NRC 2006-0049, Supplement to Response to NRC Request for Information Relating to Event Notification 42129

Supplement to Response to NRC Request for Information Relating to Event Notification 42129

ML061420158
Person / Time
Site:	Point Beach
Issue date:	05/12/2006
From:	Koehl D Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NRC 2006-0049
Download: ML061420158 (20)

Text

Com~mitedto Nud rM .Point Beach Nuclear Plant Operated by Nuclear Management Company, LLC May 12, 2006 NRC 2006-0049 10 CFR 50.46(b)(5)

U.S. Nuclear Regulatory Commission ATTN: Document Control Desk 11555 Rockville Pike Rockville, MD 20852 Point Beach Nuclear Plant, Units 1 and 2 Dockets 50-266 and 50-301 License Nos. DPR-24 and DPR-27 Supplement to Response to NRC Request for Information Relating to Event Notification 42129

References:

1. NRC Request for Additional Information (RAI) dated January 10, 2006, Regarding Event Notification 42129 (TAC Nos. MC9035 & MC9036)

2. NMC to NRC letter dated February 16, 2006 (NRC 2006-0009)

3. NMC / NRC Telephone Conference Held on April 11, 2006

4. NMC to NRC letter dated April 28, 2006 (NRC 2006-0038)

On November 8, 2005, Nuclear Management Company, LLC (NMC) notified the NRC staff in accordance with 10 CFR 50.72 that the design basis for long-term cooling at the Point Beach Nuclear Plant Units 1 and 2 (PBNP), was not correctly modeled. This notification stated that, "These errors in the modeling fidelity potentially impact the analytical basis for demonstrating compliance with the acceptance criteria of 10 CFR 46(b)(5), Long-term Cooling."

Via Reference (1), the Nuclear Regulatory Commission (NRC) requested additional information to enable NRC staff review of this event. The Nuclear Management Company, LLC (NMC) response to this request for additional information was submitted via Reference (2). Subsequent to this submittal, on March 16, 2006, NMC identified that under certain low or degraded voltage conditions, the solenoid-operated valves within the control circuits for the containment sump recirculation valves (1&2SI-850A&B) might not have sufficient voltage to operate under low or degraded 480 V motor control center (MCC) conditions.

As a result of that discovery, a telephone conference was held on April 11, 2006, between representatives of NMC and NRC. During that telephone conference, NMC stated the response (Reference 2) would be reviewed and it would be determined if a supplement to the response should be submitted. Reference (4) confirmed the verbal commitment made by NMC during the April 11, 2006, telephone conference.

6610 Nuclear Road

• Two Rivers, Wisconsin 54241-9516 Telephone: 920.755.2321

Document Control Desk Page 2 provides a supplement to the NMC response to Event Notification 42129 (Reference 2). Consistent with NMC's response via Reference (2), Enclosure 2 provides Operability Recommendation (OPR)-179.

Summary of Commitments There are no new commitments or revisions to existing commitments contained in this letter.

Dennis L. Koehl Site Vice-President, Point Beach Nuclear Plant Nuclear Management Company, LLC Enclosures (2) cc: Regional Administrator, Region IlIl, USNRC Project Manager, Point Beach Nuclear Plant, USNRC Resident Inspector, Point Beach Nuclear Plant, USNRC

a ENCLOSURE I Supplement to Response to NRC Request for Information Relating to Event Notification 42129

Background

On November 8, 2005, Nuclear Management Company, LLC (NMC) notified the NRC staff in accordance with 10 CFR 50.72 that the design basis for long-term cooling at the Point Beach Nuclear Plant Units 1 and 2 (PBNP), was not correctly modeled. This notification stated that, "These errors in the modeling fidelity potentially impact the analytical basis for demonstrating compliance with the acceptance criteria of 10 CFR 46(b)(5), Long-term Cooling."

Via Reference (1), the Nuclear Regulatory Commission (NRC) requested additional information to enable NRC staff review of this event. The Nuclear Management Company, LLC (NMC) response to this request for additional information was submitted via Reference (2). Subsequent to this submittal, on March 16, 2006, a review of draft Calculation 2005-0008, "Minimum Voltage Requirements for Safety Related MCC (Motor Control Center) Control Circuits," disclosed that solenoid-operated valves (SOVs) within the control circuits for containment sump recirculation valves 1&2SI-850A&B may not have sufficient voltage to operate under low or degraded voltage conditions. The calculation evaluates the minimum voltage required for the starters, contactors and auxiliary devices in the MCC 120 V ac control circuit to ensure that the circuits will function during a degraded voltage condition. The calculation is currently undergoing comment incorporation and has not yet been approved.

The postulated scenario during which this condition could occur is a design basis loss-of-coolant accident (LOCA) has occurred. There is no loss-of-offsite power but there is a coincident low or degraded voltage condition that has not degraded to the point of actuation of the degraded voltage relays. A subsequent passive leak has occurred which requires the closure of an Sl-850A or B containment sump isolation valve in order to isolate the leak.

The calculation indicated that the minimum 480 V MCC voltage needed to operate the SOVs ranges from 450 to 460 V to satisfy the 120 V ac control circuit minimum voltage requirements. This voltage was based upon the SOVs requiring 115 V +5% per the manufacturer. At degraded voltage conditions, the minimum 480 V MCC voltage that would be available ranges between 422 V and 427 V.

