ML15261A673

Farley, Units 1 and 2 - License Amendment Request to Revise Technical Specification 3.4.14, RCS Pressure Isolation Valve Leakage to Eliminate the RHR Autoclosure Interlock Function from the Technical Specifications

ML15261A673
Person / Time
Site:	Farley
Issue date:	08/31/2015
From:	Pierce C R Southern Co, Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-15-1055
Download: ML15261A673 (127)

Text

Charles R. PierceRegulatory Affairs DirectorSouthern NuclearOperating

Company, Inc.40 Inverness Center ParkwayPost Office Box 1295Birmingham, AL 35242Tel 205.992.7872 Fax 205.992.7601 SOUTHERN ZNUCLEARA SOUTHERN COMPANYAugust 31, 2015Docket Nos.: 50-34850-364NL-1 5-1 055U. S. Nuclear Regulatory Commission ATTN: Document Control DeskWashington, D. C. 20555-0001 Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Ladies and Gentlemen:

Pursuant to 10 CFR 50.90, Southern Nuclear Operating Company (SNC) herebyrequests an amendment to Facility Operating License Nos. NPF-2 and NPF-8 forthe Joseph M. Farley Nuclear Plant, Units 1 and 2 (FNP). This amendment request proposes to revise Technical Specification (TS) 3.4.14, "RCS PressureIsolation Valve Leakage" to eliminate the requirements for the Residual HeatRemoval (RHR) System suction valve autoclosure interlock function.

The proposed change would eliminate the current requirement to perform theRHR autoclosure interlock Surveillance Requirement (SR) 3.4.14.2 for FNP Unit1 after restart from Refueling Outage 1 R27 and for Unit 2 after restart fromRefueling Outage 2R25. In addition, the proposed change would revise ActionCondition C to eliminate the RHR autoclosure interlock from the Action Condition for FNP Unit 1 after restart from Refueling Outage 1 R27 and for FNP Unit 2 afterrestart from Refueling Outage 2R25.The proposed change and a summary of the basis for the change are discussed in Enclosure

1. Enclosure 2 provides the RHR Autoclosure Interlock RemovalReport, which includes a detailed background and basis for the proposedchange. Enclosure 3 provides the FNP TS and Bases markup pages showingthe proposed

changes, and Enclosure 4 provides the FNP TS clean typed pages.SNC requests Nuclear Regulatory Commission (NRC) approval of theseproposed changes by August 31, 2016. Following NRC approval, FNP willimplement the associated modifications on a staggered basis for each unit. TheUnit 1 modifications are currently scheduled to be implemented prior to the first U. S. Nuclear Regulatory Commission NL-1 5-1 055Page 2entry into Mode 4 following the end-of-cycle refuelin~g outage 27 (scheduled forFail 2016). The Unit 2 modifications are currently scheduled to be implemented prior to the first entry into Mode 4 following the end-of-cycle refueling outage 25(scheduled for Fall 2017).In accordance with 10 CFR 50.91 (b)(1), "State Consultation,"

a copy of thisapplication and its reasoned analysis about no significant hazards considerations is being provided to the designated Alabama officials.

If you have any questions, please contact Ken McElroy at (205) 992-7369.

Mr. Chuck R. Pierce states he is Regulatory Affairs Director of Southern NuclearOperating

Company, is authorized to execute this oath on behalf of SouthernNuclear Operating Company and, to the best of his knowledge and belief, thefacts set forth in this letter are true.Respectfully submitted, C. R. PierceRegulatory Affairs DirectorCRP/JMC/lac Sworn to and subscribe before me this 3_ _ day of 61 - L ,2015.Notary PublicMy commission expires:

/- & ),= 17

Enclosures:

1. FNP Basis for the Proposed Change2. FNP RHR Autoclosure Interlock Removal Report3. FNP Technical Specifications and Bases Markup Pages4. FNP Technical Specifications Clean Typed Pages U. S. Nuclear Regulatory Commission NL-1 5-1 055Page 3cc: Southern Nuclear Operatingq CompanyMr. S. E. Kuczynski,

Chairman, President

& CEOMr. D. G. Bost, Executive Vice President

& Chief Nuclear OfficerMs. C. A. Gayheart, Vice President

-FNPMr. M. D. Meier, Vice President

-Regulatory AffairsMr. D. R. Madison, Vice President

-Fleet Operations Mr. B. J. Adams, Vice President

-Engineering Ms. B. L. Taylor, Regulatory Affairs Manager -FNPRTYPE: CFA04.054 U. S. Nuclear Regqulatory Commission Mr. V. M. McCree, Regional Administrator Mr. L. D. Wert, Regional Administrator (Acting)Mr. S. A. Williams, NRR Project Manager -FNPMr. P. K. Niebaum, Senior Resident Inspector

-FNPAlabama Department of Public HealthDr. D. E. Williamson, State Health Officer Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 1FNP Basis for Proposed Change Enclosure i to NL-1 5-1 055FNP Basis for Proposed Change1.0 Summary Description This amendment request proposes to revise Joseph M. Farley Nuclear Plant, Units 1and 2 (FNP) Technical Specification (TS) 3.4.14, "RCS Pressure Isolation ValveLeakage" to eliminate the requirements for the Residual Heat Removal (RHR) Systemsuction valve autoclosure interlock (ACl) function.

Appropriate Bases changes would also be made consistent with the TS changesdiscussed above.Markups of the TS and Bases changes are provided in Enclosure 3 of this LicenseAmendment Request (LAR) and Enclosure 4 of this LAR provides the clean typed copyof the revised TS.2.0 Detailed Description Proposed ChangesDue to the staggered (by unit) implementation of this LAR, the proposed change is in theform of TS Notes that state when the current TS requirement is no longer applicable toeach FNP unit.The proposed change would insert a Note in current Surveillance Requirement (SR)3.4.14.2.

SR 3.4.14.2 requires the verification of RHR System ACl function.

The Notewould state:"Not applicable to Unit 1 after restart from 1 R27 and not applicable to Unit 2 afterrestart from 2R25."In addition, the proposed change would insert a Note in TS 3.4.14 Action Condition C toeliminate the reference to the RHR System ACl in that Condition.

The Note would state:"Not applicable to the autoclosure interlock for Unit 1 after restart from 1 R27 andfor Unit 2 after restart from 2R25."The Applicability of TS 3.4.14, "RCS Pressur'e Isolation Valve Leakage,"

states "Modes1, 2, and 3, and in Mode 4, except valves in the residual heat removal (RHR) flow pathwhen in or during the transition to or from, the RHR mode of operation."

Therequirements of TS 3.4.14 including the proposed Action Condition and SR Notes(described above) would not become applicable until the Mode of Applicability of TS3.4.14 is entered (i.e., in Mode 4 with the transition from RHR cooling complete).

Assuch, the proposed ACl elimination, alarm installation, and required procedure changeswill be completed prior to entering the Applicability of TS 3.4.14 after the applicable refueling outage for each unit.Enclosure 3 of this LAR provides the markup of TS 3.4.14, "RCS Pressure Isolation Valve Leakage" which shows the changes discussed above. Enclosure 3 also containsthe associated TS Bases changes which explain that the RHR ACl will be removed fromEl-i Enclosure i to NL-15-1055 FNP Basis for Proposed Changeeach unit during the applicable refueling outage (i.e., 1 R27 and 2R25) and will no longerbe required to be Operable.

Background

During normal and emergency conditions, the low pressure RHR System (designpressure is 600 psig) is isolated from the high pressure Reactor Coolant System (ROS)(normal operating pressure of 2235 psig). Isolation is necessary to: 1) avoid RHRSystem over pressurization, and 2) minimize the potential for loss of integrity of the lowpressure system and possible radioactive releases to the environment.

Two suction/isolation valves are provided on each inlet line from the RCS to the RHRSystem inside containment.

These motor-operated gate valves are normally-closed tokeep the low pressure RHR System isolated from the high pressure RCS, and areopened only when the RHR Syste~m is in operation.

The RHR suction isolation valvesare interlocked with RCS pressure signals to prevent opening when the RCS pressure isgreater than the current Open Permissive Interlock (OPI) setpoint of 402.5 psig andautomatically close when the RCS pressure increases above the ACI setpoint of 700psig. Thus, the OPI prevents inadvertent opening of the RHR System isolation valveswhen the RCS pressure is above the valve opening setpoint, and the ACI ensures thatthe RHR System isolation valves are closed when the RCS is pressurized above thevalve closing setpoint.

The OPI will not be affected by the removal of the RHR SystemACI.The RHR ACI interlock provides an automatic closure for the RHR System suctionisolation valves on high RCS pressure;

however, rapid overpressure protection of theRHR System is provided by the RHR relief valves, (located inside containment) and notby the slow acting suction isolation valves. RHR System overpressure protection is notimpacted by the removal of the ACI feature.

Thus, the RHR System integrity will not beaffected by the removal of the ACl feature.

The removal of the RHR System ACIminimizes the potential for spurious valve closure, which could result in a loss of thedecay heat removal function, RHR System .pump damage, and the inability of the RHRSystem to perform its function of RCS cold over pressurization protection.

Removal of the RHR System ACI addresses licensee and Nuclear Regulatory Commission (NRC) concerns regarding the potential for failure of the ACI circuitry tocause inadvertent isolation of the RHR System, and subsequent loss of RHR Systemcapability during cold shutdown and refueling operations.

Although the RHR System willstill be protected from overpressure by the RHR suction relief valves, once the RHRSystem ACI is removed, an alarm will be installed, which will identify to the operators that the valves are open and the RCS pressure exceeds the alarm setpoint.

Enclosure 2 of this LAR provides a more detailed discussion of the background associated with the deletion of the RHR System ACI.3.0 Technical Evaluation The evaluation for the deletion of the RHR System ACI is based on the NRC approvedWCAP-1 1736-A, "Residual Heat Removal System Autoclosure Interlock Removal Reportfor the Westinghouse Owner's Group," (Reference 1). The detailed evaluation of thisEl1-2 Enclosure i to NL-15-1 055FNP Basis for Proposed Changechange and the associated Probabilistic Analysis are provided in Enclosure 2 of thisLAR. Enclosure 2 provides the basis (NRC requirement or Probabilistic RiskAssessment (PRA) assumption.)

Upon implementation of this LAR, the plant design and procedures will ensure thefollowing conditions are met:1. An alarm will be added to each RHR suction isolation valve which will actuate ifthe valve is open and the reactor coolant system (RCS) pressure is greater thanthe open permissive setpoint and less than the RHR system design pressureminus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affectedby power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of thealarm for the RHR suction isolation valves and other procedures will be revisedas necessary to address the deletion of the ACI.4. Procedures will be revised to eliminate the current requirement to lockout powerto the open RHR suction isolation valves below 1800°F.5. Procedures will be implemented to require that power to all four closed RHRsuction isolation valves be locked out in Modes 1, 2, and 3.The approach followed in the Probabilistic Analysis (in Enclosure 2 of this LAR) forremoval of the RHR ACI is consistent with that provided in WCAP-1 1736. WCAP-1 1736was reviewed by the NRC and a Safety Evaluation was issued in August 1989. Themethod used in WCAP-1 1736 evaluated the impact of the proposed change on initiating event frequencies and system unavailabilities, and did not consider the risk metrics ofcore damage frequency or large early release frequency used in risk-informed evaluations.

The WCAP and NRC Safety Evaluation were completed and issued prior tothe availability of RG 1.174, "An Approach for Using Probabilistic Risk Assessment inRisk-Informed Decisions on Plant Specific Changes to the Licensing Basis," (Reference

2) which defined the risk-informed approach using core damage frequency and largeearly release frequency risk metrics.

The Probabilistic Analysis provided in this LAR,supports the removal of the RHR ACI, but does not provide the sole justification for thischange.Probabilistic Analyses assessed the impact of removing the RHR ACI on the following:

• Intersystem Loss-Of-Coolant Accidents (ISLOCA) initiating event frequency,

• RHR System unavailability, and* Low temperature overpressurization sequence frequencies.

As discussed previously, the detailed evaluation for the deletion of the RHR System ACIand associated Probabilistic Analysis are provided in Enclosure 2 of this LARrespectively, and are based on WCAP-1 1736-A. In the Safety Evaluation accompanying El1-3 Enclosure 1 to NL-1 5-1 055FNP Basis for Proposed Changethe NRC approval of WCAP-1 1736, the NRC staff noted five specific concerns.

TheseNRC concerns are addressed for FNP as follows:NRC Position

1. 1 : An alarm will be added to each RHR suction valve which will actuate ifthe valve is open and the pressure is greater than the open permissive setpoint and lessthan the RHR System design pressure minus the RHR System pump head pressure.

FNP Response

1. 1: A control room alarm will be added which will alert operators if an RHR System suction isolation valve is open and the RCS pressure exceedsthe alarm setpoint.

This setpoint will be greater than the open permissive setpoint and less than the RHR System design pressure minus the RHR Systempump head pressure at minimum flow.NRC Position

1. 2: Valve position Indication to the alarm must be provided from the stem-mounted limit switches (SMLSs) and power to the SMLSs must not be affected by powerlockout of the valve.FNP Position

1. 2: The four RHR System suction Isolation valves for each unit willutilize the existing limit switches located in the valve operator for valve positionindication to the new alarm. These limit switches are actuated by a geararrangement off the motor actuator rotor shaft. The contacts on the existing limitswitches utilized for position Indication to the new alarms are different from thelimit switch contacts which presently provide valve position to the main controlboard. As a result, diversity in valve position indication is achieved.

In addition, the alarm circuit is powered by a supply which Is separate from the supply thatpowers the valve control and position Indication circuits.

Thus, the alarm willremain functional during a power lockout of the, valve.NRC Position

1. 3: The procedural improvements described In WCAP-1 1736 should beimplemented.

Procedures themselves are plant specific.

FNP Position

1. 3: Plant procedures will be reviewed and revised as appropriate to reflect the deletion of the RHR System ACl. Procedures will also be revised toaddress appropriate operator response to the control room alarm which is beingadded as part of this modification.

NRC Position

1. 4: Where feasible, power should be removed from the RHR Systemsuction valves prior to their being leak checked.FNP Position

1. 4: Technical Specification 3.4.14, "ROS Pressure Isolation ValveLeakage,"

contains the requirements for leakage testing for the RHR Systemsuction Isolation valves. SR 3.4.14.1 specifies the leak testing requirements forthe pressure isolation valves. FNP will continue to verify the RHR suctionisolation valve leakage is within the required limits in accordance with SR3.4.14.1.

Ensuring proper valve position will continue to be accomplished by useof valve position indication and administrative controls.

NRC Position

1. 5: The RHR System suction valve operators should be sized so that thevalves cannot be opened against full system pressure.

El1-4 Enclosure i to NL-1 5-1 055FNP Basis for Proposed ChangeFNP Position

1. 5: The motors for the RHR suction valve operators are sized toopen against a differential pressure of 700 psid. However, the ability of the MOVto open is dependent on parameters such as supplied voltage and frictioncoefficients.

Based on the fact that the valves have a small motor sized for lessthan 1/3 full RCS system pressure, even with full voltage and a conservative stem coefficient of friction, there is reasonable assurance that the MOV will notopen at full RCS system pressure.

No credit was taken for the capability to openthe valve against full system pressure in either the generic analysis of WCAP-11736 or the FNP specific evaluations in Enclosure 2 of this LAR. Furthermore, power will be removed from all four of these valves In Modes 1, 2, and 3, and theOPI will continue to function to prevent opening of these valves when RCSpressure is greater than 402.5 psig.Conclusion:

Enclosure 2 of this LAR contains the assessments of the impact of ACl removal on RHRshutdown

cooling, low temperature overpressure protection, and interfacing systemLoss-Of-Coolant Accidents (LOCA) initiating event frequency.

For each area assessed, the removal of ACI and the adcompanying plant changes (including the recommended plant procedure changes) provide a benefit to plant safety. Therefore, the resultsdiscussed in Enclosure 2 of this LAR support the conclusions of generic WCAP-1 1736and that the deletion of the ACI is acceptable for FNP, Units 1 and 2 and will ensure thatthe FNP units continue to be operated in a safe manner.El-5 Enclosure i to NL-1 5-1 055FNP Basis for Proposed Change4.0 Regulatory Evaluation 4.1 Applicable Regulatory RequirementslCriteria 10 CFR 50.36(c),

"Technical specifications,"

requires Technical Specifications to be included for the following (1) Safety limits, limiting safety system settings, and limiting control settings.

(2) Limiting conditions for operation.

(3) Surveillance requirements.

(4) Design features.

(5) Administrative controls.

10 CFR 50.36(c)

(3) Surveillance requirements, states:"Surveillance requirements are requirements relating to test, calibration, orinspection to assure that the necessary quality of systems and components ismaintained, that facility operation will be within safety limits, and that the limitingconditions for operation will be met."The proposed change eliminates the requirement to perform theSurveillance Requirement (SR) for the Residual Heat Removal (RHR)System autoclosure interlock (ACl), since the ACl feature will beremoved.

The RHR ACl provides an automatic closure for the RHRSystem suction isolation valves on high ROS pressure;

however, rapidoverpressure protection of the RHR System is provided by the RHR reliefvalves and not by the slow acting suction isolation valves. The RHRSystem overpressure protection is not affected by the removal of the AClfeature.

Thus, the RHR System integrity will not be affected by theremoval of the ACl feature.

In addition a probabilistic risk assessment was performed to show that the interfacing system LOCA initiating eventfrequency would decrease after the elimination of the RHR ACl.As such, the performance the ACl function verification SR is not requiredto ensure that facility operation will be within the safety limits and that thelimiting condition for operation (LOCO) will be met. The LCO for Technical Specification (TS) 3.4.14, "ROS Pressure Isolation Valve Leakage,"

requires that "Leakage from each ROS PIV shall be within limits."

Theleakage from the residual heat removal (RHR) System suction valves willcontinue to be verified in the same manner as before the proposedchange. Thus, the proposed change will not affect the requirement of theTS 3.4.14 LCO. In addition, the removal of the RHR System AClminimizes the potential for spurious valve closure, which could result in aloss of the decay heat removal function, RHR System pump damage, andthe inability of the RHR System to perform its function of reactor coolantsystem (ROS) cold over pressurization protection.

As such, the proposedchange does not adversely affect the RHR System's capability tomaintain facility operation within the required safety limits.Therefore 10 CER 50.36(c) continues to be met.El1-6 Enclosure i to NL-1 5-1 055FNP Basis for Proposed ChangeGeneral Design Criterion (GDC) 14 -Reactor coolant pressure boundary.

Thereactor coolant pressure boundary shall be designed, fabricated,

erected, andtested so as to have an extremely low probability of abnormal

leakage, of rapidlypropagating

failure, and of gross rupture.30 -Quality of reactor coolant pressure boundary.

Components which arepart of the reactor coolant pressure boundary shall be designed, fabricated,

erected, and tested to the highest quality standards practical.

Means shall beprovided for detecting and, to the extent practical, identifying the location of thesource of reactor coolant leakage.The leakage from the RHR System suction isolation valves will continueto be tested and verified in the same manner as before the proposedchange. Thus, the proposed change will not affect the leakagerequirement of the TS 3.4.14 LCO.Therefore, GDC 14 and 30 will continue to be met.GDC 20 -Protection system functions.

The protection system shall be designed(1) to initiate automatically the operation of appropriate systems including thereactivity control systems, to assure that specified acceptable fuel design limitsare not exceeded as a result of anticipated operational occurrences and (2) tosense accident conditions and to initiate the operation of systems andcomponents important to safety.The RHR ACI is not a protection system that is required to ensure that thespecified acceptable fuel design limits are not exceeded as a result ofanticipated operational occurrences, nor is it required to respond toaccident conditions and initiate the operation of systems and components important to safety. The removal of the ACI will not adversely affect theability of the plant instrumentation and systems to assure that thespecified acceptable fuel design limits are not exceeded and to respondaccident conditions and initiate the operation of systems and components important to safety.Therefore, GDC 20 will continue to be met.GDC 34 -Residual heat removal.

A system to remove residual heat shall beprovided.

The system safety function shall be to transfer fission product decayheat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolantpressure boundary are not exceeded.

