ML15261A673: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
Line 1: Line 1:
{{Adams
#REDIRECT [[NL-15-1055, License Amendment Request to Revise Technical Specification 3.4.14, RCS Pressure Isolation Valve Leakage to Eliminate the RHR Autoclosure Interlock Function from the Technical Specifications]]
| number = ML15261A673
| issue date = 08/31/2015
| title = License Amendment Request to Revise Technical Specification 3.4.14, RCS Pressure Isolation Valve Leakage to Eliminate the RHR Autoclosure Interlock Function from the Technical Specifications
| author name = Pierce C R
| author affiliation = Southern Co, Southern Nuclear Operating Co, Inc
| addressee name =
| addressee affiliation = NRC/Document Control Desk, NRC/NRR
| docket = 05000348, 05000364
| license number =
| contact person =
| case reference number = NL-15-1055
| document type = Letter, License-Application for Facility Operating License (Amend/Renewal) DKT 50
| page count = 127
| project =
| stage = Other
}}
 
=Text=
{{#Wiki_filter:Charles R. Pierce Regulatory Affairs Director Southern Nuclear Operating Company, Inc.40 Inverness Center Parkway Post Office Box 1295 Birmingham, AL 35242 Tel 205.992.7872 Fax 205.992.7601 SOUTHERN Z NUCLEAR A SOUTHERN COMPANY August 31, 2015 Docket Nos.: 50-348 50-364 NL-1 5-1 055 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Ladies and Gentlemen:
Pursuant to 10 CFR 50.90, Southern Nuclear Operating Company (SNC) hereby requests an amendment to Facility Operating License Nos. NPF-2 and NPF-8 for the Joseph M. Farley Nuclear Plant, Units 1 and 2 (FNP). This amendment request proposes to revise Technical Specification (TS) 3.4.14, "RCS Pressure Isolation Valve Leakage" to eliminate the requirements for the Residual Heat Removal (RHR) System suction valve autoclosure interlock function.The proposed change would eliminate the current requirement to perform the RHR autoclosure interlock Surveillance Requirement (SR) 3.4.14.2 for FNP Unit 1 after restart from Refueling Outage 1 R27 and for Unit 2 after restart from Refueling Outage 2R25. In addition, the proposed change would revise Action Condition C to eliminate the RHR autoclosure interlock from the Action Condition for FNP Unit 1 after restart from Refueling Outage 1 R27 and for FNP Unit 2 after restart from Refueling Outage 2R25.The proposed change and a summary of the basis for the change are discussed in Enclosure
: 1. Enclosure 2 provides the RHR Autoclosure Interlock Removal Report, which includes a detailed background and basis for the proposed change. Enclosure 3 provides the FNP TS and Bases markup pages showing the proposed changes, and Enclosure 4 provides the FNP TS clean typed pages.SNC requests Nuclear Regulatory Commission (NRC) approval of these proposed changes by August 31, 2016. Following NRC approval, FNP will implement the associated modifications on a staggered basis for each unit. The Unit 1 modifications are currently scheduled to be implemented prior to the first U. S. Nuclear Regulatory Commission NL-1 5-1 055 Page 2 entry into Mode 4 following the end-of-cycle refuelin~g outage 27 (scheduled for Fail 2016). The Unit 2 modifications are currently scheduled to be implemented prior to the first entry into Mode 4 following the end-of-cycle refueling outage 25 (scheduled for Fall 2017).In accordance with 10 CFR 50.91 (b)(1), "State Consultation," a copy of this application and its reasoned analysis about no significant hazards considerations is being provided to the designated Alabama officials.
If you have any questions, please contact Ken McElroy at (205) 992-7369.Mr. Chuck R. Pierce states he is Regulatory Affairs Director of Southern Nuclear Operating Company, is authorized to execute this oath on behalf of Southern Nuclear Operating Company and, to the best of his knowledge and belief, the facts set forth in this letter are true.Respectfully submitted, C. R. Pierce Regulatory Affairs Director CRP/JMC/lac Sworn to and subscribe before me this 3_ _ day of 61 - L ,2015.Notary Public My commission expires: /- & ),= 17
 
==Enclosures:==
: 1. FNP Basis for the Proposed Change 2. FNP RHR Autoclosure Interlock Removal Report 3. FNP Technical Specifications and Bases Markup Pages 4. FNP Technical Specifications Clean Typed Pages U. S. Nuclear Regulatory Commission NL-1 5-1 055 Page 3 cc: Southern Nuclear Operatingq Company Mr. S. E. Kuczynski, Chairman, President
& CEO Mr. D. G. Bost, Executive Vice President
& Chief Nuclear Officer Ms. C. A. Gayheart, Vice President
-FNP Mr. M. D. Meier, Vice President
-Regulatory Affairs Mr. D. R. Madison, Vice President
-Fleet Operations Mr. B. J. Adams, Vice President
-Engineering Ms. B. L. Taylor, Regulatory Affairs Manager -FNP RTYPE: CFA04.054 U. S. Nuclear Regqulatory Commission Mr. V. M. McCree, Regional Administrator Mr. L. D. Wert, Regional Administrator (Acting)Mr. S. A. Williams, NRR Project Manager -FNP Mr. P. K. Niebaum, Senior Resident Inspector
-FNP Alabama Department of Public Health Dr. D. E. Williamson, State Health Officer Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 1 FNP Basis for Proposed Change Enclosure i to NL-1 5-1 055 FNP Basis for Proposed Change 1.0 Summary Description This amendment request proposes to revise Joseph M. Farley Nuclear Plant, Units 1 and 2 (FNP) Technical Specification (TS) 3.4.14, "RCS Pressure Isolation Valve Leakage" to eliminate the requirements for the Residual Heat Removal (RHR) System suction valve autoclosure interlock (ACl) function.Appropriate Bases changes would also be made consistent with the TS changes discussed above.Markups of the TS and Bases changes are provided in Enclosure 3 of this License Amendment Request (LAR) and Enclosure 4 of this LAR provides the clean typed copy of the revised TS.2.0 Detailed Description Proposed Changes Due to the staggered (by unit) implementation of this LAR, the proposed change is in the form of TS Notes that state when the current TS requirement is no longer applicable to each FNP unit.The proposed change would insert a Note in current Surveillance Requirement (SR)3.4.14.2.
SR 3.4.14.2 requires the verification of RHR System ACl function.
The Note would state: "Not applicable to Unit 1 after restart from 1 R27 and not applicable to Unit 2 after restart from 2R25." In addition, the proposed change would insert a Note in TS 3.4.14 Action Condition C to eliminate the reference to the RHR System ACl in that Condition.
The Note would state: "Not applicable to the autoclosure interlock for Unit 1 after restart from 1 R27 and for Unit 2 after restart from 2R25." The Applicability of TS 3.4.14, "RCS Pressur'e Isolation Valve Leakage," states "Modes 1, 2, and 3, and in Mode 4, except valves in the residual heat removal (RHR) flow path when in or during the transition to or from, the RHR mode of operation." The requirements of TS 3.4.14 including the proposed Action Condition and SR Notes (described above) would not become applicable until the Mode of Applicability of TS 3.4.14 is entered (i.e., in Mode 4 with the transition from RHR cooling complete).
As such, the proposed ACl elimination, alarm installation, and required procedure changes will be completed prior to entering the Applicability of TS 3.4.14 after the applicable refueling outage for each unit.Enclosure 3 of this LAR provides the markup of TS 3.4.14, "RCS Pressure Isolation Valve Leakage" which shows the changes discussed above. Enclosure 3 also contains the associated TS Bases changes which explain that the RHR ACl will be removed from El-i Enclosure i to NL-15-1055 FNP Basis for Proposed Change each unit during the applicable refueling outage (i.e., 1 R27 and 2R25) and will no longer be required to be Operable.Background During normal and emergency conditions, the low pressure RHR System (design pressure is 600 psig) is isolated from the high pressure Reactor Coolant System (ROS)(normal operating pressure of 2235 psig). Isolation is necessary to: 1) avoid RHR System over pressurization, and 2) minimize the potential for loss of integrity of the low pressure system and possible radioactive releases to the environment.
Two suction/isolation valves are provided on each inlet line from the RCS to the RHR System inside containment.
These motor-operated gate valves are normally-closed to keep the low pressure RHR System isolated from the high pressure RCS, and are opened only when the RHR Syste~m is in operation.
The RHR suction isolation valves are interlocked with RCS pressure signals to prevent opening when the RCS pressure is greater than the current Open Permissive Interlock (OPI) setpoint of 402.5 psig and automatically close when the RCS pressure increases above the ACI setpoint of 700 psig. Thus, the OPI prevents inadvertent opening of the RHR System isolation valves when the RCS pressure is above the valve opening setpoint, and the ACI ensures that the RHR System isolation valves are closed when the RCS is pressurized above the valve closing setpoint.
The OPI will not be affected by the removal of the RHR System ACI.The RHR ACI interlock provides an automatic closure for the RHR System suction isolation valves on high RCS pressure; however, rapid overpressure protection of the RHR System is provided by the RHR relief valves, (located inside containment) and not by the slow acting suction isolation valves. RHR System overpressure protection is not impacted by the removal of the ACI feature. Thus, the RHR System integrity will not be affected by the removal of the ACl feature. The removal of the RHR System ACI minimizes the potential for spurious valve closure, which could result in a loss of the decay heat removal function, RHR System .pump damage, and the inability of the RHR System to perform its function of RCS cold over pressurization protection.
Removal of the RHR System ACI addresses licensee and Nuclear Regulatory Commission (NRC) concerns regarding the potential for failure of the ACI circuitry to cause inadvertent isolation of the RHR System, and subsequent loss of RHR System capability during cold shutdown and refueling operations.
Although the RHR System will still be protected from overpressure by the RHR suction relief valves, once the RHR System ACI is removed, an alarm will be installed, which will identify to the operators that the valves are open and the RCS pressure exceeds the alarm setpoint.Enclosure 2 of this LAR provides a more detailed discussion of the background associated with the deletion of the RHR System ACI.3.0 Technical Evaluation The evaluation for the deletion of the RHR System ACI is based on the NRC approved WCAP-1 1736-A, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owner's Group," (Reference 1). The detailed evaluation of this El1-2 Enclosure i to NL-15-1 055 FNP Basis for Proposed Change change and the associated Probabilistic Analysis are provided in Enclosure 2 of this LAR. Enclosure 2 provides the basis (NRC requirement or Probabilistic Risk Assessment (PRA) assumption.)
Upon implementation of this LAR, the plant design and procedures will ensure the following conditions are met: 1. An alarm will be added to each RHR suction isolation valve which will actuate if the valve is open and the reactor coolant system (RCS) pressure is greater than the open permissive setpoint and less than the RHR system design pressure minus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affected by power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of the alarm for the RHR suction isolation valves and other procedures will be revised as necessary to address the deletion of the ACI.4. Procedures will be revised to eliminate the current requirement to lockout power to the open RHR suction isolation valves below 1800°F.5. Procedures will be implemented to require that power to all four closed RHR suction isolation valves be locked out in Modes 1, 2, and 3.The approach followed in the Probabilistic Analysis (in Enclosure 2 of this LAR) for removal of the RHR ACI is consistent with that provided in WCAP-1 1736. WCAP-1 1736 was reviewed by the NRC and a Safety Evaluation was issued in August 1989. The method used in WCAP-1 1736 evaluated the impact of the proposed change on initiating event frequencies and system unavailabilities, and did not consider the risk metrics of core damage frequency or large early release frequency used in risk-informed evaluations.
The WCAP and NRC Safety Evaluation were completed and issued prior to the availability of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis," (Reference
: 2) which defined the risk-informed approach using core damage frequency and large early release frequency risk metrics. The Probabilistic Analysis provided in this LAR, supports the removal of the RHR ACI, but does not provide the sole justification for this change.Probabilistic Analyses assessed the impact of removing the RHR ACI on the following:
* Intersystem Loss-Of-Coolant Accidents (ISLOCA) initiating event frequency,* RHR System unavailability, and* Low temperature overpressurization sequence frequencies.
As discussed previously, the detailed evaluation for the deletion of the RHR System ACI and associated Probabilistic Analysis are provided in Enclosure 2 of this LAR respectively, and are based on WCAP-1 1736-A. In the Safety Evaluation accompanying El1-3 Enclosure 1 to NL-1 5-1 055 FNP Basis for Proposed Change the NRC approval of WCAP-1 1736, the NRC staff noted five specific concerns.
These NRC concerns are addressed for FNP as follows: NRC Position #1 : An alarm will be added to each RHR suction valve which will actuate if the valve is open and the pressure is greater than the open permissive setpoint and less than the RHR System design pressure minus the RHR System pump head pressure.FNP Response #1: A control room alarm will be added which will alert operators if an RHR System suction isolation valve is open and the RCS pressure exceeds the alarm setpoint.
This setpoint will be greater than the open permissive setpoint and less than the RHR System design pressure minus the RHR System pump head pressure at minimum flow.NRC Position #2: Valve position Indication to the alarm must be provided from the stem-mounted limit switches (SMLSs) and power to the SMLSs must not be affected by power lockout of the valve.FNP Position #2: The four RHR System suction Isolation valves for each unit will utilize the existing limit switches located in the valve operator for valve position indication to the new alarm. These limit switches are actuated by a gear arrangement off the motor actuator rotor shaft. The contacts on the existing limit switches utilized for position Indication to the new alarms are different from the limit switch contacts which presently provide valve position to the main control board. As a result, diversity in valve position indication is achieved.
In addition, the alarm circuit is powered by a supply which Is separate from the supply that powers the valve control and position Indication circuits.
Thus, the alarm will remain functional during a power lockout of the, valve.NRC Position #3: The procedural improvements described In WCAP-1 1736 should be implemented.
Procedures themselves are plant specific.FNP Position #3: Plant procedures will be reviewed and revised as appropriate to reflect the deletion of the RHR System ACl. Procedures will also be revised to address appropriate operator response to the control room alarm which is being added as part of this modification.
NRC Position #4: Where feasible, power should be removed from the RHR System suction valves prior to their being leak checked.FNP Position #4: Technical Specification 3.4.14, "ROS Pressure Isolation Valve Leakage," contains the requirements for leakage testing for the RHR System suction Isolation valves. SR 3.4.14.1 specifies the leak testing requirements for the pressure isolation valves. FNP will continue to verify the RHR suction isolation valve leakage is within the required limits in accordance with SR 3.4.14.1.
Ensuring proper valve position will continue to be accomplished by use of valve position indication and administrative controls.NRC Position #5: The RHR System suction valve operators should be sized so that the valves cannot be opened against full system pressure.El1-4 Enclosure i to NL-1 5-1 055 FNP Basis for Proposed Change FNP Position #5: The motors for the RHR suction valve operators are sized to open against a differential pressure of 700 psid. However, the ability of the MOV to open is dependent on parameters such as supplied voltage and friction coefficients.
Based on the fact that the valves have a small motor sized for less than 1/3 full RCS system pressure, even with full voltage and a conservative stem coefficient of friction, there is reasonable assurance that the MOV will not open at full RCS system pressure.
No credit was taken for the capability to open the valve against full system pressure in either the generic analysis of WCAP-11736 or the FNP specific evaluations in Enclosure 2 of this LAR. Furthermore, power will be removed from all four of these valves In Modes 1, 2, and 3, and the OPI will continue to function to prevent opening of these valves when RCS pressure is greater than 402.5 psig.Conclusion:
Enclosure 2 of this LAR contains the assessments of the impact of ACl removal on RHR shutdown cooling, low temperature overpressure protection, and interfacing system Loss-Of-Coolant Accidents (LOCA) initiating event frequency.
For each area assessed, the removal of ACI and the adcompanying plant changes (including the recommended plant procedure changes) provide a benefit to plant safety. Therefore, the results discussed in Enclosure 2 of this LAR support the conclusions of generic WCAP-1 1736 and that the deletion of the ACI is acceptable for FNP, Units 1 and 2 and will ensure that the FNP units continue to be operated in a safe manner.El-5 Enclosure i to NL-1 5-1 055 FNP Basis for Proposed Change 4.0 Regulatory Evaluation
 
===4.1 Applicable===
 
Regulatory RequirementslCriteria 10 CFR 50.36(c), "Technical specifications," requires Technical Specifications to be included for the following (1) Safety limits, limiting safety system settings, and limiting control settings.(2) Limiting conditions for operation.
(3) Surveillance requirements.
(4) Design features.(5) Administrative controls.10 CFR 50.36(c) (3) Surveillance requirements, states: "Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met." The proposed change eliminates the requirement to perform the Surveillance Requirement (SR) for the Residual Heat Removal (RHR)System autoclosure interlock (ACl), since the ACl feature will be removed. The RHR ACl provides an automatic closure for the RHR System suction isolation valves on high ROS pressure; however, rapid overpressure protection of the RHR System is provided by the RHR relief valves and not by the slow acting suction isolation valves. The RHR System overpressure protection is not affected by the removal of the ACl feature. Thus, the RHR System integrity will not be affected by the removal of the ACl feature. In addition a probabilistic risk assessment was performed to show that the interfacing system LOCA initiating event frequency would decrease after the elimination of the RHR ACl.As such, the performance the ACl function verification SR is not required to ensure that facility operation will be within the safety limits and that the limiting condition for operation (LOCO) will be met. The LCO for Technical Specification (TS) 3.4.14, "ROS Pressure Isolation Valve Leakage," requires that "Leakage from each ROS PIV shall be within limits." The leakage from the residual heat removal (RHR) System suction valves will continue to be verified in the same manner as before the proposed change. Thus, the proposed change will not affect the requirement of the TS 3.4.14 LCO. In addition, the removal of the RHR System ACl minimizes the potential for spurious valve closure, which could result in a loss of the decay heat removal function, RHR System pump damage, and the inability of the RHR System to perform its function of reactor coolant system (ROS) cold over pressurization protection.
As such, the proposed change does not adversely affect the RHR System's capability to maintain facility operation within the required safety limits.Therefore 10 CER 50.36(c) continues to be met.El1-6 Enclosure i to NL-1 5-1 055 FNP Basis for Proposed Change General Design Criterion (GDC) 14 -Reactor coolant pressure boundary.
The reactor coolant pressure boundary shall be designed, fabricated, erected, and tested so as to have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture.30 -Quality of reactor coolant pressure boundary.
Components which are part of the reactor coolant pressure boundary shall be designed, fabricated, erected, and tested to the highest quality standards practical.
Means shall be provided for detecting and, to the extent practical, identifying the location of the source of reactor coolant leakage.The leakage from the RHR System suction isolation valves will continue to be tested and verified in the same manner as before the proposed change. Thus, the proposed change will not affect the leakage requirement of the TS 3.4.14 LCO.Therefore, GDC 14 and 30 will continue to be met.GDC 20 -Protection system functions.
The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.The RHR ACI is not a protection system that is required to ensure that the specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences, nor is it required to respond to accident conditions and initiate the operation of systems and components important to safety. The removal of the ACI will not adversely affect the ability of the plant instrumentation and systems to assure that the specified acceptable fuel design limits are not exceeded and to respond accident conditions and initiate the operation of systems and components important to safety.Therefore, GDC 20 will continue to be met.GDC 34 -Residual heat removal. A system to remove residual heat shall be provided.
The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded.The removal of the RHR System ACI does not adversely affect the capability of the RHR System to perform its intended safety function.
The removal of the ACI minimizes the potential for spurious valve closure, which may result in a loss of the decay heat removal function, RHR System pump damage, and the inability of the RHR System to perform its function of RCS cold over pressurization protection.
The RHR ACI interlock provides an automatic closure for the RHR System suction isolation valves on high RCS pressure; however, rapid overpressure El1-7 Enclosure i to NL-l15-1 055 FNP Basis for Proposed Change protection of the RHR System is provided by the RHR relief valves and not by the slow acting suction isolation valves. This RHR System overpressure protection is not affected by the removal of the ACI feature.Thus, the RHR System integrity will not be affected by the removal of the ACI feature.Therefore, GDC 34 continues to be met.4.2 Significant Hazards Consideration The proposed change would revise Joseph M. Farley Nuclear Plant, Units 1 and 2 (FNP) Technical Specification (TS) 3.4.14, "RCS Pressure Isolation Valve Leakage" to eliminate the requirements for the Residual Heat Removal (RHR)System suction valve autoclosure interlock (ACI) function.
In addition, the proposed change would add a control room alarm to alert the operator when an RHR suction/isolation valve is not fully closed and the Reactor Coolant System (RCS) pressure is above the alarm setpoint.The RHR ACI provides automatic closure to the RHR System suction isolation valves on high RCS pressure; however, rapid overpressure protection of the RHR System is provided by the RHR relief valves and not by the slow acting suction. isolation valves. This RHR System overpressure protection is not affected by the removal of the ACI feature. Thus, the RHR System integrity will not be affected by the removal of the ACI feature. In addition, the removal of the RHR System ACI would minimize the potential for spurious valve closure, which could result in a loss of the decay heat removal function, RHR System pump damage, and the inability of the RHR System to perform its function of ROS cold over pressurization protection.
As required by 10 CFR 50.91 (a), Southern Nuclear Operating Company (SNC)has evaluated the proposed changes to the FNP TS using the criteria in 10 CER 50.92 and has determined that the proposed changes do not involve a significant hazards consideration.
An analysis of the issue of no significant hazards consideration is presented below: 1 : Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?
Response:
No The two motor-operated gate valves located in each RHR System suction line are normally-closed to maintain the low pressure RHR System (design pressure of 600 psig) isolated from the high pressure RCS (normal operating pressure of 2235 psig). An ACI was provided to isolate the low pressure RHR System from the RCS when the pressure increases above the ACI setpoint.
However, spurious ACI actuation has resulted in RHR System isolation and subsequent loss of decay heat removal capability.
The removal of the ACl feature will preclude this inadvertent isolation, thus increasing the likelihood that RHR will be available to remove decay heat. The addition of a control room alarm to alert the operator that a suction/isolation valve(s) is not fully closed when El1-8 Enclosure 1ito NL-15-1 055 FNP Basis for Proposed Change the RCS pressure is above the alarm setpoint and administrative procedures will ensure that the RHR System will be isolated from the RCS, if the RCS pressure increases above the alarm setpoint, which will decrease the likelihood of an interfacing system LOCA. Therefore, the performance of the RHR System would not be adversely affected by the ACl deletion and the RHR suction isolation valve alarm installation.
The RHR ACl provides automatic closure to the RHR System suction isolation valves on high RCS pressure; however, rapid overpressure protection of the RHR System is provided by the RHR relief valves and not by the slow acting suction isolation valves. This RHR System overpressure protection is not affected by the removal of the ACl, this feature also serves to decrease the likelihood of an interfacing system LOCA. Thus, the RHR System integrity will not be affected by the removal of the ACl feature. In addition, the removal of the ACl feature does not adversely affect any fission barrier, alter any assumptions made in the radiological consequences evaluations, or affect the mitigation of radiological consequences.
The impact of ACl removal on RHR shutdown cooling, low temperature overpressure protection, and interfacing system LOCA initiating event frequency was assessed.
For each of these areas that were assessed, it was concluded that the removal of ACl and the accompanying plant changes provides a benefit to plant safety.With the deletion of the ACd, there is no longer any potential for spurious automatic closure of a RHR System suction isolation valve resulting in inadvertent RHR System isolation and loss of shutdown cooling.Therefore, it is concluded that the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.
2: Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?
Response:
No The removal of the RHR System ACl, and corresponding TS requirements, does not result in the initiation of any accident nor create any new credible limiting single failures.The removal of the ACl eliminates the potential for spurious circuitry actuation causing isolation of the RHR system. Furthermore, the addition of an alarm to alert the operator that a suction valve is not fully closed when RCS pressure is above the alarm setpoint reduces the likelihood that the RHR system will be exposed to high pressure conditions.
These modifications and the resulting elimination of the ACl TS Surveillance Requirement will not result in the RHR system being operated in any unanalyzed modes, either during normal or accident conditions.
Also, El1-9 Enclosure 1 to NL-15-1 055 FNP Basis for Proposed Change the RHR system will continue to be maintained and surveilled as it is currently.
No new accident scenarios, failure mechanisms, or limiting single failures are introduced as a result of the proposed changes. The proposed change does not challenge the performance or integrity of any safety-related system.Therefore, it is concluded that the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.
3: Does the proposed amendment involve a significant reduction in a margin of safety?Response:
No Removal of the ACl interlock, and its corresponding TS Surveillance Requirement, does not alter or prevent any plant response such that the margin of safety to any applicable accePtance criteria is significantly decreased.
In fact, the addition of a control room alarm that identifies that the suction valve is not fully open, together with the existing overpressure alarm, ensures that the margin of safety to an RHR overpressure condition is not significantly reduced.Furthermore, the actuation of safety-related components and the response of plant systems to accident scenarios are not affected, and thus will remain as assumed in the safety analysis.Therefore, the proposed change will not adversely affect the operation or safety function of equipment assumed in the safety analysis.For the reasons noted above, it is concluded that the proposed change does not involves a significant reduction in a margin of safety.Based upon the above analysis, SNC concludes that the proposed amendment does not involve a significant hazards consideration, under the standards set forth in 10 CFR 50.92(c), "Issuance of Amendment," and accordingly, a finding of"no significant hazards consideration" is justified.
 