As a result of the discovery and lack of adequate technical data available for these SOVs, it was determined that remote operation of the SOVs from the control room to open or close these valves might not be available under low or degraded voltage conditions. A corrective action program document was initiated to document this discovery; and an operability recommendation (OPR) was subsequently performed.

A corrective action program document had previously been initiated to identify the design basis technical data for the SOVs and to obtain this data from the manufacturer Page 1 of 5

or to perform testing of a spare SOV set. Testing of a plant spare set was conducted on January 26, 2006. Shop tests were conducted with the solenoids oriented as installed in the field. The testing revealed that the SOVs operated well down into a range where they would function under low or degraded voltage conditions. NMC recognized, however, that the testing of a single spare SOV set could not be credited, nor could the design basis capability of the installed SOVs be confirmed given that the testing could not be performed under accident conditions.

An order of magnitude estimate of core damage was performed. For the open safety function of the containment sump recirculation valves, the estimate of core damage frequency (CDF) (initiating event frequency

• probability of degraded voltage condition

• probability of failing to manually open the valve as provided for in existing, approved emergency operating procedure), was determined to be approximately E-8. The CDF associated with the closed safety function of these valves was considerably lower when the probability of a passive leak was incorporated.

The following discussion supplements the NMC response of February 16, 2006, to Event Notification 42129.

1. General A. Provide a discussion of actions taken to demonstrate the ability to establish and maintain long-term cooling in accordance with 10 CFR 50.46(b)(5).

NMC Response: This discussion supplements the chronological discussion of OPRs that have been prepared associated with this event.

OPR-1 79: The OPR concluded that the safety function of the 1&2SI-850A&B valves to open and close is maintained either by using existing, approved procedures or by using compensatory measures. Therefore, the identified condition is operable but nonconforming with the license basis because the license basis states that the valves are capable of remote operation from the control room at the minimum voltage requirements.

Compensatory measures are not required for the safety function of 1&2SI-850A&B to open to ensure long-term emergency core cooling via containment sump recirculation. Existing, approved Emergency Operating Procedures EOP-1.3, "Transfer to Containment Sump Recirculation - Low Head Injection," Step 17, and EOP-1.4, 'Transfer to Containment Sump Recirculation - High Head Injection," Step 16 would be used to locally open the valves using hydraulic pumps. The local manual operation of the valves is directed by procedure only if the valves fail to respond from the remote switch in the control room. It is expected that the environment at the location to locally open the valve (Pipeway #2 and Pipeway #3) is within acceptable radiation limits because containment sump recirculation has not been placed into service.

Page 2 of 5

Compensatory measures are required for the safety function of 1&2SI-850A&B to close to isolate a passive failure of a line outside of containment to ensure long-term core cooling via the opposite train. If 480 V system voltages are less than normal but above the degraded grid relay setpoint (below approximately 460 V), the operation of these valves may not be available from the control room as described in the licensing basis.

Although identified as compensatory measures, all of the below described actions are specified in existing, approved procedures.

If attempts to close the valves remotely from the control room fail, the options available to the operators are:

• If primary auxiliary building (PAB) radiation levels are acceptable, locally close the appropriate valve using the guidance provided in EOP-1.3 Step 17 and EOP-1.4 Step 16. Operators are trained to manually perform this task.

• If associated 480 V safeguards switchgear (B-03 or B-04) voltage is

<460 V, the following options can be performed to restore voltage:

o Remove non-essential loads and/or shift loads from the designated 480 V safeguards switchgear or 480 V safeguards MCC. Guidance is provided for manipulation of this equipment in approved, routine system operating procedures and is within the skill and knowledge of the operators.

o Contact the transmission company and request that 345 kV system voltages to be increased until 480 V safeguards switchgear voltage recovers to greater than 460 V. Guidance for contacting the transmission company is provided in an approved plant administrative procedure.

o Manually separate from the offsite power source and connect the associated emergency diesel generator (EDG) to the safeguards bus. Guidance is provided in approved standard operating procedures (SOPs) for three of the four EDGs (G-01, G-03 and G-04). Guidance is provided in approved abnormal operating procedure (AOP)-0.1 for EDG G-02.

Temporary information tags have been affixed to the affected main control boards near valves I &2SI-850A&B to alert the operators of this potential condition and direct their follow-on actions should the valves not be capable of being remotely operated to close when called upon to do so.

B. Have you completed a 10 CFR 50.59 evaluation of compensatory measures (e.g., ECCS flow reduction taken as part of your OPR's? If so, provide a copy of those evaluations. If not, please explain why.

NMC Response: Each procedure identified above that is credited as a potential compensatory measure was individually reviewed for applicability of 10 CFR 50.59 as part of the routine procedure revision and approval process.

Records of these reviews are maintained at PBNP as part of the procedure Page 3of5

history record. However, during discussions with representatives of the NRC, it was not immediately recognized that the overall 10 CFR 50.59 impacts of the compensatory measures was not assessed, even though each of these measures is contained in an approved plant procedure. As a result of this recognition, a corrective action program document was initiated. An apparent cause evaluation is being performed, which is currently scheduled for completion by May 31, 2006. This issue will be resolved within the plant's corrective action program.

C. Provide a detailed discussion including planned actions and schedule for resolution of any nonconformances with the current licensing basis or degraded conditions.