The removal of the RHR System ACI does not adversely affect thecapability of the RHR System to perform its intended safety function.

Theremoval of the ACI minimizes the potential for spurious valve closure,which may result in a loss of the decay heat removal function, RHRSystem pump damage, and the inability of the RHR System to perform itsfunction of RCS cold over pressurization protection.

The RHR ACIinterlock provides an automatic closure for the RHR System suctionisolation valves on high RCS pressure;

however, rapid overpressure El1-7 Enclosure i to NL-l15-1 055FNP Basis for Proposed Changeprotection of the RHR System is provided by the RHR relief valves andnot by the slow acting suction isolation valves. This RHR Systemoverpressure protection is not affected by the removal of the ACI feature.Thus, the RHR System integrity will not be affected by the removal of theACI feature.Therefore, GDC 34 continues to be met.4.2 Significant Hazards Consideration The proposed change would revise Joseph M. Farley Nuclear Plant, Units 1 and2 (FNP) Technical Specification (TS) 3.4.14, "RCS Pressure Isolation ValveLeakage" to eliminate the requirements for the Residual Heat Removal (RHR)System suction valve autoclosure interlock (ACI) function.

In addition, theproposed change would add a control room alarm to alert the operator when anRHR suction/isolation valve is not fully closed and the Reactor Coolant System(RCS) pressure is above the alarm setpoint.

The RHR ACI provides automatic closure to the RHR System suction isolation valves on high RCS pressure;

however, rapid overpressure protection of theRHR System is provided by the RHR relief valves and not by the slow actingsuction.

isolation valves. This RHR System overpressure protection is notaffected by the removal of the ACI feature.

Thus, the RHR System integrity willnot be affected by the removal of the ACI feature.

In addition, the removal of theRHR System ACI would minimize the potential for spurious valve closure, whichcould result in a loss of the decay heat removal function, RHR System pumpdamage, and the inability of the RHR System to perform its function of ROS coldover pressurization protection.

As required by 10 CFR 50.91 (a), Southern Nuclear Operating Company (SNC)has evaluated the proposed changes to the FNP TS using the criteria in 10 CER50.92 and has determined that the proposed changes do not involve a significant hazards consideration.

An analysis of the issue of no significant hazardsconsideration is presented below:1 : Does the proposed amendment involve a significant increase in theprobability or consequences of an accident previously evaluated?

Response:

NoThe two motor-operated gate valves located in each RHR System suctionline are normally-closed to maintain the low pressure RHR System(design pressure of 600 psig) isolated from the high pressure RCS(normal operating pressure of 2235 psig). An ACI was provided to isolatethe low pressure RHR System from the RCS when the pressureincreases above the ACI setpoint.

However, spurious ACI actuation hasresulted in RHR System isolation and subsequent loss of decay heatremoval capability.

The removal of the ACl feature will preclude thisinadvertent isolation, thus increasing the likelihood that RHR will beavailable to remove decay heat. The addition of a control room alarm toalert the operator that a suction/isolation valve(s) is not fully closed whenEl1-8 Enclosure 1ito NL-15-1 055FNP Basis for Proposed Changethe RCS pressure is above the alarm setpoint and administrative procedures will ensure that the RHR System will be isolated from theRCS, if the RCS pressure increases above the alarm setpoint, which willdecrease the likelihood of an interfacing system LOCA. Therefore, theperformance of the RHR System would not be adversely affected by theACl deletion and the RHR suction isolation valve alarm installation.

The RHR ACl provides automatic closure to the RHR System suctionisolation valves on high RCS pressure;

however, rapid overpressure protection of the RHR System is provided by the RHR relief valves andnot by the slow acting suction isolation valves. This RHR Systemoverpressure protection is not affected by the removal of the ACl, thisfeature also serves to decrease the likelihood of an interfacing systemLOCA. Thus, the RHR System integrity will not be affected by theremoval of the ACl feature.

In addition, the removal of the ACl featuredoes not adversely affect any fission barrier, alter any assumptions madein the radiological consequences evaluations, or affect the mitigation ofradiological consequences.

The impact of ACl removal on RHR shutdown

cooling, low temperature overpressure protection, and interfacing system LOCA initiating eventfrequency was assessed.

For each of these areas that were assessed, itwas concluded that the removal of ACl and the accompanying plantchanges provides a benefit to plant safety.With the deletion of the ACd, there is no longer any potential for spuriousautomatic closure of a RHR System suction isolation valve resulting ininadvertent RHR System isolation and loss of shutdown cooling.Therefore, it is concluded that the proposed changes do not involve asignificant increase in the probability or consequences of an accidentpreviously evaluated.

2: Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response:

NoThe removal of the RHR System ACl, and corresponding TSrequirements, does not result in the initiation of any accident nor createany new credible limiting single failures.

The removal of the ACl eliminates the potential for spurious circuitry actuation causing isolation of the RHR system. Furthermore, the additionof an alarm to alert the operator that a suction valve is not fully closedwhen RCS pressure is above the alarm setpoint reduces the likelihood that the RHR system will be exposed to high pressure conditions.

Thesemodifications and the resulting elimination of the ACl TS Surveillance Requirement will not result in the RHR system being operated in anyunanalyzed modes, either during normal or accident conditions.

Also,El1-9 Enclosure 1 to NL-15-1 055FNP Basis for Proposed Changethe RHR system will continue to be maintained and surveilled as it iscurrently.

No new accident scenarios, failure mechanisms, or limiting single failuresare introduced as a result of the proposed changes.

The proposedchange does not challenge the performance or integrity of any safety-related system.Therefore, it is concluded that the proposed changes do not create thepossibility of a new or different kind of accident from any previously evaluated.

3: Does the proposed amendment involve a significant reduction in a marginof safety?Response:

NoRemoval of the ACl interlock, and its corresponding TS Surveillance Requirement, does not alter or prevent any plant response such that themargin of safety to any applicable accePtance criteria is significantly decreased.

In fact, the addition of a control room alarm that identifies thatthe suction valve is not fully open, together with the existing overpressure alarm, ensures that the margin of safety to an RHR overpressure condition is not significantly reduced.Furthermore, the actuation of safety-related components and theresponse of plant systems to accident scenarios are not affected, andthus will remain as assumed in the safety analysis.

Therefore, the proposed change will not adversely affect the operation orsafety function of equipment assumed in the safety analysis.

For the reasons noted above, it is concluded that the proposed changedoes not involves a significant reduction in a margin of safety.Based upon the above analysis, SNC concludes that the proposed amendment does not involve a significant hazards consideration, under the standards setforth in 10 CFR 50.92(c),

"Issuance of Amendment,"

and accordingly, a finding of"no significant hazards consideration" is justified.

4.3 Conclusions

In conclusion, based on the considerations discussed above, (1) there isreasonable assurance that the health and safety of the public will not beendangered by operation in the proposed manner, (2) such activities will beconducted in compliance with the Commission's regulations, and (3) theissuance of the amendment will not be inimical to the common defense andsecurity or to the health and safety of the public.El1-10 Enclosure i to NL-15-1 055FNP Basis for Proposed Change5.0 Environmental Considerations A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within 'the restricted area, as defined in 10 CFR Part 20, or would change an inspection or surveillance requirement.

However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in theamounts of any effluents that may be released

offsite, or (iii) a significant increase inindividual or cumulative occupational radiation exposure.

Accordingly, the proposedamendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR51.22(c)(9).

Therefore, pursuant to 10 CFR 51 .22(b), no environmental impactstatement or environmental assessment need be prepared in connection with theproposed amendment.

6.0 References

1. WCAP-1 1736-A, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owner's Group," October 1989.2. Regulatory Guide 1.174, "An Approach For Using Probabilistic RiskAssessment In Risk-Informed Decisions On Plant specific Changes ToThe Licensing Basis," Revision 2, May 2011.7.0 Regulatory Commitments This letter contains no NRC commitments.

E1-11 Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 2RHR Autoclosure Interlock Removal Report Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportRESIDUAL HEAT REMOVAL SYSTEMAUTOCLOSURE INTERLOCK REMOVAL REPORTFOR THE JOSEPH M. FARLEY NUCLEAR PLANTUNITS 1 AND 2 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportABSTRACTA review of the original probabilistic

analysis, and a subsequent probabilistic analysishas been performed for the Joseph M. Farley Nuclear Plant, Units 1 and 2, whichjustifies the deletion of the autoclosure interlock associated with the Residual HeatRemoval System suction/isolation valves. The methodology utilized is based on theWestinghouse Owners Group generic WCAP-1 1736, "Residual Heat Removal SystemAutoclosure Interlock Removal Report for the Westinghouse Owners Group." The openpermissive circuitry is unaffected by the deletion of the ACI. An alarm will be added tonotify the operator of an incorrectly positioned Residual Heat Removal Systemsuction/isolation valve.A probabilistic analysis was used to demonstrate that the deletion of the autoclosure interlock is acceptable from both a core safety and Residual Heat Removal Systemoverpressurization standpoint.

E2-1 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportEXECUTIVE SUMMARYThis report provides a justification for the removal of the-Auto Closure Interlock (ACl)from the Residual Heat Removal System (RHR) suction/isolation valves for Joseph M.Farley Nuclear Plant (FNP), Units 1 and 2.BACKGROUND In support of WCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group," a literature review of decay heatremoval issues, associated with the loss of RHR was performed.

The literature reviewindicated that a significant number of the loss of RHR System events were caused byinadvertent automatic closure of the RHR System suction/isolation valves. In an effort toreduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of thesevalves during plant shutdown,

2) maintenance procedures that require de-energizing these valves in the open position before conducting setpoint calibration or work on theinverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHRSystem relief valves for cold overpressure protection mitigation.

The literature recognized that corrective actions are necessary to minimize the risk associated withloss of decay heat removal capability caused by actuation of the ACl, but alsohighlighted concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA),referred to as an Event V, and RHR System pressure relief capacity.

During the 1960s and 1970s, two closed valves in series isolated the RHR System fromthe Reactor Coolant System (RCS) while the RCS was at normal operating temperature and pressure.

Both Valves were to have power disconnected via administrative procedures except when the valves were to be stroked.

An Open Permissive Interlock (OPI) was provided to one of the valves to prevent opening until the RCS pressure wasbelow RHR System design pressure.

In 1971, the Atomic Energy Commission requirements had evolved to require an ACI on increasing pressure.

A meeting betweenthe industry and the Nuclear Regulatory Commission (NRC) in 1974 brought about threeacceptable methods of preventing RHR System overpressurization while the RHRSystem is in operation or when returning the RCS to operation:

1) automatic closureinterlocks on the RHR System suction/isolation valves, 2) sufficient capacity of the RHRSystem suction line relief valves to mitigate a pressure transient, or 3) a combination ofthe two.This agreement was superceded in 1975 when the NRC required, in its SafetyEvaluation Report for RESAR-41, that RHR System suction isolation valves be equippedwith the ACl feature.

The current NRC position is stated in Branch Technical PositionRSB 5-1, dated July 1981, which requires that the RHR System suction/isolation valvesE2-2 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportshall be interlocked to protect against one or both valves being ,open during an increasein RCS pressure above the RHR System design pressure and that adequate reliefcapacity shall be provided during the time period while the valves are closing.

In 1984,an internal NRC Instrumentation and Control Systems Branch memo recommended thataction be taken to modify the design of the RHR System interlocks.

An NRC internalmemo in 1985 stated that a request by a plant to remove the ACI feature should besubstantiated by proof that the change is a net improvement to safety and should, as aminimum, address the following:

1. The means available to minimize Event V concerns.

2. The alarms available to alert the operator of an improperly positioned valve.3. Adequacy of the RHR System relief capacity.

4. Means other than the ACI to ensure both Motor-Operated Valves (MOVs) areclosed (e.g., single switch actuating both valves).5. Assurance that the function of the open permissive circuitry is not affected by theproposed change.6. Assurance that MOV position indication will remain available in the control room.7. Assessment of the proposed changes effect on RHR System reliability, as wellas on Low Temperature Overpressure (LTOP) concerns.

SUMMARY DESCRIPTION This report including the Probabilistic Analyses provides the following to support theFNP, Units 1 and 2 RHR System ACI deletion:

1) The RHR System description,

2) Thecurrent RHR System suction/isolation valve control circuitry description,

3) A description of the proposed ACI deletion hardware change, 4) A description of the proposedsuction/isolation valve alarm circuitry

addition,

5) The results of the PRA analysisperformed for the RHR System unavailability including an evaluation of the gap analysisperformed for that PRA, 6) The results of the interfacing systems LOCA PRA analysis, agap analysis for that PRA, and an updated interfacing systems LOCA PRA analysis, 7)The results of the overpressurization PRA analysis and the gap analysis for that PRA,8) The RHR System relief valve adequacy, and 9) The recommended documentchanges.The approach taken for this report was to reference the study performed by theWestinghouse Owners Group (WOG), which justified the deletion of the RHR SystemACI for four reference (or lead) plants. This study is documented in WCAP-1 1736,"Residual Heat Removal System Autoclosure Interlock Removal Report for theWestinghouse Owners Group." In order to perform the plant-specific analyses for theE2-3 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportFNP units, a difference analyses was performed that compared FNP to its reference plant identified in the WOG report. Once the differences were identified, the reference probabilistic analyses were modified to model FNP, Units 1 and 2, specifically.

CONCLUSIONS This report recommends the following:

1. An alarm will be added to each RHR suction isolation valve which will actuate ifthe valve is open and the reactor coolant system (RCS) pressure is greater thanthe open permissive setpoint and less than the RHR system design pressureminus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affectedby power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of thealarm for the RHR suction isolation valves and other procedures will be revisedas necessary to address the deletion of the ACl.4. Procedures will be revised to eliminate the current requirement to lockout powerto the open RHR suction isolation valves below 1800°F.5. Procedures will be implemented to require that power to all four closed RHRsuction isolation valves be locked out in Modes 1, 2, and 3.The results of the intersystem LOCA analysis show that the frequencies of the Event Vdecreases with the removal of the ACl feature.

The results of the RHR Systemunavailability analysis show that the removal of the ACl feature increases the RHRSystem availability.

The results of the overpressurization analysis show that removal ofthe ACl feature has little impact on the consequences of LTOP events at FNP.Consistent with WCAP-1 1736 the net effect of the ACI feature removal is considered tobe a net improvement in plant safety for FNP, Units 1 and 2.E2-4 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report

1.0 INTRODUCTION

The intent of this section is to state the purpose of this report and provide the necessary information to put the analysis supporting the deletion of the FNP, Units 1 and 2,Residual Heat Removal (RHR) System suction/isolation valve Autoclosure Interlock (ACI) feature in the proper context.

It also presents, as background, a description of theWestinghouse Owners Group (WOG) generic topical report upon which this report andthe methodology used is based.1.1 PURPOSEThe Nuclear Regulatory Commission (NRC) and the nuclear industry has expressed interest in the acceptability of removing the ACl on the RHR System suction/isolation valves. This interest is in response to growing concerns about the loss of RHRcapability during cold shutdown and refueling operations due to inadvertent isolation ofthe RHR System caused by failure of the ACI circuitry.

Isolation of the RHR Systemwhile operating has resulted in a loss of decay heat removal capability at severaloperating plants. It is also a potential contributor to overpressurization of the ReactorCoolant System (RCS) with possible Power-Operated Relief Valve (PORV) challenge and RHR System pump damage.For the WOG generic topical report, upon which this report is based, a literature reviewof decay heat removal problems was performed.

The literature review indicated that asignificant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce thefrequency of these inadvertent automatic suction/isolation valve closures, several plantshave taken one or more of the following steps: 1) power lockout of these valves duringplant shutdown,

2) maintenance procedures which require de-energizing these valves inthe open position before conducting setpoint calibration or work on the inverters, and3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves forcold overpressure protection mitigation.

The literature recognized that corrective actionsare necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACl, as well as highlights concerns associated withintersystem Loss-Of-Coolant Accidents (LOCA), referred to as an Event V inWASH-1400 (Reference 1), and RHR System relief valve capacity.

Based on the history of the RHR ACI, the WOG approved a program for the evaluation of the removal of the ACI on the RHR System suction/isolation valves at the following four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris.Other WOG plants participating in the program were categorized into one of four groupsled by one of the reference plants based on similar RHR System configuration anddesign characteristics.

It was intended that other members of the WOG could reference E2-5 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportthe applicable lead plant in the study and provide a difference analysis should theydesire to delete the RHR System ACl.This report is written in support of deleting the FNP, Units 1 and 2, ACI feature on theRHR System suction/isolation valves based on the methodology contained inWCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal ReportFor The Westinghouse Owners Group" (Reference 4). A summary description ofWCAP-1 1736 is presented below.1.2 WOG PROGRAM:

WCAP-11736 WCAP-] 1736 was prepared for the WOG. It provides an evaluation of the removal ofthe ACl on the RHR System suction/isolation valves at four reference plants: Salem Unit1, Callaway, North Anna Unit 1, and Shearon Harris. The WOG plants participating inthe program were categorized into one of four groups based on similar RHR Systemconfigurations and design characteristics.

The plants listed by group are:Group 1 -Salem Unit 1Salem Unit 2D.C. Cook Units 1 & 2Indian Point Unit 3McGuire Units 1 & 2Sequoyah Units]1 & 2Watts Bar Units 1 & 2Zion Units 1 & 2Group 2 -Callaway Unit 1Braidwood Units 1 & 2Byron Units 1 & 2Catawba Units 1 & 2Comanche Peak Units 1 & 2Trojan Unit 1Seabrook Unit 1Vogtle Units 1 & 2Wolf Creek Unit 1Millstone Unit 3South Texas Units 1 & 2Group 3 -North Anna Unit 1 Group 4 -Shearon Harris Unit 1H.B. Robinson Unit 2 Farley Units 1 & 2Turkey Point Units 3 & 4 Beaver Valley Unit 2Beaver Valley Unit 1 V.C. Summer Unit 1Prairie Island Units 1 & 2North Anna Unit 2The choice of the four particular reference plants was made based on providing themaximum number of the other WOG members with the best possible fit should theychoose to delete the ACI in the future and reference this document.

It is expected that,should a plant desire to delete the ACI, a plant specific difference analysis would still berequired, but the resources expended to produce and review it should be substantially less with reference to the WOG WCAP-1 1736.WCAP-1 1736 provides, for each of the four reference plants, the supporting:

1) RHRSystem description,

2) current RHR System suction/isolation valve control circuityE2-6 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportdescription,

3) proposed ACl deletion hardware

changes,

4) proposed suction/isolation valve alarm circuitry

addition,

5) RHR System unavailability probabilistic

analysis, 6)interfacing systems LOCA probabilistic

analysis, and 7) probabilistic overpressurization analysis.

WCAP-1 1736 addresses each of the seven NRC concerns expressed in the 1985 NRCinternal memo for each of the four reference plants, and recommends the deletion of theACl feature for all WOG plants. For plants with an RHR System located outside ofcontainment, the installation of a safety grade alarm is recommended to warn theControl Room Operator that a series suction/isolation valve(s) is not fully closed whenRCS pressure is above the alarm setpoint.

For plants with an RHR System locatedentirely inside containment, an alarm is not recommended since these plants are notsusceptible to the Event V (LOCA outside containment).

The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal ofthe ACl feature.

The results of the RHR System unavailability analysis show that theremoval of the ACI feature increases the RHR System availability.

The results of theoverpressurization analysis show that removal of the ACI feature will have no effect onthe heat input transients and will result in a slight increase in frequency of occurrence forsome categories of the mass input transients with a decrease in others. The net effectof the ACl feature removal is considered to be a net improvement in plant safety.The basic information presented in WCAP-1 1736 is applicable for use in theplant-specific effort for FNP, Units 1 and 2. The literature review and licensing basisremain the same for all Westinghouse plants. The probabilistic models and databasecan be utilized as a basis for the plant-specific effort. The recommended changes to thetechnical specifications are also applicable.

This FNP plant specific report builds on the generic work of WCAP-1 1736. It justifies removal of the ACI based on a safety evaluation of the effect of ACI removal on lowtemperature overpressure protection, RHR System availability, and interfacing systemLOCA potential.

