ML17289B075

Rev 0 to Technical Memorandum Tm 2025, Secondary Containment/Standby Gas Treatment Design Basis.

ML17289B075
Person / Time
Site:	Columbia
Issue date:	11/23/1992
From:	WASHINGTON PUBLIC POWER SUPPLY SYSTEM
To:
Shared Package
ML17289B074	List: ML17289B072 ML17289B075
References
TM-2025, TM-2025-R, TM-2025-R00, NUDOCS 9212290130
Download: ML17289B075 (59)

Text

4 EPN REF.

WASHINGTON PURLlC POWER SUPPLV SVSrZM TECHNICAL MEMORANDUM INITIATINGDOC. TM NO.

PAGE 001 NCR 288-357 202~

OUTPUT REFERENCES QC.

Technical S ciTication 3/4.6.5 TITLE Secondary Containment/Standby Gas Treatment Design Basis PURPOSE See page 4 Page No. Page No.

~Su uc ~Pa e ScSu c ~Pa e 600-999 COVER SHEET 001-002 001 THRU 002 OTHER THRU TEXT 003-499 003 THRU 0 fO OTHER THRU OTHER THRU REV.

NO.

REVISION DESCRIPTION 'REPARED BY/DATE 0 Initial Issue REV. SPECIAL DESIGN REVIEWS/APPROVALS APPROVED BY/DATE VERIFIED BY/D TE NO.

giY>Q p/'0 I 0 Scc/.

0 s/q/SS /Z.-// g2.

9212290i30 92i222-PDR ADOCK 05000397

..P . PDR,44-000 Ro n/90)

I

~ ~

'I I I ~

I 1

f

I

~ ~

~ I TM 2025 Rev. 0 ADDITIONALREVIEWER 4

E ngmeenng.

Electrical II l4 gz SL Giannini Date Mechanical W Harn s Date PSE ////7 g z-Date

/- 8-WD Bainard Date

-l9-G Brastad Date Safety Analysis ll 20-fZ-RO Vosburgh Date Licensing I I 2o- yZ AG Hosier Date Technical Staff JE Bekhazt Date Operations DW Me har D te

~ ~ 8 j 7

~ ~ ~

g TM 2025 Rev. 0 INDEX 1.0 PURPOSE AND SCOPE

2.0 INTRODUCTION

3.0 ISSUE OVERVIEW 4.0 REQUIRED SYSTEM/COMPONENT SAFETY FUNCTION

5.0 TECHNICAL EVALUATION

FOR RESOLUTION OF ISSUE 5.1 Building/System Design Assessment 5.2 Technical Assessment 5.2.1 Resolution of Issue 1 - Inlet Valve Failure 5.2.2 Resolution of Issue 2 - Inadvertent Deluge Valve Initiation 5.2.3 Resolution of Issue 3 - Inadequate Heater Control Logic 5.2.4 Resolution of Issue 4 - Hot Short Failures 5.2.5 Resolution of Issue 5 - Mispositioning of Valves 5.3 Recommendations 6.0 CORRECTIVE ACTION PLAN 7.0 FINAL RESOLUTION

8.0 REFERENCES

ATTACHMENT 1 - SINGI E FAILURE ANALYSIS ATTACHMENT2 - SGT SYSTEM FAULT TREE ANALYSIS ATTACHMENT3 - BUILDINGDRAWDOWN MODEL ATTACHMENT4 - DOSE MODEL ATTACHMENT5 - ASSESSMENT OF REQUIREMENTS FOR SGT DELUGE SYSTEM ATTACHMENT6 - PROPOSED TECHNICAL SPECIFICATION CHANGES

~ ~ ~

I p>

I g g TM 2025 Rev. 0 1.0 PURPOSE AND SCOPE The purpose of this Technical Memorandum is to document the assessment of the Secondary Containment drawdown issue (see Section 3.0). This assessment includes the background for the analyses and corrective actions taken to ensure that the Standby Gas Treatment (SGT) system will adequately maintain Secondary Containment at a negative 0.25" w.g.

differential pressure with respect to atmospheric pressure during design basis accidents and limit radioactive releases to within 10CFR100 limits. Included with the assessment is an action plan for revising the existing Secondary Containment design and establishing a new design basis along with a list of required actions which must be completed to fully implement this new-basis;---- -" -.

2.0 INTRODUCTION

Niagara Mohawk Corporation filed an LER on Nine Mile Point, Unit 2 (NMP-2) with the NRC in mid-1987 following discovery that assumptions used to evaluate Secondary Containment differential pressure drawdown time following a postulated design basis event (LOCA) with a coincident loss of offsite power (LOOP) were not conservative. Upon review of WNP-2 calculations of drawdown time, it was found that the WNP-2 analysis was also nonconservative. Like NMP-2, an assumed failure of certain emergency power buses cause delay in the ability to achieve the required negative Secondary Containment differential pressure. Further, contrary to licensing commitments, the original WNP-2 analysis did not consider adverse meteorological conditions (e.g., wind and temperature) that can act to increase Secondary Containment leakage.

3.0 ISSUE OVERVIEW NCR 288-357, (JCO Rev, 0 and Rev. 1) originally documented a problem associated with ability of the Standby Gas Treatment (SGT) system to effectively perform its safety function under postulated post-accident conditions including consideration of adverse environmental conditions. A review of the WNP-2 design basis indicated that the original analysis assumed the time required for Secondary Containment pressure to reach -.25" w.g. (the time where SGT is assumed to become effective) was achieved in two minutes. Upon further investigation it was determined that the analysis had not properly accounted for diesel start time, atmospheric dispersion, maintenance of -.25" w.g. for all parts of the reactor building and adverse weather conditions of wind and extreme cold, which could affect maintenance of the negative pressure differential and influence the total building in-leakage.

1 ~

J ~

I I 1

g

~ ~ ~

)

I TM 2025 Rev. 0 Revision 2 to the original Rev. 0 and 1 JCO assessments was required to address new issues which were subsequently identified dealing with instrument calibration accuracy and setpoint error. Specifically, SGT flow indicator/recorders (SGT-FR-2A1, 2A2, 2B1, 2B2) were calibrated to read fiow in standard cubic feet per minute (SCFM) when the process flow was at 212'F, 2 psig and 0% relative humidity. During any event requiring SGT initiation, these conditions are never reached. Consequently, for the range of conditions under which SGT is designed to operate, the actual standard flow through the SGT filter units would have been 5% lower to 10% higher than indicated on the flow recorder. This was reported to the NRC in LER 92-008.

In addition, the SGT fan.flaw. controller(limiter)loop has.a, conservatively calculated accuracy of +10%. When combined, the effect of these two corrections is that the surveillance test results for system fiow and building leakage could each have been 20%

higher than previously believed.

This new information posed two problems. First, the higher total system flow (up to 20%

higher) could have resulted in a trip of the SGT fan motors on thermal overloads if the fans had been called upon to operate under degraded voltage conditions. Second, the building leakage could have been up to 20% higher than assumed in the Secondary Containment drawdown analysis resulting in potentially under predicting the time to reach -.25" w.g.

building pressure.

Finally, additional changes from Rev. 2 of the JCO to Rev.3 were required to address potential problems which could arise due to high service water pond temperatures. The issue here was that under certain conditions where pond temperatures are high and outside temperatures are low, building drawdown time is increased. This issue is discussed in Attachment 3 and results presented in Figure 5.

4.0 REQUIRED SYSTEM/COMPONENT SAFETY FUNCTION The SGT system and Secondary Containment act to minimize and control radiological releases from the plant to within 10CFR100 limits. Unfiltered release of primary Containment leakage following a severe accident and other radioactive gasses and particulates resulting from accidents outside the primary Containment (e.g., fuel handling and instrument line breaks), are prevented by maintaining the Secondary Containment pressure at -0.25" w.g. with respect to atmospheric pressure, and by filtering the effluent gasses from the Secondary Containment. The requirement for the -0.25" w.g. comes from Section 6.2.3 of the Standard Review Plan and is the point at which credit for SGT charcoal adsorption is allowed.

I

~ ~

I ~ ~ ~

~

2025 Rev. 0 To demonstrate that the SGT and Secondary Containment design keeps radioactive releases to within 10CFR100 limits, the post-accident dose assessment is performed using the source term criteria outlined in Regulatory Guide 1.3. The design must be able to accommodate a post-accident single active failure and remain operable. In addition, certain plant specific parameters must be considered in the evaluation. For example, SGT capacity, building in-leakage, outside meteorological conditions (wind, temperature, and stability), building initial temperature, building heat loads, available cooling capacity, emergency diesel start time loading sequence, and drawdown time for worst building elevation. The time to reach

-0.25" w.g. is referred to as building drawdown time and is one of the major factors influencing offsite and control room radiation doses.