NMC Response: An "Operable But Degraded/Nonconforming Corrective Action Plan" has been developed. Per the current plan, SOVs within the control circuits for 1&2SI-850A&B will be replaced. Engineering of the design and installation of the new SOVs will be performed on a schedule commensurate with the safety significance of the change and in consideration of the plant conditions required to implement the change.

4. 850 Valves NMC Response: NMC has reviewed responses to Questions 4.A through 4.E as contained in Reference (2). Responses to Questions 4.F and 4.G are not within the scope of the information presented in this supplement. NMC has also determined that supplemental responses to Questions 4.A through 4.D are not required as the safety functions of the containment sump recirculation isolation valves have not changed for either the open or close function. NMC review, however, has concluded that the failure of an SI-850 valve to remotely operate from the control room during a minimum or degraded voltage condition impacts the following paragraph contained on Page 47 of Reference (2) at the end of the discussion of Question 4.E; which states:

Therefore, based on a review of the current licensing basis and design basis of PBNP, local operator action is not necessary to open/shut the containment sump suction valves post-LOCA. This is because they are remote-operated valves and a single failure on one recirculation train will not prevent the other train from performing its design function ..."

Page 4 of 5

Based upon the approved operability recommendation discussed in this supplement, the above paragraph is revised as follows:

"Therefore, based on a review of the current licensing basis and design basis of PBNP, local operator action is not necessary to open/shut the containment sump suction valves post-LOCA, unless these valves must be manipulated concurrent with a low or degraded voltage condition that prevents remote operation from the control room.

The safety function of the containment sump recirculation valves to open continues to be maintained, without compensatory measures. The safety function is maintained by performing local, manual operation of the valves, using approved plant emergency operating procedures in the case the valves do not respond when remotely operated from the control room during a low or degraded voltage condition that may occur prior to actuation of the degraded voltage relays.

The safety function of the containment sump recirculation valves to close is to isolate a passive failure of a line outside of containment to ensure long-term emergency core cooling via the opposite train. This safety function is maintained via the implementation of compensatory measures, in the form of using approved plant operating procedures and administrative procedures which ensure continued operability of the valves.

Therefore, during the period of time until the SOVs for the containment sump recirculation valves can be replaced in a timeframe and schedule commensurate with the safety significance of this condition, the containment sump recirculation valves are considered to be operable but nonconforming with their design and license basis in that a potential common mode failure mechanism exists such that neither containment sump recirculation valve may be capable of being remotely operated from the control room.

5. ECCS Leakage There are no changes to the response provided by NMC in Reference (2) that are affected by the condition reported in this submittal. OPR-179 is provided as Enclosure 2. OPR-179 provides additional information associated with the detection, investigation and mitigation of a passive leakage outside of containment.

There would be approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> for operators to ensure that the containment sump recirculation valves could be closed. This is more than ample time for the actions described in the OPR to be performed in a controlled manner using existing, approved procedures.

Page 5 of 5

ENCLOSURE 2 Operability Recommendation (OPR)-179 11 Pages Follow

i I QF-1100 Rev2 (FP-OP-OL-01)

Page 1of11 CAP: 071048 4j"'

OPR: 000179 , 05 Rev.:° F .

SSC affected by condition: ISI-850A, ISI-850B, 2SI-850A and 2SI-850B (RHR PUMP SUMP B SUCTION)

Identify the overall scope of the condition that calls OPERABILITY Into question.

Calculation 2005-0008 "Minimum Voltage Requirements for Safety Related MCC Control Circuits" is being performed under the Calculation Upgrade Project. This calculation was prepared to evaluate the minimum voltage required for the starters / contactors and Auxiliary Devices in the MCC 120V control circuits to ensure they will function from normal grid voltage down to a degraded voltage condition. The calculation is not yet approved by PBNP, but has been prepared / reviewed by S&L and PBNP owner's acceptance technical review has been completed.

The results of the calculation show that solenoid valves within the control circuits for lSI-850A, lSI-850B, 2SI-850A and 2SI-850B "RHR Pump Sump B Suction" will not have sufficient voltage to operate near degraded voltage conditions and fail the acceptance criteria within the calculation. The calculation shows that the minimum 480V MCC voltage needed to operate the solenoids range from 450 to 460V to satisfy the 120V control circuit minimum voltage requirements. This is based on the solenoids requiring 115V +5% per the manufacturer. At the degraded voltage grid conditions, the minimum 480V MCC voltage that would be available ranges between 422V and 427V.

The solenoid valves are required to operate to ensure ISI-850A, lSI-850B, 2SI-850A and 2SI-850B are capable of opening and closing from the control room to allow for containment sump recirculation mode of operation or to isolate a leak. Therefore, the remote operation (i.e. from control room) of the 1SI-850A, I SI-850B, 2SI-850A and 2SI-850B may not be available to open or close the valves near degraded voltage conditions. Note that these valves do not receive an automatic actuation signal, but are required to be repositioned remotely by the control room operators in response to action steps described in plant procedures.

Describe the specified safety, or safety support, function(s) of the SSC. Identify the Licensing Basis functions and performance requirements, Including Technical Specifications, FSAR, NRC Commitments, or other appropriate Information (reference SCOPE section 5.3).

