View source for LR-N15-0232, Supplemental Information Needed for Acceptance of Requested Licensing Action Amendment Request Regarding Chilled Water System Modification

{{Adams
| number = ML15309A750
| issue date = 11/05/2015
| title = Supplemental Information Needed for Acceptance of Requested Licensing Action Amendment Request Regarding Chilled Water System Modification
| author name = Perry J
| author affiliation = PSEG Nuclear, LLC
| addressee name = 
| addressee affiliation = NRC/Document Control Desk, NRC/NRR
| docket = 05000272, 05000311
| license number = DPR-070, DPR-075
| contact person = 
| case reference number = LAR S14-04, LR-N15-0232, TAC MF6724, TAC MF6725
| document type = Letter type:LR
| page count = 33
| project = TAC:MF6724, TAC:MF6725
| stage = Supplement
}}

=Text=
{{#Wiki_filter:PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, NJ 08038-0236 PSECi Nuclntr Ll ,C 10 CFR 50.90 LR-N15-0232 LAR S14-04 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Salem Nuclear Generating Station Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC Docket Nos. 50-272 and 50-311

==Subject:==
Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
References      1. PSEG letter to NRC, "License Amendment Request Modifying Chilled Water System Requirements," dated September 11, 2015 (ADAMS Accession No. ML15254A387)
: 2. NRC letter to PSEG, " Salem Nuclear Generating Station, Unit Nos. 1 and 2Supplemental Information Needed For Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification," dated October 29, 2015 (ADAMS Accession No. ML15299A383)
In the Reference 1 letter, PSEG Nuclear LLC (PSEG) submitted a license amendment request for Salem Nuclear Generating Station (Salem), Unit Nos. 1 and 2. The proposed amendment would revise Technical Specification {TS) 3/4.7.10, "Chilled Water System- Auxiliary Building Subsystem," to allow (1) a reduction in the number of required components (two vs. three required chillers) and (2) use of the cross-tie capability between Unit 1 and Unit 2. A supporting change would also be made to the Control Room Emergency Air Conditioning System TS 3.7.6.1 (Unit 1) and TS 3.7.6 (Unit 2).
In the Reference 2 letter, the U.S. Nuclear Regulatory Commission staff requested that PSEG supplement the application with information necessary to enable the NRC staff to begin its detailed technical review. A conference call was held with the NRC on October 21, 2015, to clarify the supplemental information request. The requested information is provided in .

LRN150232                                                                             10 CFR 50.90 Page 2 PSEG has determined that the information provided in this submittal does not alter the conclusions reached in the 10 CFR 50.92 no significant hazards determination previously submitted. In addition, the information provided in this submittal does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.
There are no regulatory commitments contained in this letter.
If you have any questions or require additional information, please contact Brian Thomas at (856) 3392022.
I declare under penalty of perjury that the foregoing is true and correct.
NOV '05 2015 Executed on   ------
(Date)
Cl   &#xa3;     F.         7f Respectfully, k;    F. Perry Site Vice President Salem Generating Station Attachment 1       Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification (CAC Nos. MF6724 and MF6725)
Enclosure 1         S-C-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment" Enclosure 2         Technical Evaluation 801 1 0953-0 1 05, "Chilled Water System Crosstie FMEA" cc:     Mr. D. Dorman, Administrator, Region I, NRC Mr. T. Wengert, Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator

LR-N15-0232 Attachment 1 Supplemental Information Needed for Acceptance of Requested Licensing Action Re: Amendment Request Regarding Chilled Water System Modification
( CAC Nos. MF6724  and MF6725 )
Page 1 of 10

LR-N 1 5-0232 NRC Request 1
: 1. Confirm whether the replacement of the six existing safety-related chillers is in the scope of this license amendment request. If the new chillers are in scope for replacement, provide the following information, as compared to the existing chillers. The information provided should include a form (shape, size, dimensions, etc.), fit (physical interface, connections, etc.) and function (designed to perform) evaluation. This should include, but not be limited to the following:
* Safety-classification
* Design and construction codes (American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers, etc.)
* Seismic Classification
* British thermal units per hour (BTU/hr) design rating (tonnage)
* Outlet temperature requirement of chilled water (range)
* Inlet temperature requirement of the service water (range)
* Chiller design pressure and temperature
* Chiller design flow rates
* Instrumentation and controls (alarm, permissives, and trips)- digital controllers vs analog
* Horsepower requirements of compressor (emergency diesel generator (EDG) loading differences)
* Cooling water requirements, pressure, flow
* Refrigerant type (address hazards)
* Refrigerant purge unit design (if utilized)
* Field modification for installation of the new chillers related to safety-related systems, structures, and components
* Control room habitability requirement and evaluation for the new refrigerant
* Fire protection evaluation for the new refrigerant
* Evaluation of the existing chiller water pumps/system relative to the new chillers
* Evaluation of the existing service water pumps/system relative to the new chillers
* Performance testing (shop/vendor)
In addition, provide a discussion related to testing of each replacement chiller following installation. Provide information describing testing of the new chillers to meet the design function as described in Appendix A to Title 10 of the Code of Federal Regulations, Generic Design Criteria (GDC)-45 and GDC-46, "Inspection of cooling water system," as applicable.
Information on testing should verify that the chillers can perform their safety-related design function before returning to Operable status.
PSEG Response The replacement of the chillers is being performed under 1 0 CFR 50.59 and is not in the scope of this License Amendment Request (LAR). The LAR is based on the current system Auxiliary Building Chilled Water (AB CH) System. The overall function of the AB CH is not altered by the replacement of the chillers.
The replacement chillers will meet or exceed the current chiller design requirements. As discussed with the NRC staff on October 1 5, 2015, the following information is provided regarding the planned replacement chillers.
Page 2 of 10

LR-N 15-0232 The design capacity of the proposed replacement chillers is 62.5 tons. This is slightly higher than the current chiller rating of 61 tons. Furthermore, the replacement chiller rating is based on a Service Water temperature to the condensers of g3oF, 3&deg;F above the design value of gooF; thus the rating at gooF would be higher than 62.5 tons. Per the response to Question 3, the replacement chiller rating satisfies the heat load requirements with margin added.
The proposed replacement chiller refrigerant will be R-134a. According to the Environmental Protection Agency (EPA), this refrigerant has "low acute toxicity levels, and presents low risk to humans exposed to it in small amounts." Due to the physical location of the chillers with respect to the Control Room and control room ventilation intake dampers, the possibility of refrigerant entering the Control Room due to a loss of refrigerant is not considered credible. The chiller rooms are located in a separate ventilation system from the control room ventilation system.
This assessment will be documented in the DCP for the replacement chillers.
NRC Request 2
: 2. Provide a detailed description of the Auxiliary Building Chilled Water (AB CH) System, describing how the AB CH system is currently designed, and how it operates during normal and accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system.
The NRC staff requires this information to fully understand and evaluate the proposed changes to the AB CH system and the associated TS revisions.
PSEG Response The Auxiliary Building Chilled Water (AB CH) System design is unchanged by the proposed license amendment request (LAR). Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
A description of the AB CH system design was previously provided in response to a June 12, 1gg7 (ADAMS g70618034g), Request for Additional Information (RAI) related to Salem Amendments 1gg and 182 (ADAMS ML01172014g). The following provides an updated description of the system.
Auxiliary Building Chilled Water System Description The Auxiliary Building Chilled Water (AB CH) System is a closed loop system that removes heat from various safety related and non-safety related equipment, and rejects the heat to the ultimate heat sink via the Service Water (SW) System. There is one loop for each Salem Unit.
Figure 4-1 of the LAR provides a simplified one line diagram of the AB CH System.
The AB CH System includes three packaged liquid chillers and two Chilled Water pumps. Each pump circulates nominally 370 gpm of chilled water at 200 feet total head in a closed loop from the chillers to the heat loads and then back to the pump suction header. Each chiller evaporator removes heat from the returning chilled water and, in the chiller condenser, rejects the heat to the ultimate heat sink via the SW System. The chillers are designed to supply chilled water at 44&deg;F, and cycle on and off as a function of chilled water return temperature. An expansion tank is installed at the suction of the pumps to accommodate chilled water inventory, thermal expansion and to provide adequate net positive suction head (NPSH) for the pumps. The chiller compressor motors are powered from separate 460 VAC Vital Buses. The two pumps Page 3 of 10