5.0 TECHNICAL EVALUATION

FOR RESOLUTION OF ISSUE 5.1 Design Assessment As previously discussed, various aspects of SGT, Secondary Containment, Standby Service Water, and weather modeling, influence the ability of Secondary Containment and SGT to meet their design functions. Certain combinations of single active failures and winter weather conditions act to place additional load on SGT while increasing Secondary Containment leakage. For example, wind increases the demand on the SGT to hold the'leeward side of the Secondary Containment sufficiently negative while simultaneously increasing the differential pressure, and thus the in-leakage, on the windward side of the building. Differential temperature between the inside and outside of the Containment creates a differential pressure gradient from the bottom to the top of the Secondary Containment due to the density difference of the air inside and outside the building. As a result, the lower portion of the building must be held at a high differential pressure (up to -0.75" w.g.) to assure that a -0.25" w.g. differential exists at the Containment roof line during winter conditions. This overall greater differential pressure proportionally increases Secondary Containment in-leakage. The net result of wind and winter temperatures is the inability to hold the upper portion of the Secondary Containment at -0.25" w.g. differential in cold weather, and to lengthen the time required to reach -0.25" w.g. differential in moderate weather.

Steady-state Secondary Containment pressure is established when building in-leakage is equal to SGT flow and Secondary Containment temperature transients have stabilized. Analysis shows that the time required to reach the steady-state condition is a function of the assumed meteorological conditions at the time of a postulated design basis event, the assumed type of single active failure coincident with the event, the Standby Service Water (SW) temperature, the total building in-leakage, and the capacity of the SGT system. The transient analysis clearly'ndicates that the limiting

~ ~ I I I I ~ I I g

TM 2025 Rev. 0 single active failure is the assumed loss of one SGT filter unit. Under the conditions with a single filter unit, design basis SGT flow of 4457 and a maximum Technical Specification allowable Secondary Containment leakage 2240 scfm, the upper-most surface areas of the Secondary Containment cannot be maintained at -0.25" w.g.

differential with respect to atmospheric pressure under all meterological conditions.

In addition, high SW water temperature acts to extend the time required to reach-0.25" w.g., but does not affect the final steady-state pressure.

In generating the NCR 288-357 JCO, a parametric study was required to account for all the critical factors discussed. above that could influence drawdown time of Secondary Containment:.. These drawdown~times:were.then coupled, with the R.G. 1.3 methodology resulting in a maximum allowable drawdown time of 10 minutes to assure that radioactive releases remain within 10CFR100 limits. However, several adjustments to the original analysis were necessary to support the new basis.

Specifically, building in-leakage was limited to less than 1475 actual cubic feet per minute (acfm) versus the Technical Specification leakage of 2240 cfm, SGT flow was initially increased from 4457 cfm to 5600 acfm, initial building temperature was reduced from 104'F to a more realistic 75'F and outside meteorological conditions were factored into the analysis. A detailed discussion of the Secondary Containment analysis model, key parameters and model evaluation is provided in Attachment 3.

Table 1 of Attachment 3 summarizes the key parameters for each case evaluated and Figures 2A through 4 depict the building response versus time for the Table 1 cases.

Attachment 4 provides a detailed discussion of the dose assessment and related methodology supporting the different SGT/Secondary Containment cases evaluated.

Table 1 of Attachment 4 summarizes the dose results.

5.2 Technical Resolution Although the technical basis established for the JCO demonstrated that the plant design could meet regulatory requirements, it provided no margin for degradation of system performance or emergence of new requirements; e.g., increased building leakage, reduc'ed SGT performance. Consequently, several design changes were evaluated to upgrade the SGT system to a level of performance which will accommodate future requirements or possible degradation in system performance. The preferred approach was to utilize existing system equipment to the extent practical to keep upgrade costs under control. To meet this objective while re-establishing an acceptable level of performance, it was decided that the existing SGT capacity had to be increased. With the existing SGT configuration, this increase in capacity could most easily be achieved by taking advantage of the redundant design of each filter unit and running both filter units simultaneously using the same divisional power supply. This approach

TM 2025 Rev. 0 necessitates that each SGT filter unit be capable of operating simultaneously and shown to have the capability to automatically switch to either emergency power division regardless of the single failure assumed. To assure that the current system could be operated in this design configuration, a single failure analysis of the system was performed.

A detailed discussion of the single failure analysis is provided in Attachment I. The results of the analysis show that the SGT two-unit alignment is a viable option but indicated that this alignment as currently designed, is susceptible to some single failures. Specifically,

1) Single failure of the SGT inlet air valve to open in either unit.

2) Lack of control logic to detect and transfer SGT operation to the redundant filter unit on failure of a heater coil (SGT humidity control).

3) A failure of either SGT unit due to a single failure opening of the associated fire protection water deluge supply valve.

4) Electrical separation - circuit faults altering the designed active function of SGT valves and fans simultaneous in both SGT units (14 valves and 2 fans affected).

5) Inadvertent repositioning of valves in opposite divisions within a given SGT filter unit.

Overall, the results of the analysis show that the SGT system has features that provide more reliable operation than minimum design requirements would normally dictate.

However, to upgrade the existing .design, to.single. failure proof two-unit operation requires that the above identified single failure issues be addressed and resolved.

A discussion along with the recommended resolution for each of these five issues is provided below.

5.2.1 Resolution of Issue 1 - Inlet Valve Failure The SGT inlet valves, SGT-V-2A/2B will be administratively realigned to a normally open position. The valves will not be de-energized or manually locked into the open position because the flexibility to open and close these valves is necessary to support plant evolutions such as Primary Containment inerting and purging and post-accident EPG activities. This flexibilityis considered essential for overall plant personnel safety (e.g., purging could allow N, to be discharged

~ ~

II I ~

E 1 ~

I I

TM 2025 Rev. 0 to the reactor building) and overall post-accident response capability. Aligning the valves to normally open eliminates the issue of failure to open on demand.

The only remaining issue would be circuit faults, see Section 5.2.4 for discussion on this issue.

5.2.2 Resolution of Issue 2 - Inadvertent Deluge Valve Initiation The options under review for resolution of inadvertent deluge operation and thus failure of the SGT filter units include design changes which range from providing a new divisionally separated and redundant isolation valves scheme to an alternate fire.protection method"such" as.CARBOX.:. The final resolution for.

this issue has not yet been established, but will ensure that this single failure mechanism is eliminated and will be consistent with the requirement of the American Nuclear Insurers.

5.2.3 Resolution of Issue 3 - Inadequate Heater Control Logic The lead and lag heaters for the SGT system are provided to keep relative humidity (R.H.) of the inlet gases entering the charcoal beds below 70%. This requirement is dictated by R.G. 1.52 and is the basis for crediting the SGT with a 99% filtration efficiency. Note, the R.G. allows an SGT efficiency of 99%

when R.H. is below 70% and 0% efficiency if R.H. is greater than 70%.

Currently, there are two different analyses that evaluate the conditions in Secondary Containment post accident. These analyses are documented in References 15 and 19 (results of the Reference 19 evaluation are summarized in Table 6.2-29 of the FSAR). The results of these analyses differ in relation to R.H. in that the Reference 15 calculation predicts that R.H. never reaches 70%

while the Reference 19 calculations, predicts that 70% is reached after approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Given this inconsistency in the evaluations, two options were evaluated to resolve the heater logic issue:

1. Physical plant modification fixing the logic for automatic transfer from lead to lag heater on detection of heater problem or,

2. Provide interim administrative control such that operators monitor and switch from the lead to the lag heater ifthe R.H. reaches or exceeds 70%.

Based on the planned revision of the Secondary Containment post accident analyses to reflect the new SGT design, a permanent plant modification may be deemed necessary ifhumidity within the SGT filter unit is shown to exceed 70% post accident.