===4.3 Conclusions===
In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.El1-10 Enclosure i to NL-15-1 055 FNP Basis for Proposed Change 5.0 Environmental Considerations A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within 'the restricted area, as defined in 10 CFR Part 20, or would change an inspection or surveillance requirement.
However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.
Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Therefore, pursuant to 10 CFR 51 .22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.
 
==6.0 References==
: 1. WCAP-1 1736-A, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owner's Group," October 1989.2. Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant specific Changes To The Licensing Basis," Revision 2, May 2011.7.0 Regulatory Commitments This letter contains no NRC commitments.
E1-11 Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 2 RHR Autoclosure Interlock Removal Report Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report RESIDUAL HEAT REMOVAL SYSTEM AUTOCLOSURE INTERLOCK REMOVAL REPORT FOR THE JOSEPH M. FARLEY NUCLEAR PLANT UNITS 1 AND 2 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report ABSTRACT A review of the original probabilistic analysis, and a subsequent probabilistic analysis has been performed for the Joseph M. Farley Nuclear Plant, Units 1 and 2, which justifies the deletion of the autoclosure interlock associated with the Residual Heat Removal System suction/isolation valves. The methodology utilized is based on the Westinghouse Owners Group generic WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group." The open permissive circuitry is unaffected by the deletion of the ACI. An alarm will be added to notify the operator of an incorrectly positioned Residual Heat Removal System suction/isolation valve.A probabilistic analysis was used to demonstrate that the deletion of the autoclosure interlock is acceptable from both a core safety and Residual Heat Removal System overpressurization standpoint.
E2-1 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report EXECUTIVE
 
==SUMMARY==
This report provides a justification for the removal of the-Auto Closure Interlock (ACl)from the Residual Heat Removal System (RHR) suction/isolation valves for Joseph M.Farley Nuclear Plant (FNP), Units 1 and 2.BACKGROUND In support of WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group," a literature review of decay heat removal issues, associated with the loss of RHR was performed.
The literature review indicated that a significant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of these valves during plant shutdown, 2) maintenance procedures that require de-energizing these valves in the open position before conducting setpoint calibration or work on the inverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves for cold overpressure protection mitigation.
The literature recognized that corrective actions are necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACl, but also highlighted concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA), referred to as an Event V, and RHR System pressure relief capacity.During the 1960s and 1970s, two closed valves in series isolated the RHR System from the Reactor Coolant System (RCS) while the RCS was at normal operating temperature and pressure.
Both Valves were to have power disconnected via administrative procedures except when the valves were to be stroked. An Open Permissive Interlock (OPI) was provided to one of the valves to prevent opening until the RCS pressure was below RHR System design pressure.
In 1971, the Atomic Energy Commission requirements had evolved to require an ACI on increasing pressure.
A meeting between the industry and the Nuclear Regulatory Commission (NRC) in 1974 brought about three acceptable methods of preventing RHR System overpressurization while the RHR System is in operation or when returning the RCS to operation:
: 1) automatic closure interlocks on the RHR System suction/isolation valves, 2) sufficient capacity of the RHR System suction line relief valves to mitigate a pressure transient, or 3) a combination of the two.This agreement was superceded in 1975 when the NRC required, in its Safety Evaluation Report for RESAR-41, that RHR System suction isolation valves be equipped with the ACl feature. The current NRC position is stated in Branch Technical Position RSB 5-1, dated July 1981, which requires that the RHR System suction/isolation valves E2-2 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report shall be interlocked to protect against one or both valves being ,open during an increase in RCS pressure above the RHR System design pressure and that adequate relief capacity shall be provided during the time period while the valves are closing. In 1984, an internal NRC Instrumentation and Control Systems Branch memo recommended that action be taken to modify the design of the RHR System interlocks.
An NRC internal memo in 1985 stated that a request by a plant to remove the ACI feature should be substantiated by proof that the change is a net improvement to safety and should, as a minimum, address the following:
: 1. The means available to minimize Event V concerns.2. The alarms available to alert the operator of an improperly positioned valve.3. Adequacy of the RHR System relief capacity.4. Means other than the ACI to ensure both Motor-Operated Valves (MOVs) are closed (e.g., single switch actuating both valves).5. Assurance that the function of the open permissive circuitry is not affected by the proposed change.6. Assurance that MOV position indication will remain available in the control room.7. Assessment of the proposed changes effect on RHR System reliability, as well as on Low Temperature Overpressure (LTOP) concerns.
 
==SUMMARY==
DESCRIPTION This report including the Probabilistic Analyses provides the following to support the FNP, Units 1 and 2 RHR System ACI deletion:
: 1) The RHR System description, 2) The current RHR System suction/isolation valve control circuitry description, 3) A description of the proposed ACI deletion hardware change, 4) A description of the proposed suction/isolation valve alarm circuitry addition, 5) The results of the PRA analysis performed for the RHR System unavailability including an evaluation of the gap analysis performed for that PRA, 6) The results of the interfacing systems LOCA PRA analysis, a gap analysis for that PRA, and an updated interfacing systems LOCA PRA analysis, 7)The results of the overpressurization PRA analysis and the gap analysis for that PRA, 8) The RHR System relief valve adequacy, and 9) The recommended document changes.The approach taken for this report was to reference the study performed by the Westinghouse Owners Group (WOG), which justified the deletion of the RHR System ACI for four reference (or lead) plants. This study is documented in WCAP-1 1736,"Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group." In order to perform the plant-specific analyses for the E2-3 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report FNP units, a difference analyses was performed that compared FNP to its reference plant identified in the WOG report. Once the differences were identified, the reference probabilistic analyses were modified to model FNP, Units 1 and 2, specifically.
CONCLUSIONS This report recommends the following:
: 1. An alarm will be added to each RHR suction isolation valve which will actuate if the valve is open and the reactor coolant system (RCS) pressure is greater than the open permissive setpoint and less than the RHR system design pressure minus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affected by power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of the alarm for the RHR suction isolation valves and other procedures will be revised as necessary to address the deletion of the ACl.4. Procedures will be revised to eliminate the current requirement to lockout power to the open RHR suction isolation valves below 1800°F.5. Procedures will be implemented to require that power to all four closed RHR suction isolation valves be locked out in Modes 1, 2, and 3.The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal of the ACl feature. The results of the RHR System unavailability analysis show that the removal of the ACl feature increases the RHR System availability.
The results of the overpressurization analysis show that removal of the ACl feature has little impact on the consequences of LTOP events at FNP.Consistent with WCAP-1 1736 the net effect of the ACI feature removal is considered to be a net improvement in plant safety for FNP, Units 1 and 2.E2-4 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
==1.0 INTRODUCTION==
 
The intent of this section is to state the purpose of this report and provide the necessary information to put the analysis supporting the deletion of the FNP, Units 1 and 2, Residual Heat Removal (RHR) System suction/isolation valve Autoclosure Interlock (ACI) feature in the proper context. It also presents, as background, a description of the Westinghouse Owners Group (WOG) generic topical report upon which this report and the methodology used is based.1.1 PURPOSE The Nuclear Regulatory Commission (NRC) and the nuclear industry has expressed interest in the acceptability of removing the ACl on the RHR System suction/isolation valves. This interest is in response to growing concerns about the loss of RHR capability during cold shutdown and refueling operations due to inadvertent isolation of the RHR System caused by failure of the ACI circuitry.
Isolation of the RHR System while operating has resulted in a loss of decay heat removal capability at several operating plants. It is also a potential contributor to overpressurization of the Reactor Coolant System (RCS) with possible Power-Operated Relief Valve (PORV) challenge and RHR System pump damage.For the WOG generic topical report, upon which this report is based, a literature review of decay heat removal problems was performed.
The literature review indicated that a significant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of these valves during plant shutdown, 2) maintenance procedures which require de-energizing these valves in the open position before conducting setpoint calibration or work on the inverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves for cold overpressure protection mitigation.
The literature recognized that corrective actions are necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACl, as well as highlights concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA), referred to as an Event V in WASH-1400 (Reference 1), and RHR System relief valve capacity.Based on the history of the RHR ACI, the WOG approved a program for the evaluation of the removal of the ACI on the RHR System suction/isolation valves at the following four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris.Other WOG plants participating in the program were categorized into one of four groups led by one of the reference plants based on similar RHR System configuration and design characteristics.
It was intended that other members of the WOG could reference E2-5 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report the applicable lead plant in the study and provide a difference analysis should they desire to delete the RHR System ACl.This report is written in support of deleting the FNP, Units 1 and 2, ACI feature on the RHR System suction/isolation valves based on the methodology contained in WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report For The Westinghouse Owners Group" (Reference 4). A summary description of WCAP-1 1736 is presented below.1.2 WOG PROGRAM: WCAP-11736 WCAP-] 1736 was prepared for the WOG. It provides an evaluation of the removal of the ACl on the RHR System suction/isolation valves at four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris. The WOG plants participating in the program were categorized into one of four groups based on similar RHR System configurations and design characteristics.
The plants listed by group are: Group 1 -Salem Unit 1 Salem Unit 2 D.C. Cook Units 1 & 2 Indian Point Unit 3 McGuire Units 1 & 2 Sequoyah Units]1 & 2 Watts Bar Units 1 & 2 Zion Units 1 & 2 Group 2 -Callaway Unit 1 Braidwood Units 1 & 2 Byron Units 1 & 2 Catawba Units 1 & 2 Comanche Peak Units 1 & 2 Trojan Unit 1 Seabrook Unit 1 Vogtle Units 1 & 2 Wolf Creek Unit 1 Millstone Unit 3 South Texas Units 1 & 2 Group 3 -North Anna Unit 1 Group 4 -Shearon Harris Unit 1 H.B. Robinson Unit 2 Farley Units 1 & 2 Turkey Point Units 3 & 4 Beaver Valley Unit 2 Beaver Valley Unit 1 V.C. Summer Unit 1 Prairie Island Units 1 & 2 North Anna Unit 2 The choice of the four particular reference plants was made based on providing the maximum number of the other WOG members with the best possible fit should they choose to delete the ACI in the future and reference this document.
It is expected that, should a plant desire to delete the ACI, a plant specific difference analysis would still be required, but the resources expended to produce and review it should be substantially less with reference to the WOG WCAP-1 1736.WCAP-1 1736 provides, for each of the four reference plants, the supporting:
: 1) RHR System description, 2) current RHR System suction/isolation valve control circuity E2-6 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report description, 3) proposed ACl deletion hardware changes, 4) proposed suction/isolation valve alarm circuitry addition, 5) RHR System unavailability probabilistic analysis, 6)interfacing systems LOCA probabilistic analysis, and 7) probabilistic overpressurization analysis.WCAP-1 1736 addresses each of the seven NRC concerns expressed in the 1985 NRC internal memo for each of the four reference plants, and recommends the deletion of the ACl feature for all WOG plants. For plants with an RHR System located outside of containment, the installation of a safety grade alarm is recommended to warn the Control Room Operator that a series suction/isolation valve(s) is not fully closed when RCS pressure is above the alarm setpoint.
For plants with an RHR System located entirely inside containment, an alarm is not recommended since these plants are not susceptible to the Event V (LOCA outside containment).
The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal of the ACl feature. The results of the RHR System unavailability analysis show that the removal of the ACI feature increases the RHR System availability.
The results of the overpressurization analysis show that removal of the ACI feature will have no effect on the heat input transients and will result in a slight increase in frequency of occurrence for some categories of the mass input transients with a decrease in others. The net effect of the ACl feature removal is considered to be a net improvement in plant safety.The basic information presented in WCAP-1 1736 is applicable for use in the plant-specific effort for FNP, Units 1 and 2. The literature review and licensing basis remain the same for all Westinghouse plants. The probabilistic models and database can be utilized as a basis for the plant-specific effort. The recommended changes to the technical specifications are also applicable.
This FNP plant specific report builds on the generic work of WCAP-1 1736. It justifies removal of the ACI based on a safety evaluation of the effect of ACI removal on low temperature overpressure protection, RHR System availability, and interfacing system LOCA potential.
 
==1.3 BACKGROUND==
 
During normal and accident conditions, it is necessary to keep low pressure systems that are connected to the high pressure RCS properly isolated from each other in order to avoid damage by overpressurization or potential for loss of integrity of the low pressure system and possible radioactive releases.
The FNP RHR System is a low pressure system, with a design pressure of 600 psig, with an interface to the high pressure RCS, with a normal operating pressure of 2235 psig.The primary function of the RHR System is to remove residual heat from the core and reduce the temperature of the RCS during the second phase of plant cooldown and during refueling operations.
As a secondary function, the RHR System is used to E2-7 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report transfer refueling water between the Refueling Water Storage Tank (RWST) and the refueling cavity before and after the refueling operations.
The RHR System also serves as part of the Emergency Core Cooling System (ECCS) during the injection phase of a LOCA. In addition to the above functions, the RHR System suction line relief valves are used to provide cold overpressure mitigation of RCS overpressure transients.
Figure 1-1 is a simplified flow diagram showing the FNP RHR System design. The system consists of two parallel flow paths. Each path takes a suction from a separate RCS hot leg. Each flow path contains an RHR pump, an RHR heat exchanger, piping, valves, and instrumentation required for operational control.During system operation, reactor coolant flows from the RCS to the RHR System pumps, through the tube side of the residual heat exchangers, and back to the RCS.Heat is transferred from the reactor coolant to the Component Cooling Water (CCW)circulating through the shell side of the RHR heat exchangers.
Two inlet suction/isolation valves are provided in each inlet line from the RCS. These motor-operated, gate valves are normally-closed, except when the RHR System is in operation, and function to keep the low pressure RHR System isolated from the high pressure RCS. Each of these valves is provided with a manual control (OPEN/CLOSE) on the main control board and has two automatic interlocks associated with its control circuitry:
the ACI and the OPI.The OPI prevents inadvertent opening of the suction/isolation valves when the RCS pressure is above the design pressure of the RHR System considering RHR System pump discharge pressure.
Each suction/isolation valve on each inlet line is interlocked with one of the two independent RCS wide range pressure signals to provide an OPI feature to these valves. One set of suction/isolation valves, those adjoining the RCS, are interlocked with a pressure signal to prevent their being opened whenever the RCS pressure is greater than approximately 402.5 psig. The other set of valves, those adjoining the RHR System, are similarly interlocked to prevent their being opened whenever the RCS pressure is greater than approximately 402.5 psig. These valves are also interlocked with the pressurizer vapor space temperature sensor to provide an additional interlock feature.The ACI ensures that both suction/isolation valves, in each RHR System train, are fully closed when the RCS is pressurized above the RHR System design pressure.
Each set of valves in series is interlocked with one of two independent RCS wide range pressure signals to close automatically when the RCS pressure increases to approximately 700 psig.A more detailed description of the FNP RHR System is provided in Section 2.0 of this report.E2-8 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report FIGURE 1-1 SIMPLIFIED RESIDUAL HEAT REMOVAL FLOW DIAGRAM E2-9 Enclosure 2 to NL-1 5-1 055 FNP RHR Autociosure Interlock Removal Report 2.0 FARLEY RHR SYSTEM DESCRIPTION
 
===2.1 GENERAL===
DESCRIPTION The RHR System transfers heat from the RCS to the component cooling system to reduce the temperature of the reactor coolant to the cold shutdown temperature at a controlled rate during the second part of normal plant cooldown, and maintains this temperature until the plant is started up again.As a secondary function, the RHR System also serves as part of the ECCS during the injection and recirculation phases of a LOCA.The RHR System also is used to transfer refueling water between the refueling water storage tank (RWST) and the refueling cavity before and after the refueling operations.
 
