be categorized as follows:

1) A rapid cool down of the RCS due to SG depressurization (i.e., spurious opening of one bank of steam dump valves)

2) A rapid depressurization of the RCS due to a fully open pressurizer PORV (i.e., spurious opening of one pressurizer PORV)

3) A rapid depressurization of the RCS due to a fully open spray valve (i.e., spurious opening of a pressurizer spray valve or spurious opening of the pressurizer auxiliary spray valve)

4) A rapid cool down of the RCS and overfilling a SG due to excess feedwater (spurious opening of a FWRV with the actuation of the startup feedwater pump or a spurious opening of a feedwater isolation valve and FWRV)

5) Loss of RCS inventory due to centrifugal charging flow and letdown flow mismatch (loss of RCS inventory causing the indicated pressurizer water level off-scale low).

To assess the impact of the success of the operator requested actions being delayed until backed up outside the control room at the alternate shutdown stations, the following cases were performed.

Case 1: Spurious opening of one bank of steam dump valves occurring at the time of reactor trip. This case bounds the spurious opening of one bank of steam dump valves.

Case 2: Spurious opening of one open pressurizer PORV occurring at the time of reactor trip. This case bounds the spurious opening of one pressurizer PORV.

Case 3: Spurious opening of one pressurizer spray valve occurring at the time of reactor trip.

This case bounds the spurious opening of a pressurizer spray valve or the spurious opening of the pressurizer auxiliary spray valve. The spurious opening of a pressurizer spray valve is considered limiting because a spurious opening of the pressurizer auxiliary spray valve can be terminated in 10 minutes by securing the centrifugal charging pumps, whereas the terminating the spurious opening of a pressurizer spray valve takes 30 minutes after the RCPs are secured.

Case 4: Spurious opening of one FWRV occurring at the time of reactor trip. This case bounds the spurious opening of a FWRV with the actuation of the startup feedwater pump or a spurious opening of a feedwater isolation valve and FWRV because the closure of either a FWRV or feedwater isolation valve terminates feedwater flow to the SG.

The four cases above do not take credit for the operator securing letdown prior to exiting the control room. Therefore, the specific case of the loss of RCS inventory due to centrifugal charging and letdown flow mismatch is bounded by these cases.

Enclosure NOC-AE-12002838 Page 10 of 28 The analyses for these four cases were performed until the SG water level returns to the indicating range between 22% and 100%, pressurizer water level returns to the indicating range between 20% and 100%, and both charging and excess letdown are available. When these conditions are reached, the plant can safely proceed to cool down to shutdown conditions in a controlled manner.

The following are the key assumptions used in the analysis:

1. The plant is at full power, steady-state nominal conditions at the time of reactor trip.

2. Offsite power is available which is conservative for this analysis. With offsite power maintained, reactor coolant pump flow is maintained and results in increased heat transfer capability between the primary and secondary systems and a greater cooldown effect.

3. All automatic controls are assumed operable.

4. The main turbine governor valves close in 3.5 seconds after reactor trip

5. MSIVs close with a five second stroke time on:

(a) Receipt of a compensated low steam line pressure signal of 735 psig, or (b) Manually at alternate shutdown stations outside the control room by operators 10 minutes after reactor trip.

6. Main Feedwater Isolation Valves close with a 10 second stroke time on:

(a) Receipt of a safety injection (SI) signal, (b) SG narrow range water level reaching greater than 87.5% setpoint, (c) Receipt of a RCS average coolant temperature (Tavg) low (574°F) coincident signal with reactor trip, or (d) Manually at alternative shutdown stations outside the control room by operators 10 minutes after reactor trip.

7. Auxiliary Feedwater (AFW) flow starts when:

(a) Any SG narrow range water level decreases to 20%, or (b) A SI signal occurs.

Operators throttle back AFW flow in 10 minutes after reactor trip. The target for controlling AFW flow is to maintain SG water level between 22% and 50%

narrow range.