~ ~

a's <

I ~

s A

I, 'E

TM 2025 Rev. 0 Option 1 requires a physical modification to the plant and would cost from $ 48k to $ 68k (see Reference 14). Option 2 on the other hand, can be implemented immediately at no capital cost and as such is preferred over Option 1. The main limitation with Option 2 is that the assumptions used in the SGT fault tree analysis (see Attachment 2) assumed an automatic transfer from the lead to lag heater on detection of a problem. Final closure of this issue will depend upon resolution of the differences in the humidity profiles in the two calculations. It is the opinion of engineering that the original calculation in the FSAR was overly conservative and was based on a SGT flow rate significantly less than that proposed for two filter unit operation. Therefore, for the interim it is proposed

~

that Option 2 remain in-place until. these-calculations-can-be,'completed utilizing the new SGT system design and associated design parameters.

5.2.4 Resolution of Issue 4 - Circuit Fault (Hot Short) Failures Circuit faults, hot shorts (conductor-to-conductor), opens and grounds, are created by component failures which result in excessive electrical currents due to the electrical circuit protection (fuse or breaker) finite time to activate and, subsequently, cable/wire jacket failures and localized fires. These types of malfunction represent a type of single failure within a system. Consequently, to fully comply with the single failure criterion specified in the WNP-2 Electrical Separation Criteria contained in the WNP-2 Specification, Division 201, it is necessary that hot shorts be included in the analysis.

With this in mind, a single failure analysis (see Attachment 1) was performed for the SGT system. The results of the analysis indicate that to fully eliminate all hot short type failures would require major physical modifications to the plant. These modifications include the protection and/or rerouting of control circuits for 14 valves and 2 fans. The estimated cost for these modifications is provided in Table 2 of Attachment 2.

Again, due to the high cost of modifying the plant to eliminate the hot shorts, more cost effective alternatives were evaluated. The most cost-effective approach appears to involve utilizing the existing SGT equipment, eliminating the single failures of initiation logic and mechanical valve failure and then evaluate the relative contribution elimination of the hot shorts would make to overall SGT system reliability.

The SGT circuits requiring separation for hot shorts are low energy (125 volts and below) which are protected by circuit breakers or fuses (Note, simultaneous phase-to-phase shorts in three phase circuits are not considered credible). The 10

1

~ 1 g y ~ ~

0 TM 2025 Rev. 0 probability of failures for these circuits resulting in circuit damage and subsequent circuit faults is very low, and therefore supports a probabilistic approach.

A failure study, including cable faults (hot shorts) was performed utilizing fault tree analysis. The results of this study are summarized in Attachment 2. The results show that elimination of single failure vulnerability due to mechanical failure and initiation logic; i.e., the inlet valves, lead to lag heater transfer, and the fire protection deluge valves provide system reliability in excess of two 100% fully redundant filter units. The failure analysis further indicated that elimination of all-of-'the-potential hot-shorts-would.not improve system reliability significantly. That result, plus the high cost associated with eliminating hot short potential, leads to the recommendation that no changes be made to the existing electrical separation provided for the SGT system. It should be noted that separation criteria is met between power divisions but due to the uniqueness of the SGT design, intra-division separation is also required. However, not providing electrical separation to prevent the hot short potential is contrary to the commitments made to the NRC in the WNP-2 FSAR, Section 8.3.1.4. As a result, it will be necessary to gain NRC approval of a lesser separation scheme prior to declaring the SGT system single failure proof with approved exceptions.

5.2.5 Resolution of Issue 5 - Mispositioning of SGT Valves This failure mechanism involves the inadvertent repositioning of the control valves in the system due to a hot short in their control circuitry. These failure mechanisms are being addressed as part of the hot short resolution. See 5.2.4 above and Attachment 1 for further discussion. These valves will remain energized to allow the operators the control capability necessary to support both normal and post accident functions.

5.3 Recommendations Based on the above assessments, upgrading the SGT system such- that both units can be operated redundantly appears to be realistic and cost-effective. To upgrade the SGT system, the single failures identified in Attachments 1 and 2 need to be addressed. The actions necessary to accomplish the two-unit upgrade are as follows.

1. The SGT inlet valves, SGT-V-2A/B should be realigned to'a normally open position. Power will not be removed. These valves are required to remain operational to support remote operator control. Spurious closure due to hot shorts is not significant as discussed Section 5.2.4.

11

TM 2025 Rev. 0

2. As discussed above, reanalysis of the post accident response of the Secondary Containment may demonstrate that the heaters used in the SGT system are unnecessary (see Section 5.2.3). Until the calculation documenting this is finalized, administrative controls will be in place to provide a lead to lag heater transfer upon loss of lead heater.

3. Technical Specifications/FSAR must be revised to reflect the increased SGT flow requirements. Engineering recommends retaining the currently specified allowed outage times specified in the Technical Specifications. Case 6 of Attachment 3 demonstrates that a single SGT filter unit can drawdown the Secondary Containment-to a negative pressure within-5-minutes at a proposed leakage of 2240 ACFM and SGT system flow of 5300 ACFM. This single unit capability, although not meeting all the design criteria, namely -.25" w.g., does provide a strong technical basis for saying a single filter unit out of service for short periods is acceptable. See Attachment 6 for additional discussion.

The above recommendations ensure an SGT system reliability that is better than having two, 100% capacity, redundant filter units. This new design basis constitutes significant changes to the original plant design, including relaxation relative to electrical separation, drawdown time, increased radiation doses, and therefore must be submitted to and approved by the NRC. Following approval, all associated design and licensing documentation must be updated. See Action List under Section 6.0 for an outline of the required actions. Note, the plant and procedure modifications discussed above represent enhancements to the SGT system and therefore could be implemented immediately since they would not result in an unreviewed safety question.

12

~ 1 1'1 l 1

~

1 ~

~

1

TM 2025 Rev. 0 6.0 CORRECTIVE ACTION PLAN MANHOURS ACTIVITY 20 Prepare SER request including T.S. basis discussion 40 Develop new Tech Specs and implementation statement 40 Determine setpoint calculation impact Revise FSAR 400 Develop and issue design direction for resolution of the deluge valve issue following ANI/Fire Protection concurrence (N/A) SER issued by NRC Revise Chapter 6 drawdown calculation/revised EQ profile 30 Issue PMR for heater logic change, ifneeded 20 Review and revise Rad Zone maps Review vital access routes and areas 872 Issue BDC to install heater changes, ifrequired 120 Revise DRD's 60 Revise IPE Notebooks 1000 Revise design basis calcs, CVI documents Sc drawings Revise setpoint calculations 80 Revise Chapter 6 & 15 doses 8c revise fuel handling accident 40 Review and define impact to EQ for QID's Revise PPM's 40 Revise EOP's 280 Install heater changes at R-9, ifrequired Revise QID files with generic profile fix Finalize all remaining DBD's and be ready to incorporate (TBD) Provide updates to NRC as needed on design basis changes 40 Request Tech Spec change from NRC Support NRC requests for information on T.S. change Receive Tech Spec change from NRC Issue all remaining revised DBD's documents, PPM's, calcs, etc.

5282 Total mhrs 13

I ~ ~

f g lg ~ ~

~

I TM 2025 Rev. 0 7.0 FINAL RESOLUTION This will be provided later upon completion and acceptance by the NRC.

14

~ ~

g ~ ~

1

~

9

~

I

,~ If TM 2025 Rev. 0

8.0 REFERENCES

1. NE-02-88-27, Rev. 2 "Control Room, TSC, LPZ, and Exclusion Area Dose using R.G. 1.3 Source Term or NUREG 0588 Source Term"

2. ME-02-89-09, "Secondary Containment Drawdown Time"

3. WNP-2 Technical Specifications

4. NCR 288-357, Secondary Containment Drawdown Issue

5. LER 89-040-01, Secondary Containment Drawdown Issue

6. PPM 8.3.177, Secondary Containment Leakage Test

7. WNP-2 Final Safety Analysis Report (FSAR) 8 NUREG 0588, Rev. 1, Interim Staff Position on Environmental Qualification of Safety Related Electrical Equipment.

9. Regulatory Guide 1.3, Rev. 2, Assumptions used for Evaluating the Potential Radiological Consequences of a LOCA for BWRs.

10. 10CFR100, Reactor Site Criteria

11. 10CFR50, Appendix A, GDC19, Radiation Protection for Control Room

12. IOM, EANF-90-0409, 12/04/90, RO Vosburgh to PJ Macbeth, "Reliability Analysis f 9 S ddy ~ T Sy (SGT Sy, yl Sy 999, ~i'i "WNP-2 SGTS Reliability Evaluation", Final Report, ERIN Engineering and Research, 13.

