ML16256A492

Revision 309 to Final Safety Analysis Report, Chapter 10, Steam and Power Conversion System, Section 10.4.9A

ML16256A492
Person / Time
Site:	Waterford
Issue date:	08/25/2016
From:	Entergy Operations
To:	Office of Nuclear Reactor Regulation
Shared Package
ML16256A115	List: ML16256A120 ML16256A121 ML16256A122 ML16256A123 ML16256A124 ML16256A126 ML16256A127 ML16256A128 ML16256A129 ML16256A131 ML16256A132 ML16256A136 ML16256A137 ML16256A138 ML16256A144 ML16256A145 ML16256A150 ML16256A153 ML16256A154 ML16256A155 ML16256A156 ML16256A157 ML16256A159 ML16256A160 ML16256A161 ML16256A162 ML16256A163 ML16256A164 ML16256A165 ML16256A167 ML16256A170 ML16256A171 ML16256A172 ML16256A174 ML16256A175 ML16256A181 ML16256A182 ML16256A183 ML16256A184 ML16256A185 ML16256A186 ML16256A188 ML16256A189 ML16256A190 ML16256A191 ML16256A192 ML16256A193 ML16256A194 ML16256A195 ML16256A196 ... further results
References
W3F1-2016-0053
Download: ML16256A492 (23)

Text

WSES-FSAR-UNIT-310.4.9A-iAPPENDIX 10.4.9AEMERGENCY FEEDWATER SYSTEMREQUIREMENTS EVALUATIONThis Evaluation is documented in Tables10.4.9A-1, 10.4.9A-2, and 10.4.9A-3.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-1 (Sheet 1 of 7) Revision 15 (03/07)

EVALUATION OF THE WATERFORD SES UNIT NO.3 EMERGENCY FEEDWATER SYSTEM VERSUS THE REQUIREMENTS OF STANDARD REVIEW PLAN (SRP) 10.4.9 AND BRANCH TECHNICAL POSITION (BTP) ASB 10-1

A. SRP 10-4.9 Rev. 1

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE

Acceptability of the design of the Auxiliary Feedwater System, as described in the applicant's Safety Analysis Report (SAR),

is based on specific general design criteria and regulatory guides. Listed below are the specific criteria as they relate

to the AFS.

1. General Design Criterion 2, as related to structures T he EFS is designated seismic Category I. EFS 10.4.9.3.2, housing the system and the system itself being capable pumps their controls, and the Condensate Storage 9.2.5.3.3, of withstanding the effects of natural phenomena such Pool are located inside the RAB and are thus Table 3.2-1 as earthquakes, tornadoes, hurricanes, and floods. protected from site related phenomena such as NRC Q.371-11

tornadoes, hurricanes and floods.

The EFS isolation valves and the Turbine Steam Supply Valves are located in the open area on top of the RAB and are protected by the RAB walls from flooding and direct tornado and hurricane winds. Additional makeup water for the EFS may be obtained from the Wet Cooling Tower (WCT) basins, which are designated seismic Category I and designed to withstand the effects of tornadoes, hurricanes and floods.

(DRN 06-907, R15)

2. General Design Criterion 4, with respect to structures The EFS pumps, their controls, and the Condensate 10.4.9.3.2, housing the system and the system itself being capable Storage Pool are located inside the RAB and are 3.5, of withstanding the effects of external missiles and are thus protected from external missiles; the EFS Table 3.5-3 internally generated missiles, pipe whip, and jet isolation and impingement forces associated with impingement forces associated with pipe breaks. pipe breaks. Turbine Steam Supply Valves located (DRN 06-907, R15) in the open area on top of the RAB and are protected from tornado missiles by grating installed above the valves. The EFS is designed to withstand the effects of 10.4.9.3 internally generated missles. This subject is discussed 3.5 in Section 3.5 and summarized for the EFS in Table 3.5-3.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-1 (Sheet 2 of 7) Revision 307 (07/13)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE

The EFS is protected from the effects of 3.6, pipe rupture. Each motor driven pump 10.4.9 is located in its own room; the turbine driven pump is located away from high from high energy systems. The EFS isolation valves and the Turbine Steam Supply Valves are located adjacent to the break exclusion area portion of the main steam and feedwater piping.

Otherwise, design features, such as separation, pipe whip restraints and barriers ensure that pipe break, will not impair the functional capability of the EFS.

3. General Design Criterion 5, as related to the capability Not Applicable of shared systems and components important to safety to perform required safety functions.

(EC-41355, R307)4. General Design Criterion 19, as related to the design The EFS is automatically initiated by an 10.4.9, capability of system instrumentation and controls for Emergency Feedwater Actuation Signal 7.3.1.1.6, prompt hot shutdown of the reactor and potential (EFAS) as described in Section 7.3.

7.5 capability for subsequent cold shutdown. The EFS can also be started manually from the Main Control Room and the auxiliary control panel. Safety related display information located in the main control room provides the operator with sufficient information to perform the required safety functions. See Section 7.5.

Procedures are established for operating manual handwheel overrides or lining up backup air supplies for continued safety function after 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> mission time of the safety related motive gas accumulator.

(EC-41355, R307)

5. General Design Criterion 44, to assure: (DRN 00-786, R11-A)

a. The capability to transfer heat loads from the The EFS supplies sufficient cooling water 10.4.9 reactor system to a heat sink under both normal to the steam generators following loss operating and accident conditions. of normal feedwater or main steam or main feedwater line break to provide cooldown of the Reactor Coolant System to the temperature and pressure at which the Shutdown Cooling System can be placed in operation. (DRN 00-786, R11-A)

WSES-FSAR-UNIT-3TABLE 10.4.9A-1 (Sheet 3 of 7) Revision 9 (12/97)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCEb.Redundancy of components so that under accidentThe EFS is designed to perform10.4.9conditions the safety function can be performedits safety functions assumingassuming a single active component failure. (Thisa single active componentmay be coincident with the loss of offsite powerfailure coincident with a loss for certain events.)of offsite power. The turbinedriven EFS pump or both motordriven pumps together have beendesigned to provide 100% of theflow necessary for residual heat removal over the entire range ofreactor operation including allpostulated design basis accidents.