1.3 BACKGROUND

During normal and accident conditions, it is necessary to keep low pressure systemsthat are connected to the high pressure RCS properly isolated from each other in orderto avoid damage by overpressurization or potential for loss of integrity of the lowpressure system and possible radioactive releases.

The FNP RHR System is a lowpressure system, with a design pressure of 600 psig, with an interface to the highpressure RCS, with a normal operating pressure of 2235 psig.The primary function of the RHR System is to remove residual heat from the core andreduce the temperature of the RCS during the second phase of plant cooldown andduring refueling operations.

As a secondary

function, the RHR System is used toE2-7 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reporttransfer refueling water between the Refueling Water Storage Tank (RWST) and therefueling cavity before and after the refueling operations.

The RHR System also servesas part of the Emergency Core Cooling System (ECCS) during the injection phase of aLOCA. In addition to the above functions, the RHR System suction line relief valves areused to provide cold overpressure mitigation of RCS overpressure transients.

Figure 1-1 is a simplified flow diagram showing the FNP RHR System design. Thesystem consists of two parallel flow paths. Each path takes a suction from a separateRCS hot leg. Each flow path contains an RHR pump, an RHR heat exchanger, piping,valves, and instrumentation required for operational control.During system operation, reactor coolant flows from the RCS to the RHR Systempumps, through the tube side of the residual heat exchangers, and back to the RCS.Heat is transferred from the reactor coolant to the Component Cooling Water (CCW)circulating through the shell side of the RHR heat exchangers.

Two inlet suction/isolation valves are provided in each inlet line from the RCS. Thesemotor-operated, gate valves are normally-closed, except when the RHR System is inoperation, and function to keep the low pressure RHR System isolated from the highpressure RCS. Each of these valves is provided with a manual control (OPEN/CLOSE) on the main control board and has two automatic interlocks associated with its controlcircuitry:

the ACI and the OPI.The OPI prevents inadvertent opening of the suction/isolation valves when the RCSpressure is above the design pressure of the RHR System considering RHR Systempump discharge pressure.

Each suction/isolation valve on each inlet line is interlocked with one of the two independent RCS wide range pressure signals to provide an OPIfeature to these valves. One set of suction/isolation valves, those adjoining the RCS,are interlocked with a pressure signal to prevent their being opened whenever the RCSpressure is greater than approximately 402.5 psig. The other set of valves, thoseadjoining the RHR System, are similarly interlocked to prevent their being openedwhenever the RCS pressure is greater than approximately 402.5 psig. These valves arealso interlocked with the pressurizer vapor space temperature sensor to provide anadditional interlock feature.The ACI ensures that both suction/isolation valves, in each RHR System train, are fullyclosed when the RCS is pressurized above the RHR System design pressure.

Each setof valves in series is interlocked with one of two independent RCS wide range pressuresignals to close automatically when the RCS pressure increases to approximately 700psig.A more detailed description of the FNP RHR System is provided in Section 2.0 of thisreport.E2-8 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportFIGURE 1-1SIMPLIFIED RESIDUAL HEAT REMOVAL FLOW DIAGRAME2-9 Enclosure 2 to NL-1 5-1 055FNP RHR Autociosure Interlock Removal Report2.0 FARLEY RHR SYSTEM DESCRIPTION 2.1 GENERAL DESCRIPTION The RHR System transfers heat from the RCS to the component cooling system toreduce the temperature of the reactor coolant to the cold shutdown temperature at acontrolled rate during the second part of normal plant cooldown, and maintains thistemperature until the plant is started up again.As a secondary

function, the RHR System also serves as part of the ECCS during theinjection and recirculation phases of a LOCA.The RHR System also is used to transfer refueling water between the refueling waterstorage tank (RWST) and the refueling cavity before and after the refueling operations.

2.2 RESIDUAL HEAT REMOVAL SYSTEMA flow diagram of the RHR System is shown in Figure 2-1 (Unit 1 shown for theexample).

The RHR System consists of two separate trains of equal capacity, eachindependently capable of meeting the safety analysis design bases. Each train consistsof one heat exchanger, one motor-driven pump, piping, valves, and instrumentation necessary for operational control.

The inlet line to each train of the RHR System isconnected to a reactor coolant loop hot leg, while the lines exiting the RHR heatexchangers are connected to the cold legs of each of the reactor Coolant loops.Each RHR System suction line is normally isolated from the RCS by two motor-operated valves in series, while the discharge lines are isolated by check valves in each line. TheRHR System suction/isolation valves, the inlet line pressure relief valve, and thedischarge lines downstream of valves 8888A1B and 8889 are located insidecontainment, while the remainder of the system is located outside containment.

During normal RHR System operations, reactor coolant flows from the RCS hot legs 1and 3 to the RHR pumps, through the tube side of the RHR heat exchangers and backto the RCS through the Safety Injection System (SIS) cold leg injection lines. Thereactor coolant heat is transferred by the RHR heat exchangers to the COW that iscirculated through the shell side of the RHR heat exchangers.

2Coincident with RHR System normal operations, a portion of the reactor coolant flowmay be diverted from downstream of the RHR heat exchangers to the Chemical andVolume Control System (CVCS) low-pressure letdown line for cleanup and/or pressurecontrol.

By regulating the diverted flowrate and the charging flow, the RCS pressure canbe controlled during water solid-plant operations.

Pressure regulation is necessary tomaintain the pressure range dictated by the reactor vessel fracture prevention criteriaE2-10 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportrequirements and by the Reactor Coolant Pump (RCP) No. 1 seal differential pressureand Net Pump Suction Head (NPSH) requirements of the RCPs.The RCS cooldown rate is manually controlled by regulating the reactor coolant flowthrough the tube side, of the RHR heat exchangers.

Instrumentation is provided tomonitor system pressure, temperature, and total flow.System Operation A discussion of RHR System operation during various reactor operating modes follows:Reactor StartupGenerally, during cold shutdown, the RHR System operates to remove residual heatfrom the reactor core. The number of pumps and heat exchangers in service dependson the RHR System heat load at the time.At initiation of plant startup, the RCS is completely filled, and the pressurizer heaters areenergized.

The RHRS is connected to the CVCS via the low pressure letdown line tocontrol reactor coolant pressure.

Once a steam bubble is formed in the pressurizer, theRHR System is isolated, and RCS pressure/inventory control are provided by thepressurizer spray, pressurizer

heaters, and the normal letdown and charging systems.Power Generation and Hot Standby Operation The RHR System is not used during hot standby or power operations when the RCS isat normal pressure and temperature.

Under these conditions, the RHR System isaligned for operation as part of the Eccs. Upon initiation of a safety injection signal theRHR System pumps take suction from the RWST and inject borated water into the RCSvia the SIS accumulator cold leg injection headers.

When the water in the RWST isdepleted, the RHR System pumps are manually aligned to take suction from thecontainment recirculation sump. The RHR heat exchangers then cool the sump fluidbeing recirculated by the RHR System pumps and deliver the cooled water to the RCS.Since the charging pumps (high head safety injection) do not take suction from thecontainment sump, the RHR System pumps (low head safety injection) also supply thesuctions of these pumps during recirculation.

Reactor ShutdownThe initial phase of reactor cooldown is accomplished by transferring heat from the RCSto the Steam and Power Conversion System (SPCS) through the use of the steamgenerators.

When the reactor coolant temperature and p'ressure are reduced toE2-11 Enciosure 2 to NL-1 5-1055FNP RHR Autoclosure Interlock Removal Reportapproximately 350°F and less than 425 psig the second phase of cooldown starts withthe RHR System being placed in operation.

The reactor cooldown rate is limited by RCS equipment cooling rates based on allowable stress limits, as well as the operating temperature limits of the CCW System. As thereactor coolant temperature decreases, the reactor coolant flow through the RHR heatexchangers is increased to maintain a constant cooldown rate.As cooldown continues, the pressurizer is filled with water, and the ROS is operated inthe water-solid condition.

At this stage, pressure is controlled by regulating the chargingflow rate and the letdown rate to the CVCS from the RHR System. After the RCS isdepressurized, cooled to 1 40°F, the reactor vessel head may be removed for refueling or maintenance.

Refueling One RHR pump is utilized during refueling to pump borated water from the RWST to therefueling cavity. The other is used in cooldown alignment for decay heat removal.

Duringthis operation, the isolation valves in the inlet lines of the RHR System are closed, andthe isolation valves to the RWST are opened.The reactor vessel head (RVH) is lifted and placed on the storage stand. The refueling water is then pumped into the reactor vessel through the normal RHR System returnlines and into the refueling cavity through the open reactor vessel. After the water levelreaches normal refueling level, the inlet isolation valves are opened, the RWST supplyvalves are closed, and RHR is resumed.During refueling, the RHR System is maintained in service with the number of pumpsand heat exchangers in operation as required by the Technical Specifications.

Following refueling, the RHR pumps are used to drain the refueling cavity to the top of the reactorvessel flange by pumping water from the RCS to the RWST.Component Description This section describes the major components of the RHR System.RHR System PumpsTwo pumps are installed in the RHR System. The pumps are sized to deliver reactorcoolant flow through the residual heat exchangers to meet the plant cooldownrequirements.

The use of two pumps ensures that cooling capacity is only partially lostshould one pump become inoperable.

E2-12 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportThe RHR System pumps are protected from overheating and loss of suction flow byminif low bypass lines, located downstream of the heat exchanger outlet, which divertspart of the flow back to the pump suction.

A control valve located in each minif low line isregulated by a signal from the flow transmitters located in each pump discharge header.A control valve located in each minif low line is actuated by a flow switch. The minif lowvalves open when RHR pump flow decreases below the flow setpoint, and close whenthe flow increases above the designated setpointA pressure sensor in each pump discharge header provides a signal for an indicator inthe control room. A high pressure alarm is also actuated by the pressure sensor.The RHR System pumps are vertical, centrifugal units with mechanical shaft seals. Allpump surfaces in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.

RHR System Heat Exchangers Two residual heat exchangers are installed in the RHR System. The RHR System heatexchanger design is based on heat load and temperature differences between thereactor coolant and the CCW existing 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after reactor shutdown when thetemperature difference between the two systems is small. The installation of two heatexchangers ensures that the heat removal capacity of the system is only partially lost ifone heat exchanger becomes inoperative.

The heat exchangers are of the shell andU-tube type. Reactor coolant circulates through the tubes, while COW circulates throughthe shell. The tubes are welded to the tubesheet to prevent leakage of reactor coolant.Inlet Isolation Valves 87Q1 A/B and 8702A/BThe RHR System inlet isolation valves are motor-operated gate valves that arenormally-closed except when the RHR System is in operation.

These valves areprovided with a manual control (open/closed) on the main control board and will fail inthe "as-is" position.

Valves 8701 B and 8702B are interlocked with an ROS pressure transmitter and valves8701A and 8702A are interlocked with an ROS pressure transmitter and a temperature transmitter that measures pressurizer vapor space. These interlocks prevent theinadvertent opening of the valves when RCS pressure is greater than approximately 402.5 psig. In addition valves 8701A and 8702A cannot be opened when thepressurizer vapor space temperature exceeds 475°F. The valves also closeautomatically when the ROS pressure is higher than 700 psig.Because the RHR System relief valves provide cold overpressurization protection for theROS, power is removed from the RHR System isolation valves when the ROSE2-13 Enclosure 2 to NL-15-1 055FNP. RHR Autoclosure Interlock Removal Reporttemperature is below 1 80°F. By removing power from the isolation valves, aninadvertent or undesirable isolation of the RHR System relief valves is prevented.

Relief Valves 8708A and 8708BThere is one, 3-inch relief valve (inside containment) in each RHR System suction linefrom the RCS hot leg. These relief valves are located immediately downstream of theRHR System suction/isolation valves 8701A and 8702A. These relief valves preventRHR System overpressurization by discharging to the Pressurizer Relief Tank (PRT)when pressures within the RHR System suction line exceed 450 psig. These valveshave a design capacity of 900 gpm at the 450 psig setpressure.

The RHR Systemsuction relief valves provide overpressure protection for the RHR System.2.3 CURRENT RHR System SUCTION ISOLATION VALVES INTERLOCKS ANDFUNCTIONAL REQUIREMENTS The following sections provide a description of the FNP, Units 1 and 2, suction/isolation valve interlocks and valve control circuits.

Current Interlocks

(.There are two, normally-closed, motor-operated isolation valves in series in each of thetwo RHR System pump suction lines from the RCS hot legs. The two valves 8702B and8701 B, inside the missile barrier, are designated as the inner isolation valves, while thetwo valves 8701A and 8702A, outside the missile barrier, are designated as the outerisolation valves. The interlock features provided for the inner isolation valves areidentical to those provided for the outer isolation valves, except the fact that the outerisolation valves have a pressurizer vapor space temperature interlock.

Each valve is interlocked against opening unless the following conditions are met:1. The RCS pressure, as measured by the appropriate wide range pressurechannel, is less than approximately 402.5 psig. This assures the RHR Systemcannot be overpressurized by aligning it to the RCS when the RCS pressure plusthe RHR System pump head would exceed the RHR System design pressure.'

2. The corresponding RHR System pump/RWST suction isolation valve is closed.This assures positive isolation of the RWST and RHR System/RWST suctionpiping before initiating a normal cooldown.

In addition to the above interlocks, valves 8701A and 8702A are interlocked to preventagainst opening unless the pressurizer vapor space temperature is less than 475°F.E2-14 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportThis is incorporated to provide diverse means of defeating the open signal for the RHRSystem outer isolation valves.Once opened, each valve is also interlocked to automatically close on increasing RCSpressure greater than 700 psig (i.e., the ACl). This backup feature assures that bothisolation valves will be closed during a plant startup prior to reaching operating conditions, if one valve had been inadvertently left open by the operator.

The operatormay close the suction/isolation valves at any time.RHR System Common Suction Isolation Valve Description The RHR System Inlet Isolation Valves are motor-operated valves that can be opened orclosed from the main control board. The valve will automatically close on increasing RCS pressure.

On decreasing RCS pressure and pressurizer vapor temperature, thevalve control circuit receives an interlock signal that allows the valve to be opened usingthe main control board hand switch. On RCS pressure or pressurizer vapor temperature above the setpoint, the valve control circuit is disabled and the valve cannot be opened.The valve control circuit consists of control switches, limit switches, torque switches, contactors, relays, indicating lights, a 3 phase, 600 VAC motor, and pressure andtemperature control loops. The control switches are located in the main control room.The limit switches are located in the valve motor operator and provide indication of theposition of the valve. Relays are used for providing control signals.

The contactor, located in the motor control center, is switched on and off to provide the power to thevalve. The contactor also provides contacts that are used in the valve control circuit.There are red and green indicating lights on the main control board to show the positionof the valve. The valve motor operator is located at the valve and is used to change theposition of the valve. The pressure control loop measures RCS pressure and providesoutput signals to the valve Control circuit based on the system pressure that allows thevalve to be opened from the control switch or automatically closed. The temperature control loop measures pressurizer vapor temperature and provides an output signal toallow (in conjunction with a pressure signal) the valve to be opened.2.4 REFERENCE PLANT DIFFERENCES As discussed in the introduction of this report, the basic information presented inWCAP-1 1736 is applicable for use in this FNP, Units 1 and 2, plant-specific effort.However, the aspects that require further review are the differences between the FNPunits and the reference plant for its category.

Based on the recommendation ofWCAP-1 1736, the applicable reference plant for the FNP units is the Shearon HarrisPlant. Table 2-1 shows a summary of general characteristics for FNP and ShearonHarris.E2-15 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportIn order to perform the difference analysis between FNP and the reference plant, thefollowing documents required examination:

• Control wiring diagrams for the RHR System suction/isolation valves* The suction/isolation valve logic diagrams* RHR System configuration drawings* Operating Procedures

• Technical Specifications

• Final Safety Analysis Report (ESAR)Once the differences were identified, those differences that impacted the Shearon Harris"reference" probabilistic analyses were re-modeled such that the analyses would nowspecifically represent FNP, Units 1 and 2.The following lists the six plant differences that required the reference models to bemodified:

1. FNP utilizes the RHR System relief valves for cold overpressure protection; Shearon Harris utilizes 2 pressurizer PORVs.2. FNP removes power to the RHR System suction/isolation valves when the RCSis less than 1800°F; Shearon Harris does not.3. FNP RHR System isolation valve OPI utilizes pressurizer vapor spacetemperature as a method of diverse indication; Shearon Harris RHR System OPIdoes not.4. FNP RHR System isolation valve position control room indicating lights arepowered by a separate power supply from the isolation Valve motor; ShearonHarris indicating lights are powered from the same power supply as the isolation valve motor.5. FNP incorporates additional relays to the RHR System isolation valve processcontrol to control the valve position.

6. FNP does not power lockout the suction/isolation valves in Modes 1, 2, and 3;Shearon Harris does.The reference plant differences noted above were addressed in the probabilistic analyses performed for FNP, Units 1 and 2.The original probabilistic analyses performed for FNP, Units 1 and 2 is consistent withthe applicable model analyses described in WCAP-1 1736 as approved by the NRC andaddressed the reference plant differences listed above. The results of the original FNP,E2-16 Enclosure 2 to NL-1 5-1055FNP RHR Autoclosure Interlock Removal ReportUnits 1 and 2 analyses are provided in Section 4.2.2 of this report. However, sincethese original analyses were performed in the mid-i1990s, PRA methods and standards have developed further.

Therefore, the original analyses performed for the FNP units inaccordance with WCAP-1 1736 were reviewed against more current standards to identifygaps that need to be addressed to validate the results of the original analyses.

The resulting gap analysis and validation of the original FNP, Units 1 and 2 analysesresults (which include an updated inter-system LOCA PRA analyses) is discussed inSection 4.3.E2-17 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportTABLE 2-1REFERENCE PLANT COMPARISON Parameter FNPNo. Loops 3No. RHR System Drop Lines 2 (HL Loop 1&3)RHR System Operation Parameters 425 psig, 350°FRHR System Isolation Valves 2 MOVSPrevent Open Setpoint 402.5 psigAutoclosure Setpoint 700 psigRelief Vaive Design Setpoint 450 psigRelief Valve Design Flowrate 900 gpmCold Overpressure Mitigation System (COMS) -Design Criteria RHR System Relief ValvesShearon Harris2 (HL Loop 1&3)425 psig, 350°F2 MOVS363 psig700 psig450 psig900 gpm2 PORVSE2-1 8 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal Report~00 II 00 -~ 11020 0 I21 ~05~(&11511}

ROTC 5402.16*51022 004 -12 I11 4*11.0* 0-8731102 501(0-10) 00110 COO TI 011111040041 [111111]--10411110~ OF V 41-..-> 2-1114-61114 I0-17511*6 622(r-4)

I 2/011000

~ c ..L~.JTo 6216 ~ 0-10111*2 511110-I) 6 011 VOLVO I -10/ ~ (01150014100111005 1111*561 003 £030~11 1.47156 1-5115* ~. L~12*)* 1I~1 15 3/,-T78 .3/8-178

.2 A it, 806-IS.. .. ...0I'I 05I00060710' 10.07-41/" -87150-170016 11025(0-6) 001100001002 1110 C-Il11005050

~15603011.67161400-Il .I/LV*IC 10-117001,*161211 05 ,1 .....1050I 0.813/4503 0410 010 ~611 (02.11P0616011 011 60600436 ~ 020 011130 611-6610

/7-0*5800 -61*1005

'I!!/I mows026450 0110 6 I0I 06802110000008010 00111 a1.115047 111.20-7

~Ts~5*113 11111 0-7 31*64610106 2/01113/014 101010111101 11.06311 I 11.010110.065* 1011 0.0610_______ *021 6031 12001-10-135637 01.510-81

-.. ..1I4 .. 6 7 .. ... ..-106 ,,6600 LO 6- 00 1-116 __{ _______ j-erm .r18-01,,.6 i -101 511.1 -,224 -5* 0103052,2WV-36V 0 0410"

• I 55/'ri 11108SI 05-02 010117 ,L. --04-61,_

\ ,, -'-1,'66

,-5 , 1,-8 1/ iI J/0t *{ -50"015020.(-0 1-10 *(-

IC.. 25.. 16" ' 0m#n~: 4 16- I0.5-5016 l -IT+*010 3/I-IF04 16-,'-051_,111..