FSAR 6.2 "Safety Injection" Page 6.2-1: "An emergency core cooling system with the capability for accomplishing adequate emergency core cooling shall be provided. This core cooling system and the core shall be designed to prevent fuel and clad damage that would interface with the emergency core cooling system function and to limit the clad metal-water reaction to acceptable amounts for all sizes of breaks in the reactor coolant piping up to the equivalent of a double-ended rupture of the largest pipe. The performance of such emergency core cooling system shall be evaluated conservatively in each area of uncertainty. (GDC 44)" This implies that the 1&2 SI-850A&B, RHR Pump Sump Suction Valves must be capable of operating to establish the flow-path for containment sump re-circulation.

Page 6.2-6: "After the injection phase, coolant spilled from the break and water collected from the containment spray is cooled and returned to the reactor coolant system by the residual heat removal pumps which are aligned to take suction on the containment recirculation sump. This water is pumped back to the core through the residual heat removal heat exchangers. The system is arranged to allow either or both of the residual heat removal pumps to take over the recirculation function.

The recirculation sump lines consist of two independent and redundant 10 in. lines which penetrate the containment.

Each line has one remote hydraulically-operated valve located inside containment, and one remote motor-operated valve located outside containment. Each line is run independently to the suction of a residual heat removal pump.

The 10 in. drain pipes pass through sleeves in the containment structure concrete. The sleeves are welded to the liner plate and to the drain pipe with all welds inspectable. The drains pass through a second set of sleeves between the

i i QF-1100 Rev 2 (FP-OP-OL-01)

Page 2 of 11 CAP: 071048 OPR: 0001 79 v X tendon gallery and the auxiliary building. These sleeves open into the auxiliary building. The system permits long-term recirculation in the event of a passive or active component failure."

Page 6.2-7: "Each recirculation sump line has two remotely operated valves. The first valve is located adjacent to the end of the pipe in the containment such that the line inside the containment can be isolated in the event of a passive failure. The hydraulic operator is located outside of the containment in the tendon gallery. The second valve is located in the auxiliary building such that the line outside the containment can be isolated in the event of a passive failure. The valves are designed to withstand the temperature, pressure, and radioactivity conditions occurning during a loss-of-coolant accident. The valve operators are designed for the ambient conditions of the access gallery and auxiliary building. The operators are tested to verify that they can open the valves against pressures in excess of that occurring in the containment during a loss-of-coolant accident. The passive failure of one suction line (presumably excessive packing or weld leakage) will not impair the operation of the redundant valve."

FSAR 9.2 "Residual Heat Removal" Page 9.2-1: "The residual heat removal system is designed to provide the following safety-related functions: (1) deliver borated cooling water to the reactor coolant system during the injection phase of safety injection, (2) recirculate and cool the water that is collected in the containment sump and return it to the reactor coolant system during the recirculation phase of safety injection, (3) provide the means to preclude containment leakage through the RHR system piping penetrations following accidents, and (4) for piping and components that are part of the reactor coolant pressure boundary, maintain pressure boundary integrity during all modes of plant operation."

Page 9.2-2: "The residual heat removal system is a dual purpose system. During power operation, the system is aligned to perform its low head safety injection function. As such, the system is split providing two independent trains, each containing a pump and heat exchanger. Suction and discharge valves for this function and long term sump recirculation are part of the safety injection system as described in Chapter 6."

Page 9.2-2: "RHR system operational methods preclude any significant reduction in the overall design reactor shutdown margin when the loop is brought into operation for residual heat removal, or for emergency core cooling by recirculation."

Page 9.2-4: "During the loss-of-coolant accident condition, water from the containment sump is recirculated through the outside containment piping system. Both of the lines from the containment sump to the individual residual heat removal pumps have two remotely operated isolation valves in series."

FSAR 11.6 "Shielding Systems" Page 11.6-10: "All components necessary for the operation of the external recirculation loop following a loss-of-coolant accident are capable of remote manual operation from the control room and can be powered by the emergency diesel-generators so that it should not be necessary to enter the auxiliary building in the vicinity of the recirculation loops."

FSAR 14.3.5 "Radiological Consequences of Loss of Coolant Accident" Page 14.3.5-1: "The event causing the postulated releases is a double-ended rupture of a reactor coolant pipe, with subsequent blowdown, as described in Section 14.3.4. As demonstrated by the analysis in Section 14.3.2, the emergency core cooling system, using emergency power, keeps cladding temperatures well below melting and limits zirconium - water reactions to an insignificant level, assuring that the core remains intact and in place. As a result of the increase in cladding temperature and the rapid depressurization of the core, however, some cladding failure may occur in the hottest regions of the core. For analysis purposes, the entire inventory of volatile fission products contained in the core is assumed to be released during the time the core is being flooded by the emergency core cooling system. Of this core inventory, 50% of the halogens and 100% of the noble gases are assumed to be released to the containment vessel atmosphere. Fifty (50) percent of the halogens are assumed to be released to the containment sump."

QF-1 100 Rev 2 (FP-OP-OL-01)

Page 3 of 11 NMC CAP: 071048 11 ABITRE MM 1 '11 1 1711 OPR: 000179 1I 7 11 ,1 ,1 , 42 Q1 4 1 ' 4 1 1 1 1l 111 l 1l ' 11 Page 14.3.5-2: "When Emergency Core Cooling System (ECCS) recirculation is established following the LOCA, leakage is assumed to occur from ECCS equipment located outside containment."

FSAR 14.3.6 "Reactor Vessel Head Drop Event" Page 14.3.6-1: "The containment sump screen shall be installed and the flowpath for aligning RHR pump suction to the containment sump is available."