However, it has been determinedthat under realistic conditions,any one EFS pump can supplyadequate flow for decay heatremoval to one (400 gpm required) or both (450 gpm total required)steam generators.c.The capability to isolate components, subsystems,The EFS isolation valves are10.4.9or piping if required so that the system safetypowered from Redundant Class 1Efunction will be maintained.dc buses to ensure that theemergency feedwater flow to theaffected steam generator wouldbe shut off, and at least one path would remain open to admit emer-gency feedwater to the intactsteam generator when required, assuming a single active failure.6.General Design Criterion 45, as related to designProvisions have been made in the6.6provisions made to permit periodic inservice in-design and layout of the EFS tospection of system components and equipment.allow for compliance with theinservice inspection requirementsof ASME Code Section XI.

The inservice inspection programwill be submitted to the NRC atleast six months prior to firstrefueling.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-1 (Sheet 4 of 7) Revision 307 (07/13)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE

7. General Design Criterion 46, as related to design The EFS shall undergo preopoperational 14.2.12.2.68 provisions made to permit appropriate functional tests to ensure its ability to testing of the system and components to assure struc- function as intended. A description ural integrity and, leak-tightness, operability and of this test is contained in Section performance of active components, and capability of 14.2.12.2.68. the integrated system to function as intended during normal, shutdown and accident conditions.

The EFS shall also undergo periodic Technical Specification functional testing of the system and 4.7.1.2. its components to ensure the system functions as intended. These tests shall be conducted in accordance with the surveillance requirements of the plant technical specifications.

8. Regulatory Guide 1.26, as related to the quality group The design and fabrication of the EFS 3.2.2 classification of system components.

meet the requirements of Regulatory Table Guide 1.26. The safety class 2 and 3 3.2-1 portions of the EFS meet the Regulatory Guide 1.26 Quality Group B and C standards respectively.

9. Regulatory Guide 1.29, as related to the seismic desi gn The EFS meets the requirements of Regulatory 10.4.9, classification of system components. Guide 1.29. It is designated as Seismic 3.2.1, Category I and will thus perform its design Table functions following the SSE. The pertinent 3.2-1 quality assurance requirements of Appendix B to 10CFR50 are applied.

10. Regulatory Guide 1.62, as related to design provisions The EFS meets the requirements of Regulatory 7.3.1.1.6, made for manual initiation of each protective action. Guide 1.62. The operator may manually initiate 7.3.2.1.2 the Emergency Feedwater Actuation Signal (EFAS) from an easily accessible location in the control room (RTG Board). Manual initiation will ensure that protective action goes to completion. (DRN 00-786, R11-A; EC-42115, R307)11. Regulatory Guide 1.102, as related to the protection of The Waterford 3 Nuclear Plant Island Structure 2.4.10 structures, systems, and components important to safety (NPIS) is a reinforced box structure with solid Technical Requirements from the effects of flooding. exterior walls and is flood protected up to elevation Manual 3/4.7.5 +30 ft. MSL. This is sufficient to accommodate at the Design Basis Flood identified in Regulatory Guide 1.59. The technical specification requirements of Regulatory Guide 1.02 position C.2 are therefore optional. (DRN 00-786, R11-A; EC-42115, R307)

WSES-FSAR-UNIT-3 TABLE 10.4.9A-1 (Sheet 5 of 7) Revision 307 (07/13)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE (EC-42115, R307)

However, due to the nature of potential flooding, Technical Requirements Manual 3/4.7.5 which meets the intent of that Regulatory Guide position has been established. In regard to position C.3 of the guide it has been determined that all roofs housing safety related structures can safety store the maximum possible ponding reresulting from the PMP. See also item I above. (EC-42115, R307)

12. Regulatory Guide 1.117, as related to the protection of The EFS is protected from the effects of tornado structures, systems, and components important to safety as described in item 2 above. from the effects of tornado missiles

13. Branch Technical Positi on ASB 3-1 and MEB 3-1, as The EFS is pr otected from the effects of pipe related to breaks in high and moderate energy pi ping rupture as described in item 2 above. systems outside containment.

The EFS itself is used only for emergency 3.6 shutdown of the reactor when the Main 3.6A Feedwater System is inoperative. Therefore in accordance with the APCSB 3-1, it is not analyzed as a high energy system. However, the EFS has been analyzed as a moderate energy system in accordance with the Branch Technical Position MEB 3-1.

14. Branch Technical Position ASB 10-1, as related to See part B auxiliary feedwater pump drive and power supply diversity.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-1 (Sheet 6 of 7)Revision 11-A (02/02)B.BTP ASB 10-1 (DESIGN GUIDELINES FOR AUXILIARY FEEDWATER SYSTEM PUMP DRIVE AND POWER SUPPLY DIVERSITY FOR PRESSURIZED WATER REACTOR PLANTS)

FSAR BRANCH TECHNICAL POSITION COMPLIANCE REFERENCE1.The auxiliary feedwater system should consist of atThe EFS consists of two motor driven pumps, 10.4.9 least two full-capacity, independent systems thateach with a design flow capacity of 395 gpminclude diverse power sources.(45gpm recirculation included and powered from separate, redundant Class 1E 4.16 KV buses, andone 780 gpm (80 gpmrecirculation included)

turbine driven pump. The turbine driven pump or both motor driven pumps together2.Other powered components of the auxiliary feedwaterhave been designed to provide 100% of the flow system should also use the concept of separate andnecessary for residual heat removal over themultiple sources of motive energy. An example ofentire range of postulated design basis

the required diversity would be two separate auxi-accidents. However it has been determined thatliaryfeedwater trains, each capable of removingunder realistic conditions, any one EFS pump cantheafterheat load of the reactor system, having supply adequate flow for decay heat removal one train powered from either of two ac sources to one (400 gpm required) or both (450 gpm total and the other train wholly powered by steam and required) steam generators.

dc electric power.