8. Pressurizer PORV block valves are manually closed at the alternate shutdown stations within 10 minutes after the reactor trip and are manually unblocked 20 minutes after the reactor trip unless the indicated pressurizer water level is off-scale high. The lift setpoint for the pressurizer PORV is 2335 psig.

Enclosure NOC-AE-12002838 Page 11 of 28

9. Charging and Letdown:

(a) Operators secure the centrifugal charging pumps at the alternate shutdown station within 10 minutes after reactor trip.

(b) Normal letdown is secured at the alternate shutdown station by the operators in 10 minutes after reactor trip or on an SI signal.

(c) Charging and normal letdown flows are equal (132 gpm) unless either is secured.

(d) Charging and excess letdown are available 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after reactor trip.

10. Safety Injection (SI):

(a) SI occurs on compensated low steam line pressure setpoint of 735 psig, or low pressurizer pressure setpoint of 1857 psig, (b) An SI signal closes the main feedwater isolation valves, normal letdown valves, and starts the high head and low head SI pumps, and (c) Operators secure SI pumps prior to RCS depressurization for cool down to cold shutdown conditions.

Note: The shutoff head for the high head SI pumps is 1700 psia.

11. Pressurizer backup heaters (Groups A&B) are available within 10 minutes following reactor trip. Each group of backup heaters has a capacity of 431 KW (862 KW total).

12. Pressurizer proportional heaters are not available.

13. Reactor Coolant Pump (RCP):

(a) RCP seal leakage out of the RCS is 4.5 gpm/pump (18 gpm total) within 13 minutes after the centrifugal charging pumps are secured. This assumption is based on observed plant data.

(b) Operators secure RCPs within 30 minutes after reactor trip.

(c) Pressurizer normal spray flow stops when all RCPs are tripped.

14. The plant can achieve safe shutdown conditions once the following requirements are met:

(a) Indicated SG narrow range water level is in the range between 22% and 100%,

(b) Indicated pressurizer level is between 20% and 100%, and (c) Charging and excess letdown are available for RCS boration reactivity control.

Enclosure NOC-AE- 12002838 Page 12 of 28 The following provides a description and the results for each analyzed case and demonstrates that safe shut down can be achieved.

Case 1: Spurious Opening of One Bank of Steam Dump Valves Occurring at Time of Reactor Trip The analysis of the spurious opening of one bank of steam dump valves occurring at the time of reactor trip assumes the plant is at steady state conditions for 10 seconds prior to the event. A sequence of events is provided in Table B and plots of selected parameters versus time are presented in Figures 1 through 4. Only results for RCS Loop 1 are presented due to the symmetrical nature of the event.

The reactor trip in conjunction with a spuriously opened bank of steam dump valves results in the depressurization and cool down of the RCS and feedwater isolation due to a low Tavg signal.

AFW flow is then initiated on a low SG water level signal due to the main turbine trip. The depressurization of the RCS continues and results in a SI signal due to low pressurizer pressure.

The SI signal results in letdown isolation and starts the SI pumps. The depressurization of the RCS continues until the MSIVs are closed due to a compensated low steam line pressure signal.

The operators take control of AFW flow from the alternate shutdown station within 10 minutes into the event to maintain indicated SG water level. Operators unblock the pressurizer PORVs 20 minutes into the event. Operators secure the RCPs 30 minutes into the event, at which time pressurizer spray is no longer available. The pressurizer PORVs are used to limit pressurizer pressure.

Results of the analysis show the pressurizer pressure and level quickly drop until the MSIVs are closed and control is taken of AFW flow. Pressurizer pressure and level then increase as the RCS heats up. The indicated pressurizer water level initially goes off-scale low, but is restored to greater then 20% at 1780 seconds after the initiation of the event. The indicated SG water level is maintained between 22% and 100% after the initiation of AFW flow. Two hours into the event, the centrifugal charging pumps and excess letdown are available allowing boration to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shut down conditions.