1161 o as-- 01/ po I--ow' I- 60705 510066- 68__1'-*0_f

-616 -l -7620.(-f)3418(111001100

, /-461 /-7 *10 61.00.1-8---735..

..6.>3/6-4-051

-FIGURE 2-1RHR SYSTEM(UNIT 1)616.1600I. VOLVO 0110*00104511110100106105101*

000200111100

4. 21106101102.10 1141000 71114020 1111111 07*051.1110 611251 10)202.111042201*706 11116 11.1111111 10 11*2.118 6666111 1008.5. VOCOIT 00260600.0 05671211 lOll 04*11112.117*68 060124*00. 01@10* 11111. 0601111104 01166111771710020602

1. It6~6 001111101101)0011651041.1110 010100 711511. 12.10*020 111066111610

$1100116*101 000011110 0111100 77)01 01031 TI.8.6101102.7*001106 641.602 2 4206014*111 1011111601 1111100 50000.6. *115.1050 1*1111 011.0 5102717 (011611161.611*05) 0515161412.

101022. 040001111.16056006 11101006 10*1011.II. 01116061111602151110116-11100.

0. & 77-0510.

00*10 00050 111011 0*15 171111110.10110 01111*11112.71100 10311*1..

II. 00301021 05611 0100211010261 10 2.006. 001117*0161 0000IS. 110 01120001006106221111 I06~ 110501001511111*061 11~ 11-1160*3.

II 51711 P1111.1011 040010*1111111 510*1*00303 10030806106 6111104510 11020.15A IS. 11036 0110 0066. 610.0 10411 00 46006*010. 105. 11* 40011. 00 01111*0003 00 01115 10400F04116C116 1.72)114 4(1061200 06 0160111(1316.

110 11110. 80*1614041100 41110*1100106:106000001160305.

1111 111111 2 00)11100511111111 805 P010 0 0-205000~71106IiS11aI111161 0o~oo*y 06)2*05.

Inc. Ia,601011 I110067 00.1 010 11-5 1-07010 I10-10*601165

~11V5654j11000010011112-1*1811 0I .. ... I\ _+2 10-1012-02-21610 t 0.116000102(16001 01111(11E2-19 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report3.0 .PROPOSED BASIC LOGIC CHANGEThe proposed interlock change for FNP, Units 1 and 2, removes the ACI feature from the RHR Systemsuction/isolation valves (8701A/B and 8702A/B).

All other valve interlock features described in theabove Sections of this report, remain in place. With removal of the ACl feature, valves 8701A/B and8702A/B will not close automatically on increasing RCS pressure greater than 700 psig. Alarms will beadded (for each RHR System suction/isolation valve) that actuate in the main control room given a"VALVE NOT FULL CLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. The intentof the alarms is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is notfully closed, and that double valve isolation from the ROS to the RHR System is not being maintained.

Valve position indication to the alarm will be provided from the valve stem mounted limit switches andpower to the limit switches must not be affected by power lockout to the valve. The proposed designchange leaves the valve position indication main control board intact. As with other power lockoutvalves, there is no requirement for opposite train power for the limit switches, only that power to thelimit switches is not affected by the power lockout.The only proposed change to the valve interlock and circuitry is to remove the autoclosure portion ofthe interlock and add a control room alarm; the valves open permissive circuit will not be altered.As discussed in the introduction of this report, power lockout was one way to reduce the frequency ofinadvertent closure of these valves due to the presence of the AC!. Although this procedure served asan alternative to the removal of ACI, it also prevented the valves from performing their isolation function.

With the removal of the ACl circuitry on the RHR System suction/isolation valve, a failure of apressure transmitter or loss of power tO the solid state protection system (SSPS) cannot result in thevalves stroking closed. Thus, the postulated occurrence of a single failure isolating both RHR Systemtrains, while the RHR System relief valves are providing cold overpressure protection, cannot occur.Therefore, the FNP requirement to open and lockout power to these valves is redundant and no longerrequired.

Also, in the SER for the Diablo Canyon AC! removal (Reference 5), the NRC stated: "Both the staffand the licensee agreed that [removal of power to isolation valves during shutdown]

would be a badpractice since the valves would not be available to perform their isolation function should the need ariseduring shutdown.

In summary, the proposed FNP interlock changes provide deletion of the AC! feature from the RHRSystem suction/isolation valves, while still meeting the regulatory requirements to retain the openpermissive portion of the interlock.

In addition, the change provides a control room alarm to alert theoperator if a RHR System suction/isolation valve is not fully closed, and provides justification forelimination of power lockout of the suction/isolatiop valves during shutdown.

E2-20 Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 2RHR Autoclosure Interlock Removal Report Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportRESIDUAL HEAT REMOVAL SYSTEMAUTOCLOSURE INTERLOCK REMOVAL REPORTFOR THE JOSEPH M. FARLEY NUCLEAR PLANTUNITS 1 AND 2 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportABSTRACTA review of the original probabilistic

analysis, and a subsequent probabilistic analysishas been performed for the Joseph M. Farley Nuclear Plant, Units 1 and 2, whichjustifies the deletion of the autoclosure interlock associated with the Residual HeatRemoval System suction/isolation valves. The methodology utilized is based on theWestinghouse Owners Group generic WCAP-1 1736, "Residual Heat Removal SystemAutoclosure Interlock Removal Report for the Westinghouse Owners Group." The openpermissive circuitry is unaffected by the deletion of the ACl. An alarm will be added tonotify the operator of an incorrectly positioned Residual Heat Removal Systemsuction/isolation valve.A probabilistic analysis was used to demonstrate that the deletion of the autoclosure interlock is acceptable from both a core safety and Residual Heat Removal Systemoverpressurization standpoint.

E2-1 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportEXECUTIVE SUMMARYThis report provides a justification for the removal of the Auto Closure Interlock (ACI)from the Residual Heat Removal System (RHR) suction/isolation valves for Joseph M.Farley Nuclear Plant (FNP), Units I and 2.BACKGROUND In support of WCAP-11736, "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group," a literature review of decay heatremoval issues, associated with the loss of RHR was performed.

The literature reviewindicated that a significant number of the loss of RHR System events were caused byinadvertent automatic closure of the RHR System suction/isolation valves. In an effort toreduce the frequency of these inadvertent automatic suction/isolation valve closures, several plants have taken one or more of the following steps: 1) power lockout of thesevalves during plant shutdown,

2) maintenance procedures that require de-energizing these valves in the open position before conducting setpoint calibration or work on theinverters, and 3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHRSystem relief valves for cold overpressure protection mitigation.

The literature recognized that corrective actions are necessary to minimize the risk associated withloss of decay heat removal capability caused by actuation of the ACI, but alsohighlighted concerns associated with intersystem Loss-Of-Coolant Accidents (LOCA),referred

to as an Event V, and RHR System pressure relief capacity.

During the 1960s and 1970s, two closed valves in series isolated the RHR System fromthe Reactor Coolant System (RCS) while the RCS was at normal operating temperature and pressure.

Both valves were to have power disconnected via administrative procedures except when the valves were to be stroked.

An Open Permissive Interlock (OPI) was provided to one of the valves to prevent opening until the RCS pressure wasbelow RHR System design pressure.

In 1971, the Atomic Energy Commission requirements had evolved to require an ACI on increasing pressure.

A meeting betweenthe industry and the Nuclear Regulatory Commission (NRC) in 1974 brought about threeacceptable methods of preventing RHR System overpressurization while the RHRSystem is in operation or when returning the RCS to operation:

1) automatic closureinterlocks on the RHR System suction/isolation valves, 2) sufficient capacity of the RHRSystem suction line relief valves to mitigate a pressure transient, or 3) a combination ofthe two.This agreement was superceded in 1975 when the NRC required, in its SafetyEvaluation Report for RESAR-41, that RHR System suction isolation valves be equippedwith the ACI feature.

The current NRC position is stated in Branch Technical PositionRSB 5-1, dated July 1981, which requires that the RHR System suction/isolation valvesE2-2 Enclosure 2 to NL-1 5-1 055FNP RHR Autociosure Interlock Removal Reportshall be interlocked to protect against one or both valves being open during an increasein RCS pressure above the RHR System design pressure and that adequate reliefcapacity shall be provided during the time period while the valves are closing.

In 1984,an internal NRC Instrumentation and Control Systems Branch memo recommended thataction be taken to modify the design of the RHR System interlocks.

An NRC internalmemo in 1985 stated that a request by a plant to remove the ACI feature should besubstantiated by proof that the change is a net improvement to safety and should, as aminimum, address the following:

1. The means available to minimize Event V concerns.

2. The alarms available to alert the operator of an improperly positioned valve.3. Adequacy of the RHR System relief capacity.

4. Means other than the ACI to ensure both Motor-Operated Valves (MOVs) areclosed (e.g., single switch actuating both valves).5. Assurance that the function of the open permissiye cirCuitry is not affected by theproposed change.6. Assurance that MOV position indication will remain available in the control room.7. Assessment of the proposed changes effect on RHR System reliability, as wellas on Low Temperature Overpressure (LTOP) concerns.

SUMMARY DESCRIPTION This report including the Probabilistic Analyses provides the following to support theFNP, Units 1 and 2 RHR System ACI deletion:

1) The RHR System description,

2) Thecurrent RHR System suction/isolation valve control circuitry description,

3) A description of the proposed ACl deletion hardware change, 4) A description of the proposedsuction/isolation valve alarm circuitry

addition,

5) The results of the PRA analysisperformed for the RHR System unavailability including an evaluation of the gap analysisperformed for that PRA, 6) The results of the interfacing systems LOCA PRA analysis, agap analysis for that PRA, and an updated interfacing systems LOCA PRA analysis, 7)The results of the overpressurization PRA analysis and the gap analysis for that PRA,8) The RHR System relief valve adequacy, and 9) The recommended documentchanges.The approach taken for this report was to reference the study performed by theWestinghouse Owners Group (WOG), which justified the deletion of the RHR SystemACI for four reference (or lead) plants. This study is documented in WCAP-1 1736,'Residual Heat Removal System Autoclosure Interlock Removal Report for theWestinghouse Owners Group." In order to perform the plant-specific analyses for theE2-3 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportFNP units, a difference analyses was performed that compared FNP to its reference plant identified in the WOG report. Once the differences were identified, the reference probabilistic analyses were modified to model FNP, Units 1 and 2, specifically.

CONCLUSIONS This report recommends the following:

1. An alarm will be added to each RHR suction isolation valve which will actuate ifthe valve is open and the reactor coolant system (ROS) pressure is greater thanthe open permissive setpoint and less than the RHR system design pressureminus the RHR pump head pressure at minimum flow.2. Valve position indication to the alarm will be provided from the stem-mounted limit switches and power to the stem mounted limit switches will not be affectedby power lockout of the valve.3. Alarm response procedures will be implemented to support the addition of thealarm for the RHR suction isolation valves and other procedures will be revisedas necessary to address the deletion of the ACI.4. Procedures will be revised to eliminate the current requirement to lockout powerto the open RHR suction isolation valves below 1 80°F.5. Procedures will be implemented to require that power to all four closed RHRsuction isolation valves be locked out in Modes 1, 2, and 3.The results of the intersystem LOCA analysis show that the frequencies of the Event Vdecreases with the removal of the ACl feature.

The results of the RHR Systemunavailability analysis show that the removal of the ACl feature increases the RHRSystem availability.

The results of the overpressurization analysis show that removal ofthe ACl feature has little impact on the consequences of LTOP events at FNP.Consistent with WCAP-1 1736 the net effect of the ACl feature removal is considered tobe a net improvement in plant safety for FNP, Units 1 and 2.E2-4 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report

1.0 INTRODUCTION

The intent of this section is to state the purpose of this report and provide the necessary information to put the analysis supporting the deletion of the FNP, Units 1 and 2,Residual Heat Removal (RHR) System suction/isolation valve Autoclosure Interlock (Acl) feature in the proper context.

It also presents, as background, a description of theWestinghouse Owners Group (WOG) generic topical report upon which this report andthe methodology used is based.1.1 PURPOSEThe Nuclear Regulatory Commission (NRC) and the nuclear industry has expressed interest in the acceptability of removing the ACI on the RHR System suction/isolation valves. This interest is in response to growing concerns about the loss of RHRcapability during cold shutdown and refueling operations due to inadvertent isolation ofthe RHR System caused by failure of the ACI circuitry.

Isolation of the RHR Systemwhile operating has resulted in a loss of decay heat removal capability at severaloperating plants. It is also a potential contributor to overpressurization of the ReactorCoolant System (RCS) with possible Power-Operated Relief Valve (PORV) challenge and RHR System pump damage.For the WOG generic topical report, upon which this report is based, a literature reviewof decay heat removal problems was performed.

The literature review indicated that asignificant number of the loss of RHR System events were caused by inadvertent automatic closure of the RHR System suction/isolation valves. In an effort to reduce thefrequency of these inadvertent automatic suction/isolation valve closures, several plantshave taken one or more of the following steps: 1) power lockout of these valves duringplant shutdown,

2) maintenance procedures which require de-energizing these valves inthe Open position before conducting setpoint calibration or work on the inverters, and3) modifications to technical specification surveillance requirements involving verification of open suction/isolation valves when credit is taken for RHR System relief valves forcold overpressure protection mitigation.

The literature recognized that corrective actionsare necessary to minimize the risk associated with loss of decay heat removal capability caused by actuation of the ACI, as well as highlights concerns associated withintersystem Loss-Of-Coolant Accidents (LOCA), referred to as an Event V inWASH-1400 (Reference 1), and RHR System relief valve capacity.

Based on the history of the RHR ACI, the WOG approved a program for the evaluation of the removal of the ACI on the RHR System suction/isolation valves at the following four reference plants: Salem Unit 1, Callaway, North Anna Unit 1, and Shearon Harris.Other WOG plants participating in the program were categorized into one of four groupsled by one of the reference plants based on similar RHR Systemn configuration anddesign characteristics.

It was intended that other members of the WOG could reference E2-5 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportthe applicable lead plant in the study and provide a difference analysis should theydesire to delete the RHR System ACl.This report is written in support of deleting the FNP, Units 1 and 2, ACl feature on theRHR System suction/isolation valves based on the methodology contained inWCAP-1 1736, "Residual Heat Removal System Autoclosure Interlock Removal ReportFor The Westinghouse Owners Group" (Reference 4). A summary description ofWCAP-1 1736 is presented below.1.2 WOG PROGRAM:

WCAP-11736 WCAP-1 1736 was prepared for the WOG. It provides an evaluation of the removal ofthe ACl on the RHR System suction/isolation valves at four reference plants: Salem Unit1, Callaway, North Anna Unit 1, and Shearon Harris. The WOG plants participating inthe program were categorized into one of four groups based on similar RHR Systemconfigurations and design characteristics.

The plants listed by group are:Group 1 -Salem Unit 1Salem Unit 2D.C. Cook Units 1 & 2Indian Point Unit 3McGuire Units 1 & 2Sequoyah Units I & 2Watts Bar Units 1 & 2Zion Units I & 2Group 2 -Callaway Unit IBraidwood Units 1 & 2Byron Units I & 2Catawba Units 1 & 2Comanche Peak Units 1 & 2Trojan Unit 1Seabrook Unit 1Vogtle Units 1 & 2Wolf Creek Unit 1Millstone Unit 3South Texas Units 1 & 2Group 3 -North Anna Unit 1 Group 4 -Shearon Harris Unit 1H.B. Robinson Unit 2 Farley Units I & 2Turkey Point Units 3 & 4 Beaver Valley Unit 2Beaver Valley Unit 1 V.C. Summer Unit 1Prairie Island Units 1 & 2North Anna Unit 2The choice of the four particular reference plants was made based on providing themaximum number of the other WOG members with the best possible fit should theychoose to delete the ACI in the future and reference this document.

It is expected that,should a plant desire to delete the ACl, a plant specific difference analysis would still berequired, but the resources expended to produce and review it should be substantially less with reference to the WOG WCAP-1 1736.WCAP-1 1736 provides, for each of the four reference plants, the supporting:

1) RHRSystem description,

2) current RHR System suction/isolation valve control circuityE2-6 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportdescription,

3) proposed ACl deletion hardware

changes,

4) proposed suction/isolation valve alarm circuitry

addition,

5) RHR System unavailability probabilistic

analysis, 6)interfacing systems LOCA probabilistic

analysis, and 7) probabilistic overpressurization analysis.

WCAP-1 1736 addresses each of the seven NRC concerns exPressed in the 1985 NRCinternal memo for each of the four reference plants, and recommends the deletion of theACI feature for all WOG plants. For plants with an RHR System located outside ofcontainment, the installation of a safety grade alarm is recommended to warn theControl Room Operator that a series suction/isolation valve(s) is not fully closed whenRCS pressure is above the alarm setpoint.

For plants with an RHR System locatedentirely inside containment, an alarm is not recommended since these plants are notsusceptible to the Event V (LOCA outside containment).

The results of the intersystem LOCA analysis show that the frequencies of the Event V decreases with the removal ofthe ACl feature.

The results of the RHR System unavailability analysis show that theremoval of the ACI feature increases the RHR System availability.

The results of theoverpressurization analysis show that removal of the ACI feature will have no effect onthe heat input transients and will result in a slight increase in frequency of occurrence forsome categories of the mass input transients with a decrease in others. The net effectof the ACl feature removal is considered to be a net improvement in plant safety.The basic information presented in WCAP-1 1736 is applicable for use in theplant-specific effort for FNP, Units i and 2. The literature review and licensing basisremain the same for all Westinghouse plants. The probabilistic models and databasecan be utilized as a basis for the plant-specific effort. The recommended changes to thetechnical specifications are also applicable.

This FNP plant specific report builds on the generic work of WCAP-11736.

It justifies removal of the ACI based On a safety evaluation of the effect of ACI removal on lowtemperature overpressure protection, RHR System availability, and interfacing systemLOCA potential.

1.3 BACKGROUND

During normal and accident conditions, it is necessary to keep low pressure systemsthat are connected to the high pressure RCS properly isolated from each other in orderto avoid damage by overpressurization or potential for loss of integrity of the lowpressure system and possible radioactive releases.

The FNP RHR System is a lowpressure system, with a design pressure of 600 psig, with an interface to the highpressure RCS, with a normal operating pressure of 2235 psig.The primary function of the RHR System is to remove residual heat from the core andreduce the temperature of the RCS during the second phase of plant cooldown andduring refueling operations.

As a secondary

function, the RHR System is used toE2-7 Enciosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reporttransfer refueling water between the Refueling Water Storage Tank (RWST) and therefueling cavity before and after the refueling operations.

The RHR System also servesas part of the Emergency Core Cooling System (ECCS) during the injection phase of aLOCA. In addition to the above functions, the RHR System suction line relief valves areused to provide cold overpressure mitigation of RCS overpressure transients.

Figure 1-1 is a simplified flow diagram showing the FNP RHR System design. Thesystem consists of two parallel flow paths. Each path takes a suction from a separateRCS hot leg. Each flow path contains an RHR pump, an RHR heat exchanger, piping,valves, and instrumentation required for operational control.During system operation, reactor coolant flows from the RCS to the RHR Systempumps, through the tube side of the residual heat exchangers, and back to the RCS.Heat is transferred from the reactor coolant to the Component Cooling Water (CCW)circulating through the shell side of the RHR heat exchangers.

Two inlet suction/isolation valves are provided in each inlet line from the RCS. Thesemotor-operated, gate valves are normally-closed, except when the RHR System is inoperation, and function to keep the low pressure RHR System isolated from the highpressure RCS. Each of these valves is provided with a manual control (OPEN/CLOSE) on the main control board and has two automatic interlocks associated with its controlcircuitry:

the ACI and the OPI.The OPI prevents inadvertent opening of the suction/isolation valves when the RCSpressure is above the design pressure of the RHR System considering RHR Systempump discharge pressure.

Each suction/isolation valve on each inlet line is interlocked with one of the two independent RCS wide range pressure signals to provide an OPIfeature to these valves. One set of suction/isolation valves, those adjoining the RCS,are interlocked with a pressure signal to prevent their being opened whenever the RCSpressure is greater than approximately 402.5 psig. The other set of valves, thoseadjoining the RHR System, are similarly interlocked to prevent their being openedwhenever the RCS pressure is greater than approximately 402.5 psig. These valves arealso interlocked with the pressurizer vapor space temperature sensor to provide anadditional interlock feature.The ACI ensures that both suction/isolation valves, in each RHR System train, are fullyclosed when the RCS is pressurized above the RHR System design pressure.