===2.2 RESIDUAL===
HEAT REMOVAL SYSTEM A flow diagram of the RHR System is shown in Figure 2-1 (Unit 1 shown for the example).
The RHR System consists of two separate trains of equal capacity, each independently capable of meeting the safety analysis design bases. Each train consists of one heat exchanger, one motor-driven pump, piping, valves, and instrumentation necessary for operational control. The inlet line to each train of the RHR System is connected to a reactor coolant loop hot leg, while the lines exiting the RHR heat exchangers are connected to the cold legs of each of the reactor Coolant loops.Each RHR System suction line is normally isolated from the RCS by two motor-operated valves in series, while the discharge lines are isolated by check valves in each line. The RHR System suction/isolation valves, the inlet line pressure relief valve, and the discharge lines downstream of valves 8888A1B and 8889 are located inside containment, while the remainder of the system is located outside containment.
During normal RHR System operations, reactor coolant flows from the RCS hot legs 1 and 3 to the RHR pumps, through the tube side of the RHR heat exchangers and back to the RCS through the Safety Injection System (SIS) cold leg injection lines. The reactor coolant heat is transferred by the RHR heat exchangers to the COW that is circulated through the shell side of the RHR heat exchangers.
2 Coincident with RHR System normal operations, a portion of the reactor coolant flow may be diverted from downstream of the RHR heat exchangers to the Chemical and Volume Control System (CVCS) low-pressure letdown line for cleanup and/or pressure control. By regulating the diverted flowrate and the charging flow, the RCS pressure can be controlled during water solid-plant operations.
Pressure regulation is necessary to maintain the pressure range dictated by the reactor vessel fracture prevention criteria E2-10 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report requirements and by the Reactor Coolant Pump (RCP) No. 1 seal differential pressure and Net Pump Suction Head (NPSH) requirements of the RCPs.The RCS cooldown rate is manually controlled by regulating the reactor coolant flow through the tube side, of the RHR heat exchangers.
Instrumentation is provided to monitor system pressure, temperature, and total flow.System Operation A discussion of RHR System operation during various reactor operating modes follows: Reactor Startup Generally, during cold shutdown, the RHR System operates to remove residual heat from the reactor core. The number of pumps and heat exchangers in service depends on the RHR System heat load at the time.At initiation of plant startup, the RCS is completely filled, and the pressurizer heaters are energized.
The RHRS is connected to the CVCS via the low pressure letdown line to control reactor coolant pressure.
Once a steam bubble is formed in the pressurizer, the RHR System is isolated, and RCS pressure/inventory control are provided by the pressurizer spray, pressurizer heaters, and the normal letdown and charging systems.Power Generation and Hot Standby Operation The RHR System is not used during hot standby or power operations when the RCS is at normal pressure and temperature.
Under these conditions, the RHR System is aligned for operation as part of the Eccs. Upon initiation of a safety injection signal the RHR System pumps take suction from the RWST and inject borated water into the RCS via the SIS accumulator cold leg injection headers. When the water in the RWST is depleted, the RHR System pumps are manually aligned to take suction from the containment recirculation sump. The RHR heat exchangers then cool the sump fluid being recirculated by the RHR System pumps and deliver the cooled water to the RCS.Since the charging pumps (high head safety injection) do not take suction from the containment sump, the RHR System pumps (low head safety injection) also supply the suctions of these pumps during recirculation.
Reactor Shutdown The initial phase of reactor cooldown is accomplished by transferring heat from the RCS to the Steam and Power Conversion System (SPCS) through the use of the steam generators.
When the reactor coolant temperature and p'ressure are reduced to E2-11 Enciosure 2 to NL-1 5-1055 FNP RHR Autoclosure Interlock Removal Report approximately 350°F and less than 425 psig the second phase of cooldown starts with the RHR System being placed in operation.
The reactor cooldown rate is limited by RCS equipment cooling rates based on allowable stress limits, as well as the operating temperature limits of the CCW System. As the reactor coolant temperature decreases, the reactor coolant flow through the RHR heat exchangers is increased to maintain a constant cooldown rate.As cooldown continues, the pressurizer is filled with water, and the ROS is operated in the water-solid condition.
At this stage, pressure is controlled by regulating the charging flow rate and the letdown rate to the CVCS from the RHR System. After the RCS is depressurized, cooled to 1 40°F, the reactor vessel head may be removed for refueling or maintenance.
Refueling One RHR pump is utilized during refueling to pump borated water from the RWST to the refueling cavity. The other is used in cooldown alignment for decay heat removal. During this operation, the isolation valves in the inlet lines of the RHR System are closed, and the isolation valves to the RWST are opened.The reactor vessel head (RVH) is lifted and placed on the storage stand. The refueling water is then pumped into the reactor vessel through the normal RHR System return lines and into the refueling cavity through the open reactor vessel. After the water level reaches normal refueling level, the inlet isolation valves are opened, the RWST supply valves are closed, and RHR is resumed.During refueling, the RHR System is maintained in service with the number of pumps and heat exchangers in operation as required by the Technical Specifications.
Following refueling, the RHR pumps are used to drain the refueling cavity to the top of the reactor vessel flange by pumping water from the RCS to the RWST.Component Description This section describes the major components of the RHR System.RHR System Pumps Two pumps are installed in the RHR System. The pumps are sized to deliver reactor coolant flow through the residual heat exchangers to meet the plant cooldown requirements.
The use of two pumps ensures that cooling capacity is only partially lost should one pump become inoperable.
E2-12 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report The RHR System pumps are protected from overheating and loss of suction flow by minif low bypass lines, located downstream of the heat exchanger outlet, which diverts part of the flow back to the pump suction. A control valve located in each minif low line is regulated by a signal from the flow transmitters located in each pump discharge header.A control valve located in each minif low line is actuated by a flow switch. The minif low valves open when RHR pump flow decreases below the flow setpoint, and close when the flow increases above the designated setpoint A pressure sensor in each pump discharge header provides a signal for an indicator in the control room. A high pressure alarm is also actuated by the pressure sensor.The RHR System pumps are vertical, centrifugal units with mechanical shaft seals. All pump surfaces in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.RHR System Heat Exchangers Two residual heat exchangers are installed in the RHR System. The RHR System heat exchanger design is based on heat load and temperature differences between the reactor coolant and the CCW existing 20 hours after reactor shutdown when the temperature difference between the two systems is small. The installation of two heat exchangers ensures that the heat removal capacity of the system is only partially lost if one heat exchanger becomes inoperative.
The heat exchangers are of the shell and U-tube type. Reactor coolant circulates through the tubes, while COW circulates through the shell. The tubes are welded to the tubesheet to prevent leakage of reactor coolant.Inlet Isolation Valves 87Q1 A/B and 8702A/B The RHR System inlet isolation valves are motor-operated gate valves that are normally-closed except when the RHR System is in operation.
These valves are provided with a manual control (open/closed) on the main control board and will fail in the "as-is" position.Valves 8701 B and 8702B are interlocked with an ROS pressure transmitter and valves 8701A and 8702A are interlocked with an ROS pressure transmitter and a temperature transmitter that measures pressurizer vapor space. These interlocks prevent the inadvertent opening of the valves when RCS pressure is greater than approximately 402.5 psig. In addition valves 8701A and 8702A cannot be opened when the pressurizer vapor space temperature exceeds 475°F. The valves also close automatically when the ROS pressure is higher than 700 psig.Because the RHR System relief valves provide cold overpressurization protection for the ROS, power is removed from the RHR System isolation valves when the ROS E2-13 Enclosure 2 to NL-15-1 055 FNP. RHR Autoclosure Interlock Removal Report temperature is below 1 80°F. By removing power from the isolation valves, an inadvertent or undesirable isolation of the RHR System relief valves is prevented.
Relief Valves 8708A and 8708B There is one, 3-inch relief valve (inside containment) in each RHR System suction line from the RCS hot leg. These relief valves are located immediately downstream of the RHR System suction/isolation valves 8701A and 8702A. These relief valves prevent RHR System overpressurization by discharging to the Pressurizer Relief Tank (PRT)when pressures within the RHR System suction line exceed 450 psig. These valves have a design capacity of 900 gpm at the 450 psig setpressure.
The RHR System suction relief valves provide overpressure protection for the RHR System.2.3 CURRENT RHR System SUCTION ISOLATION VALVES INTERLOCKS AND FUNCTIONAL REQUIREMENTS The following sections provide a description of the FNP, Units 1 and 2, suction/isolation valve interlocks and valve control circuits.Current Interlocks
(.There are two, normally-closed, motor-operated isolation valves in series in each of the two RHR System pump suction lines from the RCS hot legs. The two valves 8702B and 8701 B, inside the missile barrier, are designated as the inner isolation valves, while the two valves 8701A and 8702A, outside the missile barrier, are designated as the outer isolation valves. The interlock features provided for the inner isolation valves are identical to those provided for the outer isolation valves, except the fact that the outer isolation valves have a pressurizer vapor space temperature interlock.
Each valve is interlocked against opening unless the following conditions are met: 1. The RCS pressure, as measured by the appropriate wide range pressure channel, is less than approximately 402.5 psig. This assures the RHR System cannot be overpressurized by aligning it to the RCS when the RCS pressure plus the RHR System pump head would exceed the RHR System design pressure.'
: 2. The corresponding RHR System pump/RWST suction isolation valve is closed.This assures positive isolation of the RWST and RHR System/RWST suction piping before initiating a normal cooldown.In addition to the above interlocks, valves 8701A and 8702A are interlocked to prevent against opening unless the pressurizer vapor space temperature is less than 475°F.E2-14 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report This is incorporated to provide diverse means of defeating the open signal for the RHR System outer isolation valves.Once opened, each valve is also interlocked to automatically close on increasing RCS pressure greater than 700 psig (i.e., the ACl). This backup feature assures that both isolation valves will be closed during a plant startup prior to reaching operating conditions, if one valve had been inadvertently left open by the operator.
The operator may close the suction/isolation valves at any time.RHR System Common Suction Isolation Valve Description The RHR System Inlet Isolation Valves are motor-operated valves that can be opened or closed from the main control board. The valve will automatically close on increasing RCS pressure.
On decreasing RCS pressure and pressurizer vapor temperature, the valve control circuit receives an interlock signal that allows the valve to be opened using the main control board hand switch. On RCS pressure or pressurizer vapor temperature above the setpoint, the valve control circuit is disabled and the valve cannot be opened.The valve control circuit consists of control switches, limit switches, torque switches, contactors, relays, indicating lights, a 3 phase, 600 VAC motor, and pressure and temperature control loops. The control switches are located in the main control room.The limit switches are located in the valve motor operator and provide indication of the position of the valve. Relays are used for providing control signals. The contactor, located in the motor control center, is switched on and off to provide the power to the valve. The contactor also provides contacts that are used in the valve control circuit.There are red and green indicating lights on the main control board to show the position of the valve. The valve motor operator is located at the valve and is used to change the position of the valve. The pressure control loop measures RCS pressure and provides output signals to the valve Control circuit based on the system pressure that allows the valve to be opened from the control switch or automatically closed. The temperature control loop measures pressurizer vapor temperature and provides an output signal to allow (in conjunction with a pressure signal) the valve to be opened.2.4 REFERENCE PLANT DIFFERENCES As discussed in the introduction of this report, the basic information presented in WCAP-1 1736 is applicable for use in this FNP, Units 1 and 2, plant-specific effort.However, the aspects that require further review are the differences between the FNP units and the reference plant for its category.
Based on the recommendation of WCAP-1 1736, the applicable reference plant for the FNP units is the Shearon Harris Plant. Table 2-1 shows a summary of general characteristics for FNP and Shearon Harris.E2-15 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report In order to perform the difference analysis between FNP and the reference plant, the following documents required examination:
* Control wiring diagrams for the RHR System suction/isolation valves* The suction/isolation valve logic diagrams* RHR System configuration drawings* Operating Procedures
* Technical Specifications
* Final Safety Analysis Report (ESAR)Once the differences were identified, those differences that impacted the Shearon Harris"reference" probabilistic analyses were re-modeled such that the analyses would now specifically represent FNP, Units 1 and 2.The following lists the six plant differences that required the reference models to be modified: 1. FNP utilizes the RHR System relief valves for cold overpressure protection; Shearon Harris utilizes 2 pressurizer PORVs.2. FNP removes power to the RHR System suction/isolation valves when the RCS is less than 1800°F; Shearon Harris does not.3. FNP RHR System isolation valve OPI utilizes pressurizer vapor space temperature as a method of diverse indication; Shearon Harris RHR System OPI does not.4. FNP RHR System isolation valve position control room indicating lights are powered by a separate power supply from the isolation Valve motor; Shearon Harris indicating lights are powered from the same power supply as the isolation valve motor.5. FNP incorporates additional relays to the RHR System isolation valve process control to control the valve position.6. FNP does not power lockout the suction/isolation valves in Modes 1, 2, and 3;Shearon Harris does.The reference plant differences noted above were addressed in the probabilistic analyses performed for FNP, Units 1 and 2.The original probabilistic analyses performed for FNP, Units 1 and 2 is consistent with the applicable model analyses described in WCAP-1 1736 as approved by the NRC and addressed the reference plant differences listed above. The results of the original FNP, E2-16 Enclosure 2 to NL-1 5-1055 FNP RHR Autoclosure Interlock Removal Report Units 1 and 2 analyses are provided in Section 4.2.2 of this report. However, since these original analyses were performed in the mid-i1990s, PRA methods and standards have developed further. Therefore, the original analyses performed for the FNP units in accordance with WCAP-1 1736 were reviewed against more current standards to identify gaps that need to be addressed to validate the results of the original analyses.The resulting gap analysis and validation of the original FNP, Units 1 and 2 analyses results (which include an updated inter-system LOCA PRA analyses) is discussed in Section 4.3.E2-17 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report TABLE 2-1 REFERENCE PLANT COMPARISON Parameter FNP No. Loops 3 No. RHR System Drop Lines 2 (HL Loop 1&3)RHR System Operation Parameters 425 psig, 350°F RHR System Isolation Valves 2 MOVS Prevent Open Setpoint 402.5 psig Autoclosure Setpoint 700 psig Relief Vaive Design Setpoint 450 psig Relief Valve Design Flowrate 900 gpm Cold Overpressure Mitigation System (COMS) -Design Criteria RHR System Relief Valves Shearon Harris 2 (HL Loop 1&3)425 psig, 350°F 2 MOVS 363 psig 700 psig 450 psig 900 gpm 2 PORVS E2-1 8 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report~00 II 00 -~ 11020 0 I21 ~05~(&11511}
ROTC 5402.16*51022 004 -12 I 11 4*11.0* 0-8731102 501(0-10)00110 COO TI 0111110 40041 [111111]--10411110~ OF V 41-..-> 2-1114-61114 I 0-17511*6 622(r-4) I 2/011000 ~ c ..L~.JTo 6216 ~ 0-10111*2 511110-I)6 011 VOLVO I -10/ ~ (01150014100111005 1111*561 003 £030~11 1.47156 1-5115* ~. L~12*)* 1 I~1 15 3/,-T78 .3/8-178 .2 A it, 806-IS.. .. ...0I'I 05I00 060710' 10.07-4 1/" -8715 0-170016 11025(0-6) 00 1100001002 1110 C-Il 11005050 ~1560301 1.67161 400-Il .I/LV*IC 10-1170 01,*161211 05  ,1 .....1050 I 0.813/4 503 0410 010 ~611 (02.11 P0616011 011 6060 0436 ~ 020 011130 611-6610 /7-0*5800 -61*1005 'I!!/I mows 026450 0110 6 I0 I 0680211 0000 008010 00111 a 1.115047 111.20-7 ~Ts~5*113 11111 0-7 31*64610106 2/0111 3/014 10101 0111101 11.06311 I 11.01011 0.065* 1011 0.0610_______ *021 6031 12001-10-135637 01.510-81
-.. ..1I4 .. 6 7 .. ... ..-106 ,,6600 LO 6- 00 1-116 __{ _______ j-erm .r18-01,,.6 i -101 511.1 -,224 -5* 0103052,2WV-3 6 V 0 0410"
* I 55/'ri 11108 SI 05-02 0101 17 ,L. --04-61,_ \ ,, -'-1,'66 ,-5 , 1,-8 1/ iI J/0t *{ -50"015020.(-0 1-10 *(- IC.. 25.. 16" ' 0m#n~: 4 16- I0.5-5016 l -IT+*010 3/I-IF 04 16-,'-051_,111..
1161 o as-- 01/ po I--ow' I- 60705 510066- 68__1'-*0_f
:''-616 -l -7620.(-f)3418(111001100 , /-461 /-7 *10 61.00.1-8---735..
..6.>3/6-4-051-FIGURE 2-1 RHR SYSTEM (UNIT 1)616.1600 I. VOLVO 0110*00104511110100106105101*
000200111100
: 4. 21106101102.10 1141000 71114020 1111111 07*051.1110 611251 10)202.111042201*706 11116 11.11 11111 10 11*2.118 6666111 1008.5. VOCOIT 00260600.0 05671211 lOll 04*11112.117*68 060124*0 0. 01@10* 11111. 0601111104 01166111771710020602
: 1. It6~6 001111101101)0011651041.1110 010100 711511. 12.10*020 111066111610
$1100116*101 000011110 0111100 77)01 01031 TI.8.6101102.7*001106 641.602 2 4206014*111 10111116 01 1111100 50000.6. *115.1050 1*1111 011.0 5102717 (011611161.611*05) 0515161412.
101022. 040001111.16056006 11101006 10*1011.II. 01116061111602151110116-11100.
: 0. & 77-0510. 0 0*10 00050 111011 0*15 171111110.10110 01111*11112.71100 10311*1..II. 00301021 05611 0100211010261 10 2.006. 001117*0161 0000 IS. 110 01120001006106221111 I06~ 1105010 01511111*061 11~ 11-1160*3.
II 51711 P1111.1011 040010*1111111 510*1*00303 10 030806106 6111104510 11020.15 A IS. 11036 0110 0066. 610.0 10411 00 46006*0 10. 105. 11* 40011. 00 01111*0003 00 01115 104 00F04116C116 1.72)114 4(1061200 06 0160111(1316.
110 11110. 80*1614041100 41110*1100106:106000001160305.
1111 111111 2 00)11100511111111 805 P010 0 0-205000~71106Ii S11aI111161 0o~oo*y 06)2*05. Inc. Ia, 601011 I 110067 00.1 010 11-5 1-07010 I 10-10*601165
~11V5654 j11000 0100111 12-1*1811 0I .. ... I\ _+2 10-10 12-02-21610 t 0.1160 00102 (16001 01111(11 E2-19 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 3.0 .PROPOSED BASIC LOGIC CHANGE The proposed interlock change for FNP, Units 1 and 2, removes the ACI feature from the RHR System suction/isolation valves (8701A/B and 8702A/B).
All other valve interlock features described in the above Sections of this report, remain in place. With removal of the ACl feature, valves 8701A/B and 8702A/B will not close automatically on increasing RCS pressure greater than 700 psig. Alarms will be added (for each RHR System suction/isolation valve) that actuate in the main control room given a"VALVE NOT FULL CLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. The intent of the alarms is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is not fully closed, and that double valve isolation from the ROS to the RHR System is not being maintained.
Valve position indication to the alarm will be provided from the valve stem mounted limit switches and power to the limit switches must not be affected by power lockout to the valve. The proposed design change leaves the valve position indication main control board intact. As with other power lockout valves, there is no requirement for opposite train power for the limit switches, only that power to the limit switches is not affected by the power lockout.The only proposed change to the valve interlock and circuitry is to remove the autoclosure portion of the interlock and add a control room alarm; the valves open permissive circuit will not be altered.As discussed in the introduction of this report, power lockout was one way to reduce the frequency of inadvertent closure of these valves due to the presence of the AC!. Although this procedure served as an alternative to the removal of ACI, it also prevented the valves from performing their isolation function.
With the removal of the ACl circuitry on the RHR System suction/isolation valve, a failure of a pressure transmitter or loss of power tO the solid state protection system (SSPS) cannot result in the valves stroking closed. Thus, the postulated occurrence of a single failure isolating both RHR System trains, while the RHR System relief valves are providing cold overpressure protection, cannot occur.Therefore, the FNP requirement to open and lockout power to these valves is redundant and no longer required.Also, in the SER for the Diablo Canyon AC! removal (Reference 5), the NRC stated: "Both the staff and the licensee agreed that [removal of power to isolation valves during shutdown]
would be a bad practice since the valves would not be available to perform their isolation function should the need arise during shutdown.''
In summary, the proposed FNP interlock changes provide deletion of the AC! feature from the RHR System suction/isolation valves, while still meeting the regulatory requirements to retain the open permissive portion of the interlock.
In addition, the change provides a control room alarm to alert the operator if a RHR System suction/isolation valve is not fully closed, and provides justification for elimination of power lockout of the suction/isolatiop valves during shutdown.E2-20 Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 2 RHR Autoclosure Interlock Removal Report Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report RESIDUAL HEAT REMOVAL SYSTEM AUTOCLOSURE INTERLOCK REMOVAL REPORT FOR THE JOSEPH M. FARLEY NUCLEAR PLANT UNITS 1 AND 2 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report ABSTRACT A review of the original probabilistic analysis, and a subsequent probabilistic analysis has been performed for the Joseph M. Farley Nuclear Plant, Units 1 and 2, which justifies the deletion of the autoclosure interlock associated with the Residual Heat Removal System suction/isolation valves. The methodology utilized is based on the Westinghouse Owners Group generic WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group." The open permissive circuitry is unaffected by the deletion of the ACl. An alarm will be added to notify the operator of an incorrectly positioned Residual Heat Removal System suction/isolation valve.A probabilistic analysis was used to demonstrate that the deletion of the autoclosure interlock is acceptable from both a core safety and Residual Heat Removal System overpressurization standpoint.
E2-1 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report EXECUTIVE
 
==SUMMARY==
This report provides a justification for the removal of the Auto Closure Interlock (ACI)from the Residual Heat Removal System (RHR) suction/isolation valves for Joseph M.Farley Nuclear Plant (FNP), Units I and 2.BACKGROUND In support of WCAP-11736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group," a literature review of decay heat removal issues, associated with the loss of RHR was performed.
The literature review indicated that a significant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of these valves during plant shutdown, 2) maintenance procedures that require de-energizing these valves in the open position before conducting setpoint calibration or work on the inverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves for cold overpressure protection mitigation.
The literature recognized that corrective actions are necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACI, but also highlighted concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA), referred :to as an Event V, and RHR System pressure relief capacity.During the 1960s and 1970s, two closed valves in series isolated the RHR System from the Reactor Coolant System (RCS) while the RCS was at normal operating temperature and pressure.
Both valves were to have power disconnected via administrative procedures except when the valves were to be stroked. An Open Permissive Interlock (OPI) was provided to one of the valves to prevent opening until the RCS pressure was below RHR System design pressure.
In 1971, the Atomic Energy Commission requirements had evolved to require an ACI on increasing pressure.
A meeting between the industry and the Nuclear Regulatory Commission (NRC) in 1974 brought about three acceptable methods of preventing RHR System overpressurization while the RHR System is in operation or when returning the RCS to operation:
: 1) automatic closure interlocks on the RHR System suction/isolation valves, 2) sufficient capacity of the RHR System suction line relief valves to mitigate a pressure transient, or 3) a combination of the two.This agreement was superceded in 1975 when the NRC required, in its Safety Evaluation Report for RESAR-41, that RHR System suction isolation valves be equipped with the ACI feature. The current NRC position is stated in Branch Technical Position RSB 5-1, dated July 1981, which requires that the RHR System suction/isolation valves E2-2 Enclosure 2 to NL-1 5-1 055 FNP RHR Autociosure Interlock Removal Report shall be interlocked to protect against one or both valves being open during an increase in RCS pressure above the RHR System design pressure and that adequate relief capacity shall be provided during the time period while the valves are closing. In 1984, an internal NRC Instrumentation and Control Systems Branch memo recommended that action be taken to modify the design of the RHR System interlocks.
An NRC internal memo in 1985 stated that a request by a plant to remove the ACI feature should be substantiated by proof that the change is a net improvement to safety and should, as a minimum, address the following:
: 1. The means available to minimize Event V concerns.2. The alarms available to alert the operator of an improperly positioned valve.3. Adequacy of the RHR System relief capacity.4. Means other than the ACI to ensure both Motor-Operated Valves (MOVs) are closed (e.g., single switch actuating both valves).5. Assurance that the function of the open permissiye cirCuitry is not affected by the proposed change.6. Assurance that MOV position indication will remain available in the control room.7. Assessment of the proposed changes effect on RHR System reliability, as well as on Low Temperature Overpressure (LTOP) concerns.
 
==SUMMARY==
DESCRIPTION This report including the Probabilistic Analyses provides the following to support the FNP, Units 1 and 2 RHR System ACI deletion:
: 1) The RHR System description, 2) The current RHR System suction/isolation valve control circuitry description, 3) A description of the proposed ACl deletion hardware change, 4) A description of the proposed suction/isolation valve alarm circuitry addition, 5) The results of the PRA analysis performed for the RHR System unavailability including an evaluation of the gap analysis performed for that PRA, 6) The results of the interfacing systems LOCA PRA analysis, a gap analysis for that PRA, and an updated interfacing systems LOCA PRA analysis, 7)The results of the overpressurization PRA analysis and the gap analysis for that PRA, 8) The RHR System relief valve adequacy, and 9) The recommended document changes.The approach taken for this report was to reference the study performed by the Westinghouse Owners Group (WOG), which justified the deletion of the RHR System ACI for four reference (or lead) plants. This study is documented in WCAP-1 1736,'Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group." In order to perform the plant-specific analyses for the E2-3 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report FNP units, a difference analyses was performed that compared FNP to its reference plant identified in the WOG report. Once the differences were identified, the reference probabilistic analyses were modified to model FNP, Units 1 and 2, specifically.
CONCLUSIONS This report recommends the following:
: 1. An alarm will be added to each RHR suction isolation valve which will actuate if the valve is open and the reactor coolant system (ROS) pressure is greater than the open permissive setpoint and less than the RHR system design pressure minus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affected by power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of the alarm for the RHR suction isolation valves and other procedures will be revised as necessary to address the deletion of the ACI.4. Procedures will be revised to eliminate the current requirement to lockout power to the open RHR suction isolation valves below 1 80°F.5. Procedures will be implemented to require that power to all four closed RHR suction isolation valves be locked out in Modes 1, 2, and 3.The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal of the ACl feature. The results of the RHR System unavailability analysis show that the removal of the ACl feature increases the RHR System availability.
The results of the overpressurization analysis show that removal of the ACl feature has little impact on the consequences of LTOP events at FNP.Consistent with WCAP-1 1736 the net effect of the ACl feature removal is considered to be a net improvement in plant safety for FNP, Units 1 and 2.E2-4 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report
 
==1.0 INTRODUCTION==
 
The intent of this section is to state the purpose of this report and provide the necessary information to put the analysis supporting the deletion of the FNP, Units 1 and 2, Residual Heat Removal (RHR) System suction/isolation valve Autoclosure Interlock (Acl) feature in the proper context. It also presents, as background, a description of the Westinghouse Owners Group (WOG) generic topical report upon which this report and the methodology used is based.1.1 PURPOSE The Nuclear Regulatory Commission (NRC) and the nuclear industry has expressed interest in the acceptability of removing the ACI on the RHR System suction/isolation valves. This interest is in response to growing concerns about the loss of RHR capability during cold shutdown and refueling operations due to inadvertent isolation of the RHR System caused by failure of the ACI circuitry.
Isolation of the RHR System while operating has resulted in a loss of decay heat removal capability at several operating plants. It is also a potential contributor to overpressurization of the Reactor Coolant System (RCS) with possible Power-Operated Relief Valve (PORV) challenge and RHR System pump damage.For the WOG generic topical report, upon which this report is based, a literature review of decay heat removal problems was performed.
The literature review indicated that a significant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of these valves during plant shutdown, 2) maintenance procedures which require de-energizing these valves in the Open position before conducting setpoint calibration or work on the inverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves for cold overpressure protection mitigation.
The literature recognized that corrective actions are necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACI, as well as highlights concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA), referred to as an Event V in WASH-1400 (Reference 1), and RHR System relief valve capacity.Based on the history of the RHR ACI, the WOG approved a program for the evaluation of the removal of the ACI on the RHR System suction/isolation valves at the following four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris.Other WOG plants participating in the program were categorized into one of four groups led by one of the reference plants based on similar RHR Systemn configuration and design characteristics.
It was intended that other members of the WOG could reference E2-5 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report the applicable lead plant in the study and provide a difference analysis should they desire to delete the RHR System ACl.This report is written in support of deleting the FNP, Units 1 and 2, ACl feature on the RHR System suction/isolation valves based on the methodology contained in WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report For The Westinghouse Owners Group" (Reference 4). A summary description of WCAP-1 1736 is presented below.1.2 WOG PROGRAM: WCAP-11736 WCAP-1 1736 was prepared for the WOG. It provides an evaluation of the removal of the ACl on the RHR System suction/isolation valves at four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris. The WOG plants participating in the program were categorized into one of four groups based on similar RHR System configurations and design characteristics.
The plants listed by group are: Group 1 -Salem Unit 1 Salem Unit 2 D.C. Cook Units 1 & 2 Indian Point Unit 3 McGuire Units 1 & 2 Sequoyah Units I & 2 Watts Bar Units 1 & 2 Zion Units I & 2 Group 2 -Callaway Unit I Braidwood Units 1 & 2 Byron Units I & 2 Catawba Units 1 & 2 Comanche Peak Units 1 & 2 Trojan Unit 1 Seabrook Unit 1 Vogtle Units 1 & 2 Wolf Creek Unit 1 Millstone Unit 3 South Texas Units 1 & 2 Group 3 -North Anna Unit 1 Group 4 -Shearon Harris Unit 1 H.B. Robinson Unit 2 Farley Units I & 2 Turkey Point Units 3 & 4 Beaver Valley Unit 2 Beaver Valley Unit 1 V.C. Summer Unit 1 Prairie Island Units 1 & 2 North Anna Unit 2 The choice of the four particular reference plants was made based on providing the maximum number of the other WOG members with the best possible fit should they choose to delete the ACI in the future and reference this document.
It is expected that, should a plant desire to delete the ACl, a plant specific difference analysis would still be required, but the resources expended to produce and review it should be substantially less with reference to the WOG WCAP-1 1736.WCAP-1 1736 provides, for each of the four reference plants, the supporting:
: 1) RHR System description, 2) current RHR System suction/isolation valve control circuity E2-6 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report description, 3) proposed ACl deletion hardware changes, 4) proposed suction/isolation valve alarm circuitry addition, 5) RHR System unavailability probabilistic analysis, 6)interfacing systems LOCA probabilistic analysis, and 7) probabilistic overpressurization analysis.WCAP-1 1736 addresses each of the seven NRC concerns exPressed in the 1985 NRC internal memo for each of the four reference plants, and recommends the deletion of the ACI feature for all WOG plants. For plants with an RHR System located outside of containment, the installation of a safety grade alarm is recommended to warn the Control Room Operator that a series suction/isolation valve(s) is not fully closed when RCS pressure is above the alarm setpoint.
For plants with an RHR System located entirely inside containment, an alarm is not recommended since these plants are not susceptible to the Event V (LOCA outside containment).
The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal of the ACl feature. The results of the RHR System unavailability analysis show that the removal of the ACI feature increases the RHR System availability.
The results of the overpressurization analysis show that removal of the ACI feature will have no effect on the heat input transients and will result in a slight increase in frequency of occurrence for some categories of the mass input transients with a decrease in others. The net effect of the ACl feature removal is considered to be a net improvement in plant safety.The basic information presented in WCAP-1 1736 is applicable for use in the plant-specific effort for FNP, Units i and 2. The literature review and licensing basis remain the same for all Westinghouse plants. The probabilistic models and database can be utilized as a basis for the plant-specific effort. The recommended changes to the technical specifications are also applicable.
This FNP plant specific report builds on the generic work of WCAP-11736.
It justifies removal of the ACI based On a safety evaluation of the effect of ACI removal on low temperature overpressure protection, RHR System availability, and interfacing system LOCA potential.
 
==1.3 BACKGROUND==
 
During normal and accident conditions, it is necessary to keep low pressure systems that are connected to the high pressure RCS properly isolated from each other in order to avoid damage by overpressurization or potential for loss of integrity of the low pressure system and possible radioactive releases.
The FNP RHR System is a low pressure system, with a design pressure of 600 psig, with an interface to the high pressure RCS, with a normal operating pressure of 2235 psig.The primary function of the RHR System is to remove residual heat from the core and reduce the temperature of the RCS during the second phase of plant cooldown and during refueling operations.
As a secondary function, the RHR System is used to E2-7 Enciosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report transfer refueling water between the Refueling Water Storage Tank (RWST) and the refueling cavity before and after the refueling operations.
The RHR System also serves as part of the Emergency Core Cooling System (ECCS) during the injection phase of a LOCA. In addition to the above functions, the RHR System suction line relief valves are used to provide cold overpressure mitigation of RCS overpressure transients.
Figure 1-1 is a simplified flow diagram showing the FNP RHR System design. The system consists of two parallel flow paths. Each path takes a suction from a separate RCS hot leg. Each flow path contains an RHR pump, an RHR heat exchanger, piping, valves, and instrumentation required for operational control.During system operation, reactor coolant flows from the RCS to the RHR System pumps, through the tube side of the residual heat exchangers, and back to the RCS.Heat is transferred from the reactor coolant to the Component Cooling Water (CCW)circulating through the shell side of the RHR heat exchangers.
Two inlet suction/isolation valves are provided in each inlet line from the RCS. These motor-operated, gate valves are normally-closed, except when the RHR System is in operation, and function to keep the low pressure RHR System isolated from the high pressure RCS. Each of these valves is provided with a manual control (OPEN/CLOSE) on the main control board and has two automatic interlocks associated with its control circuitry:
the ACI and the OPI.The OPI prevents inadvertent opening of the suction/isolation valves when the RCS pressure is above the design pressure of the RHR System considering RHR System pump discharge pressure.
Each suction/isolation valve on each inlet line is interlocked with one of the two independent RCS wide range pressure signals to provide an OPI feature to these valves. One set of suction/isolation valves, those adjoining the RCS, are interlocked with a pressure signal to prevent their being opened whenever the RCS pressure is greater than approximately 402.5 psig. The other set of valves, those adjoining the RHR System, are similarly interlocked to prevent their being opened whenever the RCS pressure is greater than approximately 402.5 psig. These valves are also interlocked with the pressurizer vapor space temperature sensor to provide an additional interlock feature.The ACI ensures that both suction/isolation valves, in each RHR System train, are fully closed when the RCS is pressurized above the RHR System design pressure.
Each set of valves in series is interlocked with one of two independent RCS wide range pressure signals to close automatically when the RCS pressure increases to approximately 700 psig.A more detailed description of the FNP RHR System is provided in Section 2.0 of this report.E2-8 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report FIGURE 1-1 SIMPLIFIED RESIDUAL HEAT REMOVAL FLOW DIAGRAM E2-9 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 2.0 FARLEY RHR SYSTEM DESCRIPTION
 
===2.1 GENERAL===
DESCRIPTION The RHR System transfers heat from the RCS to the component cooling system to reduce the temperature of the reactor coolant to the cold shutdown temperature at a controlled rate during the second part of normal plant cooldown, and maintains this temperature until the plant is started up again.As a secondary function, the RHR System also serves as part of the ECCS during the injection and recirculation phases of a LOCA.The RHR System also is used to transfer refueling water between the refueling water storage tank (RWST) and the refueling cavity before and after the refueling operations.
 