Enclosure NOC-AE-12002838 Page 13 of 28 Table B Sequence of Events For Spurious Opening of One Bank of Steam Dump Valves Occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One bank of steam dump valves spuriously open Spurious 10 Turbine Trip On Reactor Trip 13.5 Feedwater Isolation Low Tavg 33.9 AFW flow initiated Low SG level 41.4 SI initiated Low Pressurizer pressure 103 Letdown isolated On SI Signal 103 MSIV closure Low steam line pressure 278 Close Pressurizer PORV Block Valves Manual 610 Operators control AFW flow Manual 610 Secure centrifugal charging pumps Manual 610 Unblock pressurizer PORVs Manual 1210 Pressurizer level >20% 1790 Secure RCPs Manual 1810 Charging and excess letdown available for boration Manual 7210

Enclosure NOC-AE- 12002838 Page 14 of 28 Figure 1 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 80.0 70.0 60.0 o 50.0

.) 40.0

" 30.0 20.0 10.0 0.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Figure 2 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 0-0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Enclosure NOC-AE- 12002838 Page 15 of 28 Figure 3 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI 600.0 590.0 580.0 570.0 i-l 560.0 0

S* 550.0

" 540.0 530.0 0

0 520.0 510.0 500.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Figure 4 Fire Hazard - Spurious 1 Bank Steam Dump Valves Open 25/04/12 12:56:02 RETRAN-02-MOD005.2.1 05/05/05 EPRI bu.U 60.0 -

z 50.0 0

0) 0 40.0 U,

V a

a 30.0_____ _____

0 0

20.0 -

10.0 0.0 4 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Enclosure NOC-AE-12002838 Page 16 of 28 Case 2: Spurious Opening of One Pressurizer PORV Occurring at Time of Reactor Trip The analysis of a spurious opening of one pressurizer PORV occurring at the time of reactor trip assumes the plant is at steady state conditions for 10 seconds prior to the event. A sequence of events is provided in Table C and plots of selected parameters versus time are presented in Figures 5 through 8. Only results for Loop 1 are presented due to the symmetrical nature of the event.

The reactor trip results in a feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The spurious opening of one pressurizer PORV continues the depressurization of the RCS resulting in a SI signal when the low pressurizer pressure setpoint is reached. The SI signal results in letdown isolation and starts the SI pumps. The introduction of SI flow into the RCS, in combination with the low RCS pressure, results in a water solid condition in the pressurizer. At this point, RCS depressurization is terminated as shown on Figure 6A. A steady state RCS pressure condition is then achieved based on SI flow and flow out the spuriously opened pressurizer PORV. This condition continues until the block valve for the spuriously opened pressurizer PORV is secured by operator action at the alternate shutdown station. The operator will not close the block valve to the pressurizer PORV that has not spuriously opened since the indicated pressurizer water level is off-scale high and this valve provides the means of limiting pressurizer pressure. The capacity of the operable pressurizer PORV is sufficient to relieve the SI flow and thermal expansion of the RCS fluid, ensuring the pressurizer safety valves will not lift. The operators take control of AFW flow at the alternate shutdown station 10 minutes after initiation of the transient to maintain indicated SG water level. The RCPs are secured within 30 minutes into the event.

Excess letdown is placed in service two hours into the event to restore indicated pressurizer water level.

Results of the analysis show that the spuriously opened PORV results in a rapid decrease in pressurizer pressure and initiation of SI flow. The SI flow results in a water solid pressurizer and water relief through the pressurizer PORV. The pressurizer PORV has sufficient capacity to ensure pressure does not increase to the pressurizer safety setpoint. Operators maintain the indicated SG water level between 22% and 100% after the initiation of AFW flow from the alternate shutdown station. The operators are able to maintain plant conditions until excess letdown is placed in service and the indicated pressurizer water level returns to the indicating range. After indicated pressurizer level is restored, charging flow can be used to borate the RCS to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shut down conditions.