FSAR 14.3.2 "Large Break Loss of Coolant Accident Analysis" Page 14.3.2-1: "The reactor is designed to withstand thermal effects caused by a loss-of-coolant accident including the double-ended severance of the largest reactor cooling system cold leg pipe. The reactor core and internals together with the Emergency Core Cooling System (ECCS) are designed so that the reactor can be safely shut-down and the essential heat transfer geometry of the core preserved following the accident. Long-term coolability is maintained."

Technical Specification 3.5.2 "ECCS - Operating" Requires both trains of ECCS to be operable in modes 1 through 3, which in turn requires the SI-850 valve for each train to be operable.

Technical Specification Basis 3.5.2 "ECCS - Operating" Page B 3.5.2-1 and B 3.5.2-2"The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;

b. Rod ejection accident;

c. Loss of secondary coolant accident, including uncontrolled steam release; and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are two phases of ECCS operation: injection and recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS). The residual heat removal (RHR) pumps provide RCS injection directly into the upper reactor vessel plenum via the core deluge injection lines, while the safety injection (SI) pumps provide RCS injection via the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for recirculation."

"The ECCS flow paths consist of piping, valves, heat exchangers, and pumps necessary to provide water from the RWST into the RCS during the injection phase and from the containment sump into the RCS during the recirculation phase following the accidents described in this LCO. The major components of each subsystem are the RHR pumps, heat exchangers, and the SI pumps. Each of the two subsystems consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. ECCS Train interconnections could allow utilization of components from the opposite ECCS train to achieve the required ECCS flowpaths; however, cross train operation in the recirculation mode of operation requires local valve manipulations. Based on estimated times to establish the required valve line ups, the capability of establishing ECCS recirculation mode without interrupting injection flow to the core could be impaired.

Therefore, with more than one component inoperable such that both Trains of ECCS are inoperable, the facility is in a condition outside of its design basis."

"During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the SI pumps."

V i QF-1100 Rev 2 (FP-OP-OL-01)

Page 4 of 11 CAP:071048 lll0__ Y=

OPR: 0001T9 A = _

Page B 3.5.2-4: In MODES 1, 2, and 3, an ECCS train consists of, an SI subsystem, and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path taking suction from the RWST upon an SI signal and capable of manually transferring suction to the containment sump.

Technical Specification 3.5.3 "ECCS-Shutdown" Requires one train of ECCS to be operable in mode 4, which in turn requires the SI-850 valve for the train to be operable.

Technical Specification Basis 3.5.3 "ECCS-Shutdown" Page B 3.5.3-1: The ECCS flow paths consist of piping, valves, heat exchangers, and pumps necessary to provide water from the RWST into the RCS during the injection phase and from the containment sump into the RCS during the recirculation phase following the accidents described in Bases 3.5.2.

Page B 3.5.3-2: "During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers. In the long term, this flow path may be switched to take its supply from the containment sump.

This LCO is modified by a Note that allows an RHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4."

TRM 3.9.4 "Reactor Vessel Head Lift" Page 3.9.4-2: "The containment sump screen shall be installed and the flowpath for aligning RHR pump suction to the containment sump is available."

Letter NRC 2006-0009 "NRC Request for Information Relating to Event Notification 42129" Page 40: "Open Safety Function: These normally shut, hydraulically-operated valves are located inside containment in the line leading from Sump "B" to the suction of RHR pumps. The valves perform an active safety function in the open position. The SI-850 valves must be capable of opening, by remote manual switch actuation, when transitioning from the injection mode of SI to the recirculation mode of SI. When the initial supply source of SI water from the RWST is effectively depleted following a LOCA, suction for the SI and RHR pumps is switched from the RWST to the containment sump to provide long-term core cooling. The SI-850 valves receive no automatic actuation signals to open and must be aligned from the control room using their associated control switches. They have no maximum design stroke time limits associated with the safety function in the open position and fail "as-is" on a loss of power."

Page 43: "The hydraulic units located in the PAB pipeway are environmentally qualified and would allow remote operation of the valves from the control room during the complete duration of a LOCA event requiring long-term recirculation.

Failure of either containment sump "B" isolation valve to open requires operator action to manually open the valves using a staged hydraulic hand pump. If containment sump recirculation can not be established, there is procedural guidance which directs operators to utilize contingency actions.

The SI-850A/B valves can be reopened if they move from the open position to an intermediate or shut position. The valves can be remotely opened, or the staged hand hydraulic pump can be used in accordance with established emergency operating procedures and contingency actions."

Page 46: "Dose considerations for local manual action in the PAB post-accident are described in FSAR 11.6 under auxiliary shielding. The auxiliary shielding is based on a design basis LOCA with minimum safeguards that results

QF-1 100 Rev 2 (FP-OP-OL-01)

Page 5 of 1 CAP: 071048 :A~'~~.i'<, 4~

OPR: 000179 " /

Rev.: 0 _S=

in a gap release of all of the fuel rods, as determined by the 10 CFR 50.46 evaluation presented in FSAR 14.3.2 and discussed in FSAR 14.3.5. Specifically, FSAR 11.6 states the following:

All components necessary for the operation of the external recirculation loop following a loss-of-coolant accident are capable of remote manual operation from the control room and can be powered by the emergency diesel-generators so that it should not be necessary to enter the auxiliary building in the vicinity of the recirculation loops."