5/1/92

14. Supply System calculation E/I-02-91-05, Rev. 0, SGT Single Failure Analysis

15. NE-02-82-14, Rev. 0, Calculation for Determination of Environmental Conditions Present in the Reactor Building following loss of non-safety related equipment capability Fuel Pool heatup.

16. Principles of Heat Transfer, 3rd Edition, Krieth

17. Memo from S.L. Giannini to S.R. Kirkendall, Engineering and Plant Cost Estimates for SGT Modifications Resulting from Single Failure Analysis, dated 10/1/92

18. GE letter G-KK-92-096, "WNP-2 Post-LOCA=*Radiological- Consequences"; dated.

10/27/92

19. B&R Calculation 9.23.04, Rev. 0, Calculation for Post LOCA Secondary Containment pressure temperature transient Analysis 50% fuel pool capacity.

20. Regulatory Guide 1.52, Design, Testing and Maintenance Criteria for Post-Accident Engineered Safety-Feature Atmosphere Cleanup System Air filtration and Adsorption Units of Light-Water-Cooled Nuclear Power Plants.

21. ANSI Standard N509-1980, Nuclear Power Plant Air Cleaning Units and Components.

22. Drawing E519, Sheet 25, Motor Valve and Miscellaneous Control Elementary Diagram.

15

y ~ g> ~ ~

~ ~

1 4

~ ~

~ $

~ S TM 2025 Rev. 0 ATTACHMENT 1 - SINGLE FAILURE ANALYSIS An evaluation was performed to determine the single failure vulnerabilities of the SGT system for two-unit divisionally redundant operation. Reference 14 documents this evaluation. A summary of that evaluation is provided below:

The following single failures were postulated for each SGT filter unit:

A. Power supply failure.

B. Component mechanical failure.

C. Component electrical failure.

D. Initiation signal failure.

E. Circuit failure (hot shorts, shorts to ground).

F. Single operator error.

Single failures were postulated for all major components of SGT. The overall effects were evaluated to determine whether a single failure (whether it be power supply failure, initiation signal failure, mechanical failure, etc) would adversely affect SGT operation. For a given type of postulated failure, such as a loss of power supply, all major components were evaluated for a potentially limiting condition. The same process was used for all other failure types as well.

Some components were found to be vulnerable to more than one type of postulated failure. For example, the SGT inlet valves are limited in operation by a circuit failure (hot short), an initiation signal failure and a mechanical failure. Given that a mechanical failure is most limiting, the recommended corrective action of changing the initial state of the valve would eliminate the need for other corrective measures against circuit and initiation signal failures.

In cases where the effects of various failure types'were the same, the analysis did not repeat the application of all types of failures to all major components. For instance, the effects of electrical component failures are largely encompassed by the effects of a power supply failure, circuit failure (fault to ground) or mechanical failure. Thus, an electrical component failure was not repeated for all the major components already covered by the other failure analyses. Rather, an electrical component failure was imposed on discrete electrical control subcomponents used in the timer and logic circuits of the lead heaters and fans.

For the above postulated failures, circuit failures (hot shorts) were found to have the most extensive impact on SGT operation. Such failures can result in spurious equipment operation, such as inadvertent valve motion (or cycling) or fan operation. Spurious valve motion can modify or disable required SGT flow paths or result in unwanted deluge spray into a filter unit.

Spurious lead fan operation can defeat the desired logic sequence of lead equipment within an SGT filter unit, whereby the lead heater is locked out of operation without the desired 16

'I g I ~ ~ ~

g I ~

I ~

TM 2025 Rev. 0 transfer to backup equipment. Circuit failures (hot shorts) were restricted to low energy control circuits. Spurious operation of equipment resulting from a hot short between three phase power circuits was not considered a credible event.

The specific findings of the single failure analysis are as follows:

A. Each normally closed inlet valve (SGT-V-2A/2B) is located in a flow path that has no redundant success path. Although these valves are fail safe and will open on loss of air or loss of power, they are vulnerable to initiation logic failure and mechanical failure creating a single failure vulnerability point for the affected filter unit. Realigning these valves to a normally open'position Could'eliininate thi's failure'm'ode.

B. Six fire protection deluge valves (SGT-SPV-F16, F26, F36, F46, F56, F66-three in each filter unit) are also susceptible to the effects of circuit failures (hot shorts). Inadvertent opening of any of these valves could wet the associated SGT compartment, possibly disabling the unit. Redesigning the deluge supply valve arrangement to be divisionally redundant and single failure proof would eliminate this failure mechanism. Alternatively, closing the manual valves (SGT-V-F11, F21, F31, F41, F51, F61) upstream of the deluge valves would also eliminate this problem. Other options may also be available. See Attachment 5 for additional discussion.

C. Each SGT filter unit is provided with a preheater (SGT-EHC-1A1, 1A2, 1B1, 1B2) designed to limit the moisture content of the noncondensibles entering the charcoal beds to a Relative Humidity (R.H.) of 70% or less, Each SGT filter unit has two heaters, a lead and lag, powered from different electrical power divisions. Although the current design contains redundant heaters, the control logic for the system does not automatically switch system alignment upon failure of the heater coils. Consequently, a heater failure could go undetected and result in R.H. exceeding the.70%.allowable if inlet gases exceeded 70%

R.H..

D. Fourteen motor-operated valves were identified as potentially imposing limiting conditions for SGT operation due to failures associated with hot shorts. The 14 motor-operated valves (SGT-V-1A, 1B, 3A1, 3A2, 3B1, 3B2, 4A1, 4A2, 4B1, 4B2, 5A1, 5A2, 5B1, 5B2) comprise valves critical to controlling SGT operation under normal and short and long term accident conditions. These valves are currently aligned in their preferred positions for two-filter unit SGT operation. However, they are still susceptible to hot short failures which could cause them to be mispositioned and cause SGT capability to be degraded or lost. The control for these valves must be either protected or justified on some alternate basis, such as probability.

The remaining SGT components potentially affected by the hot short issue are the system 17

~ I (~ ~ ~

~ ~

~ ~

~ iS ai ll TM 2025 Rev. 0 fans. A hot short could cause spurious operation of the lead fan in a filter unit and lock out the operation of the lead heater in that filter unit. If the hot short occurs within 20 seconds of an accident signal, the lead fan interlock will defeat heater initiation. Again the control power for these fans must be protected or an alternate justification provided.

E. The SGT strip heaters are subject to the same single failure vulnerability as the deluge valves in each filter unit. The strip heaters in each filter unit are presently powered by the same electrical division. Thus, a loss of power supply or circuit failure (in this case, a fault to ground) would disable the preoperational heating of one filter unit. However, the strip heaters are not required for successful SGT operation under accident conditions. They are included for long-term. system.-conditioning.-"Therefore; the strip heaters are not included in further discussion of system modification or failure analysis.

18

~ ~

~ ~

~ lip

~

g TM 2025 Rev. 0 ATTACHMENT2 - SGT SYSTEM FAULT TREE ANALYSIS The Safety Analysis Group performed a failure analysis of the SGT system using fault tree analysis (Reference 12). ERIN Engineering and Research Inc. upgraded the original WNP-2 NUPRA fault trees to include cable and common cause failures (Reference 13). The following is a summary of the failures evaluated and the modifications necessary to eliminate them.

Modify valves SGT-V-2A/B such that they are normally open. This modification precludes system failures due to valve failure to open. The modification involves only a procedure change. The valve remains "fail-open" on loss of air or power.

E

2. Eliminating the potential for an inadvertent deluge valve initiation due to a single failure is necessary to support the fault tree analysis. Some options include adding additional fire protection deluge valves to provide redundancy for both the isolation function and the flow path or administratively closing the manual upstream valves (SGT-V-F11, F21, F31, F41, F51, F61). Either of these approaches would eliminate this failure mechanism. Other possible schemes to eliminate this failure mode may also be available. The fault tree analysis assumes this failure mode has been eliminated; no further risk-based analyses were performed.

3. Modify the main heater logic to transfer to the lag fan and heater upon detection of failure or administratively switch from lead to lag upon detection. Although the analysis assumed that this transfer would be automatic, due to cost and the high potential that humidity will never reach or exceed 70%, administrative controls will be implemented.

4. Many of the critical SGT components have the potential to be affected by hot shorts in their control circuitry. These hot shorts can cause mispositioning of critical valves and the lock out of the primary and or backup fans. However, even. under. the worse postulated hot short,,

at least one SGT filter unit would remain available and operable.