Enclosure NOC-AE-12002838 Page 17 of 28 Table C Sequence of Events for a Spurious Opening of One Pressurizer PORV Occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One pressurizer PORV fails open Spurious 10 Turbine Trip On Reactor Trip 13.5 Feedwater Isolation Low Tavg 34.6 AFW flow initiated Low SG Level 36.5 SI initiated Low pressurizer 48.5 Pressure Letdown isolated On SI Signal 48.5 Pressurizer level off-scale high 410 Pressurizer water solid 524 Close block valve to spuriously opened PORV. Second Manual 610 PORV block valve left open.

Secure centrifugal charging pumps Manual 610 Operators control AFW flow Manual 610 MSIV closure Manual 615 Secure RCPs Manual 1810 Initiate excess letdown. Charging available for boration Manual 7210 Pressurizer level < 100% 16928

Enclosure NOC-AE-12002838 Page 18 of 28 Figure 5 Fire Hazard - Spurious Pzr PORV Open 25/04/12 13:06:49 RETRAN-02-MOD005.2.1 05/05/05 EPRI 120.00 100.00 80.00--

60. 0--

40. 0

-ý 20.00--

0.0o 4-0.0 2000.0 4000.0 6000.0 8000.0 10000.0 12000.0 14000.0 16000.0 18000.0 Transient Time (Sec)

Figure 6 Fire Hazard - Spurious Pzr PORV Open 25/04/12 13:06:49 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2500 '.0 2300 .0 2100 .0 "a 1900 .0 17000.0 1500 .0 13000.0 11000.0 90000.0 0.0 2000.0 4000.0 6000.0 8000.0 10000.0 12000.0 14000.0 16000.0 18000.0 Transient Time (Sec)

Enclosure NOC-AE-12002838 Page 19 of 28 Figure 6A Fire Hazard - Spurious Pzr PORV Open 25/04/12 13:06:49 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2500.0 2300.0 2100.0

" 1900.0 1700.0 24 1500.0 1300.0 1100.0 900.0 0.0 100.0 200.0 300.0 400.0 500.0 600.0 700.0 800.0 900.0 1000.0 Transient Time (Sec)

Enclosure NOC-AE- 12002838 Page 20 of 28 Figure 7 Fire Hazard - Spurious Pzr PORV Open 25/04/12 13:06:49 RETRAN-02-MOD005.2.1 05/05/05 EPRI I-H 510.0 A 4 -i 0.0 2000.0 4000.0 6000.0 8000.0 10000.0 12000.0 14000.0 16000.0 18000.0 Transient Time (Sec)

Figure 8 Fire Hazard - Spurious Pzr PORV Open 25/04/12 13:06:49 RETRAN-02-MOD005.2.1 05/05/05 EPRI 70.0 i ~ i i 60.0 z

50.0 T---- --

40.0 30.0 J I

20.0- +/-

-C

-C 10.0- 1 4

C C

0.0 0

.0 2000.0 4000.0 6000.0 8000.0 10000.0 12000.0 14000.0 16000.0 18000.0 Transient Time (Sec)

Enclosure NOC-AE-12002838 Page 21 of 28 Case 3: Spurious Opening of One Pressurizer Normal Spray Valve Occurring at Time of Reactor Trip The analysis of a spurious opening of one pressurizer spray valve occurring at the time of reactor trip assumes the plant is at steady state conditions for 10 seconds prior to the event. A sequence of events is provided in Table D and plots of selected parameters versus time are presented in Figures 9 through 12. Only results for Loop 1 are presented due to the symmetrical nature of the event.

The reactor trip results in a feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The spurious opening of one pressurizer spray valve results in depressurization of the RCS causing a SI signal when the low pressurizer pressure setpoint is reached. The SI signal results in letdown isolation and starts the SI pumps. The RCS depressurization continues until control of AFW flow is taken at the alternate shutdown station by the operator. After control of AFW flow is taken, RCS temperature and pressurizer water level start to increase and in combination with the SI flow causes the indicated pressurizer water level to go off-scale high and the pressurizer to go water solid. The operator reopens the pressurizer PORV block valves 20 minutes into the event for pressure control. [Note that the pressurizer PORV block valves are shut within 10 minutes at the alternate shutdown station to mitigate a spurious actuation of a PORV]. Operators secure the RCPs 30 minutes into the event, which stops the spray to the pressurizer and results in an increase in pressurizer pressure due to the expansion of RCS fluid in the hot leg. However, the pressurizer pressure never exceeds the pressurizer PORV lift setpoint.