Page 47: "Therefore, based on a review of the current licensing basis and design basis of PBNP, local operator action is not necessary to open/shut the containment sump suction valves post-LOCA. This is because they are remote-operated valves and a single failure on one recirculation train will not prevent the other train from performing its design function. Under the presumption of a radiological design basis LOCA (i.e., fuel melt), the location of the valve operators is not accessible due to the unshielded recirculation lines in the vicinity of the operators. However, under the presumption of a design basis LOCA that credits minimal safeguards on injection (i.e., gap release); these areas would be accessible on a limited basis if additional protective measures were taken into consideration."

Page 63: "The SI-850A(B) valves perform a safety-related function to isolate a passive failure in the containment sump recirculation line to prevent gross diversion of containment sump inventory. The SI-850A(B) valves would be shut to support the following post-accident functions following a credible leak in the containment recirculation line:

1. Maintain Sump "B" inventory; 2. Protect the RHR system and pumps from flooding The shut safety-related function is discussed in FSAR Chapter 6.2.2 where it states:

Each recirculation sump line has two remotely operated valves. The first valve is located adjacent to the end of the pipe in the containment such that the line outside the containment can be isolated in the event of a passive failure.

In accordance with 10 CFR 50.2, the ability of the SI-850A/B valves to isolate a passive failure is classified as a safety-related function. The ability of the SI-850A/B valves to isolate a passive failure supports Criteria 2 and 3 for a safety-related component. Shutting these valves to isolate a passive failure prevents the gross diversion of containment sump inventory and ensures that at least one redundant train of long-term core cooling remains operable throughout the post-accident phase. Long-term decay heat removal is essential to maintain the plant in a safe shutdown condition and to ensure offsite doses are maintained within the limits of 10 CFR 100 and control room doses are within the limits of 10 CFR 50 Appendix A, GDC-19."

FSAR 8.0 "Introduction to the Electrical Distribution Systems" Page 8.0-2 "An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single active component. (GDC 39)"

This requires all safeguards equipment shall have sufficient voltage to ensure they operate to perform their design and safety functions to avoid undue risk to the health and safety of the public. Therefore, the safety related 480V MCC control circuits need to operate throughout the acceptable voltage range until the actuation of the degraded voltage relays.

NRC Generic Letter, "Adequacy of Station Electric Distribution System Voltages", dated 8/8/1979; WE Letter to NRC (NPC-27745), dated 10/12/1979; WE Letter to NRC (NPC-27804), dated 1/17/1980; WE Letter to NRC (NPC-27966), dated 1/21/1981; WE Letter to NRC (NPC-28029), dated 6/1/1981; WE Letter to NRC (NPC-28261), dated 9/10/1982; Report UCID-19471 (NRC SE), dated 2/9/1983 The voltage at the terminals of each safety related load should be evaluated based on the assumption that the grid voltage is at the "minimum expected value." The minimum expected value should be selected based on the least of the following: a) The minimum steady state voltage experienced at the connection to the offsite circuit. b) The

QF-1100 Rev 2 (FP-OP-OL-01)

Page6of 11 CAP: 071048 ' -5 ;, L,*5 -,s ,"' ' * ,

OPR: 0001 79 ~ ~~'  ; 4~ , ,~

Rev. 0_ _

minimum voltage expected at the connection to the offsite circuit due to contingency plans which may result in reduced voltage from this grid. c) The minimum predicted grid voltage from grid stability analysis (e.g. load flow studies). As stated by PBNP, the MCC contactors would have sufficient voltage to ensure operation of safety related loads. This implies that all the auxiliary devices within the 480V MCC control circuits that are required to operate to ensure the function of the safety related loads have to be capable of operating down to the minimum voltage conditions until automatic actuation of the degraded voltage relays occur.

Conclusion:

The licensing basis functions of the 1&2 SI-850A&B, RHR Pump Sump B Suction Valves affected by the condition above are:

1. 1&2 SI-850A&B are capable of remotely operating open from the control room to establish containment sump recirculation.

2. 1&2 SI-850A&B are capable of remotely operating closed from the control room to ensure isolation of a passive failure on a line outside of containment.

3. 1&2 SI-850A&B are capable of operating open or closed under minimum voltage conditions (e.g. voltages greater than the degraded voltage relays setpoints).

The safety functions of the 1&2 SI-850A&B, RHR Pump Sump B Suction Valves affected by the condition above are:

1. 1&2 SI-850A&B are capable of opening to establish containment sump recirculation ensuring long-term emergency core cooling.

2. 1&2 SI-850A&B are capable of closing to isolate a passive failure of a line outside of containment ensuring long-term emergency core cooling.

Evaluate the effects of the condition, Including potential failure modes, on the ability of the SSC to perform Its specified safety, or safety support, function(s)

The effect of the condition described above is that valves ISI-850A, ISI-850B, 2SI-850A and 2SI-850B would not function properly from the control room when 480V system voltages are less than approximately 460V, because the voltage at the solenoids would not be sufficient per the manufacturer. Therefore, between a voltage of approximately 420V and 460V, which may be prior to actuation of the degraded voltage relays, the valves may not be capable of remote operation from the control room. The 480V system voltage may range from the safety limit of 420V to normal voltages when actuation of the degraded voltage relays occur depending on system load since the relays are on the 4.16kV system. The operators will not receive an undervoltage alarm until after the actuation of the degraded voltage relays. This could prevent the ISI-850A, 1SI-850B, 2SI-850A and 2SI-850B valves from providing a flow path to ensure emergency core cooling or isolation of a passive failure if the valves were required to be operated under minimum voltage conditions.