The turbine driven pump, system

safety controls, and turbine steam supply valves

are powered from the SA/B Class 1E 125V dc bus. The EFS isolation valves are also fail-open and powered from Class 1E 125 dv bu ses.This ensures that flow to the depressurized

steam generator can be terminated and at least

one path to the intact steam generator will be available assuming any single active failure.(DRN 00-786)3.The piping arrangement, both intake and discharge,The piping arrangement is designed to permit the10.4.9 for each train should be designed to permit the pumps to supply feedwater to any combination of pumps to supply feedwater to any combination of steamsteam generators. Waterford 3 uses the crossovergenerators. This arrangement should take into accountpiping scheme. This is described in FSAR Section

pipe failure, active component failure, power supply 10.4.9 and shown in the schematic of Figure 10.4-6.failure, or control system failure that could preventThe EFS exceeds this BTP criteria in that the pipe-system function. One arrangement that would be accept-lines to each steam generator are isolated by four

able is crossover piping containing valves that can bepneumatically operated fail open isolation valves.operated by remote manual control from the control room,The power diversity designed into the system isusing the power diversity principle for the valve opera-summarizedabove. The design of the EFS thus ensures

tors and actuation systems.

that in the event of a single failure it can supply water to one or both steam generators, and that water

could be prevented from entering the ruptured line during the postulated main steam feedwater line break.(DRN 00-786)

WSES-FSAR-UNIT-3TABLE 10.4.9A-1 (Sheet 7 of 7) Revision 9 (12/97)

FSAR BRANCH TECHNICAL POSITION COMPLIANCE REFERENCE4.The auxiliary feedwater system should be designed withsuitable redundancy to offset the consequences of anysingle active component failure; however, each trainneed not contain redundant active components.5.When considering a high energy line break, the systemThe Waterford 3 EFS is not used during normal reactor3.6, 3.6Ashould be so arranged as to assure the capability tostartup, hot standby or shutdown. It is only usedsupply necessary emergency feedwater to the steamfor emergency shutdown when main feedwater isgenerators, despite the postulated rupture of anyinoperative. In accordance with the definition high energy section of the system, assuming a con-and criteria of APCSB 3-1, the EFS is notcurrent single active failure.a high energy system. However, the EFS has beenanalysed as a moderate energy system in accordancewith Branch Technical Position MEB 3-1.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 1 of 11)EVALUATION OF THE WATERFORD SES UNIT NO.3 EMERGENCY FEEDWATER SYSTEMVERSUS THE NRC EFW SHORT AND LONG TERM RECOMMENDATIONSA.Short Term Recommendations FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE1)5.2.1Technical Specification Time Limit onAFW System Train OutageConcern - Several of the plants reviewed have TechnicalSpecifications that permit one of the AFW system trainsto be out of service for an indefinite time period.Indefinite outage of one train reduces the defense-in-depth provided by multiple AFW system trains.Recommendation GS The licensee should propose modifica-Waterford Emergency FeedwaterTechnicaltions to the Technical Specifications to limit the time thatSystem limiting conditions forSpecificationsone AFW system pump and its associated flow train and essentialoperation and surveillance 3/4.7.1.2instrumentation can be inoperable. The outage time limit andrequirements state that an inoper-subsequent action time should be as required in currentable EFS train restored to oper-Standard Technical Specifications; i.e., 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, respectively.able status in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in hotshutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.2)5.2.2Technical Specification Administrative Controls onThis is in accordance with currentManual Valves - Lock and Verify Positionstandard Technical Specifications.Concern - Several of the plants reviewed use a single manualvalve or multiple valves in series in the common suctionpiping between the primary water source and the AFW systempump suction. At some plants the valves are locked open,while at others, they are not locked in position. If thevalves are inadvertently left closed, the AFW system would beinoperable, because the water supply to the pumps would be isolated. Since there is no remote valve position in-dication for these valves, the operator has no immediatemeans of determining valve position.Further, the Technical Specifications for plants with locked-open manual valves do not require periodic inspection toverify that the valves are locked in the correct position.For most plants where the valves are not locked open, valveposition is verified on some periodic basis.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 2 of 11)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCERecommendation GS The Licensee should lock open singleAll manually operated valves10.4.9.2valves or multiple valves in series in the AFW pump suctionin EFS suction are locked openFigure 10.4-6piping and lock open other single valves or multiple valvesand are provided with limitin series that could interrupt all AFW flow. Monthly in-switches for position monitoringspections should be performed to verify that these are loc-by plant computer.