Results of the analysis show that the spuriously opened pressurizer spray valve results in a rapid decrease in pressurizer pressure and initiation of SI flow. The SI flow in combination with the heating of the RCS after AFW flow is reduced results in a water solid pressurizer. Pressure increases again when the operators secure the RCPs, but pressure remains below the pressurizer PORV lift setpoint. The indicated SG water level remains between 22% and 100% after AFW flow is initiated. The operators are able to maintain plant conditions until excess letdown is placed in service and the indicated pressurizer water level is restored to the indicating range.

After the indicated pressurizer level is restored, charging flow can be used to borate the RCS to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shutdown conditions.

Enclosure NOC-AE-12002838 Page 22 of 28 Table D Sequence of Events for a Spurious Opening of One Pressurizer Normal Spray Valve Occurring at Time of Reactor Trip Event Signal Time (see)

Reactor Trip Manual 10 One pressurizer normal spray Spurious action 10 valve fails open Turbine Trip On reactor Trip 13.5 FW Isolation Low Tavg 34.8 AFW flow initiated Low SG level 36.7 SI initiated Low Pressurizer Pressure 151 Letdown isolated On SI Signal 151 Secure centrifugal charging Manual 610

_pumps Operators close pressurizer Manual 610 PORV block valves Operators control AFW flow Manual 610 MSIV closure Manual 615.

Pressurizer level off-scale high 992 Pressurizer water solid 1190 Open PORV Block valves Manual 1210 Secure RCPs Manual 1810 Initiate excess letdown. Manual 7210 Charging available for boration Pressurizer level <100% 10216

Enclosure NOC-AE-12002838 Page 23 of 28 Figure 9 Fire Hazard - Spurious Pzr Normal Spray Open 25/04/12 13:07:34 RETRAN-02-MOD005.2.1 05/05/05 EPRI E

0o C,

Q-0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 9000.0 10000.0 11000.0 Transient Time (Sec)

Figure 10 Fire Hazard - Spurious Pzr Normal Spray Open 25/04/12 13:07:34 RETRAN-02-MOD005.2.1 05/05/05 EPRI 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 9000.0 10000.0 11000.0 Transient Time (Sec)

Enclosure NOC-AE- 12002838 Page 24 of 28 Figure 11 Fire Hazard - Spurious Pzr Normal Spray Open 25/04/12 13:07:34 RETRAN-02-MOD005.2.1 05/05/05 EPRI nnn n 590.0 - -.. .. . .. . ...... .. ..... . . . .. .. ..

585.0- -__ ___ ___ ____ ___

580.0 V7 0,

575.0 ---.... --- .-. - . -------

I-570.0 0

565.0 -

560.0 -

555.0 550.0--

545.03 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 9000.0 10000.0 11000.0 Transient Time (See)

Figure 12 Fire Hazard - Spurious Pzr Normal Spray Open 25/04/12 13:07:34 RETRAN-02-MOD005.2.1 05105/05 EPRI 80.0 70.0 60.0 U,

z

-P 50.0 I NI 40.0 S30.0 v

20.0 10.0 0.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 9000.0 10000.0 11000.0 Transient Time (See)

Enclosure NOC-AE- 12002838 Page 25 of 28 Case 4: Spurious Opening of One FWRV Occurring at Time of Reactor Trip The analysis of a spurious opening of the one FWRV occurring at the time of reactor trip assumes the plant is at steady state conditions for 10 seconds prior to the event. At the time of reactor trip, the FWRV associated with RCS Loop 1 spuriously opens fully. A sequence of events is provided in Table E and plots of selected parameters versus time are presented in Figures 13 through 16. Due to the asymmetric nature of the transient, results are plotted for the RCS loop with the spuriously fully opened FWRV (Loop 1) and for a RCS loop without a spuriously fully opened FWRV (Loop 2). Results for Loops 3 and 4 are the same as for Loop 2.