QF-1 100 Rev 2 (FP-OP-OL-01)

Page 7 of I 1 CAP: 071048 I OPR: 000179 ' ' ' " "',

Rev.: 0 1 1/2 Is the SSC In Its present condition capable of performing Its safety or safety support function(s)?

Explain basis.

(Use engineering analysis or engineering judgment to determine whether the design safety function can be provided given the existence of the deficiency. When using engineering judgment, provide supporting information from sources such as field walkdowns, industry experience, proven system/component performance under similar service conditions, etc.)

Open Function:

The safety function of the I SI-850A, I SI-850B, 2SI-850A and 2SI-850B valves to open is to ensure long-term emergency core cooling via containment sump recirculation. Emergency Operating Procedures EOP 1.3 Unit 1 & 2 "Transfer to Containment Sump Recirculation - Low Head Injection" step 17 and EOP-1.4 Unit 1 & 2 "Transfer to Containment Sump Recirculation - High Head Injection" step 16 provide operator guidance to locally open the valves by utilizing hydraulic pumps. The local manual operation of the valves is directed by procedure only if the valves fail to respond from the remote switch in the control room. It is expected that the environment at the location to locally open the valve (Pipeway #2 and Pipeway #3) is within acceptable radiation limits because containment sump recirculation has not been placed into service (Reference NPC-27793, section 2.1.6 "Post-Accident Control of Radiation in Systems Outside Containment").

Therefore, the safety function of the ISI-850A, lSI-850B, 2SI-850A and 2SI-850B valves to open is maintained by performing local operation of the valve in case the valve were to fail to respond from the control room. However, the condition is operable but non-conforming because the licensing basis states the valves are capable of remote operation from the control room.

Closed Function:

The safety function of the I SI-850A, lSI-850B, 2SI-850A and 2SI-850B valves to close is to isolate a passive failure of a line outside of containment to ensure core long-term emergency core cooling via the opposite train. If the 480V system voltages are less than normal but above the degraded grid relay setpoint (below approximately 460 volts), the operation of the lSI-850A, lSI-850B, 2SI-850A and 2SI-850B valves may not be available from the control room as described in the licensing basis. As discussed in the following section, compensatory measures are required to ensure the operability of the valve.

v vi QF-1100 Rev 2 (FP-OP-OL-01)

Page 8 of 11 CAP: 071048 t'? I lNMC OPR: 000179 h rj If the SSC Is not fully capable (Full Qualificafion) of performing Its safety or safety support function(s), then determine If Compensatory Measures are to be taken to restore OPERABILITY or to enhance the capability of the SSC.

(Describe the Compensatory Measures, basis for which the Compensatory Measures maintain OPERABILITY, implementation mechanism (procedure, temp mod, etc.), and under what conditions the Compensatory Measures may be terminated.)

Description of the Compensatory Measures:

Compensatory measures are required to maintain the close function of the ISI-850A, ISI-850B, 2SI-850A and 2SI-850B valves to isolate a passive failure on a line outside of containment if system voltage is insufficient.

If attempts to close the associated RHR pump suction from containment sump "B" isolation valve (SI-850A or SI-850B) fail from the control room, options are:

o If PAB radiation levels are acceptable, locally close the appropriate containment sump "B" isolation valve (SI-850A or SI-850B) (Guidance provided in EOP 1.3 Unit 1 & 2 step 17 and EOP-1.4 Unit 1&

2 step 16, Operators perform training operating the SI-850 Valves manually) o If associated 480 V Safeguards Switchgear (B-03 or B-04) voltage is less then 460 volts, then the following options can be performed to restore voltage:

o Remove non-essential load and/or shift loads from the designated 480V Safeguards Switchgear or 480V Safeguards MCC. (Guidance provided for manipulation of equipment are in routine System Operating Procedures and are within the skill and knowledge of the operators) o Contact ATC to increase 345 kV system voltage until 480V Safeguards Switchgear voltage recovers to greater than 460 volts. (Guidance provided in Procedure NP 2.1.5, Revision 6, Section 4.0) o Manually separate from the offsite power source and connect the associated emergency diesel generator to the safeguards bus. (Guidance provided in Procedures 1-SOP-4KV-001 Revision 1, Section 5.1 for G-01 and Section 5.2 for G-03; Guidance provided in Procedures 2-SOP-4KV-001 Revision 1, entire procedure for G-04; Guidance provided in Procedure AOP 0.1 Revision 10, step 6.2.7 for G-02 [See Note 1]).

Note 1: A Standard Operating Procedure does not exist for transferring from offsite to diesel generator G-02 from 2A-05. However, guidance is provided in procedure AOP-0.1 to separate from offsite power by opening the bus feeder breaker.

Basis for Compensatory Measures:

Uowta-e:

The acceptable voltage is determined at the 480V safeguards switchgear because voltage indication is provided in the control room for the 480V safeguards switchgear and is not provided for the 480V safeguards MCCs. The minimum required 480V switchgear voltage of 460 volts is based on the calculation prepared and reviewed by S&L, but not yet been approved by PBNP, which shows the minimum required MCC (1B-32,IB-42, 2B-32, and 2B-42) voltage would be approximately 456 volts. Calculation 2004-0002 Revision 0, shows that the maximum voltage drop across the cables between the 480V Safeguards Switchgear and the Safeguards MCC under worst-case accident loading is 3 volts. Therefore, a minimum voltage of 460 volts or greater will provide reasonable assurance the ISI-850A, lSI-850B, 2SI-850A and 2SI-850B valves will close remotely from the control room.