LR-N 15-0232 are powered from separate 230 VAC Vital Buses. The heat loads serviced by the AB CH System for each Salem Unit are as follows:
Safety Related Heat Loads:
* Control Area Air Conditioning System (CAACS) Cooling Coils
* Control Room Emergency Air Conditioning System (CREACS) Cooling Coil
* Emergency Control Air Compressor (ECAC) Coolers Non-Safety Heat Loads:
* Penetration Area Cooler Units (PACUs)
* Miscellaneous Room Coolers (Unit 2 only), including the primary lab room cooler, secondary lab room cooler, counting room cooler and post-accident sampling room cooler The CAACS and CREACS are sub-systems of the Control Area Ventilation (CAV) System, which includes the Control Room Envelope (CRE), Relay Room and Electrical Equipment Room. The CRE is common for Salem Units 1 and 2. During normal operation, CAACS provides cooling for all the CAV System areas. During accident conditions, CREACS provides cooling for the CRE, and CAACS provides cooling for the Relay Room and Electrical Equipment Room. CAACS maintains the areas it serves at s; 76&deg;F during normal and accident conditions.
CREACS maintains the CRE at s; 85&deg;F during accident conditions, except for the Data Logging Rooms, which are maintained at s; 90&deg;F.
The three-way control valve (CH74) located on the discharge side of the CAACS coils, originally designed to control flow through the coils, is fixed in the full open position to allow full flow through the coils all the time to simplify system operation and improve reliability. Similarly, the CH168 control valve located on the discharge side of the CREACS coil is fixed in the full open position for single failure concerns, allowing flow through the coil during all modes of operation.
Chilled water flow to the ECAC coolers is normally isolated and is provided when the ECAC is operating by an automatic isolation valve that opens when the compressor starts. The ECAC is normally aligned to chilled water but can be isolated from the chilled water system and provided cooling from the service water system.
Chilled water flow is provided to the PACUs as required to maintain the environmental conditions in the mechanical penetration area for protection of equipment. Room thermostats are provided to modulate three-way control valves to each PACU. The supply of chilled water to the PACU cooling coils is automatically isolated by redundant isolation valves (CH151 and CH30) on a safety injection signal.
The Salem Unit 2 AB CH provides chilled water to the miscellaneous room coolers in addition to the uses described above. Three-way control valves modulate flow to each room cooler based on room temperature. Chilled water flow to these non-safety room cooling coils is automatically isolated by redundant isolation valves on a safety injection signal.
Page 4 of 10

LR-N 15-0232 AB CH Operation A. Normal Configuration During normal plant operation, the AB CH System in each unit provides chilled water to the CAAC coils and PACUs. In addition to these loads the Unit 2 AB CH System supplies chilled water to the miscellaneous room coolers. The ECAC is normally in standby with cooling flow through the ECAC isolated. When the ECAC is operated for testing or when the Station Air Compressors are not available or not operating, the AB CH System provides chilled water to the ECAC coolers.
B. Accident Safety Injection (SI) Configuration During the accident Sl configuration, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. On an Sl signal, redundant isolation valves automatically isolate chilled water flow to the PACUs and the miscellaneous room coolers.
Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and each Unit's CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms. If one CREACS train is unavailable, the system is aligned in the single train filtration mode (also referred to as "Maintenance Mode"). A single CREACS coil is capable of maintaining the CRE at :5 85&deg;F, except for the Data Logging Rooms, which are maintained at :5 gooF.
C. Accident High Radiation (RMS) Configuration During the accident RMS configuation, the CAV System is automatically switched to the accident pressurized mode which starts the CREACS fans. The CAACS coils continue to receive chilled water and the ECAC is assumed to be operating (with chilled water flow to the ECAC coolers) due to a loss of power or loss of station air compressors. The PACUs and the miscellaneous room coolers are not automatically isolated by the RMS signal and continue to receive chilled water flow until manually isolated by procedure. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE. Chilled water to each Unit's CAACS coils provides cooling to their respective Relay and Electrical Equipment Rooms.
On initiation of an accident high radiation (RMS) signal when the CAV system is in the Maintenance Mode, a single CREACS coil is capable of maintaining the CRE at :5 85&deg;F, except for the Data Logging Rooms, which are maintained at :5 gooF.
D. Loss of Offsite Power (LOOP) Configuration During a LOOP, chilled water flow is maintained to Units 1 and 2 CAACS coils to provide cooling to the CRE and their respective Relay and Electrical Equipment Rooms. Each Unit's ECAC is started and chilled water is supplied to the ECAC coolers. The PACUs and miscellaneous room coolers are isolated.
Page 5 of 10

LR-N 1 5-0232 E. Fire Outside Control Room Area (Recirculation)
During a postulated fire outside the control area, the CAV System is manually switched to the full recirculation configuration. This initiates the CREACS fans. The CAACS coils continue to receive chilled water. The PACUs and miscellaneous room coolers are manually isolated. Both the Unit 1 and Unit 2 CREACS coils provide cooling to the common CRE and the CAACS coils provide cooling to their respective Relay and Electrical Equipment Rooms.
AB CH Interfaces with other Systems The AB CH interfaces with the systems it supports through heat transfer across cooling coils.
Control air is required for operation of AB CH*control valves.
SW supplies cooling water to each packaged chiller condenser. The chillers reject heat to the ultimate heat sink via SW flow.
The Safeguards Equipment Controller (SEC) circuits provide automatic control of the AB CH during accident conditions. The interfaces between the AB CH and SEC circuits occur at the SEC contacts in the AB CH control circuits.
The Potable Water system provides make-up water to the AB CH Subsystem expansion tank.
Nitrogen is supplied to the expansion tank as a cover gas.
The Building and Equipment Drains system provides for transport and disposal of excess fluids from the AB CH Subsystem.
AB CH Cross-tied Operation The cross-tie piping connects the Unit 1 and Unit 2 Chilled Water Systems. The cross-tie piping is safety related seismic class 1 piping. The cross-tie piping enables the chillers from one unit to provide the cooling requirements for both units. Both the supply header cross-tie and the return header cross-tie contain one manual isolation valve that provides the boundary between unit one and unit two.
Calculations performed in support of the LAR have shown that from November 1 through April 30, one Chilled Water pump is capable of supplying the required cooling flow to both units, with the following conditions: ( 1 ) chilled water flow to the ECACs are isolated; (2) chilled water flow to the non-essential loads are isolated; (3) both CREACS trains are required (single filtration train alignment not permitted). The calculations also show that only 2 Chillers are required to remove the heat load.
The cross-tied LCO is requiring 3 chillers and 2 chilled water pumps to be operable. This requirement allows for the single failure of an electrical train that would lead to the loss of one chiller and one chilled pump. As documented in Section 4. 3 of the LAR, the analysis shows that with 2 chillers and 1 chilled water pump remaining, the cross-tied system can support the accident heat loads on one unit and safe shutdown heat loads on the other unit, as required per GDC-5.
Page 6 of 1 0

LR-N15-0232 The ECAC and non-essential loads are required to be isolated from the chilled water system prior to operating in the cross-tied configuration as required by the restrictions placed in the TS.
Therefore, there is no reliance on the automatic or manual operator action to isolate these loads following a design basis accident or loss of offsite power (LOOP). When entering the cross-tie configuration the chillers and chilled water pumps on the unit that is not supplying the cross-tie are isolated from that Unit's chilled water system. The unit supplying the chilled water cross-tie will then provide cooling to both Unit's CAACS and CREACS coils.
The chilled water valve alignment to the various coolers at both units is not impacted by operation of the cross-tie with exception for pre-isolation of the aforementioned loads. The chiller control valves for the CAACS and CREACS coils are fixed in the full open position, and thus chilled water flow to these coils is maintained in both accident and normal conditions. The CAV System operating modes are not impacted by the chilled water cross-tie and no changes are being made to the CAV control circuits for the operation of the chilled water cross-tie.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
NRC Request 3
: 3. Provide a detailed explanation of how the current AB CH system heat loads/components currently interface with the AB CH system, how the system is designed, how the system operates during normal operations, and how the system operates during accident conditions. Also, provide a discussion of the system design and operation for the proposed modified system, specifically noting the differences from the current system. The NRC staff requires this information to fully understand and evaluate any proposed changes to the heat loads/components that are served by the AB CH system and any associated TS revisions.
PSEG Response The AB CH System design is unchanged by the proposed LAR. Only the manner in which the system is operated will be changed, using the existing design in two new configurations as discussed in the LAR.
The A B CH System provides cooling to various essential and non-essential loads. The essential loads include the CAACS, CREACS, and ECAC on both units. The non-essential loads include the PACUs on both units and miscellaneous lab and room coolers on Unit 2 only.
The following are the current heat loads for these components for normal and accident conditions based on design summer ambient conditions. Heat loads are also provided for the single filtration train alignment (also known as Maintenance Mode) of the control area ventilation where one unit is cooling the entire CRE. The control area ventilation can be operated in either normal alignment (both trains operating) or Maintenance Mode (single train operating). As described in the LAR, the control room ventilation is a shared system with each Salem Unit providing one train of the two train system. During normal operation, the CAACS is supplying Page 7 of 10

