View source for B13223, Provides Results of ECCS Single Failure Analysis of Electrical & Air Sys.Two single-failure Vulnerabilities Re Boundary Valve Between QA Category 1 & non-QA Piping & Failure of Svc Water Pumps During LOCA Discovered

{{Adams
| number = ML20246A623
| issue date = 04/28/1989
| title = Provides Results of ECCS Single Failure Analysis of Electrical & Air Sys.Two single-failure Vulnerabilities Re Boundary Valve Between QA Category 1 & non-QA Piping & Failure of Svc Water Pumps During LOCA Discovered
| author name = Mroczka E
| author affiliation = CONNECTICUT YANKEE ATOMIC POWER CO., NORTHEAST UTILITIES
| addressee name = 
| addressee affiliation = NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
| docket = 05000213
| license number = 
| contact person = 
| document report number = B13223, NUDOCS 8905080292
| document type = CORRESPONDENCE-LETTERS, INCOMING CORRESPONDENCE, UTILITY TO NRC
| page count = 17
}}

=Text=
{{#Wiki_filter:,                                                                                                          _     _ - _ _ _ _ _ _
l e
      . tL L          N UTILITIES                                               o.nor.i Orric . . s.io n sir..i. Boriin. Connecticut wma ns c.uwisaevac ca*
                       ""*'**""""C""                                             P.O. BOX 270 HARTFORD, CONNECTICUT 06141-0270 L    L  J Z Z,7% 7,                                                 (203) 665-5000 April 28, 1989 Docket No. 50-213 B13223 ISAP Topic No. 1.117 U.S. Nuclear Regulatory Commission                                                                                         ,
Attention: Document Control Desk                                                                                           '
Washington, DC 20555 Gentlemen:
Haddam Neck Plant Results of Emergency Core Cooling System (ECCS)
Sinale Failure Analysis By letters dated May 13, 1988,(I) and May 27, 1988,(2) Connecticut Yankee Atomic Power Company (CYAPC0) informed the NRC Staff that a single failure analysis of the ECCS electrical and air systems aoug)beCYAPC0                  performed          at the Haddam Neck Plant.           By {{letter dated|date=October 28, 1988|text=letter dated October 28, 1988}},                            provided the NRC Staff with the scope of this analysis and a tentative completion date of April 1989.       The purpose of this letter is to provide the results of this single failure analysis.
1
!             Impell Corporation has performed the single failure analysis as described in l'          the {{letter dated|date=October 28, 1988|text=October 28, 1988 letter}} and has provided CYAPC0 with a report summarizing each component reviewed and how it w satisfactorily addressed. In addition, Impell Corporation provided a summary of unresolved potential single failures.
Northeast Utilities Service Company (NUSCO), on behalf of CYAPCO, has reviewed carb of these items and has addressed their single failure vulnera-bility. Each potential component failure as identified by Impell and its NUSCO evaluation is provided in Attachment 1.
Two single failure vulnerabilities were discovered and addressed as follows:
(1)   E. J. Mroczka letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Information Regarding ECCS Single Failure Analysis," dated May 13, 1988, stated that a single failure analysis of ECCS mechanical components would be completed prior to restart.                          Details of this evaluation were discussed at a meeting with the NRC Staff in our office on May 17, 1988.
(2)   E. J. Mroczka letter to U.S. Nuclear Regulatory Commission Document Control Desk, " Retraction of Proposed License Amendment," dated May 27,                                           ,
1988.
(3)   E. J. Mroczka letter to U.S. Nuclear Regulatory Commission Document Control Desk, "Information Regarding ECCS Single Failure Analysis," dated October 28, 1988.
fo0{
8905080292 890428                                                                                           / g PDR      ADOCK 05000213 P                        PDC                                                                                 ;