Each setof valves in series is interlocked with one of two independent RCS wide range pressuresignals to close automatically when the RCS pressure increases to approximately 700psig.A more detailed description of the FNP RHR System is provided in Section 2.0 of thisreport.E2-8 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportFIGURE 1-1SIMPLIFIED RESIDUAL HEAT REMOVAL FLOW DIAGRAME2-9 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report2.0 FARLEY RHR SYSTEM DESCRIPTION 2.1 GENERAL DESCRIPTION The RHR System transfers heat from the RCS to the component cooling system toreduce the temperature of the reactor coolant to the cold shutdown temperature at acontrolled rate during the second part of normal plant cooldown, and maintains thistemperature until the plant is started up again.As a secondary

function, the RHR System also serves as part of the ECCS during theinjection and recirculation phases of a LOCA.The RHR System also is used to transfer refueling water between the refueling waterstorage tank (RWST) and the refueling cavity before and after the refueling operations.

2.2 RESIDUAL HEAT REMOVAL SYSTEMA flow diagram of the RHR System is shown in Figure 2-1 (Unit 1 shown for theexample).

The RHR System consists of two separate trains of equal capacity, eachindependently capable of meeting the safety analysis design bases. Each train consistsof one heat exchanger, one motor-driven pump, piping, valves, and instrumentation necessary for operational control.

The inlet line to each train of the RHR System isconnected to a reactor coolant loop hot leg, while the lines exiting the RHR heatexchangers are connected to the cold legs of each of the reactor coolant loops.Each RHR System suction line is normally isolated from the RCS by two motor-operated valves in series, while the discharge lines are isolated by check valves in each line. TheRHR System suction/isolation valves, the inlet line pressure relief valve, and thedischarge lines downstream of valves 8888A/B and 8889 are located insidecontainment, while the remainder of the system is located outside containment.

During normal RHR System operations, reactor coolant flows from the RCS hot legs 1and 3 to the RHR pumps, through the tube side of the RHR heat exchangers and backto the RCS through the Safety Injection System (SIS) cold leg injection lines. Thereactor coolant heat is transferred by the RHR heat exchangers to the CCW that iscirculated through the shell side of the RHR heat exchangers.

Coincident with RHR System normal operations, a portion of the reactor coolant flowmay be diverted from downstream of the RHR heat exchangers to the Chemical andVolume Control System (CVCS) low-pressure letdown line for cleanup and/or pressurecontrol.

By regulating the diverted flowrate and the charging flow, the RCS pressure canbe controlled during water solid-plant operations.

Pressure regulation is necessary tomaintain the pressure range dictated by the reactor vessel fracture prevention criteriaE2-10 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportrequirements and by the Reactor Coolant Pump (RCP) No. 1 seal differential pressureand Net Pump Suction Head (NPSH) requirements of the RCPs.The RCS cooldown rate is manually controlled by regulating the reactor coolant flowthrough the tube side of the RHR heat exchangers.

Instrumentation is provided tomonitor system pressure, temperature, and total flow.System Operation A discussion of RHR System operation during various reactor operating modes follows:Reactor StartupGenerally, during cold shutdown, the RHR System operates to remove residual heatfrom the reactor core. The number of pumps and heat exchangers in service dependson the RHR System heat load at the time.At initiation of plant startup, the RCS is completely filled, and the pressurizer heaters areenergized.

The RHRS is connected to the CVOS via the low pressure letdown line tocontrol reactor coolant pressure.

Once a steam bubble is formed in the pressurizer, theRHR System is isolated, and ROS pressure/inventory control are provided by thepressurizer spray, pressurizer

heaters, and the normal letdown and charging systems.Power Generation and Hot Standby Operation The RHR System is not used during hot standby or power operations when the RCS isat normal pressure and temperature.

Under these conditions, the RHR System isaligned for operation as part of the ECCS. Upon initiation of a safety injection signal theRHR System pumps take suction from the RWST and inject borated water into the RCSvia the SIS accumulator cold leg injection headers.

When the water in the RWST isdepleted, the RHR System pumps are manually aligned to take suction from thecontainment recirculation sump. The RHR heat exchangers then cool the sump fluidbeing recirculated by the RHR System pumps and deliver the cooled water to the ROS.Since the charging pumps (high head safety injection) do not take suction from thecontainment sump, the RHR System pumps (low head safety injection) also supply thesuctions of these pumps during recirculation.

Reactor ShutdownThe initial phase of reactor cooldown is accomplished by transferring heat from the RCSto the Steam and Power Conversion System (SPCS) through the use of the steamgenerators.

When the reactor coolant temperature and pressure are reduced toE2-11 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportapproximately 350°F and less than 425 psig the second phase of cooldown starts withthe RHR System being placed in operation."

The reactor cooldown rate is limited by RCS equipment cooling rates based on allowable stress limits, as well as the operating temperature limits of the CCW System. As thereactor coolant temperature decreases, the reactor coolant flow through the RHR heatexchangers is increased to maintain a constant cooldown rate.As cooldown continues, the pressurizer is filled with water, and the RCS is operated inthe water-solid condition.

At this stage, pressure is controlled by regulating the chargingflow rate and the letdown rate to the CVCS from the RHR System. After the RCS isdepressurized, cooled to _<140°F, the reactor vessel head may be removed for refueling or maintenance.

Ref~ueling

• One RHR pump is utilized during refueling to pump borated water from the RWST to the'refueling cavity. The other is used in cooldown alignment for decay heat removal.

Duringthis operation, the isolation valves in the inlet lines of the RHR System are closed, andthe isolation valves to the RWST are opened.The reactor vessel head (RVH) is lifted and placed on the storage stand. The refueling water is then pumped into the reactor vessel through the normal RHR System returnlines and into the refueling cavity through the open reactor vessel. After the water levelreaches normal refueling level, the inlet isolation valves are opened, the RWST supplyvalves are closed, and RHR is resumed.During refueling, the RHR System is maintained in service with the number of pumpsand heat exchangers in operation as required by the Technical Specifications.

Following refueling, the RHR pumps are used to drain the refueling cavity to the top of the reactorvessel flange by pumping water from the ROS to the RWST.Component Description This section describes the major components of the RHR System.RHR System PumpsTwo pumps are installed in the RHR System. The pumps are sized to deliver reactorcoolant flow through the residual heat exchangers to meet the plant cooldownrequirements.

The use of two pumps ensures that cooling capacity is only partially lostshould one pump become inoperable.

E2-12 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportThe RHR System pumps are protected from overheating and loss of suction flow byminiflow bypass lines, located downstream of the heat exchanger outlet, which divertspart of the flow back to the pump suction.

A control valve located in each miniflow line isregulated by a signal from the flow transmitters located in each pump discharge header.A control valve located in each miniflow line is actuated by a flow switch. The miniflowvalves open when RHR pump flow decreases below the flow setpoint, and close whenthe flow increases above the designated setpointA pressure sensor in each pump discharge header provides a signal for an indicator inthe control room. A high pressure alarm is also actuated by the pressure sensor.The RHR System pumps are vertical, centrifugal units with mechanical shaft seals. Allpump surfaces in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.

RHR System Heat Exchangers Two residual heat exchangers are installed in the RHR System. The RHR System heatexchanger design is based on heat load and temperature differences between thereactor coolant and the CCW existing 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after reactor shutdown when thetemperature difference between the two systems is small. The installation of two heatexchangers ensures that the heat removal capacity of the system is only partially lost ifone heat exchanger becomes inoperative.

The heat exchangers are of the shell andU-tube type. Reactor coolant circulates through the tubes, while COW circulates throughthe shell. The tubes are welded to the tubesheet to prevent leakage of reactor coolant.Inlet Isolation Valves 8701A/B and 8702A/BThe RHR System inlet isolation valves are motor-operated gate valves that arenormally-closed except when the RHR System is in operation.

These valves areprovided with a manual control (open/closed) on the main control board and will fail inthe "as-is" position.

Valves 8701 B and 8702B are interlocked with an RCS pressure transmitter and valves8701A and 8702A are interlocked with an ROS pressure transmitter and a temperature transmitter that measures pressurizer vapor space. These interlocks prevent theinadvertent opening of the valves when RCS pressure is greater than approximately 402.5 psig. In addition valves 8701A and 8702A cannot be opened when thepressurizer vapor space temperature exceeds 475°F. The valves also closeautomatically when the RCS pressure is higher than 700 psig.Because the RHR System relief valves provide cold overpressurization protection for theRCS, power is removed from the RHR System isolation valves when the RCSE2-13 Enclosure 2 to NL-15-1 055-FNP RHR Autoclosure Interlock Removal Reporttemperature is below 180°F. By removing power from the isolation valves, aninadvertent or undesirable isolation of the RHR System relief valves is prevented.

Relief Valves 8708A and 8708BThere is one, 3-inch relief valve (inside containment) in each RHR System suction linefrom the RCS hot leg. These relief valves are located immediately downstream of theRHR System suction/isolation valves 8701A and 8702A. These relief valves preventRHR System overpressurization by discharging to the Pressurizer Relief Tank (PRT)when pressures within the RHR System suction line exceed 450 psig. These valveshave a design capacity of 900 gpm at the 450 psig setpressure.

The RHR Systemsuction relief valves provide overpressure protection for the RHR System.2.3 CURRENT RHR System SUCTION ISOLATION VALVES INTERLOCKS ANDFUNCTIONAL REQUIREMENTS The following sections provide a description of the FNP, Units 1 and 2, suction/isolation valve .interlocks and valve control circuits.

Current Interlocks There are two, normally-closed, motor-operated isolation valves in series in each of thetwo RHR System pump suction lines from the RCS hot legs. The two valves 8702B and8701 B, inside the missile barrier, are designated as the inner isolation valves, while thetwo valves 8701A and 8702A, outside the missile barrier, are designated as the outerisolation valves. The interlock features provided for the inner isolation valves areidentical to those provided for the outer isolation valves, except the fact that the outerisolation valves have a pressurizer vapor space temperature interlock.

Each valve is interlocked against opening unless the following conditions are met:1. The RCS pressure, as measured by the appropriate wide range pressurechannel, is less than approximately 402.5 psig. This assures the RHR Systemcannot be overpressurized by aligning it to the RCS when the RCS pressure plusthe RHR System pump head would exceed the RHR System design pressure.

2. The corresponding RHR System pump/RWST suction isolation valve is closed.This assures positive isolation of the RWST and RHR System/RWST suctionpiping before initiating a normal cooldown.

In addition to the above interlocks, valves 8701A and 8702A are interlocked to preventagainst opening unless the pressurizer vapor space temperature is less than 475°F.E2-14 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportThis is incorporated to provide diverse means of defeating the open signal for the RHRSystem outer isolation valves.Once opened, each valve is also interlocked to automatically close on increasing RCSpressure greater than 700 psig (i.e., the ACl). This backup feature assures that bothisolation valves will be closed during a plant startup prior to reaching operating conditions, if one valve had been inadvertently left open by the operator.

The operatormay close the suction/isolation valves at any time.RHR System Common Suction Isolation Valve Description The RHR System Inlet Isolation Valves are motor-operated valves that can be opened orclosed from the main control board. The valve will automatically close on increasing RCS pressure.

On decreasing RCS pressure and pressurizer vapor temperature, thevalve control circuit receives an interlock signal that allows the valve to be opened usingthe main control board hand switch. On RCS pressure or pressurizer vapor temperature above the setpoint, the valve control circuit is disabled and the valve cannot be opened.The valve control circuit consists of control switches, limit switches, torque switches, contactors, relays, indicating lights, a 3 phase, 600 VAC motor, and pressure andtemperature control loops. The control switches are located in the main control room.The limit switches are located in the valve motor operator and provide indication of theposition of the valve. Relays are used for providing control signals.

The contactor, located in the motor control center, is switched on and off to provide the power to thevalve. The contactor also provides contacts that are used in the valve control circuit.There are red and green indicating lights on the main control board to show the positionof the valve. The valve motor operator is located at the valve and is used to change theposition of the valve. The pressure control loop measures RCS pressure and providesoutput signals to the valve control circuit based on the system pressure that allows thevalve to be opened from the control switch or automatically closed. The temperature control loop measures pressurizer vapor temperature and provides an output signal toallow (in conjunction with a pressure signal) the valve to be opened.2.4 REFERENCE PLANT DIFFERENCES As discussed in the introduction of this report, the basic information presented inWCAP-1 1736 is applicable for use in this FNP, Units I and 2, plant-specific effort.However, the aspects that require further review are the differences between the FNPunits and the reference plant for its category.

Based on the recommendation ofWCAP-1 1736, the applicable reference plant for the FNP units is the Shearon HarrisPlant. Table 2-i shows a summary of general characteristics for FNP and ShearonHarris.E2-15 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportIn order to perform the difference analysis between FNP and the reference plant, thefollowing documents required examination:

• Control wiring diagrams for the RHR System suction/isolation valves* The suction/isolation valve logic diagrams* RHR System configuration drawings* Operating Procedures

• Technical Specifications

• Final Safety Analysis Report (FSAR)Once the differences were identified, those differences that impacted the Shearon Harris"reference" probabilistic analyses were re-modeled such that the analyses would nowspecifically represent FNP, Units 1 and 2.The following lists the six plant differences that required the reference models to bemodified:

1. FNP utilizes the RHR System relief valves for cold overpressure protection; Shearon Harris utilizes 2 pressurizer PORVs.2. FNP removes power to the RHR System suction/isolation valves when the RCSis less than 1 80°F; Shearon Harris does not.3. FNP RHR System isolation valve OPI utilizes pressurizer vapor spacetemperature as a method of diverse indication; Shearon Harris RHR System OPIdoes not.4. FNP RHR System isolation valve position control room indicating lights arepowered by a separate power supply from the isolation valve motor; ShearonHarris indicating lights are powered from the same power supply as the isolation valve motor.5. FNP incorporates additional relays to the RHR System isolation valve processcontrol to control the valve position.

6. FNP does not power lockout the suction/isolation valves in Modes 1, 2, and 3;Shearon Harris does.The reference plant differences noted above were addressed in the probabilistic analyses performed for FNP, Units 1 and 2.The original probabilistic analyses performed for FNP, Units 1 and 2 is consistent withthe applicable model analyses described in WCAP-1 1736 as approved by the NRC andaddressed the reference plant differences listed above. The results of the original FNP,E2-16 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportUnits 1 and 2 analyses are provided in Section 4.2.2 of this report. However, sincethese original analyses were performed in the mid-1990s, PRA methods and .standards have developed further.

Therefore, the original analyses performed for the FNP units inaccordance with WCAP-1 1736 were reviewed against more current standards to identifygaps that need to be addressed to validate the results of the original analyses.

The resulting gap analysis and validation of the original FNP, Units 1 and 2 analysesresults (which include an updated inter-system LOCA PRA analyses) is discussed inSection 4.3.E2-17 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportTABLE 2-1REFERENCE PLANT COMPARISON Parameter FNPNo. Loops 3No. RHR System Drop Lines 2 (HL Loop 1&3)RHR System Operation Parameters 425 psig, 350°FRHR System Isolation Valves 2 MOVSPrevent Open Setpoint 402.5 psigAutoclosure Setpoint 700 psigRelief Valve Design Setpoint 450 psigRelief Valve Design Flowrate 900 gpmShearon Harris2 (HL Loop 1&3)425 psig, 350°F2 MOVS363 psig700 psig450 psig900 gpm2 PORVSCold Overpressure Mitigation System (COMS) -Design CriteriaRHR System Relief ValvesE2-18 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportI 3/-4 1000~0200-3,0-41.1103 OtI(0-10) i.e1 2-080-1018 I 101085 COW 88 010005)~iF~1LY~J 2-108 3/4'0001 olo( /i " 10 -,1500 0-010-111008 00.0(0-4) 190 q0010 1008/80, 10 0 -014l.-1-81110./4--000-111031 8200 31 zoom-____ 1.4000008 0011411t110081 54.0 1.000-7 1-80088 I I~ I I 000314I I 1-05-0000 r60101 808840011000 2 OJIlIlIlI 100304 I/l'0 Liii 'IEli'- 0001 '2' 502-81_~cmI1-105800..

1,'0100,..

1.0-171i40 g W~ ElT-01-' 8 "AJC 4Ti- -----008040 cm-2o ,440 1'1P0l0 los .( /o .6 511-l-84 S800I 1lJ eo m tr,,&FI.o.oe(

[ .C -7 410-0 t -r ".~ 6 4 004 00i09 II 1.-y-0I1-50.8"8G--

FIGURE 2-1RHR SYSTEM(UNIT 1)3/4' 0108200 1(03101 0608A405091041.00010011400000100 030106 0001001005040!

10000. 458.010 00110 101540 40 040.0 0441. 54401000.0 1058 0830440410 100101084 1400000870010 04008000.108 4100800010 008200 00.00) 0044 0081.008 082570100041 P001431.000.

3/4'S7 1040000441 810020 45 0.410 61 1450000810

& 00.1104.4440 008000*1400010.0004408 1010000. 084.1080 0000 00400 5401411 (0040000.

63.408)11.0+/- 4010440011.000041005 P8011100 1001011.II 5010404001041.4145108 0-1000. 0. 04 0-0010. 0>1.~~ 1/6-00-1014 4580400051 Aol. 11403 (40091 0.0540IL 002481.4.

09.004 01104001010004 40001.0045000 II 1000830401004100000 144444010 001411040.0100 9004004 In 040.000041 81004.0800 II 000008 /0100 0114074100 0100410.A 16.00114585000 08841 7140111.0000 01010100 0401400004408 0091. 00008.004cm 1400 081 41011140300 541 4106-84 1-81008 0-01000 2-80-1014 125418100 80-008000 (li/I608054 17' ~'-o 8'TO 10 10-04-OOIs I o.oa7 1 00810000501(44.

00-405401 100-0)o714 400001 '-olooa8100303 503 00 0-75010+/-03/400.10037 5(7 7-8 0001 12' (00-70 08044808140444400 004101 010010 ~I I1100301 54.8010 0-1 0-01442-14001000410 IlU4tCO 0010000005-

7. 0091406011080CC 0' 00801 1410308.101 080. 100 5014004.050054 505110010010 060. 410000.01150411000414,00 0o084"7 1000110 Ioo loE2-19 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report3.0 PROPOSED BASIC LOGIC CHANGEThe proposed interlock change for FNP, Units 1 and 2, removes the ACl feature from the RHR Systemsuction/isolation valves (8701A/B and 8702A/B).

All other valve interlock features described in theabove Sections of this report, remain in place. With removal of the ACI feature, valves 8701A/B and8702A/B will not close automatically on increasing RCS pressure greater than 700 psig. Alarms will beadded (for each RHR System suction/isolation valve) that actuate in the main control room given a"VALVE NOT FULL CLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. The intentof the alarms is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is notfully closed, and that double valve isolation from the RCS to the RHR System is not being maintained.

Valve position indication to the alarm will be provided from the valve stem mounted limit switches andpower to the limit switches must not be affected by power lockout to the valve. The proposed designchange leaves the valve position indication main control board intact. As with other power lockoutvalves, there is no requirement for opposite train power for the limit switches, only that power to thelimit switches is not affected by the power lockout.The only proposed change to the valve interlock and circuitry is to remove the autoclosure portion ofthe interlock and add a control room alarm; the valves open permissive circuit will not be altered.As discussed in the introduction of this report, power lockout was one way to reduce the frequency ofinadvertent closure of these valves due to the presence of the ACl. Although this procedure served asan alternative to the removal of ACl, it also prevented the valves from performing their isolation

.function.

With the removal of the ACI circuitry on the RHR System suction/isolation valve, a failure of apressure transmitter or loss of power to the solid state protection system (SSPS) cannot result in thevalves stroking closed. Thus, the postulated occurrence of a single failure isolating both RHR Systemtrains, while the RHR System relief valves are providing cold overpressure protection, cannot occur.Therefore, the FNP requirement to open and lockout power to these valves is redundant and no longerrequired.