LR-N15-0232 the CRE with the CREACS system isolated and in stand-by. During an accident, the CREACS system is actuated and supplies the cooling to the CRE and the CAACS is isolated from the CRE. In the tables below for the Maintenance Mode (single train) alignment, during normal operation the CAACS on one unit is cooling the entire CRE and for accident conditions the CREACS on one unit is cooling the entire CRE. The values listed for Unit 1 and Unit 2 CAACS in Normal Operation in the Maintenance Mode include the entire CRE heat load in both the Unit 1 and Unit 2 columns (the Unit that is not supplying the CRE would actually have a lower heat load). The values listed for Unit 1 and 2 CREACS in Accident Conditions during Maintenance Mode reflects the heat load if that Unit is supplying CRE.
Normal Operation
            ** Based on three chillers running During accident conditions, the PACUs and Miscellaneous coolers are either automatically isolated or isolated by procedure.
Accident Conditions
            ** Based on two chillers running For the proposed TS changes, the above heat loads apply to the current configuration (3.7.10.a). For the new TS configurations, Two Chiller (TS 3.7.10. b) and Cross-tied (TS_3. 7.1 O. c), the above system heat loads will be less. The CAACS and CREACS loads will be less than the above values since they are based on summer design conditions, and the new TS configurations will only be applicable during the colder parts of the year (from November 1 to April 30). The ECAC load will be zero since the TS restrictions will require the ECAC to be isolated from the Chilled Water System for both the two chiller and cross-tied Page 8 of 10

LR-N15-0232 configurations. For the two chiller configuration, the non-essential loads (PACUs and miscellaneous coolers) remain aligned with both trains of CAV operable and are isolated when transitioning to Maintenance Mode. For the cross-tie configuration the non-essential loads will be isolated on both units prior to entering the cross-tie configuration; therefore, these heat loads are zero for the cross-tie configuration.
The specification for the replacement chillers includes a 10% margin added to the heat loads in the above two tables. Adding 10% to the bounding normal operation value of 55.5 tons/chiller yields 61.1 tons per chiller. Adding 10% to the bounding accident value of 50.3 tons/chiller yields 55.3 tons per chiller. The proposed replacement chillers are rated at 62.5 tons, so they will be capable of providing the required cooling for both normal and accident conditions with 10% heat load margin. In addition, this rating is based on a SW temperature to the condensers of 93&deg;F, which is a 3&deg;F margin above the design value of 90&deg;F.
NRC Request 4
: 4. GDC-5, "Sharing of structures, systems, and components," states the following:
Structures, systems, and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and coo/down of the remaining units.
Provide a failure modes and effect analysis or suitable summary table, applicable to GDC-5, to describe the analysis and conclusions for the effects of the cross-tie between units. In addition, provide a discussion describing the interactions during a design basis accident (loss of off-site power, loss of cooling accident) related to electrical power, and EDG loading sequencing that supports both units, when the units are in the cross-tied configuration.
PSEG Response The existing failure modes and effect analysis (FMEA), S-C-CH-MEE-1139, was assessed in a Technical Evaluation (TE) that determined that the cross-tied configuration does not introduce any new failure modes. The existing FMEA and the TE are provided as Enclosure 1 and 2 respectively. During the review of S-C-CH-MEE-1139, PSEG identified the following items that will be addressed during the update of the FMEA:
* Section 3.0, the main steam line radiation monitors were permanently removed from the chilled water system.
* Section 4.1.2 and Attachment 8.2, the CH? 4 chiller control valves for the CAACS coils are fixed in the full open position as discussed in response to Question 2.
* Section 4.2, during the two chiller configuration the ECAC will be isolated from chilled water for the Unit in the two chiller configuration and during cross-tied configuration the ECACs will be isolated from chilled water for both Units.
* Section 4.4, during the two chiller and cross-tied configuration the Maintenance Mode alig nment is not allowed.
Page 9 of 10

LR-N 15-0232
* Section 5.0, describes chilled water system vulnerabilities without the details of the vulnerabilities. These vulnerabilities are associated with the CREACS and CAACS temperature control valves which are discussed in Section 4.1.1 and Section 4.1.2, respectively, and the safety related isolation discussed in Section 4.3. These discussions are not impacted by the two chiller and cross-tied configuration.
The chillers and chilled water pumps receive automatic start signals on an Sl signal or LOOP from the SEC. During Sl loading, the electrical loads connected to the safety related bus will continue to operate without interruption. If the unit that is supplying chilled water to both units experiences a LOOP, there will be a brief interruption in chilled water flow to both units until the emergency diesel generators are auto started and loaded. The chillers and chilled water pumps are then automatically sequenced (loaded) onto the bus by the SEC with negligible impact on chiller heat loads at either unit.
Page 10 of 10

LRN150232 Enclosure 1 SC-CH-MEE-1139, Rev No. 1, December 10, 1998, "Chilled Water System ( CH ) - Single Failure Criteria Vulnerability Assessment"

USER  RESPONSIBLE      FOR VERIFYING REVISION, STATUS AND                 CHANGES PRINTED20 14 *1212 EENo.: S-C-CH-MEE-1139                           Rev No.: 1                         DECEMBER 10, 199M TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 1 .0    Revision Summary Revision 1 -The CH168 valve modulating function is now inoperative. TI1e control air to the valve has been removed in order to keep the valve permanently in the full open (fail-safe) position. The associated temperature controller is also disconnected. This evaluation is being revised lAW CD P517 ofDCPs lEE-0371/1 Rev. 0 and 2EE-0317/1 Rev. 0. The following changes were incorporated into the evaluation:
: 1. Section 4.1.1 was revised to describe the condition which now exists as stated above.
: 2. Section 5.0 has been revised to describe the modifications made to CH168.
: 3. Section 7.0 has been revised to update the effects on other technical documents.
: 4. Attachment 8.2, page 4 has been revised to delete the effects of a control malfunction.
Note 2 of the attachment has also been removed.
2.0     Purpose The purpose of this evaluation     is to document single   active failure vulnerabilities of the safety related portion of the Salem Units 1 and 2 Chilled Water System. Specifically, this evaluation will document the Chilled Water System's capability to perform its design function after sustaining a single active failure, measures to minimize the risk of an unmitigated single failure, and compensatory measures in the event of an unmitigated single active failure.
3.0    Scope The chilled water system perfonns both safety and non safety related functions. The system is primarily non safety related except for the Auxiliary Building Subsystem, which provides chilled water to the following areas.
: 1. Control Area Ventilation System;
: 2. Control Air System (Emergency Air Compressors);
: 3. Various Non SafetyUsers.
Note that the Main Steam Radiation Monitors do not require chilled water cooling during an accident and are considered to be a non-safety related load for this evaluation.
The scope of this evaluation will be confined to the system and component interfaces noted in I and 2 above. Only single active failures will be evaluated.
A component is subject to    an active failure if the component may be required to change state or position in order for the system to pe rform ito; safety function. Typical active failures include valves failing to move to the proper position when required, or a relay failing to energize when required. A component is subject to a passive failure if the position or state of the component is immaterial to the postulated failure. A typical passive failure is a pipe crack or rupture.

USER RESPONSIBLE FOR VERIFYING .REVISION, STATUS AND        CHANGES PRINTED2014 1212 Page &#xa3;01< 1 EE No.: S-C-CH-MEE-1139                          Rev No,: 1                      NOVEMBER        16, 1998 TITLE: Chilled Water System (CH)- Single FailureCriteria Vulnerability Assessment 4.0      Discussion A Failure Modes and Effects Analysis (FMEA) was perfonned for Unit 1 to identifY the active components subject to single failure. The Unit 2 CH system is similar, with additional non-safety related loads for the counting room, laboratory unit coolers and PASS room cooler.
Refer to attachment 8.2 for the FMEA. The results are summarized below, and are divided into functional support areas.
4.1      Control Area Ventilation System (CAV)
Chilled water is supplied to the portion of the CAV System that includes the Control Area Air Conditioning System (CAACS) and the Control Room Emergency Air Conditioning System (CREACS). The CA ACS supplies conditioned air during normal plant operation to the combined Unit 1 and Unit 2Co ntro l Room Envelope, each unit's Relay Room, and each unit's Electrical Equipment Room. The CREACS provide s conditioned air to the combined Control Room Envelope (CRE) during emergency operation. The CAACS continues to cool the Electrical Equipment room and Relay Room for each unit during an accident. The chilled water system provides coolant to cooling coils in both these subsystems. Refer to Attachment 8.1 for the system schematic diagram. The following single active failures are evaluated.
4.1.1    Failure of Control Valve 1CH168 (2CH168)
The CH168 valve modulating function is now inoperative. The control air to the valve has been removed in order to keep the valve pennanently in the full open (fail- safe) position. The associated temperature controller is also disconnected.
As a result of these modifications, an evaluation of a failure ofCH168 is no longer applicable.
4.1.2    Failure of Three Way Valve 1 CH74 (2CH74)
Three Way Valve CH74 is located in the inletloutletlbypass piping to the CAACS cooling coil which during an accident serves the Relay Room and the Electrical Equipment Room. The valve has a pneumatically operated actuator to modulate chilled water flow through the CAACS coil or through the bypass line to control cold deck air temperature. On a loss of air, the valve will spring actuate to direct all flow to the CAACS cooling coil. The control circuitry has redundant solenoid valves that