L U.S. Nuclear Regulatory Commissior                                                                  _
B13223/Page 2                                                                                       !
April 28, 1989                                                                                      i
: 1.              Item D.1 A boundary valve between the Quality Assurance (QA) Category i and non-QA piping, CH-V-383, which was positioned open during operation could have resulted in loss of potentially contaminated sump water during the recirculation phase of a LOCA. A procedure change and valve CH-V-383 has been closed to resolve this concern.
: 2.              Item E.2 A scenario was postulated where the failure of two service water pumps during a LOCA due to an electrical bus failure could result in insuffi-cient service water flow to the safety-related components. Modifications
                     ' installed                 as aJanuary result of a 1989, similgr) 4 scenario   reported to the g Staff   by   1 letters dated          13,           and February 10, 1989,       resolved '!
this vulnerability.
As discussed in Attachment 1, the service water and primary auxiliary building equipment operability analyses are not yet complete. CYAPC0 will submit the results of these analyses by June 30, 1989.
If you have any questions, please contact us.
                                                  ~
Very truly yours, CONNECTICUT YANKEE ATOMIC POWER COMPANY h
E. J froczka   6'
                                                                                             <t/
Senior Vice President cc:        W. T. Russell, Region I Administrator A. B. Wang, NRC Project Manager, Haddam Neck Plant J. T. Shedlosky, Senior Resident Inspector, Haddam Neck Plant (4)        D. B. Miller, Jr., letter to U.S. Nuclear Regulatory Commission Document                  ,
Control Desk, transmitting Reportable Occurrence LER 50-213/88-022-00,                    '
                             " Reduced Heat Removal Rate in Containment Air Recirculation Cooling Coils," dated January 13, 1989.
(5)         E. J. Mroczka letter to U.S. Nuclear Regulatory Commission Document Control Desk, " Proposed Revision to Technical Specifications, Containment Integrity During CAR Fan Heat Exchanger Cleaning Activities," dated February 10, 1989.

                  .       l       -
Docket No. 50-213 B13223 i
Attachment 1 Haddam Neck Plant Results of Emergency Core Cooling System (ECCS)
Single Failure Analysis i
April 1989

U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 1 April 28, 1989 Haddam Neck Plant Results of Emergency Core Cooling System (ECCS)
Sinale Failure Analysis A. Hiah-Pressure Safety In.iection (HPSI)
: 1. Issue The spurious or accidental closure of either HPSI system minimum flow . isolation valves SI-M0V-903 or SI-M0V-904 during a small-break loss. of coolant accident (LOCA) of a size that would result in reactor coolant system .(RCS) pressure remaining above the shutoff head of the HPSI pumps could result in failing both HPSI pumps.
Resolution
                                                      .By letters dated September 29, 1975,(I) and November 14, 1975,(2)
CYAPC0 submitted an ECCS single. failure analysis which considered the potential for spurious motor-operated valve (MOV) movement.
This report indicated the need for some plant and procedure modifi-cations. These modifications that CYAPC0 committed to implement consisted of (1) locking open the circuit breakers supplying power to valves SI-MOV-24 and RH-MOV-22 to ensure that they remain open during operation, (2) locking open valves SI-FCV-875 and RH-FCV-796 and isolating their air supply during operation, (3) locking closed valve RH-FCV-602 and isolating its air supply during operation, and (4) installing an ' additional throttling valve parallel to FCV-J10 and agher isolation valve parallel to CH-M0V-242. On December 19, 1975,     ~ CYAPC0 informed the NRC Staff that a Westinghouse (H)     1 analysis demonstrated that the probability of spurious movement of     i an M0V critical to ECCS operation, in conjunction with a LOCA, was extremely low and represented negligible risk to safe plant opera-tion. As su           CYAPC0 rescinded the earlier commitments. A March 18,1975g letter reaffirmed CYAPCO's position regarding the probability of spurious' movement of an MOV in the ECCS in light of (1)   D. C. Switzer letter to R. A. Purple, dated September 29, 1975.              i (2)   D. C. Switzer letter to R. A. Purple, dated November 14, 1975.
(3)   D. C. Switzer letter to R. A. Purple, dated December 19, 1975.
(4)   D. C. Switzer letter to R. A. Purple, dated March 18, 1975.