===2.2 RESIDUAL===
HEAT REMOVAL SYSTEM A flow diagram of the RHR System is shown in Figure 2-1 (Unit 1 shown for the example).
The RHR System consists of two separate trains of equal capacity, each independently capable of meeting the safety analysis design bases. Each train consists of one heat exchanger, one motor-driven pump, piping, valves, and instrumentation necessary for operational control. The inlet line to each train of the RHR System is connected to a reactor coolant loop hot leg, while the lines exiting the RHR heat exchangers are connected to the cold legs of each of the reactor coolant loops.Each RHR System suction line is normally isolated from the RCS by two motor-operated valves in series, while the discharge lines are isolated by check valves in each line. The RHR System suction/isolation valves, the inlet line pressure relief valve, and the discharge lines downstream of valves 8888A/B and 8889 are located inside containment, while the remainder of the system is located outside containment.
During normal RHR System operations, reactor coolant flows from the RCS hot legs 1 and 3 to the RHR pumps, through the tube side of the RHR heat exchangers and back to the RCS through the Safety Injection System (SIS) cold leg injection lines. The reactor coolant heat is transferred by the RHR heat exchangers to the CCW that is circulated through the shell side of the RHR heat exchangers.
Coincident with RHR System normal operations, a portion of the reactor coolant flow may be diverted from downstream of the RHR heat exchangers to the Chemical and Volume Control System (CVCS) low-pressure letdown line for cleanup and/or pressure control. By regulating the diverted flowrate and the charging flow, the RCS pressure can be controlled during water solid-plant operations.
Pressure regulation is necessary to maintain the pressure range dictated by the reactor vessel fracture prevention criteria E2-10 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report requirements and by the Reactor Coolant Pump (RCP) No. 1 seal differential pressure and Net Pump Suction Head (NPSH) requirements of the RCPs.The RCS cooldown rate is manually controlled by regulating the reactor coolant flow through the tube side of the RHR heat exchangers.
Instrumentation is provided to monitor system pressure, temperature, and total flow.System Operation A discussion of RHR System operation during various reactor operating modes follows: Reactor Startup Generally, during cold shutdown, the RHR System operates to remove residual heat from the reactor core. The number of pumps and heat exchangers in service depends on the RHR System heat load at the time.At initiation of plant startup, the RCS is completely filled, and the pressurizer heaters are energized.
The RHRS is connected to the CVOS via the low pressure letdown line to control reactor coolant pressure.
Once a steam bubble is formed in the pressurizer, the RHR System is isolated, and ROS pressure/inventory control are provided by the pressurizer spray, pressurizer heaters, and the normal letdown and charging systems.Power Generation and Hot Standby Operation The RHR System is not used during hot standby or power operations when the RCS is at normal pressure and temperature.
Under these conditions, the RHR System is aligned for operation as part of the ECCS. Upon initiation of a safety injection signal the RHR System pumps take suction from the RWST and inject borated water into the RCS via the SIS accumulator cold leg injection headers. When the water in the RWST is depleted, the RHR System pumps are manually aligned to take suction from the containment recirculation sump. The RHR heat exchangers then cool the sump fluid being recirculated by the RHR System pumps and deliver the cooled water to the ROS.Since the charging pumps (high head safety injection) do not take suction from the containment sump, the RHR System pumps (low head safety injection) also supply the suctions of these pumps during recirculation.
Reactor Shutdown The initial phase of reactor cooldown is accomplished by transferring heat from the RCS to the Steam and Power Conversion System (SPCS) through the use of the steam generators.
When the reactor coolant temperature and pressure are reduced to E2-11 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report approximately 350°F and less than 425 psig the second phase of cooldown starts with the RHR System being placed in operation." The reactor cooldown rate is limited by RCS equipment cooling rates based on allowable stress limits, as well as the operating temperature limits of the CCW System. As the reactor coolant temperature decreases, the reactor coolant flow through the RHR heat exchangers is increased to maintain a constant cooldown rate.As cooldown continues, the pressurizer is filled with water, and the RCS is operated in the water-solid condition.
At this stage, pressure is controlled by regulating the charging flow rate and the letdown rate to the CVCS from the RHR System. After the RCS is depressurized, cooled to _<140&deg;F, the reactor vessel head may be removed for refueling or maintenance.
Ref~ueling
*One RHR pump is utilized during refueling to pump borated water from the RWST to the'refueling cavity. The other is used in cooldown alignment for decay heat removal. During this operation, the isolation valves in the inlet lines of the RHR System are closed, and the isolation valves to the RWST are opened.The reactor vessel head (RVH) is lifted and placed on the storage stand. The refueling water is then pumped into the reactor vessel through the normal RHR System return lines and into the refueling cavity through the open reactor vessel. After the water level reaches normal refueling level, the inlet isolation valves are opened, the RWST supply valves are closed, and RHR is resumed.During refueling, the RHR System is maintained in service with the number of pumps and heat exchangers in operation as required by the Technical Specifications.
Following refueling, the RHR pumps are used to drain the refueling cavity to the top of the reactor vessel flange by pumping water from the ROS to the RWST.Component Description This section describes the major components of the RHR System.RHR System Pumps Two pumps are installed in the RHR System. The pumps are sized to deliver reactor coolant flow through the residual heat exchangers to meet the plant cooldown requirements.
The use of two pumps ensures that cooling capacity is only partially lost should one pump become inoperable.
E2-12 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report The RHR System pumps are protected from overheating and loss of suction flow by miniflow bypass lines, located downstream of the heat exchanger outlet, which diverts part of the flow back to the pump suction. A control valve located in each miniflow line is regulated by a signal from the flow transmitters located in each pump discharge header.A control valve located in each miniflow line is actuated by a flow switch. The miniflow valves open when RHR pump flow decreases below the flow setpoint, and close when the flow increases above the designated setpoint A pressure sensor in each pump discharge header provides a signal for an indicator in the control room. A high pressure alarm is also actuated by the pressure sensor.The RHR System pumps are vertical, centrifugal units with mechanical shaft seals. All pump surfaces in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.RHR System Heat Exchangers Two residual heat exchangers are installed in the RHR System. The RHR System heat exchanger design is based on heat load and temperature differences between the reactor coolant and the CCW existing 20 hours after reactor shutdown when the temperature difference between the two systems is small. The installation of two heat exchangers ensures that the heat removal capacity of the system is only partially lost if one heat exchanger becomes inoperative.
The heat exchangers are of the shell and U-tube type. Reactor coolant circulates through the tubes, while COW circulates through the shell. The tubes are welded to the tubesheet to prevent leakage of reactor coolant.Inlet Isolation Valves 8701A/B and 8702A/B The RHR System inlet isolation valves are motor-operated gate valves that are normally-closed except when the RHR System is in operation.
These valves are provided with a manual control (open/closed) on the main control board and will fail in the "as-is" position.Valves 8701 B and 8702B are interlocked with an RCS pressure transmitter and valves 8701A and 8702A are interlocked with an ROS pressure transmitter and a temperature transmitter that measures pressurizer vapor space. These interlocks prevent the inadvertent opening of the valves when RCS pressure is greater than approximately 402.5 psig. In addition valves 8701A and 8702A cannot be opened when the pressurizer vapor space temperature exceeds 475&deg;F. The valves also close automatically when the RCS pressure is higher than 700 psig.Because the RHR System relief valves provide cold overpressurization protection for the RCS, power is removed from the RHR System isolation valves when the RCS E2-13 Enclosure 2 to NL-15-1 055-FNP RHR Autoclosure Interlock Removal Report temperature is below 180&deg;F. By removing power from the isolation valves, an inadvertent or undesirable isolation of the RHR System relief valves is prevented.
Relief Valves 8708A and 8708B There is one, 3-inch relief valve (inside containment) in each RHR System suction line from the RCS hot leg. These relief valves are located immediately downstream of the RHR System suction/isolation valves 8701A and 8702A. These relief valves prevent RHR System overpressurization by discharging to the Pressurizer Relief Tank (PRT)when pressures within the RHR System suction line exceed 450 psig. These valves have a design capacity of 900 gpm at the 450 psig setpressure.
The RHR System suction relief valves provide overpressure protection for the RHR System.2.3 CURRENT RHR System SUCTION ISOLATION VALVES INTERLOCKS AND FUNCTIONAL REQUIREMENTS The following sections provide a description of the FNP, Units 1 and 2, suction/isolation valve .interlocks and valve control circuits.Current Interlocks There are two, normally-closed, motor-operated isolation valves in series in each of the two RHR System pump suction lines from the RCS hot legs. The two valves 8702B and 8701 B, inside the missile barrier, are designated as the inner isolation valves, while the two valves 8701A and 8702A, outside the missile barrier, are designated as the outer isolation valves. The interlock features provided for the inner isolation valves are identical to those provided for the outer isolation valves, except the fact that the outer isolation valves have a pressurizer vapor space temperature interlock.
Each valve is interlocked against opening unless the following conditions are met: 1. The RCS pressure, as measured by the appropriate wide range pressure channel, is less than approximately 402.5 psig. This assures the RHR System cannot be overpressurized by aligning it to the RCS when the RCS pressure plus the RHR System pump head would exceed the RHR System design pressure.2. The corresponding RHR System pump/RWST suction isolation valve is closed.This assures positive isolation of the RWST and RHR System/RWST suction piping before initiating a normal cooldown.In addition to the above interlocks, valves 8701A and 8702A are interlocked to prevent against opening unless the pressurizer vapor space temperature is less than 475&deg;F.E2-14 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report This is incorporated to provide diverse means of defeating the open signal for the RHR System outer isolation valves.Once opened, each valve is also interlocked to automatically close on increasing RCS pressure greater than 700 psig (i.e., the ACl). This backup feature assures that both isolation valves will be closed during a plant startup prior to reaching operating conditions, if one valve had been inadvertently left open by the operator.
The operator may close the suction/isolation valves at any time.RHR System Common Suction Isolation Valve Description The RHR System Inlet Isolation Valves are motor-operated valves that can be opened or closed from the main control board. The valve will automatically close on increasing RCS pressure.
On decreasing RCS pressure and pressurizer vapor temperature, the valve control circuit receives an interlock signal that allows the valve to be opened using the main control board hand switch. On RCS pressure or pressurizer vapor temperature above the setpoint, the valve control circuit is disabled and the valve cannot be opened.The valve control circuit consists of control switches, limit switches, torque switches, contactors, relays, indicating lights, a 3 phase, 600 VAC motor, and pressure and temperature control loops. The control switches are located in the main control room.The limit switches are located in the valve motor operator and provide indication of the position of the valve. Relays are used for providing control signals. The contactor, located in the motor control center, is switched on and off to provide the power to the valve. The contactor also provides contacts that are used in the valve control circuit.There are red and green indicating lights on the main control board to show the position of the valve. The valve motor operator is located at the valve and is used to change the position of the valve. The pressure control loop measures RCS pressure and provides output signals to the valve control circuit based on the system pressure that allows the valve to be opened from the control switch or automatically closed. The temperature control loop measures pressurizer vapor temperature and provides an output signal to allow (in conjunction with a pressure signal) the valve to be opened.2.4 REFERENCE PLANT DIFFERENCES As discussed in the introduction of this report, the basic information presented in WCAP-1 1736 is applicable for use in this FNP, Units I and 2, plant-specific effort.However, the aspects that require further review are the differences between the FNP units and the reference plant for its category.
Based on the recommendation of WCAP-1 1736, the applicable reference plant for the FNP units is the Shearon Harris Plant. Table 2-i shows a summary of general characteristics for FNP and Shearon Harris.E2-15 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report In order to perform the difference analysis between FNP and the reference plant, the following documents required examination:
* Control wiring diagrams for the RHR System suction/isolation valves* The suction/isolation valve logic diagrams* RHR System configuration drawings* Operating Procedures
* Technical Specifications
* Final Safety Analysis Report (FSAR)Once the differences were identified, those differences that impacted the Shearon Harris"reference" probabilistic analyses were re-modeled such that the analyses would now specifically represent FNP, Units 1 and 2.The following lists the six plant differences that required the reference models to be modified: 1. FNP utilizes the RHR System relief valves for cold overpressure protection; Shearon Harris utilizes 2 pressurizer PORVs.2. FNP removes power to the RHR System suction/isolation valves when the RCS is less than 1 80&deg;F; Shearon Harris does not.3. FNP RHR System isolation valve OPI utilizes pressurizer vapor space temperature as a method of diverse indication; Shearon Harris RHR System OPI does not.4. FNP RHR System isolation valve position control room indicating lights are powered by a separate power supply from the isolation valve motor; Shearon Harris indicating lights are powered from the same power supply as the isolation valve motor.5. FNP incorporates additional relays to the RHR System isolation valve process control to control the valve position.6. FNP does not power lockout the suction/isolation valves in Modes 1, 2, and 3;Shearon Harris does.The reference plant differences noted above were addressed in the probabilistic analyses performed for FNP, Units 1 and 2.The original probabilistic analyses performed for FNP, Units 1 and 2 is consistent with the applicable model analyses described in WCAP-1 1736 as approved by the NRC and addressed the reference plant differences listed above. The results of the original FNP, E2-16 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report Units 1 and 2 analyses are provided in Section 4.2.2 of this report. However, since these original analyses were performed in the mid-1990s, PRA methods and .standards have developed further. Therefore, the original analyses performed for the FNP units in accordance with WCAP-1 1736 were reviewed against more current standards to identify gaps that need to be addressed to validate the results of the original analyses.The resulting gap analysis and validation of the original FNP, Units 1 and 2 analyses results (which include an updated inter-system LOCA PRA analyses) is discussed in Section 4.3.E2-17 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report TABLE 2-1 REFERENCE PLANT COMPARISON Parameter FNP No. Loops 3 No. RHR System Drop Lines 2 (HL Loop 1&3)RHR System Operation Parameters 425 psig, 350&deg;F RHR System Isolation Valves 2 MOVS Prevent Open Setpoint 402.5 psig Autoclosure Setpoint 700 psig Relief Valve Design Setpoint 450 psig Relief Valve Design Flowrate 900 gpm Shearon Harris 2 (HL Loop 1&3)425 psig, 350&deg;F 2 MOVS 363 psig 700 psig 450 psig 900 gpm 2 PORVS Cold Overpressure Mitigation System (COMS) -Design Criteria RHR System Relief Valves E2-18 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report I 3/-4 1000~0200-3, 0-41.1103 OtI(0-10)i.e 1  2-080-1018 I 101085 COW 88 010005)~iF~1LY~J 2-108 3/4'0 001 olo ( /i " 10 -,15 00 0-01 0-111008 00.0(0-4)190 q0010 100 8/80, 10 0 -014l.-1-81110./4--00 0-111031 8200 31 zoom-____ 1.4 000008 0011411t 110081 54.0 1.000-7 1-80088 I I~ I I 000314 I I 1-05-0000 r60101 808840 011000 2 OJIlIlIlI 100304 I/l'0 Liii 'I Eli'- 0001 '2' 502-81_~cmI 1-105800..
1,'0100,..
1.0-171i40 g W~ ElT-01-' 8 "AJC  4 T i- -----008040 cm-2o ,440 1'1P0l0 los .( /o .6 511-l-84 S800I 1lJ eo m tr,,&FI.o.oe( [ .C -7 410-0 t -r ".~ 6 4 004 00 i09 II 1.-y-0I1-50.8"8G--
FIGURE 2-1 RHR SYSTEM (UNIT 1)3/4' 0 108200 1(03101 0608A 40509 1041.00010011400000100 030106 000100 1005040! 1000 0. 458.010 00110 101540 40 040.0 0441. 544010 00.0 1058 0830440410 100101084 14000008 70010 04008000.108 41008 00010 00820 0 00.00) 0044 0081.008 082570100041 P001431.000.
3/4'S 7 1040000441 810020 45 0.410 61 1450000810
& 00.1104.4440 008000*1400010.0004408 101000 0. 084.1080 0000 00400 5401411 (0040000.
63.408)11.0+/- 4010440011.000041005 P8011100 1001011.II 5010404001041.4145108 0-1000. 0. 04 0-0010. 0>1.~~ 1/6-00-1014 4580400051 Aol. 11403 (40091 0.0540 IL 002481.4.
09.004 01104001010004 40001.0045000 II 1000830401004100000 144444010 0014110 40.0100 9004004 In 040.000041 81004.0800 II 00 0008 /0100 0114074100 0100410.A 16.00114585000 08841 7140111.0000 01010 100 0401400004408 0091. 00008.004cm 1400 081 4101 1140300 541 4106-84 1-81008 0-01000 2-80-1014 125418100 80-008000 (li/I 608054 17' ~'-o 8'TO 10 10-04-OOIs I o.oa 7 1 00810 000501(44.
0 0-405401 100-0)o714 4 00001 '-olooa 8100303 503 00 0-7 5010+/-0 3/40 0.10037 5(7 7-8 0 001 12' (00-70 08044 808140444400 004101 010010 ~I I 1100301 54.8010 0-1 0-014 42-1400 1000410 IlU4tCO  0010000005-
: 7. 0091406011080CC 0' 00801 1410308.101 080. 100 5014004.050054 505110010010 060. 410000.01150411 000414,00 0o084"7 1000110 Ioo lo E2-19 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 3.0 PROPOSED BASIC LOGIC CHANGE The proposed interlock change for FNP, Units 1 and 2, removes the ACl feature from the RHR System suction/isolation valves (8701A/B and 8702A/B).
All other valve interlock features described in the above Sections of this report, remain in place. With removal of the ACI feature, valves 8701A/B and 8702A/B will not close automatically on increasing RCS pressure greater than 700 psig. Alarms will be added (for each RHR System suction/isolation valve) that actuate in the main control room given a"VALVE NOT FULL CLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. The intent of the alarms is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is not fully closed, and that double valve isolation from the RCS to the RHR System is not being maintained.
Valve position indication to the alarm will be provided from the valve stem mounted limit switches and power to the limit switches must not be affected by power lockout to the valve. The proposed design change leaves the valve position indication main control board intact. As with other power lockout valves, there is no requirement for opposite train power for the limit switches, only that power to the limit switches is not affected by the power lockout.The only proposed change to the valve interlock and circuitry is to remove the autoclosure portion of the interlock and add a control room alarm; the valves open permissive circuit will not be altered.As discussed in the introduction of this report, power lockout was one way to reduce the frequency of inadvertent closure of these valves due to the presence of the ACl. Although this procedure served as an alternative to the removal of ACl, it also prevented the valves from performing their isolation.function.
With the removal of the ACI circuitry on the RHR System suction/isolation valve, a failure of a pressure transmitter or loss of power to the solid state protection system (SSPS) cannot result in the valves stroking closed. Thus, the postulated occurrence of a single failure isolating both RHR System trains, while the RHR System relief valves are providing cold overpressure protection, cannot occur.Therefore, the FNP requirement to open and lockout power to these valves is redundant and no longer required.Also, in the SER for the Diablo Canyon ACl removal (Reference 5), the NRC stated: "Both the staff and the licensee agreed that [removal of power to isolation valves during shutdown]
would be a bad practice since the valves would not be available to perform their isolation function should the need arise during shutdown." In summary, the proposed FNP interlock changes provide deletion of the ACl feature from the RHR System suction/isolation valves, while still meeting the regulatory requirements to retain the open*permissive portion of the interlock.
In addition, the change provides a control room alarm to alert the operator if a RHR System suction/isolation valve is not fully closed, and provides justification for elimination of power lockout of the suction/isolation valves during shutdown.E2-20 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 4.0 PROBABILISTIC ANALYSIS
 
==4.1 INTRODUCTION==
 
TO THE PROBABILISTIC ASSESSMENT This evaluation provides the justification for removal of the auto-closure interlock (ACI) circuit for the isolation valves on the residual heat removal (RHR) system suction lines from the reactor coolant system (RCS) for the Farley Nuclear Plant (FNP), Units 1 and 2. This is a deterministic justification supported by probabilistic insights.The ACI circuit automatically closes these isolation valves if the ROS pressure increases above a pre-determined setpoint.
This circuit provides assurance these isolation valves are closed on increasing RCS pressure, such as when returning to power operation, and protects the low pressure RHR system from the high pressures of the RCS. Although the ACl function provides additional assurance that the isolation valves are closed, the ACl has also caused inadvertent
*closure of these isolation valves when the plant is on RHR cooling during shutdown resulting in loss of reactor cooling events.Due to the limited benefit of the ACl function and the potential of loss of cooling when shutdown, the Westinghouse Owners Group (now the Pressurized Water Reactor Owners Group)completed a program to justify removal of the ACl function and provided WCAP-1 1736 (Reference
: 4) to the Nuclear Regulatory Commission (NRC) for review and approval.
The NRC issued a Safety Evaluation (SE) on the WCAP that concluded removal of the ACI can produce a net safety benefit provided that several key improvements are in place.Probabilistic assessments were previously completed (1996 timeframe) to justify removal of the RHR ACI at FNP which followed the approach provided in WCAP-1 1736-A. These probabilistic assessments were based on the design and operation of FNP at that time, as well as, design and operational changes that Southern Nuclear Operating Company (SNC) was committed to implement on ACI removal. The FNP-specific analyses demonstrated that the conclusions in WCAP-1 1736 are applicable to FNP, that is, the RHR ACI feature can be removed provided several key improvements are implemented.
These analyses were completed prior to the availability of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) Probabilistic Risk Assessment (PRA) Standard and the current state-of-the-practice in PRAs.Section 4.2 provides background information on the Owners Group's generic analysis, the FNP specific analysis, recent FNP operating experience, and a summary of the meeting with SNC, Westinghouse and the NRC on April 23, 2014, regarding the approach to address the PRA in the LAR. Section 4.3 provides the results of a peer review gap assessment of the EN P-specific analyses against the ASME/ANS PRA Standard.
Section 4.4 provides the assessment of the gaps in PRA technical adequacy identified in Section 4.3 and the impact on the FNP probabilistic assessments.
Section 4.5 discusses consistency with the NRC Safety Evaluation on WCAP-1 1736 and Section 4.6 provides the conclusions.
E2-21 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
==4.2 BACKGROUND==
 