ated in the open position. These inspections should be pro-posed for incorporation into the surveillance requirements ofIn addition, the Waterford EFWthe plant Technical Specifications. See Recommendation GL-2system has redundant, parallelfor the longer term resolution of this concern.flow paths (piping and valves) sothat there is no single valve3)5.2.3AFW System Flow Throttling-Water Hammerwhich if left closed, couldinterrupt all flow.Concern - Several of the plants reviewed apparently throttledown the AFW system initial flow to eliminate or reduce the potential for water hammer. In such cases, the overall re-liability of the AFW system can be adversely affected.Recommendation GS The licensee has stated that itThe Waterford 3 EFS does not10.4.9.3.4throttles AFW system flow to avoid water hammer. The Licen-throttle flow to avoid watersee should re-examine the practice of throttling AFW systemhammer. The EFS will supply onflow to avoid water hammer.demand sufficient initial flowto assure adequate decay heatThe Licensee should verify that the AFW system will supply onremoval. Water hammer consider-demand sufficient initial flow to the necessary generators toations have been taken into assure adequate decay heat removal following loss of main feed-account in the final design.water flow and reactor trip from 100% power. In cases wherethis reevaluation results in an increase in initial AFW system flow, the licensee should provide sufficient information todemonstrate that the required initial AFW system flow will notresult in plant damage due to water hammer.4)5.2.4Emergency Procedures for Initiating BackupWater SuppliesConcern - Most of the plants do not have written proceduresfor transferring to alternate sources of AFW supply if pri-mary supply is unavailable or exhausted. Without specificcriteria and procedures for an operator to follow to trans-fer to alternate water sources, the primary supply couldbe exhausted and result in pump damage or a long interrup-tion of AFW flow.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 3 of 11)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCERecommendation GS Emergency procedures for transferringPrimary EFS water supply is pro-to alternate sources of AFW supply should be available to thevided by the Condensate Storageplant operators. These procedures should include criteria toPool (CSP). Alternate EFS waterinform the operator when, and in what order, the transfer tosupply is provided by the Wetalternate water sources should take place. The following Cooling Tower (WCT) basins. Pro-cases should be covered by the procedures:cedures will be provided on Water-ford which will include criteria(1)The case in which the primary water supply is initi-to inform the operator when, andally available. The procedures for this case shouldin what order, the transfer toinclude any operator action required to protect thethe alternate water supply should AFW system pumps against self-damage before water flowtake place.is initiated.(2)The case in which the primary water supply is beingdepleted. The procedure for this case should pro-vide for transfer to the alternate water sourcesprior to draining of the primary water supply.5)5.2.5Emergency Procedures for Initiating AFW FlowFollowing a Complete Loss of AlternatingCurrent PowerConcern - Some operating plants depend on ac power for all sourcesof AFW system supply including turbine-driven pump train. In theevent of loss of offsite and onsite ac power, ac-dependent lube oilsupply or lube oil cooling for the pump will stop, and/or manual actionsare required to initiate AFW flow from the turbine-driven pump bymanually opening the turbine steam admission valve and/or AFWsystem flow control valves. There are no procedures available to the plant operators for AFW system initiation and control under theseconditions. This could result in a considerable time delay for AFWsystem initiation, since the operators would not be guided by procedures dealing with this event.Recommendation GS The as-built plant should be capable ofThe EFS turbine-driven pump is10.4.9providing the required AFW flow for at least two hours from one AFWindependent of ac power. Lubepump train, independent of any ac power source. If manual AFW systemoil supply is internal to theinitiation or flow control is required following a complete loss of ac power,pump and therefore requires noemergency procedures should be established for manually initiatingoil pump. Cooling water for theand controlling the system under these conditions. Since the water forturbine oil cooler is suppliedcooling of the lube oil for the turbine driven pump bearings mayfrom an extraction point on the be dependent on ac power, design or procedural changes shallfirst stage of the pump.be made to eliminate this dependency as soon as practicableUntil this is done, the emergency proceures should provide for The turbine steam supply valves (TSSV) an individual to be stationed at the turbine driven pump in-are motor operated, fail as is valves,the event of the loss of all ac power to monitor pumppowered from the A/B dc bus.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 4 of 11) Revision 6 (12/92)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCEbearing and/orlube oil temperatures. If necessary, this The EFS system pipeline to eachoperator would operate the turbine-driven pump in an on-offsteam generator consists of twomode until ac power is restored. Adequate lighting poweredparallel branches, each with anby direct current (dc) power sources and communications atisolation valve and a flow control local stations should also be provided if manual initiationvalve. The isolation valves areand control of the AFW system is needed. (See Recommenda-pneumatically operated, fail open,tion GL-3 for the longer term resolution of this concern.)and are controlled by redundant,Class 1E 125V dc buses. The primary6)5.2.6AFW System Flow Path Verificationand backup control valves are pneu-matically operated, fail open, andConcern - Periodic testing of the AFW system is accomplishedthe E/P's receive their signal fromby testing of individual components of one flow train (peri-redundant PAC cabinets.odic pump recirculation flow test or automatic valve actuation), thusaltering the normal AFW system flow path(s). The flow capability ofthe entire AFW system, or at least one integral AFW system train, isonly demonstrated on system demand following a transient, or if theAFW system is used for normal plant startup or shutdown.Recent Licensee Event Reports indicate a need to improve thequality of system testing and maintenance. Specifically, periodictesting and maintenance procedures inadvertently result in (1) morethan one AFW system flow train being unavailable during the test, or (2) the AFW system flow train under test not being properly restoredto its operable condition following the test or maintenance work. TheOffice of Inspection and Enforcement has taken action to correctItem (1): the recommendation below is made to correct Item (2).Recommendation GS The licensee should confirm flow pathWaterford 3 maintenance procedures willTechnicalavailability of an AFW system flow train that has been out ofbe implemented requiring operator toSpecificationsservice to perform periodic testing or maintenance as follows:determine that the EFS valves are3/4.7.1.2properly aligned and a second operator(1)Procedures should be implemented to require anto independently verify that the valvesoperator to determine that the AFW system valvesare properly aligned.are properly aligned and a second operator to independently verify that the valves are properlyIn addition, Technical Specifications haveTechnicalaligned.been provided to assure that, prior to plantSpecificationsstartup following any cold shutdown 30 days3/4.7.1.2(2)The licensee should propose Technical Specifica-or longer, or whenever feedwater line cleaningtions to assure that, prior to plant startupthrough the emergency feedwater line has beenfollowing an extended cold shutdown, a flow testperformed, a test will be performed to verifywould be performed to verify the normal flow paththe normal flow path from the primary EFS waterfrom the primary AFW system water source to thesource to the steam generators. This flow test steam generators. The flow test should be con-will be conducted during cold shutdown, with EFSducted with AFW system valves in their normalvalves in the normal alignment for EFS flow fromalignment.the primary water source to the steam generators.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 5 of 11)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE7)5.2.7Non-Safety Grade, Non-Redundant AFW SystemAutomatic Initiation SignalsConcern - Some plants with an automatically initiated AFWsystem utilize some initiaiton signals that are not safety-grade do not meet the single failure criterion, and are notrequired by the Technical Specification to be tested period-ically. This can result in reduced reliability of the AFW system.Recommendation GS The licensee should verify that theWaterford Emergency Feedwater7.3automatic start AFW system signals and associated circuitrySystem signals and circuits areare safety-grade. If this cannot be verified, the AFW systemall safety related Class 1E. Theautomatic initiation system should be modified in the short-Waterford EFS is in accordance withterm to meet the functional requirements listed below. ForRecommendation GS-7.the longer-term, the automatic initiation signals and circuitsshould be upgraded to meet safety-grade requirements, as in-dicated in Recommendation GL-5.(1)The design should provide for the automatic ini-tiation of the AFW system flow.(2)The automatic initiation signals and circuitsshould be designed so that a single failure will not result in the loss of AFW system function.(3)Testability of the initiation signals and circuitsshall be a feature of the design.(4)The initiation signals and circuits should bepowered from the emergency buses.(5)Manual capability to initiate the AFW system fromthe control room should be retained and should be implemented so that a single failure in the manualcircuits will not result in the loss of systemfunction.(6)The ac motor-driven pumps and valves in the AFWsystem should be included in the automatic actu-ation (simultaneous and/or sequential) of theloads to the emergency buses.(7)The automatic initiation signals and circuits shall be designedso that their failure will not result in the loss of manual capability to initiate the AFW system from control room.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 6 of 11)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE8)5.2.8Automation Initiation of AFW SystemsConcern - For plants with a manually initiated AFW systemthere is the potential for failure of the operator to man-ually actuate the system following a transient in time to re-assure reactor decay heat removal via the steam generator(s).While IE Bulletin 79-06A requires a dedicated individual for W-design operating plants with a manually initiated AFWsystem, further action should be taken in the short-term.This concern is identical to Item 2.1.7a of NUREG-0578.Recommendation GS-8 - The licensee should install a system toWaterford Emergency Feedwater 10.4.9automatically initiate AFW system flow. This system need notSystem is automatically initiated.be safety-grade; however, in the short-term, it should meetThe Waterford EFS is in accordance withthe criteria listed below, which are similar to Item 2.1.7aRecommendation GS-8.of NUREG-0578. For the long-term, the automatic initiationsignals and circuits should be upgraded to meet safety-graderequirements, as indicated in Recommendation GL-2.(1)The design should provide for the automatic ini-tiation of the AFW system flow.(2)The automatic initiation signals and circuitsshould be designed so that a single failure willnot result in the loss of AFW system function.(3)Testability of the initiation signals and circuitsshall be a feature of the design.(4)The initiation signals and circuits should bepowered from the emergency buses.(5)Manual capability to initiate the AFW system fromthe control room should be retained and should be implemented so that a single failure in the manualcircuits will not result in the loss of systemfunction.(6)The ac motor-driven pumps and valves in the AFWsystem should be included in the automatic actu-ation (simultaneous and/or sequential) of theloads to the emergency buses.(7)The automatic initiation signals and circuits shall bedesigned so that their failure will not result in the lossof manual capability to initiate the AFW system from control room.