USER  RESPONSIBLE   FOR VERIFYING REVISION, STATUS AND                 CHANGES PRINTED20 141212 Page 3 of 7 BE No.: S-C-CH-MEE-1139                          Rev No.: 0                             Date: February 4, 1997 TITLE: Chilled Water System (CH) - Single Failure Criteria Vulnerability Assessment exhaust the air on a loss of power and as a consequence the spring wouid fail the valve to the full flow to the cooling coil position. Therefore the controls for this valve are redundant, enhancing the capability to endure a single failure.
A postulated failure scenario is that with the valve aligned in the bypass position during the winter time (cold makeup air and little or no heat load on the cooling coil) a mechanical malfunction may bind the valve in the bypass position. With the valve stuck ht this position, chilled water flow would bypass the CAACS and temperatures in the Relay Room and Electrical Equipment Room could increase.
This malfunction is not credible. Even in winter, the heat loading from the control area is high enough to require some cooling water flow, thus it is unlikely that the CH74 valve will ever be in the full bypass position. Also, the valve is modulating to control CAACS temperatu re which will require the valve to move to comp ensate for the 24 hr. day/night cycle. Therefore, the valve does not remain in one position for a long period of time.
If the valve were to bind in an intennediate position, adequate cooling is assured, because the CAACS heat load would drop due to the CRE load shifting to the CREACS. In addition, this valve is periodically stroke tested under S 1(2).0P-ST.CH-0003(Q). (Refs. 6.1 and 6.2) Regular preventive maintenance (PM Task Nos. 100011, 411320, 411323, 100599, 461320, 461327) is perfonned as well.
4.2  Emergency Control Air Compressor The chilled water system is the preferred source of cooling water for the Emergency Control Air Compressor (ECAC) in each unit. Because both ECACs (one in each unit) are cross-tied, and provide back-up for each other, there is no credible single failure of the CH system that will cause both ECACs to fail. In addition, for operational flexibility service water is available as a backup cooling water source for each air compressor.
4.3  Safety Related System Isolation The safety related portion of the chilled water system is separated from the non safety portions in some instances by a single safety related check valve. The following locations fall into this category:
Valve No.               Size         Description 1CH61 (2CH61)           3"           Return from the PACU's 1CH132,                2"           Return from Unit 2 Lab Coolers 1 CH260 (2CH260)        1"          Return from Radiation Monitor Enclosure 1CH55 (2CH55)          1"           Potable Water Supply To Chilled Water In these cases, the referenced check valves are safety related components, located in safety related seismically supported piping and separate the return piping from the non-safety class portions of the chilled water system.
By itself, a failure of a check valve to fully close does not affect the operation ofthe chilled water system. Redundant isolation v alve s are p r o v ided on the supply line to the nonsafety related loads.
These valves will isolate flow to the nonsafety related heat loads. The only time that a failure of a

USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 141212 Page 4 of 7 BE No.: S-C-CH-MEE-1139                             RevNo.: 0                             Date: February 4, 1997 TITLE: Chilled Water Systm (CH)- S ingle Failure Criteria V ulne rab ility Assessment check valve will impact the CH system is if the pr essur e boundary associated with the non-safety related loads also fails, allowing leakage that could drain the CH s ystem. This scenario requires two failures, the check v alve failing to cl ose, and a failure of the pipi ng system. This does n ot constitute a single failure point during normal operation or during a Loss of Coolant Accident (LOCA).
However, because some of t.he piping to th e non-safety related loads is non-seismic class, failure of the piping is assumed during a safe shutdown earthquake (SSE). If an SSE occurred (without a LOCA), the Unit(s) woul d be shut down. If the earthquake caused a failure of the non-safety related chilled water pi ping, and a check valve failed open, procedu re S2/S LOP-AB.CAV-0001 ''Loss of Control Area HVAC" provides guidance to establish alternate cooling (References 6.9, and 6.10).
The chilled water system does not connect t o or interfac e with the p rimary coolant pressure boundary, the nuclear fuel or the reactivity control system. Therefore, any fai lure of the chil led water system is not a UFSAR Chapter 15 type accident initiator. Because the primary coolant system is designed to withstand an SSE and still maintain pressure integrity (UFSAR Section 5 .2.1.2, Ref.
6.5), an SSE cannot init iate a LOCA. Therefore, a Loss of Coolant A cci dent (LOCA) and an SSE are independent events.
Per 50.59 Safety Evaluation number S96-177 (Ref. 6.6), Salem station is not designed for a LO CA coincident with a safe shutdown earthquake. This safety evaluation also demonstrates that a SSE within seven days following a LOCA is not credible. The refore, a LOCA concurrent with a se is mic event is not a postul ated event. After the immediate stabilization phase of the po stul ated LOCA, there are sufficient resources of time and personnel available to manually isolate the affected pi ping. This will preclude any loss of function ofthe chil led water system due to an SSE.
Additionally failure of a check val ve is unlikely because all valves are regularly tested as part of the plant ISI!IST program (Ref. 6.1, Ref. 6.2, Ref. 6.3, and Ref. 6.4) along with regul ar scheduled preventive maintenance.
4.4   Operational Considerations for Chiller and Pump Alignments The chilled water system consists of three 50% c apacity chillers and two 100% capacity circulating pumps in each S alem unit. Each chiller is powered from a separate Diesel backed bus, and each of
* the circulating pumps is also powered from a separate Diesel bu s. During emergency operation, two chillers and one pump will meet all the safety related chilled water cooling load requirements f o r that respective unit. This provides some flexibility for back*up and maintenance. The common control room envelope provides additional flexibility by cooli ng the CRE with a single CREACS coil using the maintemi.lui mode (Reference 6.7).
For a complete discussion of the various operational modes and system operating requirements, see the CH System ModeOps calculation SCCH-MDCl629 (Re ference 6.8) 5.0   Conclusions l11e CH system has several single failure vulnerabilities. Although not ideal compared to today1s standards, the design of the chilled water system is consistent with other Salem HVAC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. However, because calculation S-C-CAV-MDC-1640 (Reference 6.11) has determined that the consequences of the CH168 valve failing to open are unacceptable, temporary modifications are

USER RESPONSIBLE     FOR VERIFYING REVISION, STATUS .AND              CHANGES PRINTED20 14 1212
                                                                                                             - **u EENo.: S-C-CH-MEE-1139                        Rev No.: 1                        NOVEMBER 16, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 5.0    Conclusions The CH system has several single failure vulnerabilities. Although not ideal compared to today's standards, the design of the chilled water system is consistent with other Salem HVAC support systems, in that these systems were provided with limited redundancy encompassing the most likely failures. The consequences of the CH168 failing to open have been addressed as described above. Consequences of all other identified failures are acceptable, as discussed above.
The ongoing testing and maintenance programs provide confidence that the auxiliary building chilled water system will continue to provide the required heat removal for the control room area (CAACS and CREACS), and the ECAC.
To enhance the post LOCA availability of the CH system in the event of a seismic event, the following suggestion is made:
Modify the EPIPS such that within seven days after a LOCA the non-safety related chilled water loads are manually isolated (AR 970204152 to track implementation).
6.0    References 6.1      St.OP-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.2      S2.0P-ST.CH-0003(Q) REV. 4; In Service Testing Chilled Water Valves Modes 1-6 6.3      SH.RA-IS.ZZ-0151(Q) REV. 1; Non-Intrusive Check Valve Testing Data Collection 6.4      SC.RA-AP.ZZ-0021(Q) REV. 5; lSI Group Examination and Test Activities 6.5      Salem Updated Final Safety Analysis Report.
6.6      50.59 Safety Evaluation Number 896-177.
6.7      S-C-CAV-MDC-1570 Revision 1; Units 1 & 2 Control Room Envelope Equilibrium Temperatures 6.8      S-C-CH-MDC-1629, Revision 0; Mode Ops Analysis Aux. Bldg. Chilled Water System Units 1 & 2 (Draft) 6.9      S1.0P-AB.CAV-0001 "Loss of Control Area HVAC" (Draft) 6.10     S2.0P-AB.CAV-000 1 ''Loss of Control Area INAC" (Draft) 6.11     S- C-CAV MDC- 1640 ''EACS Operation with Single Failure of Cooling Coil" Rev 1.
(In approval cycle)