During plant power operation, it is necessary to isolate the low pressure systems from the high pressure RCS to avoid damage by over-pressurization of the low pressure systems. If this isolation is not established and maintained, the integrity of the low pressure systems can be compromised and lead to a loss of coolant accident with containment bypass. The RHR system is a low pressure system (600 psig) which interfaces with the high pressure RCS(2235psig).
The RHR ACl function provides additional assurance that the isolation requirement is established and maintained.
The ACl feature automatically closes the RHR/RCS isolation valves when the pressure reaches a predetermined setpoint to ensure the integrity of the RHR system is maintained.
Figure 1-1 contains a simplified flow diagram of the RHR system and its interface with the RCS. This includes the RHR/RCS isolation valves which are closed by the ACI circuit.The primary purpose of the RHR system is to remove decay heat from the ROS during plant cooldown and refueling conditions.
Inadvertent isolation of the RHR system from the ROS by spurious closure of the RHR/RCS isolation valves can cause loss of cooling events while in shutdown conditions.
In the mid-I1980s, investigations into loss of RHR cooling events concluded that a number" of the events were related to inadvertent closure of the RHR isolation valves due to spurious actuations of the ACl circuit. Additional background information is included in Section 2 of the WCAP-1 1736. Due to the loss of cooling accidents related to the ACl and the limited benefit of the AOL in establishing and maintaining the RHRIRCS interface, the Westinghouse Owners Group completed a program in the late-I1980s to justify removal of the ACl function and provided WCAP-1 1736 to the NRC for review and approval.
This was completed as a generic assessment.
The NRC issued a Safety Evaluation (SE) on the WOAP that concluded removal of the ACl was acceptable provided a number of key improvements were in place. Details of this analysis and SE are provided in Section 4.2.1.One requirement from the NRC's SE on WOAP-1 1736 was to perform plant specific evaluations because of numerous plant-specific differences and plant-specific data needed as input to the analysis.
Plant-specific evaluations were developed for FNP in 1996; however, the [AR was not submitted to remove the ACl feature. Details of this analysis are provided in Section 4.2.2 4.2.1 GENERIC ANALYSIS (WCAP-1 1736)The generic analysis that justified removal of ACl is documented in WCAP-1 1736-A. The approach used in WCAP-1 1736-A examined the impact from RHR ACl removal through assessments in three areas:* Interfacing systems loss of coolant accidents (ISLOCA) with the impact on the ISLOCA initiating event frequency used as the metric,*. RHR system unavailability with the impact on the system unavailability used as the metric, and E2-22 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report*Cold (low temperature) over-pressurization with the frequency of the low temperature overpressure (LTOP) sequence frequencies used as the metric.Since this was a deterministic justification with probabilistic insights, each metric was considered on its own merit and a common risk metric was not used.The Owners Group program divided Westinghouse Nuclear Steam Supply System (NSSS)plants into four groups based on number of ROS loops, number of RHR hot-leg suction lines, RHR suction valve arrangement, and RHR system design. Separate generic analyses were completed for each group. The values for the ISLOCA frequency, RHR system unavailability, and low temperature overpressurization event sequence frequencies were compared with the RHR ACl in place and with the RHR ACl removed and alternate compensatory actions in place.From the generic results it was concluded that removal of the RHR ACl provides an overall safety benefit. The detailed analyses were documented in the WOAP which was provided to the NRC for review and approval.The generic analysis was approved by NRC via an SE that is contained in the WCAP. In Section 2.6 of the SE, it is stated: "The staff has no requirements based on the absolute values in the PRA analysis and will not require a plant-specific PRA for each licensee proposing to remove the ACl.However, the licensee should do sufficient PRA and safety analysis to ensure that its plant will not show results that will invalidate the conclusions of WCAP-1 1736." Based on this statement, utilities have performed plant-specific analyses to justify ACl removal.In addition, the Staff Position on RHR ACI removal is included in the SE. It is stated: 'Furthermore, the staff finds that the removal of the ACI for Westinghouse plants covered by WCAP-1 1736 can produce a net safety benefit provided that the following five key improvements are in place.*An alarm will be added to each RHR suction valvewhich will actuate if the valve is open and the pressure is greater than the open permissive Setpoint and less than the RHR system design pressure minus the RHR pump head pressure [justified by WCAP-1 1736].*Valve position indication to the alarm must be provided from the stem-mounted limit switches (SMLSs) and power to the SMLSs must not be affected by power lockout of the valve [justified by WCAP-1 1736].*The procedural improvements described in WCAP-1 1736 should be implemented.
Procedures themselves are plant specific.*Where feasible, power should be removed from the RHR suction valves prior to their being leak-checked
[plant-specific].
*The RHR suction valve operators should be sized so that the valves cannot be opened against full system pressure [plant-specific]." E2-23 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 4.2.2 PREVIOUS FNP PLANT-SPECIFIC ANALYSIS FNP-specific analyses of the impact of removing the ACl function from the RHR shutdown cooling (S DC) system, based on the WCAP-1 1736 methodology, were previously completed.
The approach used for the FNP-specific assessment is consistent with WCAP-1 1736. This plant-specific analysis was completed in 1996.Detailed probabilistic assessments were completed for assessing the impact of removing the RHR ACl on:* ISLOCA initiating event frequency,* RHR system unavailability, and* Low temperature overpressurization sequence frequencies.
From the analysis, the following was concluded:
*ISLOCA initiating event frequency
-From a probabilistic standpoint, the deletion of the ACl and the inclusion of a control room alarm is beneficial in reducing the frequency of an interfacing system LOCA and the potential for a significant radionuclide release outside containment.
The calculated ISLOCA initiating event frequencies were: o Frequency with RHR ACl -I1.44E-06Iyr o Frequency without RHR AC! (and with alarm) -1.1 5E-06/yr*RHR sYstem unavailability analysis -The results of the quantification of the FNP RHR system unavailability fault trees show that with power lockout (which is currently performed with the RHR suction valves open when RCS temperature is reduced below 180&deg;F), deletion of the ACl has little impact on the system unavailability.
Without power lockout, deletion of the ACl reduces the number of spurious closures of the suction valves, and thus, increases the availability of the RHR system. The calculated RHR unavailabilities are provided in Table 4-1.* Low temperature overpressurization sequence frequencies
-The conclusion drawn from the overpressure analysis is that removal of the ACl has little impact on the consequences, of LTOP events for FNP.The results of these FNP-specific probabilistic assessments are consistent with the results of the generic analyses in WCAP-1 1736.When these analyses were performed in the mid-I1990s, the best available methods and data sources were used. However, since that time, the ASME/ANS PRA Standard has been issued (Reference
: 6) with the NRC endorsing this Standard in Regulatory Guide 1.200 (Reference 7)and PRA methods and data have developed further. The analyses supporting the FNP plant-specific application may not fully meet the expected technical adequacy defined by the PRA Standard.
For example, 1) data for component failure probabilities and event frequencies is E2-24 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report twenty years old, 2) the component boundaries and detail of the modeling necessary would be different, and 3) human reliability analysis (HRA) methods were not well defined and inconsistently applied. Therefore, these analyses would not meet the NRC expectations due to the PRA requirements today. Due to these technical adequacy limitations, these analyses Were reviewed against the PRA Standard to identify gaps that need to be addressed to validate the results stated above. This PRA peer review gap analysis is discussed in Section 4.3.4.2.3 RECENT FNP OPERATING EXPERIENCE WITH LOSS OF RHR COOLING SNC's interest in implementation of this change at FNP was reinitiated following a loss of RHR cooling event at FNP Unit 1 resulting from the unexpected closure of motor operated valve (MOV) 8701IA. The following is taken from the FNP Apparent Cause Determination Report Corrective Action Report 191314."With RCS level at the flange (i.e. 128'6") prior to core unload, with Reactor Head removal imminent, the Operating crew was preparing for cavity flood-up.
Part of the preparation for flood-up was closing the breaker for the RCS loop suction valve, which had been de-energized to comply with Low Temperature Overpressure Protection (LTOP) technical specifications.
When the breaker was closed, the RCS loop suction valve immediately began to stroke closed."When power was restored to the MOV, multiple annunciators related to loss of the LTOP function alarmed alerting the operators that the valve was closing. The relevant Abnormal Operating Procedure for Loss of RHR was entered, and the 1A RHR Pump was secured for equipment protection since it had no suction supply. One attempt was made to stroke the RCS loop suction valve back open from the Main Control Board (MCB) with no success, and then Operations personnel were dispatched to Containment to manually stroke open the valve.'After the valve had been manually stroked open, the IA RHR Pump was restarted.
The pump was secured for a total of 32 minutes. During the time which the 1A RHR pump was secured, RCS temperature rose from 1 00&deg;F and stabilized at 1 08&deg;F. Core cooling was provided at all times during the event by the 'B' Train RHR System."The unexpected closure of the RCS Loop Suction Valve was due to no power to the 'A'SSPS, whichkwas tagged out for performance of a plant modification.
With no power to SSPS, a normally energized relay in the overpressure protection scheme for the RCS loop suction valve was de-energized.
With the relay de-energized, the circuit to the close contactor in the breaker for the RCS loop suction valve was completed.
This condition was not realized prior to the event, and when the breaker was closed in preparation for cavity flood-up, the MOV immediately began going closed." In Section 5 of the CAR it is stated, "The Extent of Condition was conducted based on the system design for auto closure of the RHR loop suction valve being susceptible to a power loss E2-25 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report in the Output Cabinet of 'A' Train SSPS." Further evaluations were done to determine if additional system design flaws existed that could impact plant reliability.
Corrective actions were identified including removal of the ACI circuit.4.2.4
 
==SUMMARY==
OF THE MEETING WITH THE NRC TO DISCUSS THE APPROACH A meeting was held with the SNC, Westinghouse and the NRC Staff on April 23, 2014 to discuss the approach and obtain NRC feedback and expectations on the technical justification for the elimination of the RHR ACI at FNP.As discussed above, the generic PRA analysis supporting the ACI removal was completed in the late 1960s and the FNP specific analysis was completed in 1996. PRA technical adequacy requirements have changed significantly since that time, with the ASME/ANS issuing the PRA Standard and the NRC endorsing this St~andard with Regulatory Guide 1 .200. In addition, the use of PRA in risk-informed decisions for plant-specific changes to the licensing basis has significantly changed with the issuance of Regulatory Guide 1.174. Due to these factors, a discussion with the NRC on the approach to be followed and their expectations was considered prudent.The key points discussed at the meeting are summarized in the following:
*The NRC staff clarified that any future amendment to eliminate the RHR ACI would be based on a deterministic review and that any "risk" information is only useful supplementary information that cannot be used as the basis for a staff decision.
For any risk information to form such a basis, the amendment would have to be submitted under RG 1.174, meeting the requirements of RG 1 .200.*The SNC approach is consistent with the NRC's SE on WCAP-1 1736-A and the FNP-specific analysis.
The approach includes a review of the FNP-specific analysis against the current ASME/ANS PRA Standard and RG 1.200, with the gaps identified and categorized.
Those gaps categorized as possibly impacting the decision-making process or results will be addressed either by model changes, qualitative assessments, or sensitivity analyses.*The analysis remains focused on the impact of the ACI removal on the Interfacing System LOCAs (ISLOCA) (V-Sequence), RHR System reliability, and low temperature overpressurization events. These are: o Interfacing system LOCAs -initiating event frequency o RHR System reliability
-RHR System unavailability for shutdown cooling o Low temperature overpressure events -consequence categories.
* The Staff also stated that WCAP-1 1736-A and the SE should be reviewed to ensure that there are no other gaps beyond the PRA analysis.E2-26 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report Table 4-1: RHR System Unavailability Results from the FNP-Specific Analysis Condition With RHR ACI Without RHRACI.RHR Cooling Initiation 3.94E-02 3.94E-02 Short-term Cooling -Two of two RHR pump trains required (initial phase of cooldown)With power lockout 1  1.45E-02 1.45E-02 Without power lockout' 1.72E-02 I1.45E-02 Long-term Cooling -One of two RHR pump trains required (later phase of cooldown)With power lockout 1  1.15 E-02 1.15 E-02 Without power lockout' 4.97E-02 I1.15E-02 Notes: 1. Power lockout refers to removing power to the RHR suction valves with the valves open, when the RCS temperature is reduced below l80&deg;F.E2-27 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 4.3 TECHNICAL ADEQUACY OF FNP-SPECIFIC ANALYSIS A Gap Assessment was performed to assess the FNP-specific probabilistic modeling previously completed against the current PRA Standard.
This gap assessment was effectively backfitting current technical requirements on an analysis that was considered adequate in its day. in addition, the analysis deals with aspects that impact shutdown risk, for which no NRC-endorsed standard currently exists. Therefore, the gap assessment was based on Part 2 of the ASME/ANS PRA Standard which addresses requirements for internal events at-power PRA.This is appropriate since the FNP-specific probabilistic assessments would need to meet the appropriate Sections of Part 2 through back references in the low power and shutdown standard, if it was available.
 
====4.3.1 APPLICABLE====
 
PRA STANDARD ELEMENTS The gap assessment was performed for each of the High Level Requirements (HLR) for internal events from Part 2 of the ASME/ANS PRA Standard.
These requirements were applied both to at-power scenarios, and, as appropriate, to shutdown scenarios.
The first step was to assess the applicability of each HLR to this specific application.
Since this analysis has a limited scope in terms of initiators, sequences, systems, etc., the HLRs were assessed for their relevance to this application.
The referenced analysis does not represent a complete internal events PRA and, thus, the assessment of the PRA Standard is in the context of those model elements included in the analysis.
For example, the high level requirement HLR-IE-A addresses the completeness of the initiating event identification process. For this analysis, the only applicable initiating events, are interfacing systems LOCA (at power), loss of RHR (at shutdown), and overpressurization (at shutdown).
Therefore, the requirement for completeness of initiators applies only in a limited sense, sufficient for this application.
The Second step was to assess the FNP-specific analyses against the HLRs determined to be applicable.
This was performed by reviewing the Supporting Requirements under each HLR and summarizing the overall assessment at the high level requirement.
The FNP-specific analyses were assessed against capability Category II of the Supporting Requirements.
4.3.2 GAP ASSESSMENT RESULTS Table 4-2 lists the findings identified in the Gap Analysis.
This table includes the following:
* Column 1: The Facts & Observations (F&O) Number including the HLR being addressed* Column 2: A statement of the deficiency in meeting Capability Category II* Column 3: The categorization of the deficiency (the categorizations are listed below)* Column 4: Location of the resolution of the comment with regard to the FNP-specific analysis supporting the removal of the RHR ACI.E2-28 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report The gaps identified in Table 4-2 are considered to be deficiencies in the 1996 ACl removal analysis for FNP, Units 1 and 2. However, most of these deficiencies, identified as "Findings", do not impact the overall conclusions from the analysis.
The deficiencies identified as"Suggestions" are not included in the table since these did not impact the technical aspects or results of the assessment.
These deficiencies have been categorized into the following groups to characterize the impact of each deficiency on the validity of the analysis for this application:
Group 1 The deficiency is conservative and does not need to be addressed.
Group 2 The deficiency has no impact on the decision-making process; this could be because the deficiency is not important to the evaluation or has no impact on the evaluation.
Group 3 ..The deficiency could impact the results, but can be addressed via a high level quantitative assessment or a qualitative assessment.
Group 4 The deficiency is a key aspect of the analysis and needs a detailed assessment up to and could include a complete analysis revision of that part of the analysis.The resolutions to these findings take three general approaches:
* New Analysis -for Inter-facing Systems LOCA, the analysis was redone (see Section 4.4.5).* Qualitative Analysis -for RHR and Cold (low temperature)
Overpressure, qualitative analyses were identified as adequate to address the assessment of ACl removal. These are summarized in Sections 4.4.3 and 4.4.4 of this report, respectively.
* Several items are applicable to all three analyses.
These are in the areas of data and uncertainty.
The ISLOCA Analysis in Section 4.4.5 addresses these areas by using new analyses.
For RHR and Overpressure analyses, the qualitative analyses do not depend on data and parametric uncertainty assessment.
These are discussed in Section 4.4.2.E2-29 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report TABLE 4-2: FINDINGS FROM THE FNP-SPECIFIC ANALYSIS GAP ASSESSMENT Deficiency
'Deficiency Section for Resolution SID Deficiency Category Discussion Initiating event estimation should be updated to be based on recognized generic sources and Gap 1 recent plant-specific operating experience.
HLR-IE-C-01 Specifically, the loss of RHR initiator based on Gru3Seto4.3 fault tree modeling should be assessed against actual loss of RHR shutdown cooling events.Gap 2 HLR-IE-C-02 No calculation or characterization of uncertainty Gop3 eto ..(related to could be found in the documentation.Grp3Seto4.2 H LR-DA-D)Initiating event model configurations should be reviewed against current plant configurations and operating practices.
Specifically the ISLOCA IE Gap 3 calculation should be confirmed since failure HRI--3 modes may have changed (e.g., power removed Group 4 Section 4.4.5 to an RHR suction valve in Mode 1). It is also recommended that credit for the RHR relief valves should be considered in the ISLOCA scenarios.
For the RHR unavailability calculations, the mission time for equipment should be reviewed.Gap 4 Updated methods (e.g., support system initiating HLR-SC-A-01 event fault tree quantification) for systems that Gru3Seto443 can lead to an initiating event may be more appropriate.
Success criteria for the RHR unavailability calculation should be reviewed and updated as Gap 5 appropriate.
One train of RHR may be sufficient HLSA2 to remove decay heat. Some of the RHR Group 3 Section 4.4.3 unavailability calculations assume both trains of RHR are required; this may be inflating the benefit of the removal of ACI.Gap 6 HLR-SY-B-01 Common cause failures should be addressed in (related to the RHR unavailability analysis.
Group 3 Section 4.4.3 H LR-DA-D) _________Confirmation that no common cause failure (CCF)Gp7 combinations are required for the ISLOCA Group 2 Section 4.4.5 HLR-S-B-02 initiating event should be documented.
Gap 8 Support system dependencies should be HLR-SY-B-03 addressed in the RHR unavailability analysis.Gru2Seto443 E2-30 Enclosure 2 to NL-1 5-1 055-FNP RHR Autoclosure Interlock Removal Report TABLE 4-2: FINDINGS FROM THE FNP-SPECIFIC ANALYSIS GAP ASSESSMENT Deiiny Deficiency Deficiency Section for Resolution IDCategory Discussion Gap 9 Upgrade the HRA methodology to evaluate the HLR-HR-G-O1 cognitive failures as well as the execution Group 3 Section 4.4.5 failures.Perform a consistency review on the post-initiator actions. During a consistency review one might challenge the reasonableness of estimates given for isolating RHR given an overpressure event. Two human error probabilities (HEPs) were evaluated:
one before Ga 0 the ACI is removed and power is still removed to Group 3 Section 4.4.5 HLR-H-G-02 the RHR suction valves and one where ACI is removed, power is provide to the RHR suction valves, and an alarm is added on high pressure.
A more significant difference in results may be expected over the small decrease in probability between the two actions.Generic data should be updated to more recent recognized sources (e.g., NUREG/CR-6928).
Gap 11 Generic data was the primary source for HLR-DA-C-O1 component failure rates. Scope of plant-specific Group 3 Section 4.4.2 data collection should be expanded for component failure modes that are pertinent to the analysis.Estimation of realistic parameters for significant basic events should be updated to be based on Gap 12 recognized generic data sources (e.g., NUREG/CR-Gru3Seto4.2 HLR-DA-D-01 6928) and recent plant-specific operatingGru3Seto4..
experience.
A Bayesian update process is recommended.
An event tree quantification method was used to generate the likelihood of having an Gap 13 overpressurization event. No evidence of the HLR-QU-B-01 impact of truncation or mutually exclusive events Group 2 Section 4.4.4 could be found. No evidence on the treatment of dependencies could be found.Gap 14 Address operator dependencies using a more Gru3Seto445 HLR-QU-C-01 current systematic approach.Gru3Seto4..
Gap 15 HLQE1 Characterize the uncertainties in quantification.
Group 3 Section 4.4.2 E2-31 Enciosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report 4.4 PROBABILISTIC ASSESSMENT The probabilistic justification for RHR ACl removal is based on the FNP-specific probabilistic assessments along with addressing the gaps discussed in Section 4.3. The identified gaps are addressed either qualitatively or quantitatively.
The qualitative assessments are used where the FNP-specific analyses have been found to be rigorous and acceptable, but do not meet certain aspects of the ASME/ANS PRA Standards.
Quantitative analyses are used where the FNP-specific analyses are based on outdated methods and modeling techniques that need to be updated to obtain defendable results. These assessments are based on the current FNP design and operation as well as design and operational changes that SNO is committed to implement with the removal of the ACl.4.4.1 OVERALL APPROACH The FNP-specific analyses demonstrated that the conclusions in WCAP-1 1736 are applicable to FNP, that is, the RHR ACI feature can be removed provided several key improvements are implemented.
The probabilistic assessments addressed the three key areas that would be impacted as a result of RHR ACl deletion:
RHR system unavailability, low temperature overpressure transients, and interfacing system LOCAs. The first two areas, RHR sYstem unavailability and overpressure transients, can impact risk with the plant shutdown in Modes 4, 5, and 6 with RHR operating in shutdown cooling mode. The deficiencies in the RHR system and overpressure analyses that were identified as 'Findings" are addressed in Sections 4.4.3 and 4.4.4, using a qualitative assessment approach.
The third issue, ISLOCA, is applicable in Modes 1, 2 and 3 and characterized by the at-power PRA. This is addressed by a quantitative probabilistic assessments approach summarized in Section 4.4.5.As discussed in Sections 4.2.1 and 4.2.2, the generic approach used in WCAP-1 1736-A and approved by the NRC and the EN P-specific analyses were quantitative and were based on ISLOCA initiating event frequency, low temperature overpressure sequence frequencies, and RHR unavailability.
All metrics showed an improvement or essentially no impact with removal of the RHR ACl and implementation of compensatory measures.
The approach and results provided in this current report is consistent with the WCAP-1 1736 approach, but addresses technical shortcomings of the previous FNP-specific analyses as measured against the ASME/ANS PRA Standard.
As noted above, these updated analyses were done qualitatively and quantitatively depending on the severity of the gaps.4.4.2 ASSESSMENT OF GAPS APPLICABLE TO ALL ANALYSES Gaps 2, 11, 12, and 15 provided in Table 4-2 are identified as "Findings' and are generally applicable to all three analyses.
Each is discussed in more detail in the following.
Gaps 2 and 15 address uncertainty and are addressed together.
Gaps 11 and 12 address data and parameters and are addressed together.E2-32 Enciosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report Gap 2 Description (IE-C-02):
No calculation or characterization of uncertainty could be found in the documentation.
Gap 15 Description (QU-E-O1):
Characterize the uncertainties in quantification.
Discussion:
A full uncertainty assessment including uncertainty identification and characterization has not been completed for all these analyses.
A realistic modeling approach was used in the analysis.
This approach directly followed the analysis approach in WCAP-11736 which was reviewed and approved by the NRC.Removal of RHR ACI is not a risk-informed application based on the requirements provided in Regulatory Guide 1.174, but a deterministic assessment with probabilistic insights that considers the impact of the change on three different parameters; RHR unavailability, low temperature overpressure sequence frequencies, and ISLOCA initiating event frequency.
This probabilistic assessment supports a deterministic argument that removing the RHR ACI is a beneficial plant change. WCAP-1 1736 and FNP-specific assessments note that this change is a benefit to RHR availability and ISLOCA initiating event frequency, and has little impact on the consequences of LTOP events, and does not trade one off against the other.As discussed in this document, this probabilistic assessment supports a qualitative argument that removing the RHR ACI is aplant benefit. This has been the conclusion of industry documents evaluating the causes of loss of shutdown cooling and what can be done to address this issue, and the generic study completed by the Owners Group (WCAP-1 1736). It is generally agreed in the industry and supported in this document that ACI removal will benefit RHR availability and LTOP protection.
Therefore, a detailed characterization of uncertainties for these two assessments would not provide significant insights that will alter the conclusions of the analysis, and therefore, is not necessary.
The results of these two FNP-specific assessments agree with the generic assessment in WCAP-1 1736 so identification and characterization of uncertainties provide no additional benefits.The primary purpose of the ACI feature is to ensure thie RHR/RCS isolation valves are closed on return to power, thus reducing the chance of an ISLOCA event while at-power.
Therefore, the impact of the proposed change on ISLOCA initiating event frequency is the key to the justification for ACI removal. Evaluation of the compensatory, actions to address the primary issue of ISLOCA needs to be considered, therefore, uncertainties associated with the ISLOCA.analysis need to be considered.
A revised ISLOCA analysis is provided in Section 4.4.5 which addresses the gaps identified related to ISLOCA. This includes uncertainty identification and characterization.
 