WSES-FSAR-UNIT-3TABLE 10.4.9A-2 (Sheet 7 of 11) Revision 9 (12/97)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE9)5.3.1Primary AFW Water Source Low Level AlarmConcern - Plants which do not have level indication and alarm for theprimary water source may not provide the operator with sufficientinformation to properly operate the AFW system.Recommendation - The licensee should provide redundantThe Condensate Storage Pool (CSP),10.4.9level indication and low level alarms in the controlthe primary EFS water source, has room for the AFW system primary water supply, to allowredundant, safety grade level in-the operator to anticipate the need to make up waterdication and low level alarms inor transfer to an alternate water supply and preventthe control room. The low level a low pump suction pressure condition from occurring.alarm setpoint is at the Techni-The low level alarm setpoint should allow at leastcal Specifications minimum useable20 minutes for operator action, assuming that thevolume of 170,000 gallons and includeslargest capacity AFW pump is operating. uncertainty. A low-low level alarm is initiatedin the control room when the water inventory in the CSP is depleted to not less than 30,000gallons usable volume. This amount is sufficientto supply water to one 700 gpm capacity pump ortwo 450 gpm capacity pumps for at least 30 minutes(See A.5b).10)5.3.2AFW Pump Endurance TestConcern - Since it may be necessary to rely on the AFW system toremove decay heat for extended periods of time, it should bedemonstrated that the AFW pumps have the capability for continuousoperation over an extended period without failure.Recommendation - The licensee should perform a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> endur-In accordance with staff'sance test on all AFW system pumps, if such a test or continu-position on endurance testsous period of operation has not been accomplished to date.for EFS pumps set forth NUREG-0800Following the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> pump run, the pumps should be shut down10.4.III.3, a 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> endurance test hasand cooled down and then restarted and run for one hour.been performed on the Waterford 3 EFS pumps.Test acceptance criteria should include demonstrating that thepumps remain within design limits with respect 10 bearing/

bearing oil temperatures and vibration and that pump roomambient conditions (temperature, humidity) do not exceed en-vironmental qualification limits for safety-related equipment in the room.11)5.3.3Indication of AFW Flow to the Steam GeneratorsConcern - Indication of AFW flow to the steam generators isconsidered important to the manual regulation of AFW flow to maintainthe required steam generator water level. This concern is identical toItem 2.1.7.b of NUREG-0578.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 8 of 11) Revision 307 (07/13)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCE

Recommendation - The licensee should implement the follow- Safety grade emergency feedwater flow 7.3.1.1.6, ing requirements as specified by Item 2.1.7.b on page A-32 indication and safety grade, redundant Table 7.5-1 of NUREG-0578: steam generator level indication is available to the operator in the control (1) Safety-grade indication of AFW flow to each steam room. These instrument loops are generator should be provided in the control room. powered by the uninterruptible 120V ac (2) The AFW flow instrument channels should be powered Class 1E power source.

from the emergency buses consistent with satisfy-ing the emergency power diversity requirements for the AFW system set forth in Auxiliary Systems Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9.