USER RESPONSIBLE FOR VERIFYING REVISION, STATUS AND CHANGES PRINTED20 1412 12 Page 6 OF 7 EENo.: S-C-CH-MEE-1139                     RevNo.: 1                       NOVEMBER 16,1 998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 7.0    Effects On Other Technical Documents None 8.0    Attachments 8.1     Sketch of Chilled Water Flow Path 8.2     Unit 1 Failure Modes and Effects Analysis 8.3     10 CFR 50.59 Applicability Review for S-C-CH-MEE-1139/Revision 1

USER  RESPONSIBLE  FOR VERIFYING REVISION, STATUS AND           CHANGES PRINTED20141212 Page 7 OF 7 EE No.: S-C-CH-MEE-1139                   Rev No.: 1                       NOVEMBER 17, 1998 TITLE: Chilled Water System (CH)- Single Failure Criteria Vulnerability Assessment 9.0     Signatures
                                                  !1/J{q?                     KURT DOTEN NAME (PRINT) 14:/!fY                  RAYMOND RUNO\NSKI NAME (PRINT)
                                              /.((! ({9                       NEAL MOTLEY DATE                    NAME {PRINT)
I '2./J_fE9 t)                 JOHNZUDANS NAME (PRINT)

u c
                                                                                                                                                                          /O Ul z r-rl
                                                                                                                                                                         -l ;;o Chilled Water Flow Sketch                                                                                                                            fTl Expansion o AJ Attachment 8 . 1 to                                                                                                                         N r'l Tank    o Ul S-C-CH-ME E- 1 1 39                                                                                                                                 u
                                                                                                                                                                         -l'- 0 Page 1 of 1                                                                                                                              z Ul N rn Potabe Water                                                r fTl Lab, PASS, and                                                                                       Supply 1 CH2 1 CHI 68       Count R m . Coolers                                                                                                (2CH2)             i CH55                   'l 0
(2C H 1 68)
(U nit 2 only)                                                                                                                    (2CH55)                  ;;o I
fTl 1 CH 1 32                                                                                                                            ;;o (Unit 2 only)                                                                                                                               'l 1 CH74                                                                                                                                                          z (2CH74)                                                    1 CH61         1 CH260                                                                                GJ (2CH61 )       (2CH260)                                                                                ;;o fTl l7i
                                         \ ..-                                                                                                                               0 z
Ul
                                                                                                                                                                             -1
                                                                                                                                                                             )>
1 CH21 6 1
:                :                                                                                                                        -1
                                           '(
                                                     '                                              (2CH216)                                                                 c Ul
                                     .... r .. ...
                                             '                                                                                                                               )>
                                       .., .! _                                                                                                                              z
                                         \.
0
                                                ... ., .,.I I 1.. '
()
J 11
                                       "*r-"
I
                                            '                                                                 1 1 (21 )              i 1 CH 1 3                             )>
I
                                        *'                                                                                                                                  z
                                         ' .                                                                  Chiller               (21 CH 1 3) i GJ fTl lit - - ,.1
* l .r Ul
                       'i i i                                                        i
                                                                                                                                ..           1 1 (21 ) Chilled 1 2 (22)                         Water Pump Chiller i CH 1 50                                  1 CH 1 51                                                       1 2CH 1 3 1 CH252                                       (22CH13)
( Unit 2 only)                               (2CH 1 5 1 )
(2CH252) 1 CH1 1 7 (Unit 2 only) 1 3 (23 )
1 C H30                                    Chiller I CH253                                                       12 (22}
(2CH30)
(2CH253)                                                  Chilled Water Pump

u      c
:::Q   lll z       rrl
                                                                                                                                                                        -l      ;;o r'1 .2 to S-C-CH-MEE-1139                        Salem Unit 1 Auxiliary Building Chilled Water System                                             Page 1 of 9 o
N
                                                                                                                                                                               ;;o r'l o lll Failure Modes and Effects Analysis-LOCA Condition                                                              --o (Active Failures Onlf)                                                                      -1>-- 0 z
Component         Failure Mode            Failure                       Effects                    Detection     Single Adive         Mitigation!Comments             l/l N [J   -J Mech.aiDsm                                                              Failure                                                     I r'1 1 1CH13 (Check     Fails Closed         Mechanical           Loss of flow from    1CHE5. Loss     FL-1652          No      Yes   Pump 1CH6 and check valve                    'l Valve)                                  Binding              of cooling to all safety related     Alarms                   Note  12CH13 provides 100% redundancy              0
                                                                                                                                                                              ;;o loads. Trip of operating chiller(s)                           (1) from low flow switch. or low                                                                                     r'1
                                                                                                                                                                              ;;o chilled water outlet temperature.                                                                                'l Possible pump damage if                                                                                          -<
z operated for long period of time                                                                                GJ at shut-off.                                                                                                    ;;o r'1 Fails Open (with     Mechanical           Reduced flow from Pump               FL-1652          No      Yes   Opeiator action to manually close           <
Pump 1 CHE5          Binding              1 CHE6 due to short cycling flow     Alarms                   Note  Valve 1 1CH14                              lJl 0
Off)                                      through idle pump 1CHE5. May                                  (1)                                              z cause chillers to trip on low lJl flow.                                                                                                          ---1
#13 Chiller        Trips/fails to start Control              Loss of one 50% capacity chiller     Chiller Trip     No      Yes   Remaining two 50% capacity malfunction                                               local indicating light chillers can provide cooling for all safetv related loarls.               I
                                                                                                                                                                           )>
z l
Diesel Power train   Loss of one 50% capacity chiller     Chiller Trip     No      Yes   Remaining two 50 % capacity               0 Malfunction                                               local indicating               chillers can provide cooling for all      0 light                          safety related loads. Remaining           I
                                                                                                                                                                           )>
chillers powered   from independent      z GJ diesel sources.                          r'1 lJl Loss of service      Loss of one 50%    capacity chiller  Chiller Trip     No      Yes   Remaining two 50 % capacity I
water flow                                                local indicating               chillers can provide cooling for all light                          safetv related loads.
Chiller operates     Control              Less  than full capacity of chiller  Incidental       No      Yes   Remaining two 50% capacity           I with degraded        malfunction          available. reduced cooling to        observation                    chillers can provide cooling for all i performance                               safety related loads                                                safety related loads.                I

LJ C
::::0 Ul z     rrl
                                                                                                                                                                          --1   ::::0 fTl o     :::o .2 to S..C-CH-MEE-1139                        Salmt Unit 1 Auxiliary Building Chilled Water Systmt                                             Page 2 of 9  N     f'l o lfl Failure Modes and Effects Analysis-LOCA Condition                                                                 u 0
(Active Failures Only)                                                                      z Ul Nm Component            Failure Mode            Failure                       Effects                    Detcrlion     Single Active         MitigationlCommeuts                I fTl Mecllanism                                                              Failure                                                   'l
#12. Chiller         Trips/fails to start Control               Loss of one 50% capacity chiller     Chiller Trip     No      Yes    Remaining two 50% capacity                 0
::::0 malfunction                                                local indicating                chillers can provide cooling for all light                           safety related loads.                     fTl
:::0 Diesel Power train    Loss of one 50 % capacity cru1ler    Chiller Trip     No      Yes    Remaining two 50% capacity                'l Malfunction                                                local indicating                chillers can provide cooling for all      z light                           safety related loads. Remaining           Cl chillers powered from independent         :::0 fTl diesel sources.                           <
U)
Loss of service       Loss of one 50% capacity chiller     Chiller Trip     No      Yes    Remaining two 50% capacity 0
water flow                                                 local indicating                chillers can provide cooling for all     z liht                           safety related loods.                     Ul
                                                                                                                                                                             --1 Chiller operates     Control               Less than full capacity of chiller   Incidental       No      Yes    Remaining two 50% capacity              )>
                                                                                                                                                                             --1 with  degraded       malfunction           available. reduced cooling to        observation                     chillers can provide cooling for all    c performance                                safety related loads                                                 safety related loads.                   Ul
#1 1 Chiller         Trips/fails to start Control               Loss of one 50 % capacity chiller    Chiller Trip     No      Yes    Remaining two 50 % capacity             )>
z malfunction                                                local indicating                chillers can provide cooling for all    0 light                           safety related loads.                   n I
Diesel Power train    Loss of one 50% capacity chiller     Chiller Trip     No      Yes    Remaining two 50% capacity              )>
z Malfunction                                                local indicating                chillers can provide cooling for all    GJ fTl light                           safety related loads. Remaining         Ul chillers powered from independent diesel sources.
Loss of service       Loss of one 50 % capacity chiller     Chiller Trip    No      Yes    Remaining two 50 % capacity water flow                                                 local indicating                chillers can provide cooling for all light                          saf related loads.
Chiller operates    Control               Less than full  capacity of chiller   Incidental      No      Yes    Remaining two 50% capacity with degraded        malfunction           available. reduced cooling to         observation                    chillers can provide cooling for all performance                                safety related loads                                                 safety related loads.
1CH 1 5 1 (Air       Fails  Open          Mechanical            If during DBE loss of cooling to      Position        No      Yes    Redundant isolation valve 1 CH30 Operated Valve)                           binding               safety related loads, from leakage    indication in in non-seismic portion of system      CR.
Control Signal        If during DBE loss of cooling to     Position         No      Yes    Redundant isolation valve 1CH30 failure               safety related loads, from leakage    indication in in non-seismic portion of system      CR.