The reactor trip results in feedwater isolation due to a low Tavg signal. AFW flow is then initiated on a low SG water level signal due to the turbine trip. The feedwater isolation terminates feedwater flow from all SGs and mitigates the effects of the spuriously opened FWRV. The additional cooling and depressurization of the RCS due to the spuriously opened Loop 1 FWRV in conjunction with the AFW flow results in a SI signal due to low pressurizer pressure. The SI signal results in letdown isolation and starting the SI pumps. The RCS cooling and depressurization continue until the operator takes control of AFW flow at the alternate shutdown station. The RCS pressure does not decrease below the shutoff head of the high head SI pumps. Therefore, SI flow injection into the RCS does not occur.

RCS temperature and pressure rise after the AFW flow is reduced until the saturation pressure in the SG reaches the SG PORV setpoint. The RCS temperature and pressure continues to rise due to the thermal expansion of RCS hot leg fluid when operators secure the RCPs 30 minutes into the event. The indicated pressurizer water level and SG water level remain on scale throughout the event.

Results of the analysis show that the indicated SG water level in the loop with the spuriously opened FWRV will be higher than otherwise expected, but will remain on-scale. Operators will be able to control both pressurizer and SG water level within the indicating range throughout the event. Operators will be able to maintain plant conditions until excess letdown and charging can be placed in service, at which time the RCS can be borated to cold shutdown conditions. After satisfying boron requirements for cold shutdown conditions, the plant can start a cool down to cold shutdown conditions.

Enclosure NOC-AE-12002838 Page 26 of 28 Table E Sequence of Events for a Spurious opening of one FWRV occurring at Time of Reactor Trip Event Signal Time (sec)

Reactor Trip Manual 10 One FWRV fails open Spurious action 10 Turbine Trip On reactor Trip 13.5 FW Isolation Low Tavg 34.0 AFW flow initiated Low SG level 36.1 SI initiated Low Pressurizer Pressure 541 Letdown isolated On SI Signal 541 Secure centrifugal charging Manual 610

_pumps Close PORV block valves Manual 610 Operators control AFW flow Manual 610 MSIV closure Manual 615 Open PORV Block valves Manual 1210 Secure RCPs Manual 1810 Initiate excess letdown. Manual 7210 Charging available for boration

Enclosure NOC-AE-12002838 Page 27 of 28 Figure 13 Fire Hazard - Spurious FW Reg Valve Open 25/04/12 13:07:16 RETRAN-02-MOD005.2.1 05/05/05 EPRI 60.0 50.0 40.0 30.0 01.

20.0

____________i ____________

10.0 0.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Figure 14 Fire Hazard - Spurious FW Reg Valve Open 25/04/12 13:07:16 RETRAN-02-MOD005.2.1 05/05/05 EPRI 2300.0-2200.0-

'A W

L 2100.0--_ __ _ _ _ __ _ _____ __ _ _ __ _ _ _ __ _ _ _ _ _ _ _

1900.0 I

\4 1800.0 -I -I l~

0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Enclosure NOC-AE-12002838 Page 28 of 28 Figure 15 Fire Hazard - Spurious FW Reg Valve Open 25/04/12 13:07:16 RETRAN-02-MOD005.2.1 05/05/05 EPRI 595.0 590.0 LOOP 1 585.0 580.0 575.0 I-f_____________________A _________

- 570.0 0

0 565.0 560.0 555.0 550.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)

Figure 16 Fire Hazard - Spurious FW Reg Valve Open 25/04/12 13:07:16 RETRAN-02-MOD005.2.1 05/05/05 EPRI 100. 0

90. 0 80.0

" 70. 0 Z

' 60.0 C 50. 0 u* 40. 0 40.

o0 30. 0

-J 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 Transient Time (Sec)