Also, in the SER for the Diablo Canyon ACl removal (Reference 5), the NRC stated: "Both the staffand the licensee agreed that [removal of power to isolation valves during shutdown]

would be a badpractice since the valves would not be available to perform their isolation function should the need ariseduring shutdown."

In summary, the proposed FNP interlock changes provide deletion of the ACl feature from the RHRSystem suction/isolation valves, while still meeting the regulatory requirements to retain the open*permissive portion of the interlock.

In addition, the change provides a control room alarm to alert theoperator if a RHR System suction/isolation valve is not fully closed, and provides justification forelimination of power lockout of the suction/isolation valves during shutdown.

E2-20 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.0 PROBABILISTIC ANALYSIS

4.1 INTRODUCTION

TO THE PROBABILISTIC ASSESSMENT This evaluation provides the justification for removal of the auto-closure interlock (ACI) circuit forthe isolation valves on the residual heat removal (RHR) system suction lines from the reactorcoolant system (RCS) for the Farley Nuclear Plant (FNP), Units 1 and 2. This is a deterministic justification supported by probabilistic insights.

The ACI circuit automatically closes these isolation valves if the ROS pressure increases abovea pre-determined setpoint.

This circuit provides assurance these isolation valves are closed onincreasing RCS pressure, such as when returning to power operation, and protects the lowpressure RHR system from the high pressures of the RCS. Although the ACl function providesadditional assurance that the isolation valves are closed, the ACl has also caused inadvertent

• closure of these isolation valves when the plant is on RHR cooling during shutdown resulting inloss of reactor cooling events.Due to the limited benefit of the ACl function and the potential of loss of cooling when shutdown, the Westinghouse Owners Group (now the Pressurized Water Reactor Owners Group)completed a program to justify removal of the ACl function and provided WCAP-1 1736(Reference

4) to the Nuclear Regulatory Commission (NRC) for review and approval.

The NRCissued a Safety Evaluation (SE) on the WCAP that concluded removal of the ACI can produce anet safety benefit provided that several key improvements are in place.Probabilistic assessments were previously completed (1996 timeframe) to justify removal of theRHR ACI at FNP which followed the approach provided in WCAP-1 1736-A. These probabilistic assessments were based on the design and operation of FNP at that time, as well as, designand operational changes that Southern Nuclear Operating Company (SNC) was committed toimplement on ACI removal.

The FNP-specific analyses demonstrated that the conclusions inWCAP-1 1736 are applicable to FNP, that is, the RHR ACI feature can be removed providedseveral key improvements are implemented.

These analyses were completed prior to theavailability of the American Society of Mechanical Engineers (ASME)/American Nuclear Society(ANS) Probabilistic Risk Assessment (PRA) Standard and the current state-of-the-practice inPRAs.Section 4.2 provides background information on the Owners Group's generic analysis, the FNPspecific

analysis, recent FNP operating experience, and a summary of the meeting with SNC,Westinghouse and the NRC on April 23, 2014, regarding the approach to address the PRA inthe LAR. Section 4.3 provides the results of a peer review gap assessment of the EN P-specific analyses against the ASME/ANS PRA Standard.

Section 4.4 provides the assessment of thegaps in PRA technical adequacy identified in Section 4.3 and the impact on the FNPprobabilistic assessments.

Section 4.5 discusses consistency with the NRC Safety Evaluation on WCAP-1 1736 and Section 4.6 provides the conclusions.

E2-21 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.2 BACKGROUND During plant power operation, it is necessary to isolate the low pressure systems from the highpressure RCS to avoid damage by over-pressurization of the low pressure systems.

If thisisolation is not established and maintained, the integrity of the low pressure systems can becompromised and lead to a loss of coolant accident with containment bypass. The RHR systemis a low pressure system (600 psig) which interfaces with the high pressure RCS(2235psig).

The RHR ACl function provides additional assurance that the isolation requirement isestablished and maintained.

The ACl feature automatically closes the RHR/RCS isolation valves when the pressure reaches a predetermined setpoint to ensure the integrity of the RHRsystem is maintained.

Figure 1-1 contains a simplified flow diagram of the RHR system and itsinterface with the RCS. This includes the RHR/RCS isolation valves which are closed by theACI circuit.The primary purpose of the RHR system is to remove decay heat from the ROS during plantcooldown and refueling conditions.

Inadvertent isolation of the RHR system from the ROS byspurious closure of the RHR/RCS isolation valves can cause loss of cooling events while inshutdown conditions.

In the mid-I1980s, investigations into loss of RHR cooling eventsconcluded that a number" of the events were related to inadvertent closure of the RHR isolation valves due to spurious actuations of the ACl circuit.

Additional background information isincluded in Section 2 of the WCAP-1 1736. Due to the loss of cooling accidents related to theACl and the limited benefit of the AOL in establishing and maintaining the RHRIRCS interface, the Westinghouse Owners Group completed a program in the late-I1980s to justify removal ofthe ACl function and provided WCAP-1 1736 to the NRC for review and approval.

This wascompleted as a generic assessment.

The NRC issued a Safety Evaluation (SE) on the WOAPthat concluded removal of the ACl was acceptable provided a number of key improvements were in place. Details of this analysis and SE are provided in Section 4.2.1.One requirement from the NRC's SE on WOAP-1 1736 was to perform plant specific evaluations because of numerous plant-specific differences and plant-specific data needed as input to theanalysis.

Plant-specific evaluations were developed for FNP in 1996; however, the [AR wasnot submitted to remove the ACl feature.

Details of this analysis are provided in Section 4.2.24.2.1 GENERIC ANALYSIS (WCAP-1 1736)The generic analysis that justified removal of ACl is documented in WCAP-1 1736-A. Theapproach used in WCAP-1 1736-A examined the impact from RHR ACl removal throughassessments in three areas:* Interfacing systems loss of coolant accidents (ISLOCA) with the impact on the ISLOCAinitiating event frequency used as the metric,*. RHR system unavailability with the impact on the system unavailability used as the metric,andE2-22 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report*Cold (low temperature) over-pressurization with the frequency of the low temperature overpressure (LTOP) sequence frequencies used as the metric.Since this was a deterministic justification with probabilistic

insights, each metric wasconsidered on its own merit and a common risk metric was not used.The Owners Group program divided Westinghouse Nuclear Steam Supply System (NSSS)plants into four groups based on number of ROS loops, number of RHR hot-leg suction lines,RHR suction valve arrangement, and RHR system design. Separate generic analyses werecompleted for each group. The values for the ISLOCA frequency, RHR system unavailability, and low temperature overpressurization event sequence frequencies were compared with theRHR ACl in place and with the RHR ACl removed and alternate compensatory actions in place.From the generic results it was concluded that removal of the RHR ACl provides an overallsafety benefit.

The detailed analyses were documented in the WOAP which was provided to theNRC for review and approval.

The generic analysis was approved by NRC via an SE that is contained in the WCAP. InSection 2.6 of the SE, it is stated:"The staff has no requirements based on the absolute values in the PRA analysis andwill not require a plant-specific PRA for each licensee proposing to remove the ACl.However, the licensee should do sufficient PRA and safety analysis to ensure that itsplant will not show results that will invalidate the conclusions of WCAP-1 1736."Based on this statement, utilities have performed plant-specific analyses to justify ACl removal.In addition, the Staff Position on RHR ACI removal is included in the SE. It is stated:'Furthermore, the staff finds that the removal of the ACI for Westinghouse plantscovered by WCAP-1 1736 can produce a net safety benefit provided that the following five key improvements are in place.*An alarm will be added to each RHR suction valvewhich will actuate if the valve isopen and the pressure is greater than the open permissive Setpoint and less than theRHR system design pressure minus the RHR pump head pressure

[justified byWCAP-1 1736].*Valve position indication to the alarm must be provided from the stem-mounted limitswitches (SMLSs) and power to the SMLSs must not be affected by power lockout ofthe valve [justified by WCAP-1 1736].*The procedural improvements described in WCAP-1 1736 should be implemented.

Procedures themselves are plant specific.

• Where feasible, power should be removed from the RHR suction valves prior to theirbeing leak-checked

[plant-specific].

• The RHR suction valve operators should be sized so that the valves cannot beopened against full system pressure

[plant-specific]."

E2-23 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.2.2 PREVIOUS FNP PLANT-SPECIFIC ANALYSISFNP-specific analyses of the impact of removing the ACl function from the RHR shutdowncooling (S DC) system, based on the WCAP-1 1736 methodology, were previously completed.

The approach used for the FNP-specific assessment is consistent with WCAP-1 1736. Thisplant-specific analysis was completed in 1996.Detailed probabilistic assessments were completed for assessing the impact of removing theRHR ACl on:* ISLOCA initiating event frequency,

• RHR system unavailability, and* Low temperature overpressurization sequence frequencies.

From the analysis, the following was concluded:

• ISLOCA initiating event frequency

-From a probabilistic standpoint, the deletion of the ACland the inclusion of a control room alarm is beneficial in reducing the frequency of aninterfacing system LOCA and the potential for a significant radionuclide release outsidecontainment.

The calculated ISLOCA initiating event frequencies were:o Frequency with RHR ACl -I1.44E-06Iyr o Frequency without RHR AC! (and with alarm) -1.1 5E-06/yr*RHR sYstem unavailability analysis

-The results of the quantification of the FNP RHRsystem unavailability fault trees show that with power lockout (which is currently performed with the RHR suction valves open when RCS temperature is reduced below 180°F), deletionof the ACl has little impact on the system unavailability.

Without power lockout, deletion ofthe ACl reduces the number of spurious closures of the suction valves, and thus, increases the availability of the RHR system. The calculated RHR unavailabilities are provided inTable 4-1.* Low temperature overpressurization sequence frequencies

-The conclusion drawn from theoverpressure analysis is that removal of the ACl has little impact on the consequences, ofLTOP events for FNP.The results of these FNP-specific probabilistic assessments are consistent with the results ofthe generic analyses in WCAP-1 1736.When these analyses were performed in the mid-I1990s, the best available methods and datasources were used. However, since that time, the ASME/ANS PRA Standard has been issued(Reference

6) with the NRC endorsing this Standard in Regulatory Guide 1.200 (Reference 7)and PRA methods and data have developed further.

The analyses supporting the FNP plant-specific application may not fully meet the expected technical adequacy defined by the PRAStandard.

For example,

1) data for component failure probabilities and event frequencies isE2-24 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reporttwenty years old, 2) the component boundaries and detail of the modeling necessary would bedifferent, and 3) human reliability analysis (HRA) methods were not well defined andinconsistently applied.

Therefore, these analyses would not meet the NRC expectations due tothe PRA requirements today. Due to these technical adequacy limitations, these analyses Werereviewed against the PRA Standard to identify gaps that need to be addressed to validate theresults stated above. This PRA peer review gap analysis is discussed in Section 4.3.4.2.3 RECENT FNP OPERATING EXPERIENCE WITH LOSS OF RHR COOLINGSNC's interest in implementation of this change at FNP was reinitiated following a loss of RHRcooling event at FNP Unit 1 resulting from the unexpected closure of motor operated valve(MOV) 8701IA. The following is taken from the FNP Apparent Cause Determination ReportCorrective Action Report 191314."With RCS level at the flange (i.e. 128'6") prior to core unload, with Reactor Headremoval imminent, the Operating crew was preparing for cavity flood-up.

Part of thepreparation for flood-up was closing the breaker for the RCS loop suction valve, whichhad been de-energized to comply with Low Temperature Overpressure Protection (LTOP) technical specifications.

When the breaker was closed, the RCS loop suctionvalve immediately began to stroke closed."When power was restored to the MOV, multiple annunciators related to loss of theLTOP function alarmed alerting the operators that the valve was closing.

The relevantAbnormal Operating Procedure for Loss of RHR was entered, and the 1A RHR Pumpwas secured for equipment protection since it had no suction supply. One attempt wasmade to stroke the RCS loop suction valve back open from the Main Control Board(MCB) with no success, and then Operations personnel were dispatched to Containment to manually stroke open the valve.'After the valve had been manually stroked open, the IA RHR Pump was restarted.

Thepump was secured for a total of 32 minutes.

During the time which the 1A RHR pumpwas secured, RCS temperature rose from 1 00°F and stabilized at 1 08°F. Core coolingwas provided at all times during the event by the 'B' Train RHR System."The unexpected closure of the RCS Loop Suction Valve was due to no power to the 'A'SSPS, whichkwas tagged out for performance of a plant modification.

With nopower to SSPS, a normally energized relay in the overpressure protection scheme forthe RCS loop suction valve was de-energized.

With the relay de-energized, the circuit tothe close contactor in the breaker for the RCS loop suction valve was completed.

Thiscondition was not realized prior to the event, and when the breaker was closed inpreparation for cavity flood-up, the MOV immediately began going closed."In Section 5 of the CAR it is stated, "The Extent of Condition was conducted based on thesystem design for auto closure of the RHR loop suction valve being susceptible to a power lossE2-25 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportin the Output Cabinet of 'A' Train SSPS." Further evaluations were done to determine ifadditional system design flaws existed that could impact plant reliability.

Corrective actionswere identified including removal of the ACI circuit.4.2.4 SUMMARY OF THE MEETING WITH THE NRC TO DISCUSS THE APPROACHA meeting was held with the SNC, Westinghouse and the NRC Staff on April 23, 2014 todiscuss the approach and obtain NRC feedback and expectations on the technical justification for the elimination of the RHR ACI at FNP.As discussed above, the generic PRA analysis supporting the ACI removal was completed inthe late 1960s and the FNP specific analysis was completed in 1996. PRA technical adequacyrequirements have changed significantly since that time, with the ASME/ANS issuing the PRAStandard and the NRC endorsing this St~andard with Regulatory Guide 1 .200. In addition, theuse of PRA in risk-informed decisions for plant-specific changes to the licensing basis hassignificantly changed with the issuance of Regulatory Guide 1.174. Due to these factors, adiscussion with the NRC on the approach to be followed and their expectations was considered prudent.The key points discussed at the meeting are summarized in the following:

• The NRC staff clarified that any future amendment to eliminate the RHR ACI would bebased on a deterministic review and that any "risk" information is only useful supplementary information that cannot be used as the basis for a staff decision.

For any risk information toform such a basis, the amendment would have to be submitted under RG 1.174, meetingthe requirements of RG 1 .200.*The SNC approach is consistent with the NRC's SE on WCAP-1 1736-A and the FNP-specific analysis.

The approach includes a review of the FNP-specific analysis against thecurrent ASME/ANS PRA Standard and RG 1.200, with the gaps identified and categorized.

Those gaps categorized as possibly impacting the decision-making process or results will beaddressed either by model changes, qualitative assessments, or sensitivity analyses.

• The analysis remains focused on the impact of the ACI removal on the Interfacing SystemLOCAs (ISLOCA)

(V-Sequence),

RHR System reliability, and low temperature overpressurization events. These are:o Interfacing system LOCAs -initiating event frequency o RHR System reliability

-RHR System unavailability for shutdown coolingo Low temperature overpressure events -consequence categories.

• The Staff also stated that WCAP-1 1736-A and the SE should be reviewed to ensure thatthere are no other gaps beyond the PRA analysis.

E2-26 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportTable 4-1: RHR System Unavailability Results from the FNP-Specific AnalysisCondition With RHR ACI Without RHRACI.RHR Cooling Initiation 3.94E-02 3.94E-02Short-term Cooling -Two of two RHR pump trains required (initial phase of cooldown)

With power lockout1 1.45E-02 1.45E-02Without power lockout' 1.72E-02 I1.45E-02 Long-term Cooling -One of two RHR pump trains required (later phase of cooldown)

With power lockout1 1.15 E-02 1.15 E-02Without power lockout' 4.97E-02 I1.15E-02 Notes:1. Power lockout refers to removing power to the RHR suction valves with the valves open,when the RCS temperature is reduced below l80°F.E2-27 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.3 TECHNICAL ADEQUACY OF FNP-SPECIFIC ANALYSISA Gap Assessment was performed to assess the FNP-specific probabilistic modeling previously completed against the current PRA Standard.

This gap assessment was effectively backfitting current technical requirements on an analysis that was considered adequate in its day. inaddition, the analysis deals with aspects that impact shutdown risk, for which no NRC-endorsed standard currently exists. Therefore, the gap assessment was based on Part 2 of theASME/ANS PRA Standard which addresses requirements for internal events at-power PRA.This is appropriate since the FNP-specific probabilistic assessments would need to meet theappropriate Sections of Part 2 through back references in the low power and shutdownstandard, if it was available.

4.3.1 APPLICABLE PRA STANDARD ELEMENTSThe gap assessment was performed for each of the High Level Requirements (HLR) for internalevents from Part 2 of the ASME/ANS PRA Standard.

These requirements were applied both toat-power scenarios, and, as appropriate, to shutdown scenarios.

The first step was to assess the applicability of each HLR to this specific application.

Since thisanalysis has a limited scope in terms of initiators, sequences,

systems, etc., the HLRs wereassessed for their relevance to this application.

The referenced analysis does not represent acomplete internal events PRA and, thus, the assessment of the PRA Standard is in the contextof those model elements included in the analysis.

For example, the high level requirement HLR-IE-A addresses the completeness of the initiating event identification process.

For thisanalysis, the only applicable initiating events, are interfacing systems LOCA (at power), loss ofRHR (at shutdown),

and overpressurization (at shutdown).

Therefore, the requirement forcompleteness of initiators applies only in a limited sense, sufficient for this application.

The Second step was to assess the FNP-specific analyses against the HLRs determined to beapplicable.

This was performed by reviewing the Supporting Requirements under each HLRand summarizing the overall assessment at the high level requirement.

The FNP-specific analyses were assessed against capability Category II of the Supporting Requirements.

4.3.2 GAP ASSESSMENT RESULTSTable 4-2 lists the findings identified in the Gap Analysis.

This table includes the following:

• Column 1: The Facts & Observations (F&O) Number including the HLR being addressed

• Column 2: A statement of the deficiency in meeting Capability Category II* Column 3: The categorization of the deficiency (the categorizations are listed below)* Column 4: Location of the resolution of the comment with regard to the FNP-specific analysis supporting the removal of the RHR ACI.E2-28 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportThe gaps identified in Table 4-2 are considered to be deficiencies in the 1996 ACl removalanalysis for FNP, Units 1 and 2. However, most of these deficiencies, identified as "Findings",

do not impact the overall conclusions from the analysis.

The deficiencies identified as"Suggestions" are not included in the table since these did not impact the technical aspects orresults of the assessment.

These deficiencies have been categorized into the following groupsto characterize the impact of each deficiency on the validity of the analysis for this application:

Group 1 The deficiency is conservative and does not need to be addressed.

Group 2 The deficiency has no impact on the decision-making process; this could be becausethe deficiency is not important to the evaluation or has no impact on the evaluation.

Group 3 ..The deficiency could impact the results, but can be addressed via a high levelquantitative assessment or a qualitative assessment.

Group 4 The deficiency is a key aspect of the analysis and needs a detailed assessment up toand could include a complete analysis revision of that part of the analysis.

The resolutions to these findings take three general approaches:

• New Analysis

-for Inter-facing Systems LOCA, the analysis was redone (see Section 4.4.5).* Qualitative Analysis

-for RHR and Cold (low temperature)

Overpressure, qualitative analyses were identified as adequate to address the assessment of ACl removal.

Theseare summarized in Sections 4.4.3 and 4.4.4 of this report, respectively.

• Several items are applicable to all three analyses.

These are in the areas of data anduncertainty.

The ISLOCA Analysis in Section 4.4.5 addresses these areas by using newanalyses.

For RHR and Overpressure

analyses, the qualitative analyses do not depend ondata and parametric uncertainty assessment.

These are discussed in Section 4.4.2.E2-29 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportTABLE 4-2: FINDINGS FROM THE FNP-SPECIFIC ANALYSIS GAP ASSESSMENT Deficiency

'Deficiency Section for Resolution SID Deficiency Category Discussion Initiating event estimation should be updated tobe based on recognized generic sources andGap 1 recent plant-specific operating experience.