==
Conclusion:==
 
Uncertainty identification and characterization will not impact the results of these assessments of the proposed change on RHR unavailability or LTOP protection.
With regard to ISLOCA, uncertainty identification and characterization is provided in Section 4.4.5.4.E2-33 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report Gap 11t Description (DA-C-01):
Generic data should be updated to more recent recognized sources (e.g., NUREG/CR-6928).
Generic data was the primary source for component failure rates. Scope of plant-specific data collection should be expanded for component failure modes that are pertinent to the analysis.Gap 12 Description (DA-D-O1):
Estimation of realistic parameters
~for significant basic events should be updated to be based on recognized generic data sources (e.g., NUREG/CR-6928) and recent plant-specifiC operating experience.
A Bayesian update process is recommended.
Discussion:
The Owners Group generic and the FNP-specific analyses supporting removal of the RHR ACl feature are probabilistic assessments that suppoi-t the deterministic or qualitative arguments.
This benefit is clear for the RHR unavailability and LTOP assessments.
The use of more recent generic or plant specific data in the generic and FNP-specific analysis could impact the absolute values, but would not impact the changes in the probabilistic measures.The key parameter to the justification for RHR ACl removal is the ISLOCA initiating event frequency.
This analysis has been updated and includes FNP-specific component failure rate data. This analysis is further discussed in Section 4.4.5.Conclusion:
The data used .in the analysis will not affect the conclusions of the impact of the proposed change on RHR unavailability or LTOP protection.
With regard to ISLOCA, updated plant-specific data and parameters are used in the revised analysis provided in Section 4.4.5.4.4.3 GAP ASSESSMENT FOR LOSS OF RHR SHUTDOWN COOLING ASSESSMENT Gaps 1, 4, 5, 6, and 8 provided in Table 4-2 are identified as "Findings" and are specifically directed at the RHR system unavailability.
Each is discussed in more detail in the following.
Gap 1 Description (HLR-IE-C-01):
The loss of RHR initiator based on fault tree modeling should be assessed against actual loss of RHR shutdown cooling events.Discussion:
The FNP-specific RHR unavailability analysis is based on a detailed fault tree to determine the impact of the proposed change on RHR unavailability.
Three phases of cooldown were considered:
initiation of RHR, short-term cooling, and long-term cooling. Two conditions were considered:
with and without power to the RHR suction valves during cooldown operation.(Power is removed with the suction valves open when the RCS is cooled down below 1 80&deg;F to support the LTOP function.)
The results indicate that with power not removed from the RHR suction valves, a significant reduction in RHR unavailability is expected and with the power removed from the RHR suction valves, the impact on RHR unavailability is essentially zero.The original justification for ACl deletion identified in the NRC SE included in WCAP-1 1736-A included a large number of loss of RHR events due to ACI. In the period from 1976 to 1983, a total of 130 losses of RHR occurred, of which 37 were due to ACI.E2-34 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report Electric Power Research Institute (EPRI) TR-1 021176 (Reference
: 8) summarizes more recent US operating experience related to loss of decay heat removal (DHR). Over the twenty-year span from 1990 to 2009, a total of 255 losses of DHR from all causes were identified for both PWRs and BWRs. Of that total, over half (137) involved loss of DHR due to closure of DHR isolation valves. However, BWRs accounted for the vast majority of the 137 events, with roughly 14 isolation events occurred in PWRs.In the most recent decade (2000 to 2009), a total of 70 losses of DHR occurred, of which about one-third (26) were due to DHR isolation.
PWRs accounted for about half of the losses of DHR (34), but only two isolation events. Table A-2 of EPRI TR-1 021176 lists these two events, using the designator ISORHR. These two events are described in the following:
3/1/2002 (Watts Bar 1)"While attempting to realign the RHR system from RWST supply to RCS loop operation and simultaneously performing a full flow RHR test and filling the reactor cavity, operators isolated the common suction to the Residual Heat Removal (RHR) pumps on two occasions over a three minute span. Power had been removed from a rack which provided a permissive pressure switch signal to two valves which required manipulation during the realignment.
Two isolations, but can be considered one. 3 minutes total time from first isolation to restoring SoC after 2nd isolation.
RCS was 100&deg;F with cavity flooded or nearly flooded." 11/27/2006 (Ft. Calhoun)'The plant was being cooled down and depressurized.
After SOC was initiated, it was desired to maintain a RCP operating to cool down the RV head with the RCS. Two RCPs in the same loop were kept operating, which provided more main spray flow than had been available in the past with only one RCP. The pressure band for operating reactor coolant pumps while SDC is in service is 225 psia (RCP NPSH) to 250 psia (SOC suction valves interlock setpoint).
The operator maintained the RCS in a band of 225 -235 psia for several hours prior to the event, controlling pressure with Pzr heaters and modulating the main spray control valves. The RCPs were secured to commence a Pzr cooldown.
RCS pressure rose when the first RCP was secured, but was not noticed. When the second RCP was secured, RCS pressure reached the SOC suction isolation valves interlock setpoint, which closed the valves. The running SOC pumps were conservatively stopped to preclude any possibility of pump damage. RCS pressure was lowered, the shutdown cooling suction isolation valves were reopened, and SOC reinitiated.
RCS temperature (CET) rose from 128&deg;F to 133O F."'A search for DHR isolation events in 2010 to 2013 was conducted using the INPO ICES database.
This identified only one additional ISORHR event previously discussed in Section 4.2.3: E2-35 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 10/15/2010 (FNP Unit 1)"During preparation for the Refueling Canal flood-up with a full reactor core, a Reactor Coolant System (RCS) loop suction valve spuriously went closed when its associated breaker was closed. Part of the preparation for reactor cavity flood-up was closing the breaker for the RCS loop suction valve, which had been de-energized to comply with LTOP technical specifications.
When the breaker was closed, the RCS loop suction valve immediately began to stroke closed."The 1A Residual Heat Removal (RHR) pump was secured for equipment protection per the guiding Abnormal Operating Procedure.
Plant personnel were able to manually stroke open the RCS loop suction valve and restart the 1A RHR pump. The 1A RHR pump was secured for a total of 32 minutes. During the time that the 1A RHR pump was secured, RCS temperature rose from 100F and stabilized at 108F. Core cooling was provided at all times during the event by the'B' Train RHR System." Thus, the frequency of DHR isolation events has decreased over nearly four decades of operating experience, but this type of event does continue to occur. Note, the 2002 Watts Bar event was due to an operator error; the 2006 Ft. Calhoun event was a different ACI system (CE design). Only the FNP event of 2010 is directly related to Westinghouse-designed A Cl system.Recent industry operating data shows that loss of cooling events still occur, but due to improved plant experience in shutdown modes including removal of the ACI circuit at many plants, fewer loss of RHR cooling events can be directly attributed to ACI. One recent event related to ACI occurred at FNP, as described above.Conclusion:
The original RHR unavailability analysis demonstrated an improvement in RHR availability with elimination of the RHR ACI. In general, loss of RHR cooling events have decreased significantly from when these analyses were initially completed and loss of RHR events related to the RHR ACI have also decreased, but these events still represent an adverse safety impact and the removal of the RHR ACI will provide a safety benefit. Therefore, the conclusions of WCAP-1 1736 and the FNP-specific analyses remain applicable.
Gap 4 Description (HLR-SC-A-01):
For the RHR unavailability calculations, the mission time for equipment should be reviewed.
Updated methods (e.g., support system initiating event fault tree quantification) for systems that can lead to an initiating event may be more appropriate.
Discussion:
A support system initiating event analysis for loss of decay heat removal due to inadvertent ACI actuation would be equivalent to the analyses presented in WCAP-1 1736 and the FNP-specific analysis.
The mission time of these cases is the refueling outage durations of interest.
During the RHR System Initiation case the mission time is 2 hours; however, failures of ACI would not cause a loss of decay heat removal due to availability of steam generator cooling.The Short Term Cooling case has a the mission time of 72 hours and the Long Term Cooling E2-36 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report case has a mission time of 6 weeks. For these cases, a spurious operation of the ACl circuit during the mission time would cause loss of decay heat removal when the RHR system suction valves are not de-energized.
Removing ACl would eliminate this failure mode. Therefore the analysis conclusions are not impacted by differences in mission time or different calculational models.Conclusion:
Although different approaches to the RHR unavailability analysis could have been used, the mission time has no impact on the benefit of ACI removal. The analysis conclusions remain applicable.
Gap 5 Description (HLR-SC-A-02):
Success criteria for the RHR unavailability calculation should be reviewed and updated as appropriate.
One train of RHR may be sufficient to remove decay heat. Some of the RHR unavailability calculations assume both trains of RHR are required; this may be inflating the benefit of the removal of ACl.Discussion:
Using a different success criterion for the first 72 hours (i.e. requiring only one RHR train for success as opposed to two trains) is analogous to the success criteria used in the long term cooling cases. The results would be roughly proportional to the mission time used;however, the RHR unavailability without the ACl circuit would still be lower than those cases with the ACl circuit. If the success criterion is one RHR train, then inadvertent isolation of that train would lead to loss of DHR, but a second train would be available for backup protection.
With two trains required, inadvertent isolation of either one would lead to loss of DHR with no backup train. Although one train may be adequate, removal of ACI eliminates a potential path to loss of DHR regardless of the success criteria.Conclusion:
Use of different success criteria for RHR heat removal has no impact on the conclusion of the benefit of removing the RHR ACl circuit.Gap 6 Description (HLR-SY-B-01):
Common cause failures should be addressed in the RHR unavailability analysis.Discussion:
Modeling of common cause failure of ACI circuit components to the two sets of suction valves could increase the contribution of the ACI failure to RHR unavailability.
Also modeling common cause failures of RHR components may increase the unavailability of the RHR. But the RHR and ACI common cause failure contributions will impact all cases considered.
RHR unavailability will increase by including the common cause contributions for both the case with the ACI and the case without the ACI, but the change in unavailability will not be impacted.
Adding the ACI common cause will increase the unavailability for the case with ACI, but removing the ACI eliminates this source of common cause, therefore, the RHR unavailability will improve. Therefore, adding the RHR and ACI common cause failure contributions will not impact the analysis conclusions.
E2-37 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report
 
== Conclusion:==
.
Modeling of the RHR and ACl component common cause failures will not impact the conclusions of the analysis that the RHR unavailability will be improved following removal of the ACl." Gap 8 Description (HLR-SY-B-03):
Support system dependencies should be addressed in the RHR unavailability analysis.Discussion:
Support systems are important to the operation of components that require electric power (Alternating and Direct Current), cooling (water or air), and actuation signals. For example, this includes pumps that are required to start and run, and valves that are required to change position.
When the plant is on RHR cooling, the RHR/RCS isolation valves are required to remain open and the RHR system is required to continue to run. Modeling support systems to the pumps and to the ACl circuit would be required to determine an absolute value for RHR unavailability.
But this is an assessment of the change in RHR unavailability with and without ACl and modeling of support system dependencies will affect this assessment only to the extent they support the ACl circuit (e.g., 120V instrument power). However, modeling of ACl support system dependencies that can lead to spurious closure of the RHR/RCS isolation valves will increase the RHR unavailability for the case with RHR/ACI installed.
But for the case with RHR/ACI removed, the ACl contribution is removed. Therefore, including the support systems would provide a larger benefit for ACl removal.Conclusion:
Not modeling the support system dependencies has no impact on the conclusion of the analysis.
Removing the ACl circuit eliminates a potential failure mode that could lead to closure of the RHR/RCS isolation valves, therefore, the RHR unavailability will improve with its removal which supports the conclusions of the analysis.Concluding Statement Deleting ACl will be a safety improvement with regard to RHR shutdown cooling. ACl deletion eliminates the potential for inadvertent closure of the RHR suction isolation valves by removing the only circuit that provides an auto-closure signal to these valves. Since ACl serves no function to support shutdown cooling, ACl removal can be judged to be a safety improvement for shutdown cooling by qualitative considerations.
The original justification for ACl deletion was the large number of loss of RHR events that were due to ACl actuation.
Of the 130 losses of RHR that occurred in the industry from 1.976 to 1983, a total of 37 were due to the ACl circuit. The current data for loss of RHR shows significantly fewer events due to inadvertent closure of RHR suction valves, as well as significantly fewer losses of RHR in general. This reduction in the number of events is likely due to the number of plants that removed the ACl circuit as Well as increased focus on outage risk management.
However, for those plants with ACl, the potential for loss of RHR due to inadvertent ACl remains.E2-38 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report For FNP specifically, the potential exists for closure of RHR suction valves based on SSPS relays that are de-energized-to-actuate the ACl circuit. This was the cause of the FNP Unit 1 event of October 15, 2010: "The unexpected closure of the RCS Loop Suction Valve was due to no power to the 'A'Train SSPS. With no power to SSPS, a normally energized relay in the overpressure protection scheme for the RCS loop suction valve was de-energized, due to its power being derived from the output cabinet of A-Train SSPS. With the relay de-energized, the closed circuit for the RCS loop suction valve was completed." Thus, for the FNP units, inadvertent actuation of ACl remains a potential challenge to RHR shutdown cooling and ACl removal would be a safety improvement with regard to the shutdown cooling function.4.4.4 GAP ASSESSMENT FOR OVERPRESSURE RELIEF AT SHUTDOWN ASSESSMENT The RHR suction relief valves provide LTOP protection for the RCS during Modes 4, 5, and 6 with RHR in service. These relief valves are designed to open at 450 psig and each provides 900 gpm relief capacity.
With isolation .of RHR via ACl actuation, the RHR suction relief valves'would be isolated from the RCS and would no longer provide the overpressure relief function.With RHR isolated, the RCS overpressure relief is provided by the pressurizer (PZR) power operated relief valves (PORVs). However, the PORVs are not designed to provide LTOP protection and would open only at their manually controlled setpoint.
Therefore, actuation of ACl would serve to isolate the designed LTOP protection.
In fact, to support the LTOP function, the current operating procedures direct the open RHR suction MOVs be depowered when the RCS is cooled below 1 80&deg;F. This effectively bypasses the ACl circuit, but also complicates the response to a loss of RCS inventory out the RHR system, where closure of the RHR suction isolation valves would be necessary.
AC! also serves to isolate the low-pressure RHR system from overpressure conditions.
This is redundant to the function of the RHR relief valves which are sized to protect the RHR system from overpressurization.
The ACl protection function is limited to slow-acting overpressure transients due to the response time for the RHR suction valves to transfer from full-open to full-close. With the RCS in water solid conditions, the overpressure transients from mass addition or heat addition would occur too quickly for A~l to provide complete protection.
Longer term mitigation of this event must be provided by operator actions, with or without ACI. The operator must eliminate the overpressure condition so that RHR shutdown cooling can be restored.The generic analysis and FNP-specific analysis used event trees to model the mitigating actions following the occurrence of LTOP events. Consideration was given to automatic and manual mitigating actions. Pressure relief via the RHR relief valves and the pressurizer PORVs are credited.
A number of different endstates are defined depending on the success or failure of the equipment and manual actions. These endstates define the pressure state, loss of coolant E2-39 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report state, and RHR/RCS isolation state. The endstate frequencies generally show improvement (reduced frequencies) or very small degradations
(<1 E-10/lyr) with the ACl removed.Gap 13 provided in Table 4-2 is identified as a "Finding" and is specifically directed at overpressure relief at shutdown.
This is discussed in more detail in the following.
GaD 13 Description (HLR-QU-B-O1):
An event tree quantification method was used to generate the likelihood of having an overpressurization event. No evidence of the impact of truncation or mutually exclusive events could be found. No evidence on the treatment of dependencies could be found.Discussion:
Although no evidence is provided for truncation impact, the FNP-specific assessment show some frequencies on the order of 10-11 and 10-13, which indicates a very low truncation was applied if one was used. Typically for simple event tree analyses, truncation is not important since all of the endstate frequencies can be calculated.
A fault tree linking approach was not used so truncation is not as important.
Therefore, the truncation limit is not expected to impact the results.* With regard to mutually exclusive events, if the event is included as a top event in the event tree, then mutually exclusive events are addressed by the structure of the event tree and in the determination of which events to address in each sequence.
Mutually exclusive events in a fault tree typically are directed at test and maintenance activities that cause the unavailability of redundant trains when at least one of the trains is required to be available.
The fault trees used to model RHR suction valve closure failure include modeling for the RHR isolation valve actuation failures which includes operator action for the isolation where applicable.
Test and maintenance is not included in the model, therefore mutually exclusive events are not in the model and the analysis results are not impacted.Dependencies of interest are those between operator actions and support systems. Operator actions are included in basic events RSV (suction valves fail to close), OA1 (operator stops pump), OA2 (operator opens PORV), and POR (PORVs reseat). The only operator action dependency that needs to be addressed is between OA1 and OA2 following failure of OAI.This is addressed in the FNP-specific analysis.
Dependencies related to support systems are limited to control power for the RHR/RCS isolation valves and PORVs. These power dependencies are not expected to have any impact on the analysis conclusions since they impact the different scenarios being evaluated similarly.
Therefore, the approach for addressing dependencies is acceptable and does not impact the results.Conclusion:
The FNP-specific analysis provides a quantitative assessment of the LTOP function on ACl removal and this analysis remains acceptable.
The impact of the approach to quantification truncation limit, mutually exclusives, and treatment of dependencies is not expected to impact the analysis results or conclusions.
E2-40 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report Concluding Statement ACl removal will improve the reliability of the LTOP system by allowing the RHR relief valves to function in a mitigation capacity.
Currently, with ACl actuation, the RHR relief valves will be isolated by closure of the RHR suction valves. With AC! removed, the RHR relief valves remain available to protect the RHR system from overpressure and are designed to operate for any credible mass addition.
The impact of ACI removal on RHR system overpressure protection is negligible due to the slow response of the RHR suction isolation valves and the design of the RHR relief valves.In addition, the removal of ACI also eliminates the need for the power lockout with the RHR System suction valves open that is currently performed with RCS temperature below 180&deg;F.Maintaining the RHR System suction valves powered in shutdown modes improves the capability of operators to isolate RHR from the RCS in the event of a leak in the RHR system.4.4.5 GAP ASSESSMENT FOR ISLOCA INITIATING EVENT FREQUENCY Gaps 3, 7, 9, 10, and 14 are specifically directed at the FNP-specific ISLOCA analysis.
These gaps are provided in Table 4-2 and discussed in more detail in Section 4.4.5.5.Gap 3 was considered Deficiency Category 4; Gaps 9, 10, and 11 were considered Deficiency Category 3; and Gap 7 was considered Deficiency Category 2. Due to the one gap identified as Deficiency Category 4, it was decided to revise the ISLOCA initiating event frequency analysis to be consistent with the latest industry practice.
This update addresses the five gaps identified above.Gaps 2 and 15 are applicable to all three analyses.
These gaps are discussed in Section 4.4.5.5 for ISLOCA.4.4.5.1 ISLOCA PATHWAYS The RHR is a low pressure system, with a design pressure of 600 psig. The high pressure/low pressure interface on the suction side of each of the RHR pumps is normally isolated by two closed motor-operated valves (MOVs). One of the MOVs in each suction path is normally energized in Mode 1, but all four MOVs are equipped with interlocks to prevent them from being opened with RCS pressure above the RHR system design pressure.
However, failure of the series valves due to rupture or control system failures could result in over-pressurization of the RHR piping and an ISLOCA outside of containment.
The pathway configurations are provided on Figure 1-1. The isolation valves are 8701A and 8701 B on RHR train A, and 8702A and 8702B on RHR train B, with power provided from the train indicated in the valve ID (e.g., 8701A is train-A powered).
Relief valves on each RHR line, 8708A on train A and 8708B on train B, provide protection against over pressurizing the RHR lines.E2-41 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 4.4.5.2 ISLOCA MODEL A base fault tree was developed to model the ISLOCA pathways between the RHR and RCS.This model reflects the plant as operated with the ACI feature installed. (Note: Because this ISLOCA model is used only to assess the impact of the ACl circuit, it addresses only the RHR suction isolation paths; other potential ISLOCA paths are not relevant to this assessment.)
The basis for the fault tree model is:* Two isolation valves are available in each RHR line.* One of the two isolation valves in each line (8701 B train A, 8702B train B) has electrical power removed when the plant is at-power (Step 5.25.3 of FNP-1-UOP-1.1 or Step 23.c of FN P-2-UOP-1
.1 ).* RHR relief valves provide overpressure protection.
* If the RHR is overpressurized, then the RHR piping fails.* The ACl on the RHR isolation valves provides a signal to close the RHR isolation valves if the RHR pressure exceeds 700 psig.* Operators close both isolation valves in each RHR line following procedures prior to plant return to power.* Both isolation valves in either line in the open position prior to returning to power is detectable since the plant will not be able to pressurize.
Leak testing the valves prior to returning to power and sizing of the isolation valve operators so the valves cannot be opened against full system pressure are not credited in the analysis.The base fault tree and associated cutsets are provided in Appendix A. RHR/RCS isolation is compromised if both isolation valves in one RHR line are either in the open position or failed due to internal leakage and the corresponding relief valve is failed. Isolation valves 8701 B train A and 8702B train B may be in an open position if the operator fails to remove power to the valve and the valve spuriously transfers open or if the operator fails to close the valve and the ACI feature fails. Isolation valves 8701IA train A and 8702A train B, the isolation valves with power available in Mode 1, may be in an open position if the valve spuriously transfers open or if the operator fails to close the valve and the ACl feature fails.This base fault tree was modified to reflect the changes with the ACl feature removed. With the proposed removal of the ACl feature, the RHR isolation valves (8701lA/B and 8702A/B) will not-close automatically on increasing RCS pressure greater than 700 psig. In order to remove the ACI feature, five design-related and operations-related changes were provided in the N RC's Safety Evaluation (included in the WCAP-1 1736). The commitments and their impacts on the fault tree model in this analysis are listed in Table 4-3. The key changes to the fault tree model E2-42 Enclosure 2 to NL-15-1055 FNP RHR Autociosure Interlock Removal Report are Items 1, 2, and 3 on Table 4-3. Item 4, leak testing the valves prior to returning to power and Item 5, sizing of the isolation valve operators so the valves cannot be opened against full system pressure, are not credited in the analysis.The revised fault tree and associated cutsets are provided in Appendix B. RHR/RCS isolation is compromised if both isolation valves in one RHR line are either in the open position or failed due to internal leakage and the corresponding relief valve is failed. An isolation valve may be in an open position if the operator fails to remove power to the valve and the valve spuriously transfers open or if the operator fails to detect the valve is in the open position during startup via the new alarm system and close it.Key Modeling Data:*Failure values for fail-to-close on demand and transfer open for isolation valves 8701A/B and 8702A/B, and failure rates for limit switches, pressure transmitters, relays, and contacts are from the FNP Data Analysis Notebook (Reference 9). The values used are: o Isolation valve fail-to-close on demand = 3.97E-03/demand o Isolation valve transfer open = 4.45E-08/hr o Isolation valve limit switch fail-to-operate
= 1 .70E-O7/hr o Pressure transmitters fails = 1.1 7E-04/demand o Bistable fails = 5.44E-04/demand o Interlock relay fails on demand = 2.48E-05/demand o Alarm relay contact fail-to-close
= 8.50E-06/demand
*Valve internal leakage failure probability and the relief valve fail-to-open on demand are from NUREG/CR-6928 (Reference 10). The values used are: o Valve internal leakage = 2.02E-09/hr o Relief valve fail-to-open
= 2.77E-03/demand
*Pre-initiator HFEs are applied to the isolation valves left mis-positioned during startup and failure to remove power from isolation valves. In addition, failure of the operator to recognize the isolation valve is open during startup (respond to the new alarm) is included in the model. The HRA Calculator was used to determine these human error probabilities.
The values used are: o Isolation valves left mis-positioned during startup = 1 .65E-03 o Electric power not removed from the isolation valves = 8.23E-04 E2-43 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report'o Failure of the operators to recognize the isolation valve is open during startup =2.66E-04 Common Cause Failure Modeling Components of similar manufacture and function, and with the same maintenance and test activities are subject to common cause failure (CCF). Consistent with current practice, only active CCFs are included as contributors to the ISLOCA initiating event frequency portion of the ISLOCA model. This eliminates including CCF for the isolation valve failure modes of transfers open and internal leakage. Also modeled is the failure of the isolation valves to close. Failure to close both RHR suction valves 8701A/B and 8702A/B during startup is not considered a credible failure mode since the condition would be apparent and corrected.
RCS pressurization could not proceed with two isolation valves in the samne RHR line open. Therefore, CCF of RHR suction valves on the same train to close is not modeled. CCF modeling of other components, such as the RHR relief valves is not required since these components are not in the same cutsets.HRA Dependency Assessment The operator actions to close the RHR/RCS isolation valves and to remove power from the valves are judged to be independent.
Each step is verified to have been correctly completed and the steps for these aCtions, although in the same procedure, are at different stages of the startup and separated by a significant time period with a low level of stress.The operator actions to close the RHR/RCS isolation valves during startup and to respond to the new alarm systemn are judged to be independent.
The step to close the RHR/RCS isolation valves is verified completed earlier during the startup procedure.
Responding to an alarm to close the isolation valves will occur significantly later, after the RCS pressure exceeds the open permissive setpoint following an alarm response procedure.
The combination the three operator actions (close the RHR/RCS isolation valves, remove power from the valves, and to respond to the new alarm system) are also judged to be independent for the reasons discussed above.4.4.5.3 RESULTS OF ISLOCA INITIATING EVENT FREQUENCY ANALYSIS The ISLOCA initiating event frequency was calculated for the current plant operating configuration with ACl installed and for the plant configuration with AC! removed and the changes to operating practices and procedures credited in the analysis.
The results are:* ISLOCA initiating event frequency with ACI = 8.46 E-09/yr* ISLOCA initiating event frequency without ACl = 7.16E-10/yr
* Reduction in ISLOCA initiating event frequency
= 7.74E-09/yr E2-44 Enciosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report The frequency of an ISLOCA via the RHR suction lines decreases with the removal of the AC!feature. In the case with AC! removed, the ACl is replaced with an alarm system to indicate an isolation valve is open on increasing RCS pressure with an operator action to close the valve.In addition, both RHR suction isolation valves in each train will now be required to have power removed at startup, as opposed to only one in each train as the current practice.4.4.5.4 UNCERTAINTY IDENTIFICATION AND CHARACTERIZATION Table 4-4 provides an assessment of the key uncertainties and potential impact on the conclusions of this assessment.
The key uncertainties identified and characterized are HRA Uncertainty, HRA Dependency, Passive CCF, and Low Pressure Piping and Component Failure. Each is addressed and discussed in Table 4-4. It is concluded that the impact of alternate modeling approaches would not have a significant impact on the calculated frequencies and would not impact the conclusions.
4.4.5.5 DISPOSITION OF ISLOCA INITIATING EVENT FREQUENCY ANALYSIS GAP ASSESSMENT FINDINGS Gap 2 Description (IE-C-02):
No calculation or characterization of uncertainty could be found in the documentation.
 
==
Conclusion:==
 
The key uncertainties identified and characterized are HRA Uncertainty, HRA Dependency, Passive CCF, and Low Pressure Piping and Component Failure (rupture of the RHR system). It is concluded that the impact of alternate modeling approaches would not have a significant impact on the calculated frequencies and would not impact the conclusions (see Section 4.4.5.4).Gap 3 Description (HLR-IE-C-03):
Initiating event model configurations should be reviewed against current plant configurations and operating practices.
Specifically the ISLOCA IE calculation should be confirmed since failure modes may have changed (e.g., power removed to an RHR suction valve in Mode 1). It is also recommended that credit for the RHR relief valves should be Considered in the ISLOCA scenarios.
 
==
Conclusion:==
 
This gap is addressed in the development of the new ISLOCA initiating event frequency model for the RHR suction lines.Gap 7 Description (HLR-SY-B-02):
Confirmation that no CCF combinations are required for the ISLOCA initiating event should be documented.
 