12) 5.3.4 AFW System Availability During Periodic Surveillance Testing

Concern - Some plants require local manual realignment of valves to conduct periodic pump surveillance tests on one AFW system train. When such plants are in this test mode and there is only one remaining AFW system train available to respond to a demand for initiation of AFW system operation, the AFW system redundancy and ability to withstand a single

failure are lost. (DRN 00-786, R11-A; EC-41355, R307)Recommendation - Licensees with plants which require local Procedures are established for testing manual handwheel 10.4.9.2 manual realignment of valves to conduct periodic tests on overrides on the EFS Flow Control Valves. The procedure one AFW system train and which have only one remaining AFW performs a single stroke and then restores the valve to the train available for operation should propose Technical operational alignment. Other than this brief manual realign- Specifications to provide that a dedicated individual who ment, local manual realignment of valves to conduct surveillance is in communication with the control room be stationed at tests on EFS trains is not required. Periodic pump surveillance the manual valves. Upon instruction from the control room, tests can be conducted by merely starting the pump and water this operator would realign the valves in the AFW system will be pumped from the CSP through the mini-flow recirculation from the test mode to its operational alignment.

lines back to the CSP. The manual handwheel override test will have specific instructions regarding the need to immediately restore the handwheel position to normal upon any interruption of the test. (EC-41355, R307)

B. 5.4 Long-Term Recommendations 1) 5.4.1 Automatic Initiation of AFW Systems

Concern - This concern is the same as short-term generic recommendation GS-8; namely, failure of an operator to actuate a manual start EFW in time to maintain steam generator water level high enough to assure decay heat removal via the steam generator(s).

Recommendation GL For plants with a manual AFW system, Not applicable. Waterford 3 initiation is auto- 10.4.9, the licensee should install a system to automatically initiate the matic, safety grade, and redundant. 7.3.1.1.6, AFW system flow. This system and associated automatic 7.3.1.1.1 (DRN 00-786, R11-A)

WSES-FSAR-UNIT-3TABLE 10.4.9A-2 (Sheet 9 of 11) Revision 9 (12/97)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCEinitiation signals should be designed and installed to meetsafety-grade requirements. Manual AFW system start andcontrol capability should be retained with manual startserving as backup to automatic AFW system initiation.2)5.4.2Single Valves in the AFW System Flow Path Concern - This is the same short-term generic recommendation GS namely, AFW system inoperability due to an inadvertently closedmanual valve that could interrupt all AFW system flow.Recommendation GL Licensees with plant design in whichAll manually operated valves in EFS10.4.9,all (primary and alternate) water supplies to the AFW systemssuction are locked open and areFigure 10.4-6pass through valves in the single flow path should installprovided with limit switches forredundant parallel flow paths (piping and valves).position indication in the controlroom.Licensees with plant designs in which the primary AFWsystem water supply passes through valves in a singleIn addition, the Waterford EFS system flow path, but the alternate AFW system water supplieshas redundant, parallel flow pathsconnect to the AFW system pump suction piping downstream(piping and valves) so that thereof the above valve(s), should install redundant valvesis no single valve which if left parallel to the above valve(s) or provide automatic open-closed, could interrupt all flow.ing of the valve(s) from the alternate water supply uponlow pump suction pressure.The licensee should propose Technical Specifications to incorporateappropriate periodic inspections to verify the valve positions into thesurveillance requirements.3)5.4.3Elimination of AFW System Dependency onAlternating Current Power Following AComplete Loss of Alternating Current PowerConcern - This concern is the same as short-term genericrecommendation GS-5 namely, delay in initiation of AFW systemoperation or maintaining AFW system operation following a postulatedloss of onsite and offsite ac power; i.e., ac power blackout.Recommendation GL At least one AFW system pump and itsWaterford's EFS turbine-driven pump is10.4.9, 8.1Aassociated flow path and essential instrumentation shoulddc controlled and capable of being oper-automatically initiate AFW system flow and be capable ofated independently of ac power for at leastbeing operated independently of any ac power source for atfour hours. The turbine steam supply valvesleast two hours. Conversion of dc power to ac power isare motor operated, fail as is valves, acceptable.from A/B dc bus. The EFS system pipelineto each steam generator consists of twoparallel branches, each with an isolation WSES-FSAR-UNIT-3 TABLE 10.4.9A-2 (Sheet 10 of 11) Revision 6 (12/92)

FSAR ACCEPTANCE CRITERIA COMPLIANCE REFERENCEvalve and a flow control valve. The isola-tion valves are pneumatically operated,fail open, and are controlled byredundant, Class 1E, 125V dc buses.