HLR-IE-C-01 Specifically, the loss of RHR initiator based on Gru3Seto4.3 fault tree modeling should be assessed againstactual loss of RHR shutdown cooling events.Gap 2HLR-IE-C-02 No calculation or characterization of uncertainty Gop3 eto ..(related to could be found in the documentation.Grp3Seto4.2 H LR-DA-D)Initiating event model configurations should bereviewed against current plant configurations andoperating practices.

Specifically the ISLOCA IEGap 3 calculation should be confirmed since failureHRI--3 modes may have changed (e.g., power removed Group 4 Section 4.4.5to an RHR suction valve in Mode 1). It is alsorecommended that credit for the RHR reliefvalves should be considered in the ISLOCAscenarios.

For the RHR unavailability calculations, themission time for equipment should be reviewed.

Gap 4 Updated methods (e.g., support system initiating HLR-SC-A-01 event fault tree quantification) for systems that Gru3Seto443 can lead to an initiating event may be moreappropriate.

Success criteria for the RHR unavailability calculation should be reviewed and updated asGap 5 appropriate.

One train of RHR may be sufficient HLSA2 to remove decay heat. Some of the RHR Group 3 Section 4.4.3unavailability calculations assume both trains ofRHR are required; this may be inflating thebenefit of the removal of ACI.Gap 6HLR-SY-B-01 Common cause failures should be addressed in(related to the RHR unavailability analysis.

Group 3 Section 4.4.3H LR-DA-D)

_________

Confirmation that no common cause failure (CCF)Gp7 combinations are required for the ISLOCA Group 2 Section 4.4.5HLR-S-B-02 initiating event should be documented.

Gap 8 Support system dependencies should beHLR-SY-B-03 addressed in the RHR unavailability analysis.Gru2Seto443 E2-30 Enclosure 2 to NL-1 5-1 055-FNP RHR Autoclosure Interlock Removal ReportTABLE 4-2: FINDINGS FROM THE FNP-SPECIFIC ANALYSIS GAP ASSESSMENT Deiiny Deficiency Deficiency Section for Resolution IDCategory Discussion Gap 9 Upgrade the HRA methodology to evaluate theHLR-HR-G-O1 cognitive failures as well as the execution Group 3 Section 4.4.5failures.

Perform a consistency review on the post-initiator actions.

During a consistency reviewone might challenge the reasonableness ofestimates given for isolating RHR given anoverpressure event. Two human errorprobabilities (HEPs) were evaluated:

one beforeGa 0 the ACI is removed and power is still removed to Group 3 Section 4.4.5HLR-H-G-02 the RHR suction valves and one where ACI isremoved, power is provide to the RHR suctionvalves, and an alarm is added on high pressure.

Amore significant difference in results may beexpected over the small decrease in probability between the two actions.Generic data should be updated to more recentrecognized sources (e.g., NUREG/CR-6928).

Gap 11 Generic data was the primary source forHLR-DA-C-O1 component failure rates. Scope of plant-specific Group 3 Section 4.4.2data collection should be expanded forcomponent failure modes that are pertinent tothe analysis.

Estimation of realistic parameters for significant basic events should be updated to be based onGap 12 recognized generic data sources (e.g., NUREG/CR-Gru3Seto4.2 HLR-DA-D-01 6928) and recent plant-specific operatingGru3Seto4..

experience.

A Bayesian update process isrecommended.

An event tree quantification method was used togenerate the likelihood of having anGap 13 overpressurization event. No evidence of theHLR-QU-B-01 impact of truncation or mutually exclusive events Group 2 Section 4.4.4could be found. No evidence on the treatment ofdependencies could be found.Gap 14 Address operator dependencies using a more Gru3Seto445 HLR-QU-C-01 current systematic approach.Gru3Seto4..

Gap 15HLQE1 Characterize the uncertainties in quantification.

Group 3 Section 4.4.2E2-31 Enciosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report4.4 PROBABILISTIC ASSESSMENT The probabilistic justification for RHR ACl removal is based on the FNP-specific probabilistic assessments along with addressing the gaps discussed in Section 4.3. The identified gaps areaddressed either qualitatively or quantitatively.

The qualitative assessments are used where theFNP-specific analyses have been found to be rigorous and acceptable, but do not meet certainaspects of the ASME/ANS PRA Standards.

Quantitative analyses are used where the FNP-specific analyses are based on outdated methods and modeling techniques that need to beupdated to obtain defendable results.

These assessments are based on the current FNPdesign and operation as well as design and operational changes that SNO is committed toimplement with the removal of the ACl.4.4.1 OVERALL APPROACHThe FNP-specific analyses demonstrated that the conclusions in WCAP-1 1736 are applicable toFNP, that is, the RHR ACI feature can be removed provided several key improvements areimplemented.

The probabilistic assessments addressed the three key areas that would beimpacted as a result of RHR ACl deletion:

RHR system unavailability, low temperature overpressure transients, and interfacing system LOCAs. The first two areas, RHR sYstemunavailability and overpressure transients, can impact risk with the plant shutdown in Modes 4,5, and 6 with RHR operating in shutdown cooling mode. The deficiencies in the RHR systemand overpressure analyses that were identified as 'Findings" are addressed in Sections 4.4.3and 4.4.4, using a qualitative assessment approach.

The third issue, ISLOCA, is applicable inModes 1, 2 and 3 and characterized by the at-power PRA. This is addressed by a quantitative probabilistic assessments approach summarized in Section 4.4.5.As discussed in Sections 4.2.1 and 4.2.2, the generic approach used in WCAP-1 1736-A andapproved by the NRC and the EN P-specific analyses were quantitative and were based onISLOCA initiating event frequency, low temperature overpressure sequence frequencies, andRHR unavailability.

All metrics showed an improvement or essentially no impact with removal ofthe RHR ACl and implementation of compensatory measures.

The approach and resultsprovided in this current report is consistent with the WCAP-1 1736 approach, but addresses technical shortcomings of the previous FNP-specific analyses as measured against theASME/ANS PRA Standard.

As noted above, these updated analyses were done qualitatively and quantitatively depending on the severity of the gaps.4.4.2 ASSESSMENT OF GAPS APPLICABLE TO ALL ANALYSESGaps 2, 11, 12, and 15 provided in Table 4-2 are identified as "Findings' and are generally applicable to all three analyses.

Each is discussed in more detail in the following.

Gaps 2 and15 address uncertainty and are addressed together.

Gaps 11 and 12 address data andparameters and are addressed together.

E2-32 Enciosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportGap 2 Description (IE-C-02):

No calculation or characterization of uncertainty could be foundin the documentation.

Gap 15 Description (QU-E-O1):

Characterize the uncertainties in quantification.

Discussion:

A full uncertainty assessment including uncertainty identification andcharacterization has not been completed for all these analyses.

A realistic modeling approachwas used in the analysis.

This approach directly followed the analysis approach in WCAP-11736 which was reviewed and approved by the NRC.Removal of RHR ACI is not a risk-informed application based on the requirements provided inRegulatory Guide 1.174, but a deterministic assessment with probabilistic insights thatconsiders the impact of the change on three different parameters; RHR unavailability, lowtemperature overpressure sequence frequencies, and ISLOCA initiating event frequency.

Thisprobabilistic assessment supports a deterministic argument that removing the RHR ACI is abeneficial plant change. WCAP-1 1736 and FNP-specific assessments note that this change isa benefit to RHR availability and ISLOCA initiating event frequency, and has little impact on theconsequences of LTOP events, and does not trade one off against the other.As discussed in this document, this probabilistic assessment supports a qualitative argumentthat removing the RHR ACI is aplant benefit.

This has been the conclusion of industrydocuments evaluating the causes of loss of shutdown cooling and what can be done to addressthis issue, and the generic study completed by the Owners Group (WCAP-1 1736). It isgenerally agreed in the industry and supported in this document that ACI removal will benefitRHR availability and LTOP protection.

Therefore, a detailed characterization of uncertainties forthese two assessments would not provide significant insights that will alter the conclusions ofthe analysis, and therefore, is not necessary.

The results of these two FNP-specific assessments agree with the generic assessment in WCAP-1 1736 so identification andcharacterization of uncertainties provide no additional benefits.

The primary purpose of the ACI feature is to ensure thie RHR/RCS isolation valves are closedon return to power, thus reducing the chance of an ISLOCA event while at-power.

Therefore, the impact of the proposed change on ISLOCA initiating event frequency is the key to thejustification for ACI removal.

Evaluation of the compensatory, actions to address the primaryissue of ISLOCA needs to be considered, therefore, uncertainties associated with the ISLOCA.analysis need to be considered.

A revised ISLOCA analysis is provided in Section 4.4.5 whichaddresses the gaps identified related to ISLOCA. This includes uncertainty identification andcharacterization.

==

Conclusion:==

Uncertainty identification and characterization will not impact the results of theseassessments of the proposed change on RHR unavailability or LTOP protection.

With regard toISLOCA, uncertainty identification and characterization is provided in Section 4.4.5.4.E2-33 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportGap 11t Description (DA-C-01):

Generic data should be updated to more recent recognized sources (e.g., NUREG/CR-6928).

Generic data was the primary source for component failurerates. Scope of plant-specific data collection should be expanded for component failure modesthat are pertinent to the analysis.

Gap 12 Description (DA-D-O1):

Estimation of realistic parameters

~for significant basic eventsshould be updated to be based on recognized generic data sources (e.g., NUREG/CR-6928) and recent plant-specifiC operating experience.

A Bayesian update process is recommended.

Discussion:

The Owners Group generic and the FNP-specific analyses supporting removal ofthe RHR ACl feature are probabilistic assessments that suppoi-t the deterministic or qualitative arguments.

This benefit is clear for the RHR unavailability and LTOP assessments.

The use ofmore recent generic or plant specific data in the generic and FNP-specific analysis could impactthe absolute values, but would not impact the changes in the probabilistic measures.

The key parameter to the justification for RHR ACl removal is the ISLOCA initiating eventfrequency.

This analysis has been updated and includes FNP-specific component failure ratedata. This analysis is further discussed in Section 4.4.5.Conclusion:

The data used .in the analysis will not affect the conclusions of the impact of theproposed change on RHR unavailability or LTOP protection.

With regard to ISLOCA, updatedplant-specific data and parameters are used in the revised analysis provided in Section 4.4.5.4.4.3 GAP ASSESSMENT FOR LOSS OF RHR SHUTDOWN COOLING ASSESSMENT Gaps 1, 4, 5, 6, and 8 provided in Table 4-2 are identified as "Findings" and are specifically directed at the RHR system unavailability.

Each is discussed in more detail in the following.

Gap 1 Description (HLR-IE-C-01):

The loss of RHR initiator based on fault tree modelingshould be assessed against actual loss of RHR shutdown cooling events.Discussion:

The FNP-specific RHR unavailability analysis is based on a detailed fault tree todetermine the impact of the proposed change on RHR unavailability.

Three phases of cooldownwere considered:

initiation of RHR, short-term

cooling, and long-term cooling.

Two conditions were considered:

with and without power to the RHR suction valves during cooldown operation.

(Power is removed with the suction valves open when the RCS is cooled down below 1 80°F tosupport the LTOP function.)

The results indicate that with power not removed from the RHRsuction valves, a significant reduction in RHR unavailability is expected and with the powerremoved from the RHR suction valves, the impact on RHR unavailability is essentially zero.The original justification for ACl deletion identified in the NRC SE included in WCAP-1 1736-Aincluded a large number of loss of RHR events due to ACI. In the period from 1976 to 1983, atotal of 130 losses of RHR occurred, of which 37 were due to ACI.E2-34 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportElectric Power Research Institute (EPRI) TR-1 021176 (Reference

8) summarizes more recentUS operating experience related to loss of decay heat removal (DHR). Over the twenty-year span from 1990 to 2009, a total of 255 losses of DHR from all causes were identified for bothPWRs and BWRs. Of that total, over half (137) involved loss of DHR due to closure of DHRisolation valves. However, BWRs accounted for the vast majority of the 137 events, with roughly14 isolation events occurred in PWRs.In the most recent decade (2000 to 2009), a total of 70 losses of DHR occurred, of which aboutone-third (26) were due to DHR isolation.

PWRs accounted for about half of the losses of DHR(34), but only two isolation events. Table A-2 of EPRI TR-1 021176 lists these two events, usingthe designator ISORHR. These two events are described in the following:

3/1/2002 (Watts Bar 1)"While attempting to realign the RHR system from RWST supply to RCS loopoperation and simultaneously performing a full flow RHR test and filling thereactor cavity, operators isolated the common suction to the Residual HeatRemoval (RHR) pumps on two occasions over a three minute span. Power hadbeen removed from a rack which provided a permissive pressure switch signal totwo valves which required manipulation during the realignment.

Two isolations, but can be considered one. 3 minutes total time from first isolation to restoring SoC after 2nd isolation.

RCS was 100°F with cavity flooded or nearly flooded."

11/27/2006 (Ft. Calhoun)'The plant was being cooled down and depressurized.

After SOC was initiated, itwas desired to maintain a RCP operating to cool down the RV head with theRCS. Two RCPs in the same loop were kept operating, which provided moremain spray flow than had been available in the past with only one RCP. Thepressure band for operating reactor coolant pumps while SDC is in service is 225psia (RCP NPSH) to 250 psia (SOC suction valves interlock setpoint).

Theoperator maintained the RCS in a band of 225 -235 psia for several hours priorto the event, controlling pressure with Pzr heaters and modulating the main spraycontrol valves. The RCPs were secured to commence a Pzr cooldown.

RCSpressure rose when the first RCP was secured, but was not noticed.

When thesecond RCP was secured, RCS pressure reached the SOC suction isolation valves interlock

setpoint, which closed the valves. The running SOC pumps wereconservatively stopped to preclude any possibility of pump damage. RCSpressure was lowered, the shutdown cooling suction isolation valves werereopened, and SOC reinitiated.

RCS temperature (CET) rose from 128°F to133O F."'A search for DHR isolation events in 2010 to 2013 was conducted using the INPO ICESdatabase.

This identified only one additional ISORHR event previously discussed in Section4.2.3:E2-35 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report10/15/2010 (FNP Unit 1)"During preparation for the Refueling Canal flood-up with a full reactor core, aReactor Coolant System (RCS) loop suction valve spuriously went closed whenits associated breaker was closed. Part of the preparation for reactor cavity flood-up was closing the breaker for the RCS loop suction valve, which had been de-energized to comply with LTOP technical specifications.

When the breaker wasclosed, the RCS loop suction valve immediately began to stroke closed."The 1A Residual Heat Removal (RHR) pump was secured for equipment protection per the guiding Abnormal Operating Procedure.

Plant personnel wereable to manually stroke open the RCS loop suction valve and restart the 1A RHRpump. The 1A RHR pump was secured for a total of 32 minutes.

During the timethat the 1A RHR pump was secured, RCS temperature rose from 100F andstabilized at 108F. Core cooling was provided at all times during the event by the'B' Train RHR System."Thus, the frequency of DHR isolation events has decreased over nearly four decades ofoperating experience, but this type of event does continue to occur. Note, the 2002 Watts Barevent was due to an operator error; the 2006 Ft. Calhoun event was a different ACI system (CEdesign).

Only the FNP event of 2010 is directly related to Westinghouse-designed A Cl system.Recent industry operating data shows that loss of cooling events still occur, but due to improvedplant experience in shutdown modes including removal of the ACI circuit at many plants, fewerloss of RHR cooling events can be directly attributed to ACI. One recent event related to ACIoccurred at FNP, as described above.Conclusion:

The original RHR unavailability analysis demonstrated an improvement in RHRavailability with elimination of the RHR ACI. In general, loss of RHR cooling events havedecreased significantly from when these analyses were initially completed and loss of RHRevents related to the RHR ACI have also decreased, but these events still represent an adversesafety impact and the removal of the RHR ACI will provide a safety benefit.

Therefore, theconclusions of WCAP-1 1736 and the FNP-specific analyses remain applicable.

Gap 4 Description (HLR-SC-A-01):

For the RHR unavailability calculations, the mission timefor equipment should be reviewed.

Updated methods (e.g., support system initiating event faulttree quantification) for systems that can lead to an initiating event may be more appropriate.

Discussion:

A support system initiating event analysis for loss of decay heat removal due toinadvertent ACI actuation would be equivalent to the analyses presented in WCAP-1 1736 andthe FNP-specific analysis.

The mission time of these cases is the refueling outage durations ofinterest.

During the RHR System Initiation case the mission time is 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; however, failures ofACI would not cause a loss of decay heat removal due to availability of steam generator cooling.The Short Term Cooling case has a the mission time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and the Long Term CoolingE2-36 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportcase has a mission time of 6 weeks. For these cases, a spurious operation of the ACl circuitduring the mission time would cause loss of decay heat removal when the RHR system suctionvalves are not de-energized.

Removing ACl would eliminate this failure mode. Therefore theanalysis conclusions are not impacted by differences in mission time or different calculational models.Conclusion:

Although different approaches to the RHR unavailability analysis could have beenused, the mission time has no impact on the benefit of ACI removal.

The analysis conclusions remain applicable.

Gap 5 Description (HLR-SC-A-02):

Success criteria for the RHR unavailability calculation should be reviewed and updated as appropriate.

One train of RHR may be sufficient to removedecay heat. Some of the RHR unavailability calculations assume both trains of RHR arerequired; this may be inflating the benefit of the removal of ACl.Discussion:

Using a different success criterion for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (i.e. requiring only one RHRtrain for success as opposed to two trains) is analogous to the success criteria used in the longterm cooling cases. The results would be roughly proportional to the mission time used;however, the RHR unavailability without the ACl circuit would still be lower than those caseswith the ACl circuit.

If the success criterion is one RHR train, then inadvertent isolation of thattrain would lead to loss of DHR, but a second train would be available for backup protection.

With two trains required, inadvertent isolation of either one would lead to loss of DHR with nobackup train. Although one train may be adequate, removal of ACI eliminates a potential pathto loss of DHR regardless of the success criteria.

==

Conclusion:==

Use of different success criteria for RHR heat removal has no impact on theconclusion of the benefit of removing the RHR ACl circuit.Gap 6 Description (HLR-SY-B-01):

Common cause failures should be addressed in the RHRunavailability analysis.

Discussion:

Modeling of common cause failure of ACI circuit components to the two sets ofsuction valves could increase the contribution of the ACI failure to RHR unavailability.

Alsomodeling common cause failures of RHR components may increase the unavailability of theRHR. But the RHR and ACI common cause failure contributions will impact all casesconsidered.

RHR unavailability will increase by including the common cause contributions forboth the case with the ACI and the case without the ACI, but the change in unavailability will notbe impacted.

Adding the ACI common cause will increase the unavailability for the case withACI, but removing the ACI eliminates this source of common cause, therefore, the RHRunavailability will improve.

Therefore, adding the RHR and ACI common cause failurecontributions will not impact the analysis conclusions.

E2-37 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportConclusion:.

Modeling of the RHR and ACl component common cause failures will not impactthe conclusions of the analysis that the RHR unavailability will be improved following removal ofthe ACl."Gap 8 Description (HLR-SY-B-03):

Support system dependencies should be addressed in theRHR unavailability analysis.

Discussion:

Support systems are important to the operation of components that require electricpower (Alternating and Direct Current),

cooling (water or air), and actuation signals.

Forexample, this includes pumps that are required to start and run, and valves that are required tochange position.

When the plant is on RHR cooling, the RHR/RCS isolation valves are requiredto remain open and the RHR system is required to continue to run. Modeling support systemsto the pumps and to the ACl circuit would be required to determine an absolute value for RHRunavailability.

But this is an assessment of the change in RHR unavailability with and withoutACl and modeling of support system dependencies will affect this assessment only to the extentthey support the ACl circuit (e.g., 120V instrument power). However, modeling of ACl supportsystem dependencies that can lead to spurious closure of the RHR/RCS isolation valves willincrease the RHR unavailability for the case with RHR/ACI installed.

But for the case withRHR/ACI removed, the ACl contribution is removed.

Therefore, including the support systemswould provide a larger benefit for ACl removal.Conclusion:

Not modeling the support system dependencies has no impact on the conclusion of the analysis.