u c
:::0 (!) .
z :::0   [Tl
                                                                                                                                                                    ---1
[Tl o :::o .2 to S-C-CH-MEE-1 139                    Salem Unit 1 Auxiliary Building Chilled Water System                                             Page 3 of9   N f'l o l/)
Failure Modes and Effects Analysis-LOCA Condition                                                                   u 0
(Active Failures Only)                                                                             z
                                                                                                                                                                    '::::;' (/)
N OJ    -
Component         Failure Mode            Failure                    Effects                    Detection   Single Active                                                r Mitigation!Commt!llts                  [Tl Mechanism                                                          Failure                                                       'l 1 CH30 (Air        Fails Open          Mechanical         If during DBE loss. of cooling to    Position       No      Yes    Redundant isolation valve 1CH151               0
:::0 Operated Valve)                        binding            safety related loads, from leakage   indication in in non-seismic portion of system     CR.                                                                          [Tl
:::0 Control Signal     If during DBE loss of cooling to     Position       No      Yes    Redundant isolation valve 1 CH 151             'l failure            safety related loads, from leakage   indication in z
in non-seismic portion of system     CR.                                                                .
G) 1CH232 (Check      Fails Closed        Mechanical         Loss of cooling to Emergency         High           No      Yes    Redundant compressor for Unit 2.               :::0
[Tl Valve)                                 binding            Control  Air Compressor, failure     Temperature            Note   Operator action to line-up service             <
i:fi of compressor                        alarm on               (1)    water cooling.
0 compressor                                                                  z 1CH216 (Air        Fails Closed        Mechanical         Loss of all cooling to  one ECAC. High           No      Yes    Redundant compressor for Unit 2.              l/)
                                                                                                                                                                           ---1 Operated Valve)                        binding            Failure of compressor.               Temperature                   Operator action to line-up service            )>
                                                                                                                                                                           ---1 alarm on                      water cooling.                                c compressor                                                                  l/)
Controls           Loss of all cooling to one ECAC. High           No      Yes    Redundant compressor     for Unit 2.          )>
z
                                     . Malfunction        Failure of compressor.               Temperature                   Operator action to line-up service            0 alarm on                      water cooling.                                n I .
compressor                                                                  )>
z 1CH2 1 8 (air      Fails Closed        Mechanical         Loss of cooling to one ECAC          High           No      Yes    Redundant ECAC cross tied from            GJ
[Tl operated valve)                        binding            after cooler and cylinders.          Temperature                   other unit. Operator action to open       l/)
alarm on                      manual bypass valve 1CH219.
compressor Controls           Loss of cooling to one ECAC          High           No      Yes    Redundant ECAC cross tied from malfunction       after  cooler and cylinders.          Temperature                   other unit. Operator action to open alarm. on                     manual bypass valve 1CH2 19.
compressor 1 CH74  (Air       Fails full bypass   Mechanical         Loss of cooling to CAACS             High           Yes     Yes    Valve modulates to control operated 3-way     flow                binding                                                 temperature in                temperature. unlikely to be full TCV)                                                                                           Electrical                    bypass. Testing and.PM increase Equipment and                 reliability. Operator action to Relay rooms.                  repair/restore flow to CAACS Controls          Loss of cooling to CAACS              High           No      Yes    Redundant controls malfunction                                             temperature in Electrical Equipment and Relay rooms.

                                                                                                                                                          -o     c
:::'Q  VJ z      r'l
                                                                                                                                                          -1     ;::o r'1 Attachment 8.2 to S-C-CH-MEE-1 139          Salem  Unit 1 Auxiliary Building Chilled Water System                                           Page 4 of 9 o      :::o N      r'l Failure Modes and Effects Analysis-LOCA      Condition                                                     o UJ
                                                                                                                                                                 -o (Active Failures Only)                                                                    .P. O z
::::;  Vl N      -
CD Component      Failure Mode     Failure                 Effects                Detection    Single   Active     Mitigation/Comments                            r r'1 Mechanism                                                     Failure
                                                                                                                                                                 '1 0
1 CH 1 68 {Air N/A            N/A           NJA                                N/A          N/A       NJA      Control air as well as the                        ;::o operated                                                                                                       temperature controller have                      <
r'1 temperature                                                                                                    been disconnected from                           ;::o
                                                                                                                                                                '1 control valve)                                                                                                 CH 1 68. The fail is now in                      -<
permanently in th e full open                    z C)
                                                                                         .                     (fail-safe) position .
                                                                                                                                                                ;::o r'1 1 CH55 (check Fails closed    Mechanical    Loss of make-up capability.        LA-41 56     Yes       Yes      Loss of inve nto ry will be                      Vi 0
valve)                        bindi ng                                         Alarms. Also           Note (1} slow with only normal S1/S2.0P-DL.ZZ-leakage. Operator action to provide alternate make-up
                                                                                                                                                                -1
                                                                                                                                                                )>
                                                                                                                                                                -1 0006{0)                         source.                                          c Vl Primary logs.                                                          !
I I
0 Fails open     Mechanical    If concurrent with a seismic       LA-4156      Yes                                                                 n Yes      Passive failure of non-                          J:
                                                                                                                                                                )>
binding       event, draining of expansion       Alarms. Also           Note (1) safety class  piping is not an                   z*
tank via the non-safety related    S 1 /S2.0P-                     accident initiator. The CH                       C) r'1 Vl potable water make-up piping.      DLZZ-                           system is not required to Loss of make-up capability.        0006(0)                         withstand a LOCA Pump damage from low NPSH.         Primary                         concurrent with a DB E.
Loss of cooling to safety related  Logs.                           Operator action to close
                                          . loads. _                                                          valves 1 CH3 or 1 CH 1 .

                                                                                                                                                                -o c
                                                                                                                                                                ;;o ())
z      f'l
                                                                                                                                                                ---j   /0 fTl o      /0 .2 to S-C-CH-MEE 1 139               Satan Unit 1 Auxiliary Building Chilled Warer System                                              Page 5 of 9 N      f'l 0      ())
                                                                                                                                                                       -o Failure Modes and Effects Analysis-LOCA Condition                                                            
                                                                                                                                                                -1:>- 0 (Active Failures Only)                                                                       z
())
N m I
Component         Failure Mode         Failure                   Effects                      Detection   Single Activ:e        Mitigation/Comments                fTl Mechanism                                                            Failure                                                   '1 1 0
1 CH2 (air         Fails closed     Loss of air       Loss of automatic make-up           LA-4156           Yes     Yes     Loss of inventory will be slow with       ;;o operated LCV)                                         capability.                         Alarms. Also                      only normal leakage. Operator             <
S liS2.0P-                        action to open manual bypass valve        fTl
                                                                                                                                                                      ;;o DL.ZZ-                            I CH57                                    'l 0006(Q)                                                                     z
:::"L" Logs.                                                               Cl ,
i Mechanical        Loss of automatic make-up           LA-4156           Yes     Yes     Loss of inventory will be slow with       ::::o J f'l binding           capability.                         Alarms. Also                  only normal leakage. Operator             <
())
S I IS2. 0P-                      action to open manual bypass valve        6' DL.ZZ-                            1 CH57                                    z 0006(Q)                                                                    ())
                                                                                                                                                                     -l Primarv Lo_gs.                                                             :r>
                                                                                                                                                                     -l Control           Loss of automatic make-up           LA-4156           Yes     Yes     Loss of inventory will be slow with      c Alarms. Also                                                               ())
malfunction       capability.                                                           only normal leakage. Operator SliS2.0P-                         action to open manual bypass valve       :r>
z DL.ZZ-                            1CH57                                    0 0006(Q)                                                                    n I
Primary Logs.                                                              :r>
z Fails open       Mechanical        Overfill of expansion lank,         LA-4 156          Yes     Yes     Operator action to close valves          Cl fTl binding           possible flooding of expansion      Alarms. Also                  1CH3 or lCHl                             ())
tank area                            Sl/S2. 0P-DL.ZZ-0006(Q) wu.y Logs.
Control           Overfill of expansion tank,         LA-4156           Yes     Yes     Operator action to close valves possible flooding of expansion      Alarms . Also                     1CH3 or lCHI roo tank area                           S 11S2.0P-DL.ZZ-0006(Q)
Primarv Logs.