The primary and backup control valves4)5.4.4Prevention of Multiple Pump Damage due to Lossare pneumatically operated, failof Suction Resulting From Natural Phenomenaopen, and the E/P's receive theirsignal from redundant PAC cabinets.Concern - In many of the operating plants, the normalwater supply to the AFW systems pumps (including theinterconnected piping) is not protected from earthquakesor tornadoes. Any natural phenomenon severe enough toresult in a loss of the water supply could also be severe enough to cause a loss of offsite power with loss of mainfeedwater, resulting in an automatic initiation signal tostart the AFW system pumps. The pumps would start withoutany suction head, leading to cavitation and multiple pumpdamage in a short period of time, possibly too short for the operators to take action that would protect the pumps.This may lead to unacceptable consequences for some plants,due to a complete loss of feedwater (main and auxiliary).Recommendation GL Licensees having plants with un-Not applicable. The normal water10.4.9protected normal AFW system water supplied should evaluatesupply to the EFS system is thethe design of their AFW systems to determine if automaticCondensate Storage Pool (CSP).protection of the pumps is necessary following a seismicThe CSP is located inside theevent of a tornado. The time available before pump damage,Reactor Auxiliary Building andthe alarms and indications available to the control roomthus is protected from siteoperator, and the time necessary for assessing the problemrelated phenomena. The CSP is and taking action should be considered in determiningalso designed as seismic Category I.whether operator action can be relied on to prevent pumpdamage. Consideration should be given to providing pumpThe EFS isolation valves and TSSV protection by means such as automatic switchover of theare located atop the RAB and arepump suctions to the alternate safety-grade source of water,protected from flooding and directautomatic pump trips on low suction pressure, or upgradinghurricane and tornado winds by thethe normal source of water to meet seismic Category I andRAB walls. The valves are designedtornado requirements.to withstand the pressure differentialinduced by a tornado and are protected5)5.4.5Non-Safety Grade, Non-Redundant AFW Systemby a grating against tornado missiles.Automatic Initiation SignalsConcern - This concern is the same as short-term genericrecommendation GS namely, reduced AFW system reliabilityas a result of use of non-safety-grade, non-redundant signals,which are not periodically tested, to automatically initiatethe AFW system.

WSES-FSAR-UNIT-3 Table 10.4.9A-2 (Sheet 11 of 11) Revision 6 (12/92)ACCEPTANCE CRITERIACOMPLIANCEFSAR REFERENCERecommendation GL The licensee should upgrade the AFWWaterford 3 EFS automatic initia-7.3.1.1.6system automatic initiation signals and circuits to meettion signals and circuits aresafety-grade requirements.safety-grade.

WSES-FSAR-UNIT-3 TABLE 10.4.9A-3 (Sheet 1 of 4)COMPARISON OF WATERFORD EFW SYSTEM WITH NRC EFW SYSTEM FLOW REQUIREMENTSAs a result of recent staff reviews of operating plantAuxiliary Feedwater Systems (AFWS), the staff concludesthat the design bases and criteria provided by licenseesfor establishing AFWS requirements for flow to the steam generator(s) to assure adequate removal of reactor decayheat are not well defined or documented.We require that you provide the following AFWS flow designbasis information as applicable to the design basis transientsand accident conditions for your plant.1.a.Identify the plant transient and accident conditions1.a.The design bases for the Waterford 3 Emergency Feedwater Systemconsidered in establishing AFWS flow requirements,(EFS) are described in Subsections 10.4.9 and 10.4.9.1 of the FSAR.including the following events:The adequacy of the EFS during transient and accident conditions isshown in Chapter 15 of the FSAR, for each event where EFS is re-1.Loss of Main Feed (LMFW)quired to function. The following references are provided to showwhere each of the events listed in the question have been considered.2.LMFW w/loss of offsite ac power3.LMFW w/loss of onsite and offsite ac power1.Loss of Main Feed - FSAR Subsection 15.2.2.5 4.Plant cooldown2.Loss of Main Feed w/loss of offsite power - FSAR Subsection15.2.3.25.Turbine trip with and without bypass3.Loss of Main Feed w/loss of onsite and offsite power - FSARSubsection 10.4.9.1(f)6.Main steam isolation valve closure4.Plant Cooldown, FSAR Subsection 10.4.9.1(a)(2)7.Main feed line break5.a.Turbine Trip with bypass. If the Trubine Bypass System8.Main steam line break functions, it follows that the main condenser is operableand emergency feedwater actuation is not required.9.Small break LOCAb.Turbine trip without Bypass. FSAR Subsection 10.4.9.1(b)10.Other transient or accident conditions notlisted above. 6.MSIV Closure. FSAR Subsection 10.4.9.1(b)7.Main Feed Line Break. FSAR Subsection 10.4.9, Introduction 8.Main Steam Line Break. FSAR Subsection 10.4.9, Introduction 9.Small Break LOCA. FSAR Subsections 6.3.3 and 6.3.3.4.2.c.2 10.Other transients. FSAR Chapter 15 WSES-FSAR-UNIT-3 TABLE 10.4.9A-3 (Sheet 2 of 4) Revision 14 (12/05) b. Describe the plant protection acceptance criteria b. The acceptance criteria for each of the events analyzed in Chapter and corresponding technical bases used for each 15 of the FSAR are determined by the event classifications set initiating event identified above. The acceptance forth in Regulatory Guide 1.70, Revision 2. That is, the allowable criteria should address plant limits such as: transient RCS pressure, fuel design limit, or degree of fuel damage is determined by the estimated frequency of occurrence of the event

- Maximum RCS pressure (PORV or safety valve being analyzed. To the extent that the EFS is activated, or must actuation) be activated, the response of the EFS is included in the analysis; in addition, single failures in the EFS are considered in the sin-

- Fuel temperature or damage limits (DNB, PCT, gle failure analyses required for each event.

maximum fuel central temperature) The EFS control system is designed to avoid overfilling the steam - RCS cooling rate limit to avoid excessive generator and enable the operator to control the rate of RCS cooling. coolant shrinkage - Minimum steam generator level to assure sufficient steam generator heat transfer surface to remove decay heat and/or cool down the primary system. (DRN 05-544, R14) 2. Describe the analyses and assumptions and corresponding 2. The analysis performed for each event is described in detail in technical justification used with plant condition con- Chapter 15 of FSAR, and is prescribed in Regulatory Guide 1.70, Re-sidered in 1.a. above including: vision 2, the assumptions (and technical justification for those assumptions) are included in the FSAR. Parameters and assumptions a. Maximum reactor (including instrument error allowance) common to several accidents are described in Section 15.0 of the at the time of the initiating transient or accident. FSAR. a. Maximum reactor power is given in FSAR Table 15.0-4. b. Time delay from initiating event to reactor trip. b. Delay times associated with individual reactor trips are given c. Plant parameter(s) which initiates AFWS flow and in Table 15.0-3.