==
Conclusion:==
 
This gap is addressed in Section 4.4.5.2. Modeling of CCF is not required for any of the components in the analysis.Gap 9 Description (HLR-HR-G-O1):
Upgrade the HRA methodology to evaluate the cognitive failures as well as the execution failures.E2-45 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
== Conclusion:==
 
The method used in this new analysis to calculate the HEPs follows industry accepted practices by applying the EPRI HRA Calculator.
The three HEPs analyzed for the ISLOCA evaluation are addressed as pre-initiators with applicable cognitive and/or execution failures.Gap 10 Description (HLR-HR-G-02):
Perform a consistency review on the post-initiator actions. During a consistency review, one might challenge the reasonableness of estimates given for isolating RHR given an overpressure event. Two HEPs were evaluated:
one before the ACl is removed and power is still removed to the RHR suction valves and one where ACI is removed, power is provide to the RHR suction valves, and an alarm is added on high pressure.A more significant difference in results may be expected over the small decrease in probability between the two actions.Conclusion:
The model used to develop the ISLOCA initiating event frequency does not include any post-initiator actions so this gap is not applicable to the revised analysis.
But comparison the two pre-initiator alignment type HEPs is valid. These are:* Isolation valves left mis-positioned during startup = 1 .65E-03* Electric power not removed from the isolation valves = 8.23E-04 The HEP values, each approximately 1 E-03, are consistent for similar types of latent errors.Gap 14 Description (HLR-QU-C-01):
Address operator dependencies using a more current systematic approach.Conclusion:
HRA dependency is assessed in Section 4.5.2. It was concluded that there is no dependency between the operator action pairs and no dependency between the three operator actions since the actions are performed at different stages of the startup and separated by a significant time period with a low level of stress, and/or different procedures are used for the actions (startup procedures and alarm response procedure).
In the previous section the HRA dependency was further discussed and a sensitivity assessment was completed assuming a low level of dependency between OA. This was shown not to impact the conclusions.
Gap 15 Description (QU-E-01):
Characterize the uncertainties in quantification.
 
==
Conclusion:==
 
The key uncertainties identified and characterized are HRA Uncertainty, HRA Dependency, Passive CCF, and Low Pressure Piping and Component Failure (rupture of the RHR system). It is concluded that the impact of alternate modeling approaches would not have a significant impact on the calculated frequencies and would not impact the conclusions (see Section 4.4.5.4).E2-46 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report TABLE 4-3: PLANT COMMITMENTS FROM NRC SER FOR WCAP-11736 Commitment from NRC SER Impact on Fault Tree model 1. An alarm will be added to each RHR suction valve Failures of alarm are modeled in the fault which will actuate if the valve is open and the pressure tree.is greater than the open permissive setpoint and less than the RHR system design pressure minus the RHR pump head pressure.2. Valve position indication to the alarm must be Failure of the valve position indication limit provided from the stem-mounted limit switches, with switches are modeled in the fault tree.indication power not affected by power-lockout of the Credit for the position indicator from the valve, stem-mounted limit switches was also taken into account during the development of operator action failure to detect that the valves are in the wrong position.3. The procedural improvements described in WCAP- The procedure(s) will be changed to include 11736 should be implemented.
removing power in Mode 1 (power lockout)for both isolation valves, instead of only the valve adjacent to the RHR system.Therefore, operator failure to remove power is applied to both isolation valves in each RHR train.4. Where feasible, power should be removed from the No impact (this is not addressed in the fault R HR suction valves prior to their being leak-checked.
tree model).5. The RHR suction valve operators should be sized so No impact (this is not credited in the fault that the valves cannot be opened against full system tree model).pressure.E2-47 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report TABLE 4-4: UNCERTAINTY ASSESSMENT Area of Model Alternative Sensitivity Assessment Uncertainty Impact HRA Developed using EPRI Alternate HRA Two HEPs were developed for FNP-specific analysis usingTHERP, which Uncertainty HRA Calculator methodologies was the state-of-practice at the time this WCAP was prepared.
These HEPs were re-developed using the EPRI HRA Calculator and one resulted in the same value while the other resulted in more conservative value.The more conservative HEP values were used in this analysis.HRA Not modeled in this Include HRA If a low dependency between the three actions is assumed, the Dependency analysis dependency combined human error probability is still very small. A review of the cutsets for the case without ACI identified four cutsets with the three operator actions. A sensitivity case was performed assuming a low dependency between these actions which resulted in the ISLOCA initiating event frequency increasing from 7.16E-10/yr to 8.6E-10/yr.
This is still a reduction in the frequency compared to the case with ACI.Passive CCF Not modeled Include passive Common industry practice recommends only including active CCF CCF's in the events, and excluding passive CCF events. Including passive CCF failures ISLOCA model will result in ISLOCA models that may contain events that are not contributors to ISLOCA precursors and unrealistic ISLOCA IF frequency.
Note that passive CCF events will have the same impact for both ACI and non-ACI cases, therefore, including the passive CCF events will not__________________impact the conclusion of this analysis.Pipe and Assumed all low Calculate a Assuming rupture of low pressure pipes and components when exposed Component pressure pipe and probability for to RCS pressure is conservative and consistent with the ISLOCA modeling Rupture components outside pipe and practice.Pressure containment are subject component Uncertainty to rupture if exposed to rupture when RCS pressure exposed to RCS___________pressure E2-48 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 4.5 CONSISTENCY WITH NRC SAFETY EVALUATION ON WCAP-11736 The bases for the NRC's determination of net positive safety Change are provided in the NRC's SE included in WCAP-11736.
Section 2.6 states,"The staff has no requirements based on the absolute values in the PRA analysis and will not require a plant-specific PRA for each licensee proposing to remove the ACI.However, the licensee should do sufficient PRA and safety analysis to ensure that its plant will not show results that will invalidate the conclusions of WCAP-1 1736." The results of the FNP-specific probabilistic assessments, qualitative and quantitative, discussed in this report provide the "sufficient PRA and safety analysis" to support the conclusions of WCAP-1 1736.Five improvements were provided in the NRC's SE included in WCAP-1 1736. These are summarized below along with the assumptions used in this analysis that credits some of these commitments.
: 1. An alarm will be added to each RHR suction valve which will actuate if the valve is open and pressure is greater than the open permissive setpoint and less than the RHR system design pressure minus the RHR pump head pressure.The availability of alarms that would actuate if RHR suction valves were open at elevated pressure is credited in the ISLOCA assessment in Section 4.4.5.2. Valve position indication to the alarm must be provided from stem-mounted limit switches, and power to .the stem mounted limit switches must not be affected by power lockout of the valve.The availability of RHR suction valve position indication based on stem-mounted limit switches is credited in the ISLOCA assessment in Section 4.4.5.3. Procedure improvements identified in WCAP-1 1736 should be implemented.
Appropriate procedure changes are assumed to be made to account for the removal of the ACI circuitry.
In addition, alarm response procedures were credited in the ISLOCA assessment in Section 4.4.5. The analysis also is based on power lockout to both isolation*valves in each RHR train.4. Where feasible, power should be removed from RHR suction valves prior to their being leak check.This was not credited in. the probabilistic assessments in Section 4.4.E2-49 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 5. The RHR suction valve operators should be sized so that valves cannot be opened against full system pressure.This was not credited in the probabilistic assessments in Section 4.4.In addition, the FNP-specific assessment identified two other plant-specific changes for FNP:*Power Lockout below 180&deg;F -Currently RHR suction MOVs are depowered open when RCS temperature is below 1 80&deg;F to support the LTOP function.
However, depowering these valves open limits operators ability to isolate RHR from RCS in. the event of leakage in the RHR system. With the removal of ACI, this depowering is no longer needed to support LTOP. Thus, the procedure should be changed to assure that the suction MOVs remain powered while RHR shutdown cooling is in service.This procedure change to eliminate the power lockout below 1800&deg;F is credited in the qualitative probabilistic assessment in Section 4.4.4.*Power Lockout in Modes 1 to 3 -Currently, in Modes 1 to 3 with RHR suction MOVs closed, power is removed only from the B-train-powered RHR suction MOVs (8701 B and 8702B).Power lockout should be extended to all four RHR suction MOVs in Modes 1 to 3 to support ISLOCA.The procedure changes to power-lockout all four RHR suction valves are credited in the ISLOCA assessment in Section 4.4.5.E2-50 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
==4.6 CONCLUSION==
S AND RECOMMENDATIONS Section 4.0 summarizes the probabilistic assessments of the impact of ACI removal on RHR shutdown cooling, low temperature overpressure protection, and interfacing system LOCA initiating event frequency.
For each area, the removal of A~l and the accompanying plant changes provide a benefit to plant safety. Thus, these results for FNP support the conclusions of WCAP-1 1736 that the deletion of the autoclosure interlock is acceptable from a safety standpoint.
E2-51 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report SECTION 4.0 APPENDIX A FAULT TREE MODEL AND CUTSETS FOR ISLOCA INITIATING EVENT FREQUENCY ANALYSIS WITH AUTOCLOSURE INTERLOCK E2-52 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 1.00E+00 2.77E-03 2.77E-03 E2-53 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report'[ .65E-03 2.48Eo05 5.44E-04 E2-54 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 3.97E.03 2.48E-0l5 E2-55 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report E2-56 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report rl 823E-04"11.65E-03 2,48E-05 E2-57 Enclosure 2 to. NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report OUTSET REPORT -ISL-RHR-SUCTION-ACI
= 8.46E-09 (PROBABILITY)
PROBABILITY f % CLASS INPUTS...3.86E-09 3.86E-09 1.75E-10 1.75E-10 1.75 E-10 1.75 E-10 1.72EF-11 1 .72E-1 1 3.17E-12 3.1 7E-12 8.72E-1 3 8.72E-1 3 7.81 E-13 7.81 E-13 3.12E-13 3.12 E-13 1.88 E-13 1.88 E-13 45.6%91.2%93.3%95.3%97.4%99.5%99.7%.99.9%99.9%99.9%100. 0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%/ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION PAF%ISL.-RHR-SUCTION PAF LHMVK-8701 B RUPTURE-RHR-SUCTION LHMVK-8702B RUPTURE-RHR-SUCTION LHMVK-8701 B RU PTU RE-RH R-S UCTION LH MVK-8701 A RU PTU RE-RH R-S UCTIO N LHMVK-8702B RUPTURE-RH R-SUCTION LHMVK-8702A RUPTURE-RHR-SUCTION LHMVR-8701B RUPTURE-RHR-SUCTION LHMVR-8702B RU PTU RE-RH R-S UCTION LH MVK-8701 A PAF LHMVK-8702A PAF ,1 RHOECLOSE-1 B RUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION LHMVR-8701 A RUPTURE-RHR-SUCTION LHMVR-8702A RUPTURE-RHR-SUCTION LHMVU-8701A PAF LHMVU-8702A PAF 1RHO EC LOSF-1 B RCPTF-PT402 1 RHOECLOSE-2B RCPTF-PT403 LHMVU-8701A LH MVU-8702A LHMVR-8701A LHMVR-8701 B LH MVR-8702A LHMVR-8702B LHMVU-8701A LHMVU-8702A LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVU-8701A SAADF-PS402 LH MVU-8702A SAADF-PS403 LHMVR-8701 B LHMVR-8702B LHMVU-8701 B RUPTURF-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LH MVU-8702A RU PTU RE-RH R-SU CT ION LHRVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LH RVD-8708B LH RVD-8708A LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B E2-58 Enclosure 2 to NL-15-1 055 FNP RHR Autoclosure Interlock Removal Report Probability f % Class Inputs...Probability
% Class Inputs...3.98E-14 3.98E-1 4 3.98E-14 3.98E-14 3.96E-1 4 3.96E-14 3.96E-14 3.96E-14 1.41 E-14 1.41 E-14 8.52E-1 5 8.52E-1 5 8.52E-1 5 8.52E-1 5 1.81 E-15 1.81 E-15 1.81 E-15 1.81 E-15 1.81EF-15 1. 81 E-15 100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%IS L-R HR-S UCTION PAF%IS L-R HR-S UCTION OA-DEPOWER-RH R-1%ISL-RHR-SUCTION OA.-DEPOWER-RHR-2
%IS L-RH R-S UCTIO N PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF 1 RHOECLOSE-1 B RU PTU RE-RH R-S UJCTION 1 RHOECLOSE-2B RU PTU RE-RH R-S UCTION 1 RHOECLOSE-1 B RUPTURE-RH R-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION 1 RHOECLOSE-1A RUPTURE-RHR-SUCTION 1 RHOECLOSE-1 B RUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION LH MVR-8701 A PAF LH MVR-8702A PAF 1 RHOECLOSE-1A RCPTF-PT402 1 RHOECLOSE-1 B RCPTF-PT402 1 RHOECLOSE-2A RCPTF-PT403 1 RHOECLOSE-2B RCPTF-PT403 1 RHOECLOSE-1A RU PTU RE-RH R-S UCTION 1 RHOECLOSE-1 B RU PTU RE-RH R-S UCTION 1 RHOECLOSE-1A RU PTU RE-RH R-SUCOTIO N 1 RHOECLOSE-1 B RUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION LH MVU-8701 A SAREF-PY402X LHMVU-8702A SAREF-PY4O3X LHMVU-8701 A SAREF-K454 LHMVU-8702A SAREF-K454 LHMVR-8701 B SAADF-PS402 LH MVR-8701 A SAADF-PS402 LH MVR-8702B SAADF-PS403 LH MVR-8702A SAADF-PS403 LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVR-8701 B RUPTURE-RH R-SUCTION LH MVR-8701 A RUPTURE-RHR-SUCTION LHMVR-8702B RUPTURE-RHR-SUCTION LH MVR-8702A RUPTURE-RH R-SUCTION LHMVR-8701 B SAREF-PY402X LH MVR-8701 A SAREF-PY402X LHMVR-8701 B SAREF-K1 54 LHMVR-8701A SAREF-K454.
LHMVR-8702B SAREF-PY403X LHMVR-8702B SAREF-K1 54 LHRVD-8708A LHRVD-8708B LHRVD-8708A LHRVDJ-8708B LHRVD-8708A LH RVD-8708A LH RVD-8708B LH RVD-8708B LH RVD-8708A LH RVD-8708B LH RVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LH RVD-8708A LH RVD-8708A LHRVD-8708A LHRVD-8708B LH RVD-8708B E2-59 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report Probability
% Class Inputs...1.81E-15 100.0% %ISL-RHR-SUCTION 1RHOECLOSE-2B LHMVR-8702A LHRVD-8708B PAF RUPTURE-RHR-SUCTION SAREF-PY403X 1.81 E-1 5 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2B LHMVR-8702A LHRVD-8708B PAF RUPTURE-RHR-SUCTION SAREF-K454 7.1 8E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1 A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAADF-PS402 7.1 8E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER--RHR-2 PAF RUPTURE-RHR-SUCTION SAADF-PS403 1 .54E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RH R-1 PAF RCPTF-PT402 RU PTU RE-RHR-SUCTION 1 .54E-16 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RH R-2 PAF RCPTF-PT403 RU PTURE-RHR-SUCTION 3.27E-1 7 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAREF-PY402X 3.27E-1 7 100.0% %ISL-RHR-SUCTION
.1RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAREF-K1 54 3.27E-17 100.0% %ISL-RHR-SUCTION
' 1RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RHR-2 PAF RUPTURE-RHR-SUCTION SAREF-PY403X 3.27E-17 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RHR-2 PAF RUPTURE-RHR-SUCTION SAREF-K1 54 E2-60 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report SECTION 4.0 APPENDIX B FAULT TREE MODEL AND CUTSETS FOR ISLOCA INITIATING EVENT FREQUENCY ANALYSIS WITHOUT AUTOCLOSURE INTERLOCK E2-61 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 1 .00E+00/Y 1.00 E+00 2.7715-03 2.77E-03 E2-62 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal ReportE-03 8.509-06 E2-63 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report a.97E-03 1.852-03 8.50E-06 E2-64 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 3.97E'03 8.50E-06 E2-65 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report 3.97E-03 8.50E-06 E2-66 EnlsReO2AtoILTY 5- 055 IPTS.CUTSET REPORT -ISL-RHR-SUCTION-NO-ACI
= 7.1 6E-1 0 (Probability)
PROBABILITY
% CLASS INPUTS...1.75E-10 1.75 E-10 1.75 E-10 1 .75E-1 0 3.1 7E-1 2 3.17E-12 3.17E-12 3.17E-12 7.81 E-13 7.81 E-13 3.12E-13 3.12 E-13 1.08E-13 1.08E-13 1.08 E-13 1.08 E-13 3.96E-14 3.96E-14 24.5%48.9%73.4%97.8%98.3%98.7%99.1%99.6%99.7%99.8%99.8%99.9%99.9%99.9%99.9%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RH R-1%IS L-R HR-S UCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCT ION OA-DEPOWER-RH R-2%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION LH RVD-8708A%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF LHMVK-8701 B RUPTURE-RH R-SUCTION LHMVK-8701A RUPTURE-RH R-SUCTION LHMVK-8702B RUPTURE-RHR-SUCTION LHMVK-8702A RUPTURE-RHR-SUCTION LHMVK-8701A PAF LHMVK-8701 B PAF LH MVK-8702A PAF LHMVK-8702B PAF LHMVR-8701A RUPTURE-RHR-SUCTION LHMVR-8702A RUPTURE-RHR-SUCTION LHMVU-8701A PAF LHMVU-8702A PAF 1 RHOECLOSE-1A PAF 1iRHOECLOSE-1iB PAF 1 RHOECLOSE-2A PAF 1 RHOECLOSE-2B PAF 1 RHOECLOSE-1A R-SUCTION 1 RHOECLOSE-1 B RUPTURE-RHR-SUCTION LH MVR-8701 A LHMVR-8701 B LH MVR-8702A LHMVR-8702B LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LI-MVU-8702A RUPTURE-RHR-SUCTION LHMVR-8701 B LHMVR-8702B LH MVU-8701 B RUPTURE-RHR-SUCTION LH MVU-8702B RUPTURE-RHR-SUCTION ACSWF-TRAINA RUPTU RE-RH R-SUCTION ACSWF-TRAINA RUPTURE-RHR-SUCTION ACSWF-TRAINB RUPTURE-RHR-SUCTION ACSWF-TRAIN B RUPTURE-RHR-SUCTION LHMVR-8701 B SAADF-PS402 LHMVR-8701A SAADF-PS402 LH RVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LHRVD-8708A LH RVD-8708B LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B LHMVR-8701 B LHMVR-8701 A LHMVR-8702B LHMVR-8702A LHRVD-8708A LHRVD-8708A E2-67 EnRO toBILTY 1055 S NPTS.PROBABILITY
% ]_CLASS INPUTS...3.96E-14 3.96E-14 1 .94E-14 1 .94E-14 1.94E-14 1 .94E-14 1.41 E-14 1.41 E-14 1.41 E-14 1.41 E-14 8.52E-1 5 8.52E-1 5 8.52E-1 5 8.52E-1 5 1.96E-15 1.96 E-15 1.96 E-15 1.96 E-15 7.1 8E-1 6 100.0%100.0%100.0%100. 0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LH RVD-8708A%ISL-RHR-SUCTION LH RVD-8708B%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION pAF%IS L-RH R-S UCT ION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%IS L-RH R-S UCTIO N LHRVD-8708A
%ISL-RHR-SUCTION LH RVD-8708A%IS L-RH R-S UCTIO N LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION OA-DEPOWER-RHR-1 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION 1 RHOECLOSE-1A-PAF 1RHOECLOSE-1B PAF 1 RHOECLOSE-2A PAF 1 RHOECLOSE-2B PAF LH MVR-8701 A PAF LHMVR-8701 B PAF LH MVR-8702A PAF LHMVR-8702B PAF 1 RHOECLOSE-1A RCPTF-PT402 1 RHOECLOSE-1 B RCPTF-PT402 1 RHOECLOSE-2A RCPTF-PT403 1 RHOECLOSE-2B RCPTF-PT403 1 RHOECLOSE-1 B OA-DEPOWER-RH R-1 1 RHOECLOSE-1A OA-DEPOWER-RHR-1 1 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 1RHOECLOSE-1iB PAF LHMVR-8702B SAADF-PS403 LHMVR-8702A SAADF-PS403 1 RHOEDETAN-1 RUPTURE-RHR-SUCTION 1 RHOEDETAN-1 RUPTURE-RHR-SUCTION 1 RHOEDETAN-2 RUPTURE-RHR-SUCTION 1 RHOEDETAN-2 RUPTU RE-RH R-SUCTION LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTU RE-RH R-SUCTION LHMVU-8702A RUPTU RE-RH R-SUCTION LHMVR-8701 B RUPTURE-RHR-SUCTION LHMVR-870 1A RUPTURE-RHR-SUCTION LHMVR-8702B RUPTU RE-RH R-SUCTION LHMVR-8702A RUPTU RE-RH R-SUCTION ACSWF-TRAINA PAF ACSWF-TRAINA PAF ACSWF-TRAIN B PAF ACSWF-TRAIN B PAF LH MVU-8701 A RUPTURE-RHR-SUCTION LH RVD-8708B LHRVD-8708B LHMVR-8701 B LHMVR-8701A LHMVR-8702B LHMVR-8702A LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RH R-SUCTION LHRVD-8708A SAADF-PS402 E2-68 PROBABoLITY 2 toASSL-NPUTS..
PROBABILITY
% { CLASS INPUTS...7.18E-16 7.18E-16 7.18 E-16 6.19E-16 6.19E-16 6.19 E-16 6.19 E-16 3.5 1E-16 3.51 E-16 3.51 E-16 3.51 E-16 1 .54E-16 1,.54E-1 6 1 .54E-1 6 1 .54E-1 6 1.12 E-17 1.12 E-17 1.12 E-17 1.12E-17 100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708B
%IS L-R HR-S UCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-1
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION OA-DEPOWER-RHR-2
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708A
%ISL-RHR-SUCTION LHRVD-8708B
%ISL-RHR-SUCTION LHRVD-8708B 1 RHOECLOSE-1A PAF 1 RHOECLOSE-2B PAF 1 RHOECLOSE-2A PAF 1 RHOECLOSE-1A PAF 1 RHOECLOSE-1 B PAF 1 RHOECLOSE-2A PAF 1 RHOECLOSE-2B PAF 1 RHOECLOSE-1 B OA-DEPOWER-RHR-1 1 RHOECLOSE-1A OA-DEPOWER-RHR-1 1 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 1 RHOECLOSE-1 B PAF 1 RHOECLOSE-1A PAF 1 RHOECLOSE-2B PAF 1 RHOECLOSE-2A PAF 1 RHOECLOSE-1 B OA-DEPOWER-RHR-1 1 RHOECLOSE-1A OA-DEPOWER-RH R-1 1 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION AFCNK-TRAINA RUPTURE-RHR-SUCTION AFCN K-TRAINA RUPTURE-RHR-SUCTION AFCNK-TRAINB RUPTURE-RHR-SUCTION AFCNK-TRAINB RUPTURE-RHR-SUCTION 1 RHOEDETAN-1 PAF 1 RHOEDETAN-1 PAF 1 RHOEDETAN-2 PAF 1 RHOEDETAN-2 PAF LHMVU-8701 A RCPTF-PT402 LHMVU-8701 B RC PTF-PT402 LHMVU-8702A RCPTF-PT403 LHMVU-8702B RCPTF-PT403 AFCNK-TRAINA PAF AFCNK-TRAINA PAF AFCNK-TRAINB PAF AFCNK-TRAINB PAF LHRVD-8708A SAADF-PS402 LH RVD-8708B SAADF-PS403 LH RVD-8708B SAADF-PS403 LHMVR-8701 B LHMVR-8701A LH MVR-8702B LHMVR-8702A LHMVU-8701A RU PTU RE-RH R-S UCTIO N LHMVU-8701 B RUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RH R-SUCTION LH RVD-8708A RUPTURE-RHR-SUCTION LH RVD-8708A RUPTURE-RHR-SUCTION LHRVD-8708B RUPTURE-RHR-SUCTION LH RVD-8708 B RUPTURE-RHR-SUCTION LHMVU-8701 A RUPTURE-RHR-SUCTION LHMVU-8701 B RUPTURE-RHR-SUCTION LH MVU-8702A RU PTU RE-RH R-S UCTION LHMVU-8702B RUPTURE-RHR-SUCTION
______________
L _________
J _____________
+/-E2-69 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report.5.0 ADEQUACY OF THE RHR SYSTEM RELIEF VALVE CAPACITY The FNP RHR System is protected from inadvertent overpressurization by ASME code relief valves located on each RHR System pumps suction line from the RCS hot leg, downstream of the inlet isolation valves. The main purpose of the RHR System relief valve is to protect the RHR System from overpressurization during RHR System operation.
The original design basis of the relief valves assumed the following limiting RHR System overpressurization event: the RCS is water solid, and the control valves in the charging and seal injection lines fail fully open and the letdown line control valve fails closed. This causes a mass addition to the RCS, thus pressurizing the RCS and RHR System.Based on this event, the RHR System relief valves were sized to relieve the combined flow of two charging pumps at the relief valve setpressure plus accumulation.
The setpressure of the relief valves is 450 psig with a 10 percent accumulation.
This setpoint considers the additional pressure boost of the downstream RHR System pumps in maintaining the 660 psig (110 percent of design pressure as required by the ASME Code Section NC-731 1) design overpressure limit of the RHR System.In order to meet the above criteria, the FNP relief valves are each designed to relieve 900 gpm of 400&deg;F water, relieving to a maximum allowable backpressure of 50 psig at a valve setpressure of 450 psig (plus 10 percent accumulation).
E2-70 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report 6.0 PROPOSED DOCUMENT CHANGES The proposed document changes for FNP, to address the ACl and power lockout of the RHR System isolation valve removal, are similar to those indicated in WCAP-1 1736. The associated FNP, Units 1 and 2 Technical Specification changes are addressed elsewhere in this License Amendment Request.The FNP specific FSAR and procedural changes are being addressed separately from this License Amendment Request in accordance with the 10OCFR50.59 evaluation process. The specific procedure changes to support the ACl deletion are as follows: 1. Procedures will be revised to eliminate the current requirement to lockout power to the open RHR suction isolation valves below 180&deg;F.2. Procedures will be implemented to lockout power to all four closed RHR suction isolation valves in Modes 1, 2, and 3.3. Alarm response procedures will be implemented to support the addition of the alarm for the RHR suction isolation valves (described above).4. Other procedures will be revised as necessary to account for the deletion of the ACl.E2-71 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
==7.0 CONCLUSION==
S AND RECOMMENDATIONS This section addresses the seven concerns expressed in the NRC internal memorandum (Reference
: 11) of January, 1985 stating the position of the Reactor Systems Branch (RSB) on requests for removal of the RHR System ACI. The memorandum stated that any proposal to remove the ACl should be substantiated by proof that the change is a net improvement in safety and should assess as a minimum the following:
: 1. The means available to minimize Event V concerns.2. The alarms to alert the operator of an improperly positioned RHR System MOV.3. The RHR System relief capacity must be adequate.4. Means other than the ACI to ensure both MOVs are closed (e.g., single switch actuating both valves).5. Assurance that the function of the open permissive circuitry is not affected by the proposed change.6. Assurance that MOV position indication will remain available in the control room regardless of the proposed change.7. Assessment of the effect of the proposed change on RHR System reliability, as well as on LTOP concerns.Each of the seven items above will be commented on separately and reference will be made to supporting analysis contained in this report where applicable.
Means Available To Minimize A LOCA Outside The Containment An interfacing systems LOCA is the failure of a low pressure piping system that interfaces with the RCS when the low pressure system is subject to the high RCS pressure.
An RHR System LOCA, initiated by failure of the boundary between the RCS and RHR System, is classified as a non-mitigable LOCA outside containment.
It is assumed to occur if the Valves in the RHRS suction line fail open when the RCS is at normal operating pressure (2235 psia) and the RHR relief valve(s) fail to mitigate the pressure increase.
Since the RHR System is designed for a much lower pressure (600 psig), the result of both suction/isolation valves failing open and failure of the RHR relief valve(s) is overpressurization of the RHR System. The RHR System for Farley, Units 1 and 2, is located outside of containment.
A failure of the RHR System pressure boundary is assumed to result in a LOCA outside of containment.
The RHR System has two-motor operated suction/isolation valves on the hot leg suction line from the RCS. These valves on each suction line serve as the primary RCS pressure boundary.
They are remotely operated from the Main Control Room, and are powered by separate Class 1 E electrical power sources. Continuous valve position indication is provided from the valve stem mounted limit E2-72 Enciosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report switches with indication in the Main Control Room. Plant operating procedures instruct the operator to isolate the RHR System during plant heatup, so the likelihood of these valves being left open is remote. Additionally, this report recommends the following:
* Installation of a Main Control Room alarm to alert the operator if a RHR System suction/isolation"VALVE NOT FULLY CLOSED" in conjunction with a "RCS PRESSURE HIGH" signal, and* Procedures be implemented to lockout power to all four closed RHR suction isolation valves in Modes 1, 2, and 3 As noted above, should a failure of the boundary between the RCS and RHR System occur, the pressure effect on the low pressure RHR System could be mitigated by the RHR System suction line relief valves. These relief valves discharge inside containment to the Pressurizer Relief Tank (PRT). A discharge would be detected by high temperature, level, and pressure alarms in the PRT.The results of the interfacing systems LOCA probabilistic analyses (Sections 4.2.2 (for the original analyses) and Section 4.4.5.3 (for the updated analysis) showed a reduction in frequency with the deletion of the RHR System A~l.In conclusion, sufficient means are available to minimize a LOCA outside of containment and removal of the ACI feature is desirable in that it reduces the frequency of interfacing systems LOCA in Modes 1, 2, and 3.Alarms To Alert The Operator Of An Improperly Positioned RHR System Isolation Valve The proposed interlocks and functional requirements for FNP recommend the addition of an alarm for each suction/isolation valve that will actuate in the Main Control Room given a "VALVE NOT FULLY CLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. A more detailed description of the modifications to the individual valve control circuitry are presented in S;ection 3.0. The intent of the alarm is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is not fully closed, and that double valve isolation from the RCS to the RHR System is not being maintained.
Valve position indication to the alarm should be provided from the valve stemn mounted limit switches and power to the stem mounted limit switches must not be affected by power lockout to the valve. As with other power lockout valves, there is no requirement for opposite train power for the stem mounted limit switches, only that power to the stemn mounted limit switches is not affected by the power lockout.This alarm meets the intent of the requirements of Regulatory Guide 1.139, "Guidance For Residual Heat Removal," which states that it is the regulatory position on RHR System isolation that "... Alarms in the control room should be provided to alert the operator if either valve is open when the RCS pressure exceeds RHR System design pressure." Verification Of The Adequacy Of RHR System Relief Valve Capacity The proposed design change as described in Section 3.0 of this report has no impact on the performance and/or design basis assumption used in the original sizing of the valve. As such, the RHR E2-73 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report System relief valves perform adequately to meet their original design basis criteria as described in Section 5.0.Means Other Than Autoclose Interlocks to Ensure Both Isolation Valves Are Closed (e.g., Single Switch Actuating Both Valves)Current FNP operating instructions, along with redundant position indication and the proposed alarm, are sufficient to insure isolation.
The addition of a single switch to close both valves would prevent the cycling of individual suction/isolation valves. This would require FNP to lift leads and add jumpers during valve maintenance.
The location of the hand switches (for both valves) is such that they are near enough to each other on the main control board to ensure timely operator action.In addition, this report recommends that procedures be implemented to lockout power to all four closed RHR suction isolation valves in Modes 1, 2,.and 3 Assurance That the Open Permissive Circuitry is Neither Removed or Affected by the Proposed Change The proposed design change, as described in Section 3.0 of this report, leaves the open permissive circuit intact. Hardware changes are limited to removal of the ACl portion of the valve control circuitry and the addition of an alarm. Neither one of these changes will affect the operation of the RHR System OPI.Assurance That Isolation Valve Position Indication Will Remain Available in the Control Room Regardless of the Proposed Change The proposed design change, as described in Section 3.0 of this report leaves the valve position indication at the main control board intact. This indication will be provided by two means: 1. Continuous valve position indication (Main Control Board status lights), and 2. Alarms will be added with the ACI removal.Assessment of the Effect of the Proposed Change on RHR System Availability, as Well as Low Temperature Overpress ure Protection RHR SYSTEM UNAVAILABILITY ANALYSIS The availability of the RHR System to remove decay heat was considered in three phases for the RHR System Unavailability Analysis.
The first phase covers the period during which the RHR System is placed into service and goes through a warm-up period needed to minimize the thermal shock to the system and insure boron mixing. The second phase covers the initial period of cooldown when the decayheat load is high. During this phase, two trains of the RHR System (two pumps and two heat exchangers) are assumed to be required for 72 hours. The third phase covers the final long-term E2-74 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report period of cooldown when the heat load is smaller. For this phase only one train of the RHR System (one pump and one heat exchanger) is required to be in operation.
Six weeks was the time period assumed for this phase (based on the average refueling outage time period). The results of the quantification of the FNP RHR System unavailability fault trees, as discussed in Section 4.2.2 (for the original analyses) and in Section 4.4.3 for the gap analysis evaluation) show that with power lockout, deletion of the ACI has little impact on the system unavailability.
Without power lockout, deletion of the ACI reduces the number of spurious closures of the suction valves and thus increases the availability of the RHR System. These results are summarized in Table 4-1.OVERPRESSURIZATION ANALYSIS The effect of an overpressure transient at cold shutdown conditions will be altered by the removal of the RHR System ACI feature. An overpressurization analysis was conducted that used event trees to model the mitigating actions (both automatic and manual) following the occurrence of low temperature overpressurization events. These mitigating actions affect the severity of the overpressurization events and reduce the possibility of damage to the plant. The analysis was conducted in two parts: 1) determination of the frequency of cold overpressurization events, and 2) the effect of mitigation on the transients.
Nine initiating events which fell into two broad categories, heat input transients and mass input transients, were considered.
For the heat input transients considered the pressure peak is either acceptably low with reference to the RHR System suction relief valves or the transient proceeds so quickly that the RHR System ACl could not cause the slow acting RHR System suction/isolation valve to close in time to affect the transient.
The analysis concludes that the removal of the RHR System ACl feature will have no effect on the heat input transients. (Refer to WOG WCAP-1 1736 for discussion).
For the slower mass input transients event trees were utilized to model the mitigating actions that occur following the transients.
Operator actions and mitigating systems were included in the event trees.Success criteria for each event tree top event were developed and system/component failure probabilities were calculated.
The conclusion to be drawn from the overpresssure analysis (as discussed in Section 4.2.2 (for the original analyses) and Section 4.4.4 (for the gap analysis evaluation) is that removal of the ACl has little impact on the consequences of LTOP events for FNP.It should be understood that the ACl was not installed to mitigate overpressure transients.
The RH-R System suction valves are slow-acting and take approximately two minutes to close. The ACl will not protect the RHR System from a fast-acting overpressure transient such as the startup of a RCP.The major impact with respect to overpressure concerns is that removal of the ACl will significantly reduce the number of letdown isolation transients.
E2-75 Enclosure 2 to NL-1 5-1 055 FNP RHR Autoclosure Interlock Removal Report
 