Fourteen motor-operated valves (SGT-V-2A, 2B, 3A1, 3A2, 3B1, 3B2, 4A1, 4A2, 4B1, 4B2, 5A1, 5A2, SB1, 5B2) are susceptible to hot short failures which could cause them to be mispositioned and cause SGT capability to be degraded or lost. The power and control for these valves must be either protected or justified on some alternate basis, such as probability.

The remaining SGT components potentially affected by hot shorts are the system fans. A hot short could cause spurious operation of the lead fan in a filter unit and lock out the operation of the lead heater in that filter unit. If the hot short occurs within 20 seconds of an accident signal, the lead fan interlock will defeat heater initiation. Again the control power for these fans must be protected or an alternate justification provided.

19

~

~l aug

~ >

f TM 2025 Rev. 0

5. Modify power supply to the strip heaters. This modification has no risk benefit since these heaters do not have a safety-related function. No further risk-based evaluations were performed.

Correcting or eliminating the most limiting of the above failure mechanisms provides a significant improvement in the overall system reliability. The following table presents the results of the study. Table 1 below provides a summary of the relative gain in reliability obtained by elimination of each of these failure mechanisms. In addition, the cost associated with eliminating each of the failure mechanism is summarized with a detailed cost breakdown provided in Table 2.

20

TM 2025 Rev. 0 TABLE 1 PROBABILITY OF COST OF CASE FAILURE MODIFICATION

1. WNP-2 Existing Design 5.00E-3 NA

2. Realign SGT-V-2A/B to 7.23E-4 $ 10K Normally open

3. Case 2 plus 7.23E-4 $ 1,055K elimination of an inadvertent deluge valve initiation *

4. Case 3 plus Heater 5.98E-4 $ 68K Logic Modification

5. Case 4 plus elimination 5.69E-4 $ 968K of hot shorts

6. New SGT System with 8.19E-4 NA 2-Redundant (100%)

Filter units

• The fault tree analysis assumed the deluge valve failure was eliminated.

Based on the analyses shown above, and the information presented in Reference 13, the relative risk benefits associated with potential upgrades to the SGT system can be assessed. The recommended system upgrades are presented as follows:

1. Modify the operation of valves SGT-V-2A/B such that the valves are normally open.

However, due to the relative minor gain in reliability associated with de-energizing the valves and the added operator flexibility gained by their remaining remote-manually operable from the control room, these valves should not be de-energized and locked in an open position.

2. Modification of the heater logic to eliminate the potential for an undetected failure of the lag heater is not recommended due to the cost of the modification and the potential that the heaters may be shown to be unnecessary by analysis. In the interim, operator action to detect and transfer heaters is deemed adequate.

21

~

( ~ ~

g C

~ ~

TM 2025 Rev. 0

3. Based on the results of this study and the high cost associated with elimination of the hot short potential, it is recommended that no changes be made to the existing electrical separation provided for the SGT System. However, not providing such electrical separation per our criteria is contrary to the commitments made to the NRC in the WNP-2 FSAR, Section 8.31.4. As a result, it will be necessary to gain NRC approval of a lesser separation scheme prior to declaring the SGT System single failure proof.

4. Note, the testing of SGT-V-4 and 5 valves is already provided for in PPM 7.4.3.2.2.11.

The ERIN probability analysis assumed that this relay was not tested and therefore its reliability was downgraded accordingly. Since this test is routinely done, the reliability numbers were adjusted accordingly.

22

TABLE 2

SUMMARY

OF COSTS FOR SGT MODIFICATIONS DESCRIPIION MAN IABOR EQUIP. USAGE hIATERIAL SUB EQUIPhIENT OIHER TOTAL HOURS COiVAACT DOLIARS Issue I - Realign SGT Inlet Valves At Administrative Cost (PPM update, ctc.) - Total 10000 $ 10,000 Issue 2- Hcatcr Control Logic Case I - Design Modification At Electrical, inst and contr design 384 11136 0 0 $ 11,136 B: WNP-2 maintenance electricians 240 9120 4260 15000 $ 28,320 C: Engineering 568 28400 0 0 $ 28,400 Total: $ 67,856 Case 2 - Operator Action A: Administrative cost - Total 10000 $ 10,000 Issue 3 - Case I - Deluge Valves - Single Failure Design A: Electrical, inst and contr design 1654 47966 0 $ 47,966 B: Mechanical design 900 26100 0 $ 26,100 C: WNP-2 maintcnancc clcctricians 19660 747080 86640 $ 833,720 D: WNP-2 maintenance l&C technicians 1432 54416 29414 $ 83,830 E: Enginccring (ME, CE, EE) 1270 63500 0 $ 63,500 Total: $ 1,055,116 Case 2 - Isolation of Manual Valves A: Administrative cost (PPM update, ctc.) 10000 $ 10,000 Issue 4 - Valve Control Conductor Protection (14 valves) ~

At Electrical, inst and contr design 1491 43239 0 $ 43,239 B: WNP-2 maintcnancc electricians 2492 946960 114978 $ 1,061,938 Ct Enginccring 114 5700 "'

$ 5,700 Lead Control Conductor Protection A: Electrical, inst and contr design 805 23345 0 $ 23,345 B: WNP-2 maintenance electricians 3380 128440 17328 $ 145,768 C: Enginccring 84 4200 0 $ 4,200 Total: $ 1,284,190 Issue 5 - Strip heater, Power Supply Changcovcr At Elcctrical, inst and contr design 296 8584 0 $ 8,584 B: WNP-2 maintenance clcctricians 460 17480 1732 $ 19,212 C: Engineering 112 5600 0 $ 5,600 Total: $ 33,396

~ SGT-V-IA/IB cannot affect thc safety functions of thc SGT system and therefore would not require any corrective actions.

TM 2025 Rev. 0 ATTACHMENT3 - BUILDINGDRAWDOWN MODEL Model Descri tion: The Secondary Containment pressure transient is modeled by treating the reactor building as a constant volume with air mass and bulk building temperature as functions of time. Mass change per unit time is the summation of SGT exhaust mass flow rate, the net between in-leaking and out-leaking mass flows. Temperature change per unit time is determined from heat sources during a transient; e.g., heat loads introduced by the start of emergency equipment, and heat transfer to the Standby Service Water system. Because the starting sequence of equipment produces inflection points for mass flow, heat sources, and heat sinks, the above equation is evaluated numerically, with conservative simplifying assumptions. The more significant of these assumptions. are as follows:""

a. During the Secondary Containment pressure transient, the only heat transfer from the structure is by unit coolers. No credit is taken for heat removal through exhausted air, nor is credit taken for the heat capacity of in-leakage of cooler air.

b. With the exception of the main steam tunnel and normal lighting, heat transfer from normal steady-state operating equipment is assumed to continue to shed heat to the Secondary Containment at the same rate during the transient.. This assumption is conservative. The transient has a duration of several minutes. If on-site power is lost, nonsafety-related equipment willcease to operate, but the equipment willremain at essentially the same temperature for the first few minutes of the transient. Process piping would continue to transfer heat at essentially the same rate.

C. The normal lighting heat load in Secondary Containment is terminated with the onset of the LOOP/LOCA; the emergency lighting heat load initiates with the termination of the normal load. This assumption represents a fair description of the actual behavior. While the lighting fixtures that were on during normal operation will continue to shed heat (warm ballast, etc.) for a short time after the LOOP, this is counter balanced by including the emergency load immediately following the LOOP and other conservative assumptions. The emergency lighting does not come on until ten seconds following the LOOP.

d. No heat introduced to the Secondary Containment from the initiation of safety-related equipment is transferred to the building mass; all such heat is transferred instantaneously to the air mass of the room in which the safety-related equipment is located raising the temperature of the entire mass of air within the room. This assumption maximizes the expansion rate of the air mass which in turn produces conservative pressure transient amplitudes; but at the same time the assumption also maximizes the rate of heat transfer to the Standby Service Water system by maximizing the rate at which a temperature differential is established between the 24

TM 2025 Rev. 0 individual Secondary Containment room unit coolers and the Standby Service Water.

e. The heat transferred from components in the main steam tunnel causes expansion of the air within the tunnel when unit coolers within the tunnel experience a power and coolant flow loss; i.e., the coolers do not operate during a LOOP/LOCA. The air mass within the tunnel is assumed to be at pressure equilibrium with the reactor building at the start of the transient, and experiences the same pressure 'transient as the reactor building. Testing has confirmed that the main steam tunnel space vents to the reactor building at a sufficient rate to preclude pressure buildup within the tunnel.

f. The fuel pool heat load is constant and independent of the time of year relative to the refueling outage; i.e., fuel pool cooling equipment is operated to maintain constant pool temperature. To validate this assumption, a 10% margin is added to the measured steady-state plant heat loads to account in the variability of fuel pool heat loads.

g. Secondary Containment leakage is assumed to be linear with differential pressure, which produces greater leakage values at differential pressures greater than negative 0.25" w.g. than an assumption that leakage is proportional to the square root of differential pressure. Extensive test data exists demonstrating that Secondary Containment boundary component leakage generally follows a combined linear and square root relationship to differential pressure, with crack and linear seam leakage following a linear relationship.