time delay between initiating event and introduc-tion of AFWS flow into steam generator(s). c. The Emergency Feedwater Actuation Signal (EFAS) is described in Subsection 7.3.1.1.6 of the FSAR. Where there is any signifi- d. Minimum steam generator water level when initiating cance, the time delay between initiating event and introduction event occurs. of the EFS flow into the steam generator(s) is shown in the "Sequence of Events" Tables in Chapter 15, e.g., Tables 15.2-1,

e. Initial steam generator water inventory and deple- 15.2-6, 15.2-8, and 15.2-10.

tion rate before and after AFWS flow commences - identify reactor decay heat rate used. d. The steam generator water level assumed for each event analyzed is chosen to maximize the severity of those events in which it

f. Maximum pressure at which steam is released from may be significant. An example of this is provided in Sub-generator(s) and against which the AFW pump must section 15.2.2.5.3.2 of the FSAR.

develop sufficient head. e. The reactor decay heat used in all safety analysis is the ANS g. Minimum number of steam generators that must receive Standard Decay Heat Curve, with the uncertainties defined in AFW flow; e.g., 1 out of 2?, 2 out of 4? the ANS Standard. Refer to Subsection 6.3.1.2 of the FSAR. h. RC flow condition - continued operation of RC pumps The steam generator fluid mass inventory is shown as a function or natural circulation. of time in the FSAR for those events where it is a parameter of interest. Refer to FSAR Figures 15,1-11, 15.1-19, 15.1-30, 15.1-38d,

i. Maximum AFW inlet temperature. 15.1-57, 15.1-70, 15.2-11, 15.2-35,,15.2-47, and 15.2-63. (DRN 05-544, R14)

WSES-FSAR-UNIT-3 TABLE 10.4.9A-3 (Sheet 3 of 4) Revision 14 (12/05) (DRN 03-2064, R14;05-544, R14) j. Following a postulated steam or feed line break, time f. The steam generator pressure as a function of time is shown delay assumed to isolate break and direct AFW flow in the FSAR for those events where it is a parameter of time to intact steam generator(s). AFW pump flow capacity interest, and the time at which the EFS is started is shown allowance to accommodate the time delay and maintain in the "Sequence of Events" Tables. Refer to Figure 15.2-7 minimum steam generator water level. Also identify and Table 15.2-1 credit taken for primary system heat removal due to blowdown. k. Volume and maximum temperature water in main feed lines between steam generator(s) and AFWS connection to main feed line. l. Operating condition of steam generator normal g. In the absence of normal feedwater, emergency feedwater must blowdown following initiating event. be supplied to at least one steam generator. m. Primary and secondary system water and metal h. There is no requirement for reactor coolant pump operation. sensible heat used for cooldown and AFW flow There is sufficient natural circulation flow for plant cooldown sizing. and transfer to shutdown cooling. n. Time at hot standby and time to cooldown RCS i. The maximum expected EFW inlet temperature is 100 F. to RHR system cut in temperature to size AFW water source inventory. j. For the main steam line break, refer to FSAR Table 15.1-12. For the feedwater line break, refer to FSAR Table 15.2-8. The water inventory in the intact steam generator is shown on Figure 15.1-38d for the main steam line break and on Figure 15.2-47 for the feedwater line break case. For the analysis of the steam line break, it is assumed that the blowdown is saturated steam with no moisture carryover. This results in the maximum energy removal from the RCS (maximum cool down) with the greatest resultant moderator reactivity feedback potential for fuel damage (FSAR Subsection 15.3.1.3.2). For the feedwater line break, it is assumed that the blowdown is saturated liquid, with no steam content, and, at the same time, it is assumed that normal feedwater flow to the intact steam generator goes instantaneously to zero. These assumptions minimize the energy removal from the RCS, with the maximum resultant transient pressure. (DRN 03-2064, R14;05-544, R14)

WSES-FSAR-UNIT-3TABLE 10.4.9A-3 (Sheet 4 of 4) Revision 9 (12/97)k.The volume and maximum temperature of water in main feed lines betweenthe steam generators and the EFS connection to the main feed line isas follows:1.Volume for Steam Generator 1 line is 2043.3 gallons2.Volume for Steam Generator 2 line is 2050.5 gallonsThe maximum expected feedwater temperature is 448

°F.l.The steam generator blowdown line is isolated either by the EFAS orCIAS. For all postulated faulted conditions (LOCA, steam or feed linebreak) the blowdown will be terminated automatically.m.The EFS flow requirements are established by the reactor decay heatimmediately after reactor trip. Sensible heat removal during cooldownhas a second-order effect on the calculations performed to verify thatthe bases defined in FSAR Subsections 10.4.9 and 10.4.9.1 are satisfied.The volume of water used in these calculations is given in Table 5.1-2 inthe FSAR. The mCp for the RCS is approximately 0.64 x 10 6 BTU/F.n.The time requirements used in establishing the water inventory for the EFSare given in FSAR Subjection 10.4.9.1.e.3.Verify that the AFW pumps in your plant will supply3.The EFS is designed to perform its intended function in the event of athe necessary flow to the steam generator(s) as determinedsingle failure in the system and a postulated pipe break, as required byby items 1 and 2 above considering a single failure. IdentifyBranch Technical Position APCSB3-1 (FSAR Subsection 10.4.9.1.c).the margin in sizing the pump flow to allow for pumpIn the event of loss of ac power (onsite and offsite) an additional singlerecirculation flow, seal leakage and pump wear.failure is not postulated (FSAR Subsection 10.4.9.1.f).The bounding event for the EFS is the FWLB which requires an EFW pumpdelivery to the intact steam generator of 575 gpm at 1102 psig. The minimumcapability for the two electric driven pumps or the one turbine drivenpump exceeds this requirement accounting for pump recirculation flow,seal leakage and pump wear.