i V.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 2 April 28, 1989                                                                      i discussions between the NRC Staff and H;(5) this position maintained that the H analysis was applicable to the Haddam Neck Plant, and that it adequately and accurately addressed the extremely low           ;
probability  of spurious Mg movement in conjunction with a LOCA.
However, on June 25, 1976,      CYAPC0 agreed to implement the above-mentioned modifications in order to support expeditious review by       j the NRC Staff of the Cycle VII operation. This letter emphasized        l that CYAPC0 continued to believe that the H analytical effort remained applicable to the Haddam Neck Plant and that it adequatg addressed the issue of spurious M0V movement. The NRC Staff acknowledged the low probability of spurious valve failures and found the commitments made to be acceptable to meet the sin failure criterion for the ECCS.        Finally, on July 30,   1976,g CYAPC0 submitted technical specification changes associated with the guidelines of Branch Technical Position EICSB #18.
Based on this historical review of events, CYAPC0 has concluded that spurious valve movements are not part of the Haddam Neck licensing basis.
Thus, SI-M0V-903 and SI-MOV-904 are not single failure concerns in a regulatory sense because spurious valve movements are not part of the Haddam Neck licensing basis and need not be postulated.             i However, CYAPC0 is processing an amendment request that will require these valves to be verified open at least once per 12 hours.       Fur-ther, the probability is extremely low that either of the HPSI minimum flow recirculation valve; will spuriously or accidentally close during a small-break LOCA. Current plant-specific probabilis-     !
tic analysis techniques were used to evalusto the frequency that one of the two minimum flow isolation valves would close due to inter-      i nally initiated events and potentially result in a ccre melt. This  ,
analysis showed that tho increase in core melt frequency due to ene     '
of two minimum flow isolation valves spuriously closing was f ar less than 0.05 percent and therefore r.ot a signf ficant contributor to the overall core melt frequency due to internally initiated events. The evaluated frequency was small primarily because the probability of a (5) Documented by R. A. Purple letter to D. C. Switzer, dated February 23, 1976.
(6)   D. C. Switzer letter to A. Schwencer, dated June 25, 1976.
(7)   A. Schwencer letter to D. C. Switzer, dated June 30, 1976.
l     (8)   D. C. Switzer letter to A. Schwencer, dated July 30, 1976.

U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 3 April 28, 1989 spurious closure of one of two MOVs due to hot shorts is a rela-                         ;
tively small number and if the RCS pressure remained at a pressure above HPSI pump shutoff head, there is a reasonable probability that the charging pumps could mitigate the potential of a core melt given                     !
their availability.
: 2. Issue An MOV stem or other component failure on one of the four injection valves (SI-M0V-861A, B, C, or D) that is undetected could lead to a condition where no flow is delivered to the reactor during the short-term recirculation mode of operation. If one of the valves failed during its initial opening (upon a safety injection actuation signal) in such a manner that left the gate wedged into the valve's seat, the operators would be unaware of this condition since the main control board indication for this valve would show an open indication. (This condition should not pose a problem during the injection phase since we would assume that two HPSI pumps are operating and three injection lines would be available with flow being delivered to the reactor through at least two of these lines.)
The failure now presents itself as a preblem upon entering the short-term recirculation mode since the operator will be required to close two of the 861 valves. If the operator were to leave open the valve that has failed (unknown to him), and the valve to the line where a line break has been postulated, the plant could end up with a condition where no flow is delivered to the vessel.
Existing safety-related and environmentally qualified instruments-                       ,
tion will not provide any direct indication that the above condi-                        :
tions existed. However, Emergency Operating Procedures direct the operators to use a flow-to-RHR pump amperage correlation., and an analysis may also be able to determine expected flow rates for the various conditions.
Resolution l
This type of valve faige (i.e.,   gate-stem separation) is consid-The Haddam Neck Plant was designed to l             ered a passive failure.
(9)   SECY-77-439, dated August 17, 1977, discusses this type of failure and states the on the basis of the licensing review experience accumulated in I        the period since 1969, it has been judged in most instances that the                          <
l        probability of most types of passive failures in fluid systems is sufficiently small that they need not be assumed in addition to the l
(Footnote Continued) l l                                                                                    _ _ _ _ _ -