==8.0 REFERENCES==
: 1. WASH-1400, "Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," October 1975.2. "Safety Evaluation Report by the Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory
*Commission, in the Matter of Westinghouse Electric Company Reference Safety Analysis*Report RESAR-41, Docket No. STN 50-480," NUREG-75/1103, December 31, 1975, pages 5-17 to 5-19, 7-15, 7-16, and Appendix C..3. "Branch Technical Position RSB 5-1, "Design Requirements of the Residual Heat Removal System," Revision 2, July 1981.'4. WCAP-11736, Revision 0, Volume l and II "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners," October 1989.5. Nuclear Regulatory Commission "Safety Evaluation of Removal of RHR Autoclosure Interlock Function and Installation of an Alarm at Diablo Canyon Units 1 and 2 (TAC NOS. 66030 and 66031)," February 17, 1988.6. ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications".
: 7. U.S. NRC Regulatory Guide 1.200, Rev. 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", March 2009.8. EPRI TR-1 021176, "An Analysis of Loss of Decay Heat Removal and Loss of Inventory Event Trends (1990-2009)", EPRI, December 2010.6. Joseph M. Farley Nuclear Plant, Units 1 and 2, Data Analysis Notebook, PRA Model Revision 9, March 2010.7. NUREG/CR-6928, "Summary of SPAR Component Unreliability Data and Results 2010 Parameter Estimation Update".8. Memorandum from B.W. Shearon, NRC to RSB members, "Auto Closure Interlocks for PWR Residual Heat Removal (RHR) Systems," January 28, 1985.E2-76 Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 3 FNP Technical Specification And Bases Markups Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups No Change Page Included For Information Only 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.14 RCS Pressure Isolation Valve (PiV) Leakage RCS PIV Leakage 3.4.14 LCO 3.4.14 APPLICABILITY:
Leakage from each RCS PlV shall be within limit.MODES 1, 2, and 3, MODE 4, except valves in the residual heat removal (RHR) flow path when in, or during the transition to or from, the RHR mode of operation.
ACTIONS--------------------
NOTES--------------
: 1. Separate Condition entry is allowed for each flow path.2. Enter applicable Conditions and Required Actions for systems made inoperable by an inoperable PlV.CONDITION REQUIRED ACTION COMPLETION TIME A. One or more flow paths-------NOTE-----
with leakage from one or Each valve used to satisfy more RCS PIVs not Required Action A.1 and Required within limit. Action A.2 must be verified to meet SR 3.4.14.1 and be in the reactor coolant pressure boundary or the high pressure portion of the system.________________________________________________(continued)
Farley Units 1 and 2 3.4.14-1 Amendment No. 146 (Unit 1)Amendment No. 137 (Unit 2)E3 -1 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups RCS PIV Leakage 3.4.14 ACTIONS ________CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)
A.1 Isolate the high pressure 4 hours portion of the affected system from the low pressure portion by use of one closed manual, deactivated automatic, or check valve.AND A.2 Isolate the high 72 hours pressure portion of the affected system from the low pressure portion by use of a second closed manual, deactivated automatic, or check valve.B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time for Condition A not AND met.B.2 Be in MODE 5. 36 hours C. RHR System C.1 Place the affected valve(s) 4 hours autoclosure or open in the closed position and permissive interlock maintain closed under function inoperable, administrative control.-- --NOTE----.........................
Not applicable to the autoclosure interlock for Unit 1 after restart from 1 R27 and for Unit 2 after restart from 2R25.Farley Units 1 and 2 3.4. 14-2 Amendment No. 146 (Unit 1)Amendment No. 137 (Unit 2)E3 -2 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups ROS PIV Leakage 3.4.14 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY+SR 3.4.14.1-----------
NOTES- ------1. Not required to be performed in MODES 3 and 4.2. Not required to be performed on the RCS PIVs located in the RHR flow path when in the shutdown cooling mode of operation.
: 3. RCS PIVs actuated during the performance of this Surveillance are not required to be tested more than once if a repetitive testing loop cannot be avoided.Verify leakage from each RCS PIV is equivalent to< 0.5 gpm per nominal inch of valve size up to a maximum of 5 gpm at an RCS pressure > 2215 psig and < 2255 psig.18 months, prior to entering MODE 2 AND Following valve actuation due to automatic or manual action or flow through the valve (except for RCS PIVs located in the~iJ IN rxIX, lX IIUVV I SR 3.4.14.2 NOTE hi/Not required to be met when the RHR System valves are required open in accordance with SR 3.4.12.3.Verify RHR System autoclosure interlock In accordance with causes the valves to close automatically the Surveillance with a simulated or actual RCS pressure Frequency Control signal _> 700 psig and _< 750 psig. Program 2. Not applicable to Unit 1 after restart from 1 R27 and not applicable to Unit 2 after restart from 2R25.I Farley Units 1 and 2 3.4. 14-3 Amendment No. 185 (Unit 1)Amendment No. 180 (Unit 2)E3 -3 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups No Change Page Included For Information Only RCS Ply Leakage 3.4.14 SURVEILLANCEREQUIREMENTS________
SR 3.4.14.3----------NOTE---------
Not required to be met when the RHR System valves valves are required open in accordance with SR 3.4.12.3.Verify RHR System open permissive interlock In accordance with prevents the valves from being opened with a the Surveillance simulated or actual RCS pressure signal Frequency Control> 295 psig and < 415 psig. Program Farley Units 1 and 2 3.4. 14-4 Amendment No. 185 (Unit 1)Amendment No. 180 (Unit 2)E3 -4 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups No Change RCS PIV Leakage B 3.4.14 Page Included For Information Only BASES ACTIONS A.i and A.2 (continued)
The flow path must be isolated by two valves. Required Actions A.1 and A.2 are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be within the RCPB or the high pressure portion of the system. However, the valves used to isolate the flow path (which are not PIVs) do not have to be pre-qualified by periodic testing. When Required Action A is entered and the flow path isolated, the valves will be verified at that time to meet the leakage requirements of SR 3.4.14.1.
This is accomplished using the methodology of SR 3.4.13.1 (RCS water inventory balance) with the leakage limits of SR 3.4.14.1 applied.Required Action A.1 requires that the isolation with one valve must be performed within 4 hours. Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 4 hour Completion Time allows the actions and restricts the operation with leaking isolation valves.Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing some other valve qualified for isolation or restoring one leaking PlV. The 72 hour Completion Time after exceeding the limit considers the time required to complete the Action and the low probability of a second valve failing during this time period.B.1 and B.2 If leakage cannot be reduced, the system isolated, or the other Required Actions accomplished, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This Action may reduce the leakage and also reduces the potential for a LOCA outside the containment.
The allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant'systems.C.1 The inoperability of the RHR autoclosure interlock renders the associated RHR suction isolation valves incapable of isolating in response to a high pressure condition.
The inoperability of the RHR open permissive interlock renders the associated RHR suction (continued)
Farley Units 1 and 2 B 3.4.14-4 Revision 0 E3 -5 Enclosure 3 to NL-15-1 055 FNP Technical Specification And Bases Markups RCS PIV Leakage B 3.4.14 BASES ACTIONS Required Action 0.1 is modified by a Note that states the Required Action for the autoclosure interlock is not applicable to Unit 1 after 1R27 and not applicable to Unit 2 after 2R25. The Required Action for the autoclosure interlock is no longer applicable after these refueling outages because the autoclosure interlock will be removed during the outages and will no longer be required OPERABLE.SURVEILLANCE REQUIREMENTS 0.1. (continued) isolation valves incapable of preventing inadvertent opening of the valves at RCS pressures in excess of the RHR systems design pressure.
If the RHR autoclosure or open permissive interlocks are inoperable, operation may continue as long as the affected RHR suction valves are closed and administrative controls are in place in the control room to maintain them closed (e.g., tags on the main control board handswitches, etc.) within 4 hours. This Action accomplishes the purpose of the autoclosure or open permissive function.Rto _Operators:
The location of the electrical switchgear contain te breakers for the RHR isolation valves is subje ot- very high dose ra *ns the event of a small break LOCA. T efore, opening the break o-sr the RHR isolation valve ould place the plant in a condition wher ould a small b-=a' LOCA occur, the plant could not be placed on n- a-:l 4twithout unacceptably high exposures to plant personnel.
.s the issue of dose during a salbekLOCA, h e*edAto dition C requires islton of the valve .der administrative con teLfrom the control room to allow ,l'5ishment of RHR operation, shou b~e required, without u u.rcceptable dose to plant personnel in the event s~mall bre OA S/R 3.4.14.1 Note to Operators:
After 1R27 (Unit 1) and 2R25 (Unit 2) when the RHR autoclosure interlocks are removed from each unit, the RHR suction isolation valves will be required to be closed with power removed from the valves in MODES 1, 2, and 3. The requirement to isolate the valves with power removed in these MODES is necessary to satisfy the conditions for removal of the RHR autoclosure interlock.
If the open permissive interlock becomes inoperable after the removal of the autoclosure interlock, the Required Action to ensure the valves are closed using the administrative controls described above would only be applicable in MODE 4. In MODES 1, 2, and 3, if an open permissive interlock becomes inoperable, the Required Action to close and maintain close the valves by administrative controls would be met by the administrative controls in place to ensure the valves are closed with power removed (as required for the removal of the autoclosure interlock).
Farley Units 1 and 2 Performance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 and Required Action A.2 is required to verify that leakage is below the specified limit and to identify each leaking valve. However, the valves used to isolate the flow path to satisfy Required Actions A.1 and A.2 (which are not PIVs)do not have to be pre-qualified by periodic testing. When Required Action A is entered and the flow path isolated, the valves will be verified at that time to meet the leakage requirements of SR 3.4.14.1.This is accomplished using the methodology of SR 3.4.13.1 (RCS water inventory balance) with the leakage limits of SR 3.4.14.1 applied. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to a 3 or 5 gpm maximum applies to each valve.Leakage testing requires a stable pressure condition.(continued)
B 3.4.14-5 Revision 0 E3 -6 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases Markups RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS SR 3.4.14.1 (continued) shutdown cooling mode of operation.
PIVs contained in the RHR shutdown cooling flow path must be leakage rate tested when RHR is secured and stable unit conditions and the necessary differential pressures are established.
Leak rate testing is performed manually, with test personnel in the vicinity of the system connections in containment during setup and testing. Should the check valve that was being tested rupture or pressure in the system cause a rupture of the test equipment, there would be a concern for the safety of the personnel in the area. In addition, testing with RCS temperature above 212 &deg;F would result in any leakage past the RHR valves flashing into steam making accurate measurement of the leakage rate impossible.
Therefore, testing of the RHR System PIVs should normally be performed in Mode 5, as the test results are meaningful and plant conditions in Mode 5 minimize the potential impact on personnel safety.Any change in the components being tested by this SR will require reevaluation of STI Evaluation Number 558904 in accordance with the Surveillance Frequency Control Program.SR 3.4.14.2 Verifying that the RHR autoclosure interlock is OPERABLE ensures that RCS pressure will not pressurize the RHR system beyond 125%of its design pressure of 600 psig. The autoclosure interlock isolates the RHR System from the RCS when the interlock setpoint is reached.The Setpoint ensures the RHR design pressure will not be exceeded.The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. /,i two Notes. Note 1 The SR is modified by an exception to the requirement to perform this surveillance when using the RHR System suction relief valves for cold overpressure protection in accordance with SR 3.4.12.3.Note 2 states the Surveillance is not applicable to Unit 1 after 1 R27 and not applicable to Unit 2 after 2R25. The Surveillance is no longer applicable after these refueling outages because the autclosure interlock will be removed during the outages and will no longer be required OPERABLE.(continued)
Farley Units 1 and 2 B 3.4.14-7 Revision 59 E3 -7 Enclosure 3 to NL-1 5-1 055 FNP Technical Specification And Bases NO Change Page Included For Information Only RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.14.3 Verifying that the RHR open permissive interlock is OPERABLE ensures that the RCS will not pressurize the RHR system beyond design of 600 psig. The open permissive interlock prevents opening the RHR System suction valves from the RCS when the RCS pressure is above the setpoint.
The setpoint upper value ensures the RHR System design pressure will not be exceeded at the RHR pump discharge and was chosen taking into account instrument uncertainty and calibration tolerances.
This value also provides assurance that the RHR System suction relief valves setpoint will not be exceeded.The minimum value of the setpoint range is chosen based upon operational considerations (differential pressure) for the RCP seals and thus does not have a safety-related function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.The SR is modified by a Note that provides an exception to the requirement to perform this surveillance when using the RHR System suction relief valves for cold overpressure protection in accordance with SR 3.4.12.3.REFERENCES
: 1. 10OCFR 50.2.2. 10 CFR 50.55a(c).
: 3. 10 CFR 50, Appendix A, Section V, GDC 55.4. WASH-1400.(NUREG-75/014), Appendix V, October 1975.5. NUREG-0677, May 1980.6. Technical Requirement Manual (TRM).7. ASME, Boiler and Pressure Vessel Code, Section XI.8. 10 CFR 50.5ha(g).
Farley Units 1 and 2 B 3.4.14-8 Revision 52 E3 -8 Joseph M. Farley Nuclear Plant -Units 1 and 2 License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 4 FNP Technical Specifications Clean Typed Pages Enclosure 4 to NL-1 5-1 055 FNP Technical Specifications Clean Typed Pages RCS PIV Leakage 3.4.14 ACTIONS_____
___CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)
A.1 Isolate the high pressure 4 hours portion of the affected system from the low pressure portion by use of one closed manual, deactivated automatic, or check valve.AND A.2 Isolate the high 72 hours pressure portion of the affected system from the low pressure portion by use of a second closed manual, deactivated automatic, or check valve.B. Required Action and B.1 Be in MODE 3. 6 hours associated Completion Time for Condition A not "AND met.B.2 Be in MODE 5. 36 hours-NOTE-- --Not applicable to the autoclosure interlock for Unit 1 after restart from 1 R27 and for Unit 2 after restart from 2R25.C. RHR System C.1 Place the affected valve(s) 4 hours autoclosure or open in the closed position and permissive interlock maintain closed under function inoperable, administrative control.Farley Units 1 and 2 3.4.14-2 Amendment No.Amendment No.(Unit 1)(Unit 2)E4 -1 Enclosure 4 to NL-15-1055 FNP Technical Specifications Clean Typed Pages RCS PIV Leakage 3.4.14 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY+SR 3.4.14.1-~~~~NOTES--------
: 1. Not required to be performed in MODES 3 and 4.2. Not required to be performed on the RCS PIVs located in the RHR flow path when in the shutdown cooling mode of operation.
: 3. RCS PIVs actuated during the performance of this Surveillance are not required to be tested more than once if a repetitive testing loop cannot be avoided.Verify leakage from each RCS Ply is equivalent to< 0.5 gpm per nominal inch of valve size up to a maximum of 5 gpm at an RCS pressure > 2215 psig.and < 2255 psig.18 months, prior to entering MODE 2 AND Following valve actuation due to automatic or manual action or flow through the valve (except for RCS PIVs located in the RHR flow path).4-SR 3.4.14.2-~~~~NOTES--------
: 1. Not required to be met when the RHR System valves are required open in accordance with SR 3.4.12.3.2. Not applicable to Unit 1 after restart from 1 R27 and not applicable to Unit 2 after restart from 2R25.Verify RHR System autoclosure interlock causes the valves to close automatically with a simulated or actual RCS pressure signal >_ 700 psig and _< 750 psig.In accordance with the Surveillance Frequency Control Program Farley Units 1 and 2 3.4. 14-3 Amendment No.Amendment No.(Unit 1)(Unit 2)E4 -2}}

Latest revision as of 07:49, 7 April 2019

Redirect to:

Retrieved from "https://kanterella.com/w/index.php?title=ML15261A673&oldid=1417839"