Additionally, a spare solenoid valve and assembly was tested within a controlled environment (I&C shop) under Work Order 0600414. The results showed that the solenoid valve, in the vertical position as installed in the field, would be capable of successfully operating down to a voltage of approximately 81 volts (120V Base). The test was not an in situ test and no accident environment or aging conditions were applied. The results show that the vendor specification for voltage is not an absolute voltage limit.

W i QF-1100 Rev 2 (FP-OP-OL-01)

Page 9 of 1 NMC ,

CAP: 071048 ' ' OP A LIRcoM D gQ iA, Rev.: 0 Timinz:

As discussed in Operability Recommendation OPROOO 170 revision I and Letter 2006-0009, it is reasonable to assume operations would identify a passive failure of a leak outside containment in less than approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> because there would be means of sump pump alarms in the control room in the tendon gallery and/or Facade.

However, if these alarms would fail, a leak would result in a reduction of containment sump "B" level.

During recirculation, the two safety-related redundant containment sump B level transmitters are monitored, so the control room staff would detect a gross change in the containment sump "B" level. A gross change in the containment sump "B" level caused by a 50 gpm leak would be noticed within at least one shift. This is based upon control board reviews and daily log sheets. Once a gross change in the containment sump "B" level has been observed, an immediate investigation into the source of the level change would be initiated by the control room staff.

In addition, if the tendon gallery sump pumps failed or would not function, the tendon gallery could potentially flood up to the facade floor (El. 6'-6") before the leak was detected and isolated. Filling the tendon gallery would take about 82,400 gallons of water. If the bounding leak rate of 50 gpm was located somewhere within the tendon gallery, it would take approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> to fill the tendon gallery with water to the facade floor.

OPROOO 170 states with the extremely high leak rate of 50 gpm (comparable to a design basis failure of an RHR pump seal), at least 3,400 minutes, or 57 hours6.597222e-4 days <br />0.0158 hours <br />9.424603e-5 weeks <br />2.16885e-5 months <br /> (more than 2 days) would be available to detect the leakage before it jeopardized system operation as a result of depletion of the containment sump volume.

Therefore, operations would have approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> (57 hours6.597222e-4 days <br />0.0158 hours <br />9.424603e-5 weeks <br />2.16885e-5 months <br /> - 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />) to perform the above compensatory measures, which provides sufficient time to perform the above actions in a controlled manner per current operating procedures and skill of the craft.

Implementation Mechanism:

The above compensatory measures will be placed in the Operations Notebook with Temporary Information Tags placed near the I SI-850A, I SI-850B, 2SI-850A and 2SI-850B control switches in the control room. The above compensatory measures are within the scope of current operating procedures and skill of the craft.

Under What Conditions the Compensatory Measures may be Terminated:

The compensatory measures may be removed once the condition described in CAP071048 is corrected. Options to resolve the condition will be determined in the follow on OBD action plan. It is recommended to create a Standard Operating Procedure to align G-02 to 2A-05 as provided in 1-SOP-4KV-001 and 1-SOP-4KV-001.

Conclusion:

The safety function of the ISI-850A, ISI-850B, 2SI-850A and 2SI-850B valves to open and close is maintained by performing the compensatory actions previously described. However, the condition is operable but non-conforming because the licensing basis states the valves are capable of remote operation from the control room at the minimum voltage requirements.

Eupment ro"mmenddtbe fl Operable 0 poeomb* Out Degdd blo UNononorming 11 Inopra (oifyshi f Mnager Imdae Respoible e i E Vefier: O y A' .7.s.

1:fi......00

-X..

..0is1 Ads CAoncpurren ShIft manag'erd - 7sli0iD; 3____________i_34 End Date and Time:

k. C

'hi OF- 100 Rev 2 (FP-OP-OL-01)

Page 11 of 11 CAP: 071048 K OPR: 0001 79 '~~: d' Rev.: 0 f2+7  : W, Identify references used. (Reference Name and Section (s))

FSAR Section 6.2 FSAR Section 8.0 FSAR Section 9.2 FSAR Section 11.6 FSAR Section 14.3.5 FSAR Section 14.3.6 FSAR Section 14.3.2 Technical Specification 3.5.2 Technical Specification 3.5.3 Technical Specification Basis 3.5.2 Technical Specification Basis 3.5.3 TRM Section 3.9.4 OPROO0170 Revision 1 OPROO0171 Revision 0 Calculation 2004-0002, Attachment G1 through G4 Letter NRC 2006-0009 NRC Generic Letter, "Adequacy of Station Electric Distribution System Voltages", dated 8/8/1979 WE Letter to NRC (NPC-27745)

WE Letter to NRC (NPC-27804)

WE Letter to NRC (NPC-27966)

WE Letter to NRC (NPC-28029)

WE Letter to NRC (NPC-28261)

Report UCID-19471 (NRC SE)

Letter NPC-27793 Continuation.

bcc: C. Butcher G. Salamon R. E. Grazio J. Perry (MSRC) D. L. Koehl M. Lorek D. A. Weaver (P346) G. C. Packard J. H. McCarthy L. Peterson K. Chivers C. Anderson