u c
:::0 VJ >
z l'l
                                                                                                                                                                        -j :::O 1'1 o :::o .2 to S-C-CH-MEE-1 139                     Salem Unit 1 Auxiliary Building Chilled Water System                                              Page 6 of 9    N i'l o Vl Failure Modes and Effects Analysis-LOCA Condition                                                                      u
                                                                                                                                                                        +>- 0 (Active Failures Only)                                                                         z
(/)
N CO r
Component         Failure Mode         Failure                        Effects                     Detection Single  Active        Mitigation/Comments                       1'1 Mechanism                                                              Failure                                                        'l 1 CH616 (Air       Fails Closed      Mechanical            Loss of capability to vent           None           No      Yes    Relief valve 1CH143 will open at 24 0
:::0 operated PCV)                                              nitrogen to conqolpressure.                                        psig.                                           <
vent                          No                                                             f'l Control               Loss of capability to                None                   Yes    Relief valve 1CH143 will open at 24             :::0 malfunction           nitroto control pressure.                                         psig.                                           'l Fails  open       Mechanical            Venting of nitrogen blanket.         None           Yes     Yes    The required NPSH for the CH                  z C)
Increased corrosion in system                                      pumps is  1 1 ft, without N2 approximately 30 ft is available.               :::0 f'l Control               Venting of nitrogen blanket.         None           Yes     Yes    The required NPSH for the CH                    <
Vi malfunction           Increased corrosion in system.                                     pumps is 1 1  ft, without N2                   6 approximately 30 ft is available.
I 1CH 147 {Air       Fails open        Mechanical            Increase expansion tank pressure      None          No      Yes    Relief valve 1 CH143 will open at 24 operated PCV)                                              to float on N2 header pressure .                                   psig May overpressurize portions of                                                                                   c
(/)
system.
* Control malfunction Increase expansion tank pressure to float on N2 header pressure.
May overpressurize portions of None          No      Yes    Relief valve 1CH143 will open at pSig 24
                                                                                                                                                                            )
()
I system.                                                                                                          )>
z Fails Closed      Mechanical faJ.1ure   Loss of ability to pressurize         None          Yes     Yes    The required NPSH for the CH                  C) 1'1 expansion  tank                                                    pumps is 1 1 ft, without N2                   (/)
approximately 30    ft is available.
Control               Loss of ability to pressurize         None          Yes     Yes    The required NPSH for       the CH malfunction           expansion   tank                                                   pumps is 1 1 ft, without N2 approximately 30 ft is available.
1CH416 (check      Fails open        Mechanical            If concurrent with a seismic          None          Yes     Yes    The required NPSH for the CH valve)                               binding               event, venting of nitrogen                                  Note   pumps is 1 1  ft, without N2 blanket via the non-safety related                          (1)    approximately 30 ft is available. .
nitro<>en supply piping.
Fails closed      Mechanical            Loss of ability to pressurize         None          Yes     Yes    The required NPSH for the CH binding               expansion   tank                                            Note   pumps is 1 1  ft, without N2
{1)    approximately 30    ft is available ..
1 CH61 (check       Fails open       Mechanical            If concurrent with a seismic          LA-4156       Yes     Yes    Operator action to close 1 CH60.
valve)                               binding               event, draining of system             Alarms. Also          Note through non-safety related piping     S 1 1S2.0P-           (1) to the Penetration Area Cooling       DL.ZZ-Unit piping. Loss of cooling to       0006 (Q) saf related heat loads               Primary Logs.

u c
::s! Ul z      1'1 .
                                                                                                                                                                      ---1   :;u '
1'1 o :::o .2 to S-C-CH-MEE-1 139                   Salan Unit 1 Auxiliary Building Chilled Water Systtm                                             Page 7 of 9     N I'l o Vl Failure Modes and Effects Analysis-LOCA Condition                                                                      u
                                                                                                                                                                      .P. O (Active Failures Only) z Ul N     OJ Component         Failure Mode        Failure                      Effects                     Detection    Single Active         Mitigation/Comments 1'1 Mechanism                                                               Failure                                                       .,.,
1CH260 (Check      Fails closed    Mechanical            Loss of cooling to rad monitors     Temperature      Yes     Yes    The radiation monitors are not                 0
:;u valve)                             binding                                                   alarms on rad            Note   required to function during a                  <
monitors                 (1)    LOCA. or a DBE. The only                       1'1
:;u function that they provide is for              .,.,
detection of a steam generator tube           z rupture.                                      C)
Fails open      Mechanical            If during a DBE draining of CH      LA-4156          Yes     Yes    Passive failure of non-safety                 Fg ;
binding               system through non-safety related   Alarms. Also             Note   class piping is not an accident               <
piping to rad monitors. loss of      S l /S2.0P-                                                                   Ul (1)    initiator. The CH system is not               6 cooling to safety related loads      DL.ZZ-                                                                        z required to withstand a LOCA 0006(Q)                                                                       Ul concurrent with a DBE. Operator               ---1 Primary Logs.
action to close manual valves                 )>
                                                                                                                                                                           ---1 ICH260 or 1CH26 1 .                           c Ul 1 CH253 (Air       Fails closed    Mechanical failure   Loss of cooling to rad monitors      Temperature      Yes     Yes    The radiation monitors  are not
                                                                                                                                                                           )>
operated isolation valve) alarms on rad monitors required to function during a LOCA. or a DBE. The only               I      z 0
n function that they provide is for            :r::
detection of a steam generator tube    I     )>
z rupture. .                                   C)
I     1'1 Control               Loss of cooling to rad monitors     Temperature      Yes     Yes    The radiation monitors  are not        I     Ul malfunction                                               alarms on   rad                 required fo function during a monitors                        LOCA, or a DBE. Safety function is     1 only for detection of a steam
* generator tube rupture.                I I
Fails open      Mechanical failure    If during a DBE draining of CH      LA-4156          No      Yes    Redundant valve 1CH252 will be         I system through non-safety related    Alarms. Also                    able to isolate on low pressure to rad piping . Loss of cooling to safety   SliS2.0P-                       monitors                               I related loads.                       DL.ZZ-0006(Q)
Primary Logs.                                                          I i
Control               If during a DBE draining of CH      LA-4156          No      Yes    Redundant valve 1 CH252 will be malfunction          system through non-safety related    Alarms. Also                    able to isolate on low pressure to rad I piping . Loss of cooling to safety   S l !S2. 0P-                    monitors related loads                        DL ZZ-0006(Q)
Prima_!)'_ Logs.                                                       I

:::O Vl
                                                                                                                                                                           --o c z
                                                                                                                                                                           -j      l'l
:::O l'l o i'l  :::o Attachment 8.2   to s-c-CH-MEE-1 139                     Salem Unit 1 Auxiliary Building Chilled Water System                                             Page S of 9     N o Vl Failure Modes and Effects Analysis-LOCA Condition                                                                       --o O 
                                                                                                                                                                           -JO>.       '
(Active Failures Only)                                                                          z Vl N-     OJ I
Component          Failure Mode        Failure                        Effects                    Detection    Single  Active        MitigationlComments             '
l'l Mechanism                                                                 Failure                                                        ---1 0
. 1 CH252 (Air        Fails closed    Mecbaillcal failure    Loss of cooling* to rad monitors     Temperature      Yes     Yes    The radiation monitors are not                  :::0 operated                                                                                         alarms on rad                   required to function during a                   <
isolation valve)                                                                                 monitors                        LOCA. or a    design basis                      l'l
:::0 earthquake. The only function that              'l they provide is for detection of a              z steam generator tube rupture. .                C)
Control                Loss of cooling to rad monitors      Temperature      Yes     Yes    The radiation monitors are not                  :::0 l'l malfunction                                                 alarms on rad                   required to function during a                   <
monitors Ul LOCA, or a design basis                        0 earthquake. The only function that             z they provide is for detection of a steam R'enerator tube rupture.
Fails open      Mechanical failure     If during a  DBE draining of CH      LA-4156          No      Yes    Redundant valve 1CH252      will be system through non-safety related    Alarms. Also                    able to isolate on low pressure to rad piping to rad monitors. loss of      Sl/S2. 0P-                      monitors                                       )>
z cooling to  safety related loads. DLZZ-                                                                          0 0006(Q) i ,
Primary Loi:!:S.
Control                If during a DBE draining of CH       LA-4156          No      Yes    Redundant valve 1CH252 will be malfunction            system through non-safety related    Alarms. Also                    able to isolate on low pressure to rad         Vl piping to rad monitors. loss of      Sl/S2.0P-                       monitors cooling to safety related loads. DL. ZZ-0006(Q)
Primary LQgs.
 #1 1 Chilled         Pump stops      Mechanical   failure   Loss of flow to chillers. Loss of    Flow alarm FL-   No      Yes    Redundant pump 1 CHE6.
water pump                                                  cooling to safety related heat        1652 1 CHE5                                                     loads.
Electrical failure     Loss of flow to chillers. Loss of    Flow alarm FL-   No      Yes    Redundant pump 1 CHE6.
cooling to safety related heat        1652 loads.
 #12 Chilled          Pump stops      Mechanical failure     Loss of flow to chillers. Loss of    Flow alarm FL-   No      Yes    Redundant pump 1 CHE5.
water pump                                                  cooling to safety related heat        1652 1CHE6                                                      loads.
Electrical failure     Loss of flow to chillers. Loss of    Flow alarm FL-   No      Yes    Redundant pump 1 CHE5.
cooling to safety related heat        1652 loads.
NOTES