Because normal lighting loads are automatically load shed at the detection of a LOCA (see drawing E519-25), the LOOP and non-LOOP lighting loads are identical. Also, operation of the main steam tunnel unit coolers is not assumed following a,LOCA; i.e., they are.not safety-related. Therefore, the LOOP/LOCA and LOCA Secondary Containment heat loads are the same. The WNP-2 Secondary Containment contains 14 rooms with unit coolers that operate during a LOOP/LOCA. The temperature transient of each room is a function of emergency and normal heat loads, capacity of the room unit cooler, equipment operating sequence, assumed failures, etc. The temperature transient is therefore determined for individual rooms with air expansion or contraction contributing to the overall Secondary Containment pressure transient.

Secondary Containment pressure is calculated in five second time increments and is a function of heat generation rates within the Secondary Containment, heat transfer out, and building in-leakage or out-leakage, all during the time increment.

The WNP-2 Secondary Containment JCOs submitted to NRC on 9/89, discussed on 1/16/90 with the NRC Staff, and summarized in LER 89-040-01, had a number of basic assumptions that have been modified during the development of a change to the SGT design basis due to these 25

<e ~

l

~

~ g k ~ 0~

~ ~

fl TM 2025 Rev. 0 discussions with the NRC and as new knowledge was added to this issue. Specifically, Leaka e As um tion: At the NRC meeting on 1/16/90, the NRC Staff expressed concern on the assumption of uniform leakage over all Secondary Containment surfaces in calculating the drawdown time to a achieve -0.25" w.g. at all Secondary Containment surfaces. To resolve NRC concern, WNP-2 created a revised model which splits Secondary Containment leakage into two portions. The first leakage parameter is leakage at grade elevation while the second leakage parameter is leakage at the higher elevation sheet metal siding. Due to the relative small number of penetrations through the WNP-2 concrete Secondary Containment structure (441'levation to 606'10" Elevation) the portion of leakage from'these'areas is'expected to be small Due to-the large number of, siding seams (over 30,000 feet) in the upper WNP-2 Secondary Containment structure (Elevation 606'10" to Elevation 669'), the portion of leakage from the siding is expected to be the majority of WNP-2 Technical Specification allowable leakage.

A special series of tests (PPM 8.3.177) were conducted during the WNP-2 R-5 outage to characterize leakage. The results of these tests indicate that the majority of the leakage was at the upper siding seams.

For the JCO, a high leakage at grade during winter (the most limiting design condition) was used and is conservative with regard to building drawdown calculation. The grade leakage in the analysis was set at 40% of the total leakage (although actual test data does not identify the need to assume significant leakage at grade). For the revised SGT design (single failure proof), a more conservative analysis was performed with the majority of leakage assumed to be at plant grade level where higher differential pressure exists. The SGT system has substantially more than required capacity to bring the entire Secondary Containment below -.25" w.g. differential pressure using 95% joint frequency meteorology.

Envir nment Tem erature: At the NRC meeting on 1/16/90, the environment temperature assumptions in the analysis were discussed. The JCO submitted on 9/89 used the lowest average monthly temperature recorded in the WNP-2 FSAR. At the 1/16/90 NRC meeting, WNP-2 presented the concept of using 95% joint frequency distribution meteorology data of wind and temperature as a design basis for Secondary Containment SGT design. Since offsite dose consequences are based on 95% joint frequency meteorology of wind and stability, per R.G. 1.145, it seemed justified to apply a similar approach to Secondary Containment design. The NRC staff did not voice concern or criticism with that approach in the 1/16/90 meeting or in response to information submitted on the docket that described using the 95% meteorology of wind and temperature into the analysis assumptions.

26

~ I ~ <>> ~ ~

s I

I t

I

TM 2025 Rev. 0 Im act f Instrument In ccurac Further revisions to the original Rev. 0 and 1 JCO assessments were required to address new issues which were subsequently identified dealing with instrument calibration accuracy and setpoint error. Specifically, Standby Gas Treatment flow indicator/recorders (SGT-FR-2A1, 2A2, 2B1, 2B2) were calibrated to read flow in SCFM when the process flow was at 212'F, 2 psig and 0% relative humidity.

During any event requiring SGT initiation, these conditions are never reached.

Consequently, for the range of conditions under which SGT is designed to'operate, the actual standard flow through the SGT filter units would have been 5% lower to 10%

higher than indicated on the flow recorder.

In addition to this calibration correction factor," the'SGT fan flow controller (limiter) loop has a conservatively calculated accuracy of +10%. The effect of these two corrections is that the surveillance test results for system flow and building leakage could each have been 20% higher than previously believed, This new information posed two problems. First, the higher total system flow (up to 20%

higher) could have resulted in a trip of the SGT fan motors on thermal overloads if the fans had been called upon to operate under degraded voltage conditions. And second, the building leakage could have been up to 20% higher than assumed in the Secondary Containment drawdown analysis resulting in potentially under predicting the time to reach a -.25" w.g, building pressure. This latter assumption is the point in time when SGT filtration is assumed to become effective for dose calculations.

With the new information available, a new flow limiter setpoint (based on setpoint calculation E/1-02-91-1066) has been established which considers degraded voltage, charcoal bed residence time and adverse environmental conditions. A summary of the setpoint calculation is provided below:

Analytical limit = 5812 Indicated Cubic Feet Per Minute (ICFM)

Correction for setpoint accuracy (nominal setpoint) = 5378 ICFM (rounded to 5380 ICFM)

Correction for fiow element ICFM to Actual Cubic Feet Per Minute (ACFM)

(nominal inlet conditions', 90'F, 0% R.H., 0.2 psig) = 5857 ACFM

'90'F inlet is based on a 15'F temperature rise across the SGT heater coils and a 75'F nominal secondary containment temperature at the beginning of the accident. This condition represents the expected minimum building temperature during normal full power operation. The 0% RH and 14.89 psia values represent the most limiting combination of expected SGT operating conditions at the SGT flow element and their use result in the most conservative correction factor (i.e., lowest flow) per Calculation NE42-9246 for converting ICFM to ACFM.

27

0 ~ ~

\

~ >~

J

~ ~

TM 2025 Rev. 0 Lower setpoint limit = 4944 ICFM correction for flow element ICFM to ACFM (90'F, 0% RH, 0.2 psig') = 5385 ACFM From the setpoint calculation, the correction factor for flow limiter accuracy considers the effect of calibration error, instrument drift and environmental effects. Calibration error and drift make up approximately 50% of the total loop setpoint accuracy with the remaining 50% attributed to environmental effects and other uncertainties.

these accuracies into account in establishing limits on building leakage and

'aking available SGT system flow, the following parametric cases for Secondary Containment performance were evaluated'.

Case 2A Case 28 gas'e~2 (ACFM) (ACFM) (ACFM)

SGT Fan Flow: 5850~ 5385 5385 Leakage: 1625 1475 1625 The Case 2A combination assumes the controller error is causing the flow limiter to control flow higher than the nominal setpoint. Case 2B assumes the controller error is causing the flow limiter to control and indicate flow lower than the nominal setpoint. In both these cases, the system flow capacity and associated leakage are derived based on the assumption that the total loop calibration and drift portion of the setpoint error act in only one direction for a given calibration period. On the other hand, the environmental conditions are assumed to act in the direction which provides the worse condition for the drawdown analysis; i.e.,

the error acts to reduce total system flow capacity and increase total building leakage'. The assumption for calibration and drift error is considered valid. based on historical trends observed during instrument calibration.

Figures 2A and 2B (Case 2A and 2B respectively) present the revised drawdown analysis results and include consideration for the new flow limiter setting and range of possible Secondary Containment leakages. Calculation ME-02-89-09 presents a detailed calculation and documentation of the drawdown analysis for the Secondary Containment.