l i
1 U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 4 April 28, 1989 withstand an " active" failure during either the injection or recir-culation phase of a LOCA as was discussed in the original Facility Description and Safety Analysis (FgA) and the safety evaluation for the full-term operating license.        In addition, a single (ipyf ilure !
and analysis was submitted to the NRC Stgff) on May 19, 1972, supplemented on September 29, 1975,           which        not address passive failures. By {{letter dated|date=June 30, 1976|text=letter dated June 30,1976}},g the NRC Staff approved this analysis.
Thus, SI-MOV-861A, B, C, and D are not single failure concerns in a regulatory sense because passive failures are not part of 'he Haddam Neck licensing basis and need not be postulated.
Further, CYAPC0 has concluded that although the accident scenario is possiole, the probability of this scenario is of such a low value that when compared to other accident scenarios, the event is of relatively low safety significance. Current plant-specific probabi-listic analyses have revealed that the frequency of the above-described accident scenario represents far less than 0.5 percent of the core melt frequency due to internally initiated events.
: 3. Issue Loss of valve position indication by itself could cause ECCS degra-dation in the short-term recirculation mode. If one of the injec-tion valves was closed (unknown), the operator could close valves in the two intact lines with the fourth line being the one that is           I failed. The net result is no flow into the vessel.                        j If a valve failed open (unknown) and the operator thought it was          l closed and closed any one of the other injection line valves, the         j (Footnote Continued) initihting failure in application of the single failure criterion to assure safety of a nuclear power plant. In the rare instances where a passive failure is assumed to occur, it is postulated 24 hours into the accident.
(10) Supplement to the Safety Evaluation, Section 4, ECCS of R. A. Purple letter to D. C. Switzer, dated December 27,         1974, transmitting the "Haddam Neck Plant Full-Term Operating License."
(11) D. C. Switzer letter to D. J. Skovolt, dated May 19, 1972.
(12) D. C. Switzer letter to R. A. Purple, dated September 29, 1975.
(13) A. Schwencer letter to D. C. Switzer, dated June 30, 1976.

4 U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 5 April 28, 1989 HPSI and/or residual heat removal (RHR) pump could run out and possibly have cavitation problems.
Resolution The limit switch is attached to the valve stem and shows the actual         !
position of the valve. Thus, it would be impossible to have valve       i position indication at the main control board that was exactly              I opposite to the actual valve posit'on without disc / stem failure           '
(di.sc/ stem failure a- discussed previously is considered a passive failure and not postulated at the Haddam Neck Plant). Feilure of position status lights at the main control board would be corrected by the operator with new bulbs. Thus, loss of position indication is not a single failure concern.
B.          Low-Pressure Safety Iniection (LPSI)
: 1. Issue The spurious or accidental        opening of the containment      spray valves RH-MOV-23 or RH-M0V-34 during LPSI pump injection would result in a reduction in core deluge flow.
Resolution CYAPC0haspreviouslyaddressedthesgiousopeningofthesevalves prior to plant restart in May 1988           At this time CYAPC0 con-cluded that the spurious opening of these valves, RH-M0V-23 and RH-MOV-24, would not be a concern from a regulatory standpoint since spurious valve movements are not part of the Haddam Neck Plant licensing basis and need not be postulated.
C.        Residual H9at Removal
: 1. Issue As was the case during LPSI pump injection, opening of the contain-ment spray valves RH-MOV-23 or RH-MOV-34 during either short- or (14) E. J. Mroczka letter to            U.S. Nuclear Regulatory Commission Document Control Desk, "Information Regarding ECCS Single Failure Analysis," dated May 13, 1988, stated that a single failure analysis of ECCS mechanical components would be completed prior to restart.                Details of this evaluation were discussed at a meeting with the NRC Staff in our office on May 17, 1988.                                                                       l
                                                                                                      )
l
__           - - -                                                                                  I

U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 6 April 28,1989 long-term recirculation would result in a loss or significant decrease in both flow to the vessel and net positive suction head                             ,
(NPSH) to the RHR, HPSI. and charging pumps during their respective                           l modes of operation.                                                                           '
Resolution These valves are again n)t single failure concerns in the regulatory sense for the same reason es provided for Item B.1,
: 2. Issue The   component cooling water (CCW)        surge tank relief valve (CC-RV-777) discharges to the containment sump suction line through check valve CC-CV-802. According to the ground rules established for this review, may be assumed.(ygakage        past tank The surge   the check reliefvalve during valve      recirculation is not   safety-related, and leakage could reach the CCW system.
Resolution Although CC-RV-777 is not safety-related, leakage through the relief valve should not occur because this valve should not be opened; that is, the back-pressure resulting from leakage around the check valve will help ensure that the relief valve remains closed.       A passive failure (e.g. , heat exchanger tube break) would be necessary to pressurize the CCW system to cause a challenge to the relief valve.
Thus, CC-RV-777 is not a single failure concern since this type of passivt failure need not be postulated.
: 3. Issue The reactor containment sump level transmitters (LT-1810A and B)                              )
which are used to signti switchover frcm the LOCA injectico to recirculation modes of operation do not appear to be safety-related; Impell Corporation considered any component not listed in the Haddam                          )
Neck Plant Material,      Equipment,   and Parts List    (MEPL)   to be nonsafety-related.
(15) E. J. Mroczka letter to                       U.S. Nuclear Regulatory Commission Document                            i Control Desk, "Information Regarding ECCS Single Failure Analysis," dated                           j October 28, 1988.                                                                                   1
  -____-__m_      _ _ _ . _ . . _ _ _        _