u c AJ (J) z :;o  l'l
                                                                                                                                           --j 1'1 .2 to S-C-CH-MEE-1 1 39          Salem Unit 1 Auxiliary Building Chilled Water System                              Page 9 of 9 o      AJ N      i'l Failure Modes and Effects Analysis-LOCA Condition                                            0     (/)
u (Active Failures Only)                                                        -J0.-  0 Bi t Note 1 : At the time of the Salem design, check valves were considered as "passive" devices, this position was Nml   , ,
1'1 accepted by the NRC. Current design standards do not permit a single check valve to fun ction as the class boundary                   'l 0
between safety and non-safety related piping.                                                                                         :;o rrJ Note 2: Deleted                                                                                                                       :;o
                                                                                                                                                 'l z
GJ
:;o 1'1
(/)
0 z
(/)
                                                                                                                                                 --1
                                                                                                                                                 )>
                                                                                                                                                 --1 c
I n
I
                                                                                                                                                 )>
z GJ 1'1
(/)

LRN15-0232 Enclosure 2 Technical Evaluation 801 10953-0105, "Chilled Water System Crosstie FMEA"

                                                           .:. 1 -
Revi s ed to          include L i c en s i ng c omment s
* * * * * * * * * * * * *
* L ong Text Ob j e c t I dent i f i c a t i on* * * * * * * * * * * * *
* Orde r 0 0 0 0 8 0 1 1 0 9 5 3 Ope r a t i on 0 1 0 5 Conf i rmat ion 0 0 1 2 7 0 2 4 3 8 Conf i rma t i on c ount e r 0 0 0 0 0 0 0 5 Long t ext DOCUMENT # :              8 01 1 0 95 3 - 0 1 0 5 TITLE :         Chi l l ed Wat e r Sys t em Cro s s t i e FMEA REASON FOR EVAL UAT I ON                   /   S COPE :
LAR S 1 4 - 0 4 i s b e ing p repared to reque s t a change to the Chi l l ed Water ( CH ) Sys t em T e c hn i c a l Spec i f i c a t i on 3 . 7 . 1 0 .                           One o f the reque s t e d change s i s to a l l ow us e of the exi s t ing CH Sys tem c ro s s t i e b e tween the two uni t s to a l l ow one uni t 1 s chi l l ers t o b e removed f rom s e rvi c e in order t o p e r f o rm maintenance on c ommon l ine c omponent s on that uni t .                                 Thi s eva luat i on perf orm s a Fai lure Mode s and E f f e c t s Ana lys i s ( FMEA) over u s e of the c ro s s t i e .
The s c op e o f thi s T e chni c a l Evalua t i on was revi ewed unde r procedure HU-AA - 1 2 1 2 as part o f the p re - j ob b r i ef .                                       The r e s u l t i ng R i s k Rank was 1 , whi c h c a l l s f o r exis t ing pro c e s s reviews .           I n thi s c as e . the Techn i c a l Eva l uat ion i s s a f e ty - re l a t ed , s o an independent review i s p e r f o rmed .
DETA I LED EVALUAT ION .:
Gene ral D e s ign C r i t e r i on 4 4 , 11 Cool ing Wat e r 11 s t a t e s that 11 s u i t ab l e redundancy in c omponents # s ha l l b e provided to a s s ure that # the sys t em s af ety func t i on can be a c c omp l i shed , a s s uming a s ingl e f a i lure 11
* Reference 1 perf orms a FMEA o f the CH Sys t em .                                           The eva luat i on addre s s e s s ing l e a c t i ve f a i lure vu lne rab i l i t i e s .                           Use of the CH c r o s s t i e doe s no t impac t the func t ion of the c omponen t s c urrent l y addressed i n the eva luat i on o r the impac t o f a f a i lure of any of t he s e c omponent s .                        The current FMEA i s c ons i s t en t w i th dra f t S t andard Revi ew P l an 9 . 2 . 7 , 11 Chi l l ed Wa t e r 11
* R e f erenc e s 2 and 3 perf orm CH and Cont rol Area Vent i l a t i on (CAV)
Sys t em a na lys e s in support of LAR S 1 4 - 0 4 , whi ch inc lude s evalua t i on o f the CH sys t em c ro s s t i e a l i gnment .                                  The analys e s addre s s a sing l e f a i lure o f a c hi l l e r o r pump o n the uni t with the ava i l ab l e chi l l e r s .
The c :ro s s t i e l in e s thems e lves do not c ontain any act ive c omponent s , and thus no new a c t ive f a i lure me chani sms are i nt ro du c e d .        Both the s upp l y and return l ine s cont a in a s ingle manual i s ol a t i on valve .                   Onc e opened , the r e is no fai lure m e c hani sm that w i l l cause e i ther o f thes e valve s t o go c lo s e d .
Admini s t ra t ive cont ro l s wi l l be e s t ab l i shed t o ensure the valves s t ay open for the durat i on the .c ro s s t i e i s ne ede d .

                                                     -   2 -
The CH sys tem i s a medium ene.rgy sys tem .                       Medium Energy Line Breaks ( MELB ) f o r a l l medium energy sys tems <;.re addre s s ed by Re f e rence 4 1 and thu s thi s i s not a new f a i l ur e mechani sm .
CONCLUS IONS / FINDINGS :
Use     of the CH S y s t em c r o s s t i e doe s not impac t the f a i l u r e
* e f fe c t s of CH Sys t em act ive and pa s s ive f a i lures current ly ana ly z ed     . The cro s s t i e l ines do not c on t a in any a c t ive c omponents and do not introdu c e any new f a i lure mechani sms .                             The resul t s .o f thi s Techn i c a l Evaluat ion wi l l be incorpora t ed into S - C - CH - MEE - 1 1 3 9 upon NRC app rova l o f LAR S 1 4 - 0 4 [ 8 0 1 1 0 9 5 3 - 0 1 0 6 ] .
REFERENCES :
1 . S - C - CH-MEE - 1 1 3 9 , Revi s i on 1 , Chi l l ed Wat e r Sys t em S ing l e Fai lure Cr i t eria Vulnerab i l ity A s s es sment
: 2.      S - C - CH - MDC - 2 2 8 2 , Rev i s ion 2 , Chi l ler S ervi c e Wat e r F l ow Requirement s               [ i s sued per Tecb,ni cal Eva luat ion 8 0 1 1 0 9 5 3 - 0 0 1 5 ;
pending NRC approva l of LAR S 14 - 0 4 ]
3 . S - C - CAV - MD C - 2 3 2 0 , Revi s i on 1 , Eva l ua t i on o f the Control Ar e a Vent i l ation Sys tem Dur ing Chi l l ed Water Sys t em Chi l l er Repl ac ement             [ i s sued p e r Techni c al Evaluat ion 8 0 1 1 0 9 5 3 - 0 0 1 5 ;
pending NRC approva l o f LAR S 1 4 - 0 4 ]
: 4.      S - C - Z Z - SD C - 1 2 0 3 ,  Rev i s i on 3 1  Moderate Energy Break Ana ly s i s BREPARER :         Kevin King                                        Date :    S e e SAP INDEPENDENT REVIEWER:                     Robe r t Garver       Date :   S e e SAP LI CENSING REVIEWER ;                  B r i an Thomas               Date :    See SAP APPROVED :.           S e e SAP                                 Date :   S ee SAP}}