~Rounded down from 5857 ACFM This assumption is taken since building leakage is ver'ifled annually to be less than 1475 CFM as part of the NCR 288-357 Rev 1 JCO (adjusted for fiow element calibration and standard conditions) and the accuracy of the flow limiter/indicator could be as much as 10% high or low during the test. Subsequent system initiation during an accident (at some later time) could result in a different environmental error being introduced into the system.

28

aa r'o o g

TM 2025 Rev. 0 Case 2C (Figure 2C) was run assuming all instrument errors act to provide the worst case combination of building leakage and available SGT fiow; i.e., 5385 ACFM SGT fiow with the building leakage test inaccuracy in the opposite direction, providing a leakage of 1625 ACFM. Even for this case, the SGT system is able to achieve building drawdown to a -.25" w.g. pressure differential within ten minutes with single filter unit SGT operation and limiting dose consequences to less than 10CFR100 limits. Case 2C is not considered a credible combination of SGT flow and building leakage, but is included to'demonstrate acceptable consequences even in this unlikely condition. Cases 2A and 2B represent the case expected range of flow and leakage for the SGT and Secondary Containment. 'orst Stand Service Water Tem erature'Limitati n: Going from revision 2 to revision 3 of the JCO was required to address the limitation placed on SW pond temperature. The normal Technical Specification limit on Standby Service Water pond temperature is 77'F. In order to assure a maximum Secondary Containment drawdown time of 10 minutes or less, the spray pond temperature must be maintained below 72'F when outside temperature is at or near the minimum temperature associated with the 95% meteorology envelope (i.e. 20'F).

For outside temperatures between 20'F and 24'F, the maximum allowable spray pond temperature increases linearly from 72'F to 77'F. Figure 5 provides a temperature zone map (spray pond temperature versus outside temperature) of acceptable operating temperatures for the spray pond, and those combinations of temperatures that are not acceptable. WNP-2 is adopting this restriction until the new two-unit SGT design can be implemented.

New Two-Unit T Desi n: Finally, two cases were evaluated for the new two-unit design and the one-unit out of service. Again, the key parameters for Case 3 - two filter unit design and Case 4 - one filter unit OOS are summarized in Table 1 and the drawdown building pressure plots are provided in Figures 3 & 4. See Attachment 4 for the dose assessment for these cases.

29

TM 2025 Rev. 0 TABLE 1 Case 0 Case 1 Caso 2A Case 2B Case 2C Case 3 Case 4 K~K O~D Revogt t Rcv2 di 3 JCO S~tud S~tud 2.Unit SGT J.Unit OOS JCO Fig 2B Fig 2C Fig 3 Fig 4 R.G. 1.3 R<<lcasc 2nd Contain -.25'.G. -.2$ '.O. -.2$ '.G. -.2S'.G. -.2S W.G. -.25 W.O. Neg press all Press (WoNt Loc) (Worst Loc) (WoNt Loc) (Worst Loc) (Worst Loc) locations Drawdown 2 1/2 minutes 10 minutes 6.1/2 minutes 8 minutes 12 minutes 2-1/2 minutes 7 Iillnutcs Tune 2nd Cont Leak 2240 ACFM 147S ACFM 1625 ACFM 147$ ACFM 1625 ACFKhl 2240 ACFM 2240 ACFM Location oF Not Specified Uniform 40% - Bouom, 40% .Bottom. 40% -Bottom, 60% - Bottom, 40% .Bouom, Leakage Across Bwg 60% - 60% - Top 60% - Top 40% -Top 60% -

Top'7'F Top'2'F SW Temp 77'F 75'F (70'F pcr 72'F 72'F 77'F (pcr (pcr Tech PPM 2.4.5) Tech Spec) Spec)

Initial Bldg 100'F 7S'F 75'F 7S'F 7$ 'F 75'F 75'F Temperature Outs Kte Teal p Not Specified 12'F (lowest 20'F (9S% 20'F (95% 20'F (9$ % 20'F (95% 20'F (95%

(NCR issue) monthly avg.) wind/temp mct) met) mct) mct) mct)

Will Not SpccUicd 10.3 MPH 9S% Met. Data 95% Met. Data 95% hfet. Data 9S% Men 95% Met. Data Conditions (NCR issue) (avg Data wind Jan)

SGT How 44S7 ACFM S600 ACFM 58SO ACFM S38$ ACFM S385 ACFM 10600 ACFM 5300 ACFM Flow Umitcr Not Specified Quatitativcty 8.0%(E/142- 8.0%(E/142- 8.0%(E/1 8.0% (E/142- 8.0%(E/142-Accuracy 91-1066) 91-1066) 91-1066) 91-1066) 91-1066)

Considered'ualitatively Dcgradcd 80% 87% Ref. 87% Ref. 87% Ref. 87% Ref. 87% Ref.

Voltage Calc E/142- Cele E/142- E/142-9041, Cele E/142- Cele E/142-Considcrcd'ot 9041, 9041, degraded volt 9041, 9041, degraded volt dcgtadcd volt degraded volt degraded volt Flow Element Not -5 to +10% 5 to +10% -5 to +10% ,

-5 to +10% -5 to +10%

Calib. Error Considered Considered (Ref Cele (Ref Cele (Ref NE42- (Rcf Calo (Ref NE42-NE-02-9246 NE42-9246 9246 bldg. NE42-9246 9246 bldg bldg. temp) bldg. temp) temp) bldg. temp) temp)

Assumed SGT or SW DIV I or II Dlv I or II Single Failure power failure power failure

'The parameter was qualitatively considered in the safety evaluation to have no impact on the operability of SGT under all design basis accident conditions.

A building leakage model where 60% of the leakage is at the top and 40% is at the bottom represents a more realistic representation of actual building performance.

'Represents actual time to reach required drawdown from LOCA w/time delay for EDG start.

30

~ ~

.;

~ ~

~ ~ ~ ~ ~ ~

~

' ~ ~

~;

~ ~

~

~ I ~ ~

~ ~

~ ~ ~

~ ~

~ t

~ ~ ~

~

p

~ ~ ~ ~

~ . ' ~ ~

~ ~ ~

~ ~ t

~ ' ~

~ I ~

~ ~ ~

' ~ ~ ~ 1 ~; ~ ~ ~ ~ ' ~ , ~ ~, ~

' ~

~ ~ ~ ~ ~

~ ~ ~

~

~ ~ ~ ~ I ~

~ ~ ~ ~ ~;: ~

~ I I

~ ~ ~

~ o

~ I ~ ~ ~

~ o;

~ ~ I

~ >

~ - ~

~ ~ ~

~ I ~ ~

~ .. ' I I

~ I

~ I

' ~

~ ~ ~

~ ~ I ~

' ' I ' ~ I .' ' ~

I ~ ~ ~ ~ ~ ~

~ ~ I ~

~ ~

I ~

~ ~ ~ ~

I ~

~ ~ ~ ~ ~ ~ .

I '

~ ~

I I ~ I

~; ~

~ ~

~ ~ I

~ s s

~ ~ ~

~ ~ I ~ ~ I S I ., ' I ~

~ ~ ~

~ I~

I + ~ ~

~ ~ ~ ~ I ' ~ I; ~ ~ ~ I I ~ ~ ~ '~ 'l

~ ~ I ~

~ ~ 4

~

~ ~ ~ ~ I ~

~ > ~

~ ' ~

~ ~

~ I ~

~ 1

~ ~

~ ~ ~ ~ ~

~ e.

I ~ ~

~ ~

~

j

~ I ~ I

~ .. ' ~ ~

~ ~ ~

~ I ~

~ ' ~

I I~

~ ~ I ~

~ ~ ~ ~ ~ ~ ~ ~ I ~ ~

I ~

~ ~

k 4 i '

~ ~ ~ ~ t i s ~ I ~

I ' I

~ . ~

~ ~ ~ '

~ ~

~ I ~ ~ ~

~ ~

~ ~

I ~ I

~ ~ I

~ .. ' ~ I I ~ ~

~ I ~

~ ' ~

~ ~

I~

II ~ I ~ ~ ~ ~

' ~ ' I' ~ ~ ~

I ~

~ I I I ~ ~ ~

I r I I ~

I ~ I 4

~ ~ ~

( a y

~

g p j g

~

M vQ TM 2025 Rev. 0 ATTACHMENT4 - DOSE MODEL The original WNP-2 dose calculation model has been enhanced and expanded to support evaluations associated with the development of a change to the SGT design basis. A FORTRAN computer code (PADD, Post-Accident Design Dose) is being developed to calculate offsite, Exclusion Area Boundary (EAB) and Low Population Zone (LPZ), and Control Room doses using Regulatory Guide 1.3 or NUREG 0588 source term. Development and documentation for PADD is found in calculation NE-02-88-27, Rev 2. PADD models Primary Containment, Secondary Containment, and the control room in which it tracks the airborne isotopic radioactivity concentrations as a function of'time. Using the airborne concentration over time PADD then calculates dose rates and integrated doses for the control room and offsite locations (EAB and LPZ). Offsite doses are also affected by input of meteorological data for the atmospheric dispersion model as described in Regulatory Guide 1.145 and calculation NE-02 27, Rev. 2.