i 1
l                     .
                                                                                                            \
i U.S. Nuclear Regulatory Commission                                                ,
l                         B13223/ Attachment 1/Page 7                                                       '
l April 28, 1989 i
Resolution The procedure for switchover to sump recirculation postaccident has been reviewed and determined that although the operator             is instructed to check sump level using these instruments, the readout is not nsed in making a decision. Instead, the primary instruments-    !
tion used to perform the switchover from injection to sump recircu-lation is refueling water storage tank (RWST) level. Although the reactor containment sump level transmitters are not the primary indication used to signal switchover, CYAPC0 has reviewed the environmental electrical qualification status of this instruments-tion and has determined that it is qualified.
: 4. Issue An M0V valve failure similar to that discusscd under 'the HPSI system     '
could lead to a loss of core deluge flow for the long-term recircu-lation mode of operation. The valves to be considered for this case are the core deluge valves SI-M0V-071A and B which are reclosed after the initial injection phase anc left closed for short-term recirculation. The failure occurs when the operator selects a valve and opens it from the main control board. As before, if the valve should fail in such a manner that leaves the valve's gate wedged into the seat, the operator would be unaware c' this failure since a normal open indication would show at the main control board. This condition would leave the plant in a condition where no flow is delivered to the core deluge.                                          1 I
Loss of position indication by itself could cause ECCS degradation as a result of a similar scenario to the one described under HPSI.
Resolution This valve stem or disc failure has been determined to be a passive    f failure. Thus, SI-M0V-871A and B are not single failure concerns in    j a regulatory secse because passive failures are r,ot part of the       i Haddam Neck licensing basis and need not be postulated.
However, operators are instructed to verify flow using the flow-to-
                             "       RHR pump amperage correlation as this valve is beino opened. Should i flow not increase, the operators are directed to open the other valve. Therefore, operators do not rely solely on valve indication. i Further, CYAPC0 has performed a probabilistic evaluation and deter-    !
mined that the frequency of the above-described accident scenario      j represents far less than 0.5 percent of the core melt frequency due      !
to internally initiated events.
l i
l i

U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 8 April 28, 1989 D. Charaina System
: 1. Issue Leakage of water past the charging system check valve CH-CV-382A could result in potentially contaminated water from charging minimum flow up to drain header valves DH-V-319, DH-V-407, and DH-V-408.
These valves, although normally closed, are not listed in the MEPL and therefore cannot be considered as safety-related. Consequently credit cannot be taken for them preventing leakage.
Resolution CYAPC0 has determined that the potential problem was not that CH-CV-383A may leak, but that CH-V-383 was open during operation.                               I In the past, valve CH-V-383 has been left in the open position so that alternate letdown to the charging pump suction could be quickly established if normal letdown were lost. However, valve CH-V-383 is the boundary between Quality Assurance (QA) Category 1 and non-QA piping and should be closed to protect the integrity of the QA boundary. Therefore, as a result of this single failure analysis, valve CH-V-383 has been closed and a path to the primary drain tank (PDT) has been established via valve DH-V-408.
Now in Modes 1, 2, and 3 if normal letdown is lost,      t. loop drain valve will be open and the drain cooler outlet valve will be throt-tied to provide a path to the PDT. An operator would be dispatched to open CH-V-383 and isolate the path to the PDT, thus establishing alternate letdown to the charging pun:p suction (volune control tank). The plant is permitted to remain in this condition, by procedure, for up to 72 hours, after which a plant shetdown would be initiated. Opening of valva CH-V-383 for short periods of tke at infrequent intervals is acceptable based ,on the low probability of a LOCA concurrent with the Tailure of the non-QA piping upstream during the short time the valve is open.
Based on these actions, CH-CV-383A is no longer a single failure vulnerability because the boundary valve, CH-V-383, is now closed.
: 2. Issue The following charging system relief valves were identified to CYAPC0 for determination if their set points were still adequate for the new ECCS flow paths:
: a. BA-RV-279--Metering Pump Suction Header
: b. CH-RV-280--Metering Pump Discharge Header
: c. CH-RV-332--Reactor Coolant Pump Seal Leakoff Line

I U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 9 April 28, 1989 l
Resolution l                        CYAPC0 has completed an evaluation of these three relief valves and determined that no modifications are required. The results of this evaluation are as follows:
: a. BA-RV-279--This is a small capacity relief valve that is intended to handle back-leakage through the charging metering pump. In the event it should lift, the discharge will be                            ,
directed to the primary drains tank.
: b. CH-RV-280--The set point of this valve is sufficient to handle the system conditions expected during the recirculation and charging modes of operation and thus should not be challenged.
: c. CH-RV-332--The set point of this valve is adequate for antici-pated pressures and thus should not be challenged.
Based on these evaluations, BA-RV-279, CH-RV-280, and CH-RV-332 are not single failure concerns.
E. ECCS Suonort System:    Service Water
: 1. Issue A failure of the service water discharge header Pressure Switch Relay PS1443X could cause all four service water pumps to automati-cally start except during a loss of off-site power (LOOP), when the PS1443X automatic pump start is blocked. Such a failure of this relay is an improbable event.           Failure of Pressure Switch Relay PS1443X could, however, cause all four service water pumps to automatically start and possibly overload 4160-V and 480-V station service transformers under degraded off-site power conditions.
Pesolution During normal operation the Haddam Neck Plant operates with at least two service water pumps in service; therefore, failure of PS1443X could add a maximum of two service water pumps at once. The worst-case time for this tu occur would be coincident with the start of the HPSI pumps during safety injection.
CYAPC0 has reviewed this scenario and determined that should this event occur during degraded off-site power conditions of 111-kV, then all safety injection loads, plus the additional service water pumps, will start successfully.      The Connecticut Valley Electric Exchange is instructed to maintain off-site power above 112 kV and, in this scenario, would already have entered their voltage restora-                           I tion procedures.
_     - --                                                                                                         i

U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 10 April 28, 1989 Additionally, the probability of this pressure switch failure concurrent with the starting of tha HPSI pump is very remote. The transient will be inconsequential if the pressure switch failure were to occur either seconds before or after the HPSI motor is started, such that locked rotor currents are not taken simultane-ously.
Based on these evaluations, CYAPC0 has determined that PS1443X is not a single failure concern.                                               l
: 2. Issue The loss of an emergency diesel generator or 4160 emergency bus with        l at least one off-site power feed available could result in an unanalyzed scenario. The above scenario would result in the loss of two service water pumps without the automatic isolation of SW-MOV-1,        ;
SW-MOV-2, SW-MOV-3, and SW-MOV-4 with air still available to the            ;
other air-operated       service water valves.       SW-MOV-1,  SW-MOV-2, SW-MOV-3, and SW-MOV-4 can be closed via the local control switches which are located outsido the control room.                                 ;
Resolution                                                                  .
i This   scenario      i   i                             by letters   dated January  13,1989,[16f milar      to that10,reportgdg and February      1989,    in that the major     i nonessential service water loads would not be isolated. However,            l these scenarios are different with respect to the number of service         (
water pumps available; two pumps are available during this scenario versus three pumps during the reported scenario.
As a result of the above-reported scenario, the following modifica-         l tions vera completed:                                                       l
: 1. SW-MOV-1 and SW-MOV-2 were modified to close upon receipt of a safety injection actuation signal (SIAS).
(16) D. B. Miller, Jr., letter to U.S. Nucleer Regulatory Commission Document Control Desk, transmitting Reportable Occurrence LER 50-213/88-022-00,
               " Reduced Heat Removal Rate in Containment Air Recirculation Cooling Coils," dated January 13, 1989.
(17) E. J. Mroczka letter to        U.S. Nuclear Regul atory Commission Document      .
Control Desk, " Proposed Revision to Technical Specifications Containment        l Integrity During CAR Fan Heat Exchanger Cleaning Activities," dated              ;
February 10, 1989.
i l
l l                                                                                               l L_------_---------              --     -                                                      J