The original WNP-2 model had limited ability to evaluate the dose impact of the time required to achieve -0.25" w.g. (i.e., time interval when SGTs filtering efficiency was equal to zero) due to ambient conditions. PADD is a more precise calculation of dose due to improvements made in the method for calculating total dose (i,e., exact numerical solution versus average dose over large time steps). The code allows the user to specify the loss of SGT filtering efficiency for any time interval during the initial radioactivity release assumed to occur for an accident. These changes to the original WNP-2 model allow PADD to determine dose consequences (whole body and thyroid) for the exclusion area, low population zone, and control room (whole body, thyroid, and beta) as a result of changes in Secondary Containment drawdown times.

General Electric was commissioned to complete the verification of the PADD computer code by alternate calculational means, The alternate calculations included validating the JCO runs as well as two runs for the new SGT design basis. Table 1 presents the original design results (Case 0), PADD results for the NCR 88-357 JCO (Cases 1, 2A, and 2C), and GE results for the proposed SGT design basis (Cases 3 and 4). The GE res'ults are presented since final verification of PADD is not complete. The GE results are documented in Reference 18. The results indicate that the doses in the control room, at the site boundary and the low population zone (LPZ) are well within the 10CFR100 limits for the new two-unit design as well as the various JCO cases.

37

~ +

) ~

TABLE 1-

SUMMARY

OF OFFSITE / CONTROL ROOM DOSES SGT Time To Reach Control Room Dose (Rem) Exclusion Area (Rcm) LPZ Dose (Rcm)

Case Flow -.25" W.G.(min) T~hroid ~Who/&Bod Bere W~hole/Bod T~hroid ~Whole/Bod ~Th roid (ACFM) 10CFR100.11,10CFR50 App A 30 5 30 300 300 Limits Case 0 4457 5.8 0.1 2.7 1.3 E-7 8.3 E-7 6.3 E-7 8.1 E-5 (Original Design)

Case 1 10* 19.3 84 (NCR 88-357, Rcv 0,1)

Case 2A 5850 10* 0.2 5.4 4.7 131.3 3.7 115.0 (NCR 88-357, Rcv 2,3)

Case 2C 5385 0.245 5.4 4.8 153.4 3.7 124.0 (Study-worse comb. flow/leak)

Case 3**** 10600 15.7 0.376 3.33 4.84 87.4 3.6 97.3 (Ncw two-unit design)

Case 4***+ 5300 10WBB: 20.2 0.376 3.33 5.14 144.8 3.7 120.5 (1 Unit 005-LCO)

Actual drawdown times are less, but are rounded up to closest 5 minute increment for purposes of calculating the offsite and control room doses Actual drawdown is less than l4 minutes, but is rounded up to 12 minutes for purposes of calculating the offsite and control room doses.

• • • Drawdown is to negative pressure only, not -.25" w.g.

• • • • Results obtained using GE verified dose analysis computer codes.

4c",g a, L ~ ~ l 0 I

- - ~ ~'

TM 2025 Rev. 0 ATTACHMENT5 - ASSESSMENT OF COOLING REQUIREMENTS FOR THE SGT SYSTEM POST ACCIDENT WNP2's current design for the SGT system utilizes a recirculation system for maintaining the charcoal bed below the charcoal combustion temperature limitof 626 'F (330 'C) and the iodine desorption limit of 300'F. This latter limit is set to prevent the desorption of Iodine from the charcoal as outlined in ANSI N509-1980 (to which WNP2 has committed). A review of calculation 5.01.53 indicates that the peak heat generated in one charcoal bed due to the deposition of radionuclides post-accident is 7564.Btu/hr....Given sufficient time, this amount of heat could significantly raise the temperature of the charcoal under no SGT'flow conditions due to poor heat transfer properties of the charcoal. The new two-unit design incorporates redundant fans in each filter unit such that flow will always be present during SGT operation. In addition, with the recycle valves (SGT-V-4A1,4A2,4B1,4B2) each unit can be taken off line and maintain bed cooling by recycling air back to the building. With this constant flow, a simple heat transfer calculation can be used to show that the temperature rise in the charcoal bed is minimal.

Q=mC,bT Where: Q= heat transferred from the bed = 7564 Btu/hr.

m* = mass flow rate of air (ibm/hr) = CFM p = (500 cfm) (p) (Table 1, Attachment 3)

C = heat capacity of air = 0.24 Btu/ibm-R (Reference 16) dT = temperature difference across bed p = density of air = 0.071 lb/ft (100'F) (Reference 16)

These values are taken at room temperature and pressure.

Solving for the temperature difference for single filter unit flow of 500 CFM:

hT = Q/MC, = (7564 Btu/hr) / (500 CFM ) (0.071 lb/ft') (0.24)(60 min/hr)

= 15'F This minimal temperature rise is well below the limits for charcoal combustion or iodine desorption. Consequently, under post-accident conditions with constant flow across the charcoal beds, the potential for a significant rise in bed temperatures due to the deposition of radionuclides is eliminated.

• The measured leakage seen in recent testing is 1100 CFM (acceptance ( 1475 CFM). For conservatism, 500 CFM which is less than 1475/2 = 738 CFM will be used.

39

anal a ~ I lf I ~ '"\ ~ 4 ~ -s,, ~ I ~ aC, I lt TEef t' I I A I, ~ a,.et

~ k

TM 2025 Rev. 0 ATTACHMENT6 - PROPOSED TECHNICAL SPECIFICATION CHANGES The existing WNP-2 Technical Specifications must be revised to reflect the new proposed two-filter unit operating mode. The Technical Specifications section 3.6.5.3 and the associated bases willrequire changes to reflect the SGT flow changes and drawdown times. Also, the paragraph below marked insert is provided as a recommended addition to the bases section of the Technical Specifications.

In general, it is recommended that the 7 day allowed outage time (AOT) for one SGT out of service be retained. The basis for acceptability of this condition is provided in Case 5 of . This case demonstrates that the Secondary Containment drawdown to a negative pressure can be achieved with one filter unit, at the Technical Specification leakage of 2240 ACFM within 10 minutes. Although one filter unit under these conditions does not reach the

-.25" w.g. for all locations in the building during all environmental conditions, it does ensure that all areas are at least negative during 95% meteorological conditions. Allowing credit for SGT filtration once the building becomes negative results in doses at the site boundary and the control room equal to the two-unit configuration. This level of protection coupled with the low probability of a LOCA coincident with adverse environmental conditions during the seven-day period appears to be a sound justification for retaining the current seven-day AOT LCO.

Finally, it is recommended that when Secondary Containment leakage testing is performed, it be conducted when wind and temperature conditions are nominal; i.e., wind less than ten mph and temperatures greater than 50'F. These conditions will provide a more consistent basis for trending of the building leakage and will minimize the time necessary by Engineering to evaluate test data and determine leakage is within acceptable limits.

TE HNICAL SPE IFI ATI N.BA IN ERT The SGT design is based on a divisionally redundant two-unit system; that is each unit of SGT is capable of being powered from either division of emergency electrical power. In post accident situations both units of SGT will initiate to achieve and maintain a -.25" w.g pressure in all locations of the Secondary Containment using 95% joint frequency distribution meteorology data of wind and temperature. Drawdown time under these conditions at a design in-leakage of 2240 ACFM is less then 5 minutes. This combination of conditions and system response limitthe dose consequences to less than 10CFR100 limits. Under these same conditions where one filter (HEPA and charcoal) unit is out of service, one filter unit is capable of achieving a building drawdown to a negative pressure in all locations within 10 minutes. This system performance, allowing credit for the drawdown to negative pressure (versus -.25" w.g.) within ten minutes will also limit post accident doses to less than 10CFR100 limits.

40