V.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 11 April 28, 1989
: 2. SW-MOV-3 and SW-MOV-4 had a remote close push-button installed in the control room. Plant procedures were revised to instruct operators to isolate these valves prior to placing the RHR heat exchangers in service.                                             l
: 3. SW-TV-2365A and B (steam generator blowoff tank condenser           l isolation valves) were modified to close upon receipt of an        l SIAS.                                                              !
Based on these modifications, the failure of two service water pumps during a LOCA due to an electrical bus failure has been evaluated, and the results show that sufficient flow is provided to safety-related components during this failure mode.
Although an electrical bus failure was credible and was a single failure vulnerability, crediting operator action and the use of nonsafety-related equipment would have allowed the third service water pump to be available in sufficient time that this scenario was enveloped by the reported scenario.
It should be noted that prior to implementing these modifications, a probabilistic analysis had determined that the frequency of this        {
accident scenario represented far less than 0.05 percent of the core     i melt frequency due to internally initiated events.
: 3. Issue The service water system should be analyzed to verify that it is capable of supplying adequate flow during the injection phase of a LOCA    with air-operated valvet SW-A0V-9, SW-A0V-738A and B,           .
SW-FCV-1421E, SW-PCV-606, SW-FCV-112, SW-A0V-8, SW-TV-781A and B,       i SW-TV-2210, and SW-TV-2365A and B open.
Resolution As part of a long-term resolution described in Item E.2,         CYAPC0 a s        water system reanalysis. As contracted requested by}!the to NRC performStaff,gceCYAPC0 intends to submit this         .
                                                                                                        ]
reanalysis by June 30, 1989. The draft of this reanalysis has            4 verified that the service water system is capable of supplying ade-quate flow, assuming these valves are open, except for SW-TV-2365A and B which were modified as described above.                           1 (18) A. B. Wang letter to E. J. Mroczka,         " Issuance   of  Amendment   (TAC No. 72024)," dated March 7, 1989.
L_- _ -- _ _ _

i O
.,                         .                                                                                                                j 1
l U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 12                                                                                    4 April 28, 1989 i
F. ECCS Support System: Heatina. Ventilation and Air Conditioning (HVAC)                                    f
: 1.                     Issue Neither the primary auxiliary building (PAB) exhaust nor supply ventilation systems are single failure proof. A loss of plant air (nonsafety-related) or the the failure of numerous components could render these systems ineffective in providing PAB ventilation after a LOCA coincident with a LOOP. Operator access is required and may not be allowed if the failures occur after recirculation initiation.
Resolution i
An evaluation is currently under way to determine if HVAC is essen-               ;
tial in the PAB during a LOCA coincident with a LOOP. Specifically, this analysis will determine if equipment will remain operable at the temperature expected during a LOCA without HVAC available.
Preliminary results indicate that equipment will be operable.       The final results of this evaluation will be provided to the NRC Staff by June 30, 1989.
: 2.                     Isrue The system operating configuration and the failure modes of various components for the PAB ventilation system are not clearly docu-mented.
Resolution CVAPC0 has acknowledged that the PAB ventilation system is not single failure proof and therefore is performing the analysis dis-cussed above to ensure that equipment can operate without HVAC.                   l
: 3.                     Issue The MEPL identifies a single ventilation path for exhaust air duct at<d dampers with no backup.. The inlet to this system from the PAB is not included as safety-related. Additionally, the MEPL does not include any PA3 supply ventilation components.
Resolution                                                                        ;
Same as provided for Item F.2.                                                    '

o e   .'
U.S. Nuclear Regulatory Commission B13223/ Attachment 1/Page 13 April 28, 1989 G. Diesel Generator Rooms "A" and "B" Ventilation
: 1. Issue The air intake damper for each diesel generator room is motor-operated and is required for diesel generator room ventilation. A review of related documents and a site walkdown did not reveal the damper's component name (identification number) so that it could be checked against the MEPL to determine if the intake dampers and associated components have the required separation.
Resolution A review of the emergency diesel generator inlet damper motors has indicated that they are independent and a single failure in the dampers cannot cause both emergency diesel generators to fail.
1
-}}