Removing the ACl circuit eliminates a potential failure mode that could lead toclosure of the RHR/RCS isolation valves, therefore, the RHR unavailability will improve with itsremoval which supports the conclusions of the analysis.

Concluding Statement Deleting ACl will be a safety improvement with regard to RHR shutdown cooling.

ACl deletioneliminates the potential for inadvertent closure of the RHR suction isolation valves by removingthe only circuit that provides an auto-closure signal to these valves. Since ACl serves nofunction to support shutdown

cooling, ACl removal can be judged to be a safety improvement for shutdown cooling by qualitative considerations.

The original justification for ACl deletion was the large number of loss of RHR events that weredue to ACl actuation.

Of the 130 losses of RHR that occurred in the industry from 1.976 to 1983,a total of 37 were due to the ACl circuit.

The current data for loss of RHR shows significantly fewer events due to inadvertent closure of RHR suction valves, as well as significantly fewerlosses of RHR in general.

This reduction in the number of events is likely due to the number ofplants that removed the ACl circuit as Well as increased focus on outage risk management.

However, for those plants with ACl, the potential for loss of RHR due to inadvertent AClremains.E2-38 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportFor FNP specifically, the potential exists for closure of RHR suction valves based on SSPSrelays that are de-energized-to-actuate the ACl circuit.

This was the cause of the FNP Unit 1event of October 15, 2010:"The unexpected closure of the RCS Loop Suction Valve was due to no power to the 'A'Train SSPS. With no power to SSPS, a normally energized relay in the overpressure protection scheme for the RCS loop suction valve was de-energized, due to its powerbeing derived from the output cabinet of A-Train SSPS. With the relay de-energized, theclosed circuit for the RCS loop suction valve was completed."

Thus, for the FNP units, inadvertent actuation of ACl remains a potential challenge to RHRshutdown cooling and ACl removal would be a safety improvement with regard to the shutdowncooling function.

4.4.4 GAP ASSESSMENT FOR OVERPRESSURE RELIEF AT SHUTDOWN ASSESSMENT The RHR suction relief valves provide LTOP protection for the RCS during Modes 4, 5, and 6with RHR in service.

These relief valves are designed to open at 450 psig and each provides900 gpm relief capacity.

With isolation

.of RHR via ACl actuation, the RHR suction relief valves'would be isolated from the RCS and would no longer provide the overpressure relief function.

With RHR isolated, the RCS overpressure relief is provided by the pressurizer (PZR) poweroperated relief valves (PORVs).

However, the PORVs are not designed to provide LTOPprotection and would open only at their manually controlled setpoint.

Therefore, actuation ofACl would serve to isolate the designed LTOP protection.

In fact, to support the LTOP function, the current operating procedures direct the open RHR suction MOVs be depowered when theRCS is cooled below 1 80°F. This effectively bypasses the ACl circuit, but also complicates theresponse to a loss of RCS inventory out the RHR system, where closure of the RHR suctionisolation valves would be necessary.

AC! also serves to isolate the low-pressure RHR system from overpressure conditions.

This isredundant to the function of the RHR relief valves which are sized to protect the RHR systemfrom overpressurization.

The ACl protection function is limited to slow-acting overpressure transients due to the response time for the RHR suction valves to transfer from full-open to full-close. With the RCS in water solid conditions, the overpressure transients from mass additionor heat addition would occur too quickly for A~l to provide complete protection.

Longer termmitigation of this event must be provided by operator

actions, with or without ACI. The operatormust eliminate the overpressure condition so that RHR shutdown cooling can be restored.

The generic analysis and FNP-specific analysis used event trees to model the mitigating actionsfollowing the occurrence of LTOP events. Consideration was given to automatic and manualmitigating actions.

Pressure relief via the RHR relief valves and the pressurizer PORVs arecredited.

A number of different endstates are defined depending on the success or failure of theequipment and manual actions.

These endstates define the pressure state, loss of coolantE2-39 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportstate, and RHR/RCS isolation state. The endstate frequencies generally show improvement (reduced frequencies) or very small degradations

(<1 E-10/lyr) with the ACl removed.Gap 13 provided in Table 4-2 is identified as a "Finding" and is specifically directed atoverpressure relief at shutdown.

This is discussed in more detail in the following.

GaD 13 Description (HLR-QU-B-O1):

An event tree quantification method was used togenerate the likelihood of having an overpressurization event. No evidence of the impact oftruncation or mutually exclusive events could be found. No evidence on the treatment ofdependencies could be found.Discussion:

Although no evidence is provided for truncation impact, the FNP-specific assessment show some frequencies on the order of 10-11 and 10-13, which indicates a very lowtruncation was applied if one was used. Typically for simple event tree analyses, truncation isnot important since all of the endstate frequencies can be calculated.

A fault tree linkingapproach was not used so truncation is not as important.

Therefore, the truncation limit is notexpected to impact the results.* With regard to mutually exclusive events, if the event is included as a top event in the eventtree, then mutually exclusive events are addressed by the structure of the event tree and in thedetermination of which events to address in each sequence.

Mutually exclusive events in a faulttree typically are directed at test and maintenance activities that cause the unavailability ofredundant trains when at least one of the trains is required to be available.

The fault trees usedto model RHR suction valve closure failure include modeling for the RHR isolation valveactuation failures which includes operator action for the isolation where applicable.

Test andmaintenance is not included in the model, therefore mutually exclusive events are not in themodel and the analysis results are not impacted.

Dependencies of interest are those between operator actions and support systems.

Operatoractions are included in basic events RSV (suction valves fail to close), OA1 (operator stopspump), OA2 (operator opens PORV), and POR (PORVs reseat).

The only operator actiondependency that needs to be addressed is between OA1 and OA2 following failure of OAI.This is addressed in the FNP-specific analysis.

Dependencies related to support systems arelimited to control power for the RHR/RCS isolation valves and PORVs. These powerdependencies are not expected to have any impact on the analysis conclusions since theyimpact the different scenarios being evaluated similarly.

Therefore, the approach for addressing dependencies is acceptable and does not impact the results.Conclusion:

The FNP-specific analysis provides a quantitative assessment of the LTOPfunction on ACl removal and this analysis remains acceptable.

The impact of the approach toquantification truncation limit, mutually exclusives, and treatment of dependencies is notexpected to impact the analysis results or conclusions.

E2-40 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportConcluding Statement ACl removal will improve the reliability of the LTOP system by allowing the RHR relief valves tofunction in a mitigation capacity.

Currently, with ACl actuation, the RHR relief valves will beisolated by closure of the RHR suction valves. With AC! removed, the RHR relief valves remainavailable to protect the RHR system from overpressure and are designed to operate for anycredible mass addition.

The impact of ACI removal on RHR system overpressure protection isnegligible due to the slow response of the RHR suction isolation valves and the design of theRHR relief valves.In addition, the removal of ACI also eliminates the need for the power lockout with the RHRSystem suction valves open that is currently performed with RCS temperature below 180°F.Maintaining the RHR System suction valves powered in shutdown modes improves thecapability of operators to isolate RHR from the RCS in the event of a leak in the RHR system.4.4.5 GAP ASSESSMENT FOR ISLOCA INITIATING EVENT FREQUENCY Gaps 3, 7, 9, 10, and 14 are specifically directed at the FNP-specific ISLOCA analysis.

Thesegaps are provided in Table 4-2 and discussed in more detail in Section 4.4.5.5.Gap 3 was considered Deficiency Category 4; Gaps 9, 10, and 11 were considered Deficiency Category 3; and Gap 7 was considered Deficiency Category

2. Due to the one gap identified asDeficiency Category 4, it was decided to revise the ISLOCA initiating event frequency analysisto be consistent with the latest industry practice.

This update addresses the five gaps identified above.Gaps 2 and 15 are applicable to all three analyses.

These gaps are discussed in Section4.4.5.5 for ISLOCA.4.4.5.1 ISLOCA PATHWAYSThe RHR is a low pressure system, with a design pressure of 600 psig. The high pressure/low pressure interface on the suction side of each of the RHR pumps is normally isolated by twoclosed motor-operated valves (MOVs). One of the MOVs in each suction path is normallyenergized in Mode 1, but all four MOVs are equipped with interlocks to prevent them from beingopened with RCS pressure above the RHR system design pressure.

However, failure of theseries valves due to rupture or control system failures could result in over-pressurization of theRHR piping and an ISLOCA outside of containment.

The pathway configurations are providedon Figure 1-1. The isolation valves are 8701A and 8701 B on RHR train A, and 8702A and8702B on RHR train B, with power provided from the train indicated in the valve ID (e.g., 8701Ais train-A powered).

Relief valves on each RHR line, 8708A on train A and 8708B on train B,provide protection against over pressurizing the RHR lines.E2-41 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.4.5.2 ISLOCA MODELA base fault tree was developed to model the ISLOCA pathways between the RHR and RCS.This model reflects the plant as operated with the ACI feature installed.

(Note: Because thisISLOCA model is used only to assess the impact of the ACl circuit, it addresses only the RHRsuction isolation paths; other potential ISLOCA paths are not relevant to this assessment.)

Thebasis for the fault tree model is:* Two isolation valves are available in each RHR line.* One of the two isolation valves in each line (8701 B train A, 8702B train B) has electrical power removed when the plant is at-power (Step 5.25.3 of FNP-1-UOP-1.1 or Step 23.c ofFN P-2-UOP-1

.1 ).* RHR relief valves provide overpressure protection.

• If the RHR is overpressurized, then the RHR piping fails.* The ACl on the RHR isolation valves provides a signal to close the RHR isolation valves ifthe RHR pressure exceeds 700 psig.* Operators close both isolation valves in each RHR line following procedures prior to plantreturn to power.* Both isolation valves in either line in the open position prior to returning to power isdetectable since the plant will not be able to pressurize.

Leak testing the valves prior to returning to power and sizing of the isolation valve operators sothe valves cannot be opened against full system pressure are not credited in the analysis.

The base fault tree and associated cutsets are provided in Appendix A. RHR/RCS isolation iscompromised if both isolation valves in one RHR line are either in the open position or faileddue to internal leakage and the corresponding relief valve is failed. Isolation valves 8701 B trainA and 8702B train B may be in an open position if the operator fails to remove power to thevalve and the valve spuriously transfers open or if the operator fails to close the valve and theACI feature fails. Isolation valves 8701IA train A and 8702A train B, the isolation valves withpower available in Mode 1, may be in an open position if the valve spuriously transfers open orif the operator fails to close the valve and the ACl feature fails.This base fault tree was modified to reflect the changes with the ACl feature removed.

With theproposed removal of the ACl feature, the RHR isolation valves (8701lA/B and 8702A/B) will not-close automatically on increasing RCS pressure greater than 700 psig. In order to remove theACI feature, five design-related and operations-related changes were provided in the N RC'sSafety Evaluation (included in the WCAP-1 1736). The commitments and their impacts on thefault tree model in this analysis are listed in Table 4-3. The key changes to the fault tree modelE2-42 Enclosure 2 to NL-15-1055 FNP RHR Autociosure Interlock Removal Reportare Items 1, 2, and 3 on Table 4-3. Item 4, leak testing the valves prior to returning to powerand Item 5, sizing of the isolation valve operators so the valves cannot be opened against fullsystem pressure, are not credited in the analysis.

The revised fault tree and associated cutsets are provided in Appendix B. RHR/RCS isolation iscompromised if both isolation valves in one RHR line are either in the open position or faileddue to internal leakage and the corresponding relief valve is failed. An isolation valve may be inan open position if the operator fails to remove power to the valve and the valve spuriously transfers open or if the operator fails to detect the valve is in the open position during startup viathe new alarm system and close it.Key Modeling Data:*Failure values for fail-to-close on demand and transfer open for isolation valves 8701A/Band 8702A/B, and failure rates for limit switches, pressure transmitters, relays, and contactsare from the FNP Data Analysis Notebook (Reference 9). The values used are:o Isolation valve fail-to-close on demand = 3.97E-03/demand o Isolation valve transfer open = 4.45E-08/hr o Isolation valve limit switch fail-to-operate

= 1 .70E-O7/hr o Pressure transmitters fails = 1.1 7E-04/demand o Bistable fails = 5.44E-04/demand o Interlock relay fails on demand = 2.48E-05/demand o Alarm relay contact fail-to-close

= 8.50E-06/demand

• Valve internal leakage failure probability and the relief valve fail-to-open on demand arefrom NUREG/CR-6928 (Reference 10). The values used are:o Valve internal leakage = 2.02E-09/hr o Relief valve fail-to-open

= 2.77E-03/demand

• Pre-initiator HFEs are applied to the isolation valves left mis-positioned during startup andfailure to remove power from isolation valves. In addition, failure of the operator torecognize the isolation valve is open during startup (respond to the new alarm) is included inthe model. The HRA Calculator was used to determine these human error probabilities.

The values used are:o Isolation valves left mis-positioned during startup = 1 .65E-03o Electric power not removed from the isolation valves = 8.23E-04E2-43 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report'o Failure of the operators to recognize the isolation valve is open during startup =2.66E-04Common Cause Failure ModelingComponents of similar manufacture and function, and with the same maintenance and testactivities are subject to common cause failure (CCF). Consistent with current practice, onlyactive CCFs are included as contributors to the ISLOCA initiating event frequency portion of theISLOCA model. This eliminates including CCF for the isolation valve failure modes of transfers open and internal leakage.

Also modeled is the failure of the isolation valves to close. Failureto close both RHR suction valves 8701A/B and 8702A/B during startup is not considered acredible failure mode since the condition would be apparent and corrected.

RCS pressurization could not proceed with two isolation valves in the samne RHR line open. Therefore, CCF of RHRsuction valves on the same train to close is not modeled.

CCF modeling of other components, such as the RHR relief valves is not required since these components are not in the samecutsets.HRA Dependency Assessment The operator actions to close the RHR/RCS isolation valves and to remove power from thevalves are judged to be independent.

Each step is verified to have been correctly completed and the steps for these aCtions, although in the same procedure, are at different stages of thestartup and separated by a significant time period with a low level of stress.The operator actions to close the RHR/RCS isolation valves during startup and to respond tothe new alarm systemn are judged to be independent.

The step to close the RHR/RCS isolation valves is verified completed earlier during the startup procedure.

Responding to an alarm toclose the isolation valves will occur significantly later, after the RCS pressure exceeds the openpermissive setpoint following an alarm response procedure.

The combination the three operator actions (close the RHR/RCS isolation valves, remove powerfrom the valves, and to respond to the new alarm system) are also judged to be independent forthe reasons discussed above.4.4.5.3 RESULTS OF ISLOCA INITIATING EVENT FREQUENCY ANALYSISThe ISLOCA initiating event frequency was calculated for the current plant operating configuration with ACl installed and for the plant configuration with AC! removed and thechanges to operating practices and procedures credited in the analysis.

The results are:* ISLOCA initiating event frequency with ACI = 8.46 E-09/yr* ISLOCA initiating event frequency without ACl = 7.16E-10/yr

• Reduction in ISLOCA initiating event frequency

= 7.74E-09/yr E2-44 Enciosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportThe frequency of an ISLOCA via the RHR suction lines decreases with the removal of the AC!feature.

In the case with AC! removed, the ACl is replaced with an alarm system to indicate anisolation valve is open on increasing RCS pressure with an operator action to close the valve.In addition, both RHR suction isolation valves in each train will now be required to have powerremoved at startup, as opposed to only one in each train as the current practice.

4.4.5.4 UNCERTAINTY IDENTIFICATION AND CHARACTERIZATION Table 4-4 provides an assessment of the key uncertainties and potential impact on theconclusions of this assessment.

The key uncertainties identified and characterized are HRAUncertainty, HRA Dependency, Passive CCF, and Low Pressure Piping and Component Failure.

Each is addressed and discussed in Table 4-4. It is concluded that the impact ofalternate modeling approaches would not have a significant impact on the calculated frequencies and would not impact the conclusions.

4.4.5.5 DISPOSITION OF ISLOCA INITIATING EVENT FREQUENCY ANALYSIS GAPASSESSMENT FINDINGSGap 2 Description (IE-C-02):

No calculation or characterization of uncertainty could be foundin the documentation.

==

Conclusion:==

The key uncertainties identified and characterized are HRA Uncertainty, HRADependency, Passive CCF, and Low Pressure Piping and Component Failure (rupture of theRHR system).

It is concluded that the impact of alternate modeling approaches would not havea significant impact on the calculated frequencies and would not impact the conclusions (seeSection 4.4.5.4).

Gap 3 Description (HLR-IE-C-03):

Initiating event model configurations should be reviewedagainst current plant configurations and operating practices.

Specifically the ISLOCA IEcalculation should be confirmed since failure modes may have changed (e.g., power removed toan RHR suction valve in Mode 1). It is also recommended that credit for the RHR relief valvesshould be Considered in the ISLOCA scenarios.

==

Conclusion:==

This gap is addressed in the development of the new ISLOCA initiating eventfrequency model for the RHR suction lines.Gap 7 Description (HLR-SY-B-02):

Confirmation that no CCF combinations are required forthe ISLOCA initiating event should be documented.

==

Conclusion:==

This gap is addressed in Section 4.4.5.2.

Modeling of CCF is not required for anyof the components in the analysis.

Gap 9 Description (HLR-HR-G-O1):

Upgrade the HRA methodology to evaluate the cognitive failures as well as the execution failures.

E2-45 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportConclusion:

The method used in this new analysis to calculate the HEPs follows industryaccepted practices by applying the EPRI HRA Calculator.

The three HEPs analyzed for theISLOCA evaluation are addressed as pre-initiators with applicable cognitive and/or execution failures.

Gap 10 Description (HLR-HR-G-02):

Perform a consistency review on the post-initiator actions.

During a consistency review, one might challenge the reasonableness of estimates given for isolating RHR given an overpressure event. Two HEPs were evaluated:

one beforethe ACl is removed and power is still removed to the RHR suction valves and one where ACI isremoved, power is provide to the RHR suction valves, and an alarm is added on high pressure.

A more significant difference in results may be expected over the small decrease in probability between the two actions.Conclusion:

The model used to develop the ISLOCA initiating event frequency does not includeany post-initiator actions so this gap is not applicable to the revised analysis.

But comparison the two pre-initiator alignment type HEPs is valid. These are:* Isolation valves left mis-positioned during startup = 1 .65E-03* Electric power not removed from the isolation valves = 8.23E-04The HEP values, each approximately 1 E-03, are consistent for similar types of latent errors.Gap 14 Description (HLR-QU-C-01):

Address operator dependencies using a more currentsystematic approach.

==

Conclusion:==

HRA dependency is assessed in Section 4.5.2. It was concluded that there is nodependency between the operator action pairs and no dependency between the three operatoractions since the actions are performed at different stages of the startup and separated by asignificant time period with a low level of stress, and/or different procedures are used for theactions (startup procedures and alarm response procedure).

In the previous section the HRAdependency was further discussed and a sensitivity assessment was completed assuming a lowlevel of dependency between OA. This was shown not to impact the conclusions.

Gap 15 Description (QU-E-01):

Characterize the uncertainties in quantification.

==

Conclusion:==

The key uncertainties identified and characterized are HRA Uncertainty, HRADependency, Passive CCF, and Low Pressure Piping and Component Failure (rupture of theRHR system).

It is concluded that the impact of alternate modeling approaches would not havea significant impact on the calculated frequencies and would not impact the conclusions (seeSection 4.4.5.4).

E2-46 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportTABLE 4-3: PLANT COMMITMENTS FROM NRC SER FOR WCAP-11736 Commitment from NRC SER Impact on Fault Tree model1. An alarm will be added to each RHR suction valve Failures of alarm are modeled in the faultwhich will actuate if the valve is open and the pressure tree.is greater than the open permissive setpoint and lessthan the RHR system design pressure minus the RHRpump head pressure.

2. Valve position indication to the alarm must be Failure of the valve position indication limitprovided from the stem-mounted limit switches, with switches are modeled in the fault tree.indication power not affected by power-lockout of the Credit for the position indicator from thevalve, stem-mounted limit switches was also takeninto account during the development ofoperator action failure to detect that thevalves are in the wrong position.

3. The procedural improvements described in WCAP- The procedure(s) will be changed to include11736 should be implemented.

removing power in Mode 1 (power lockout)for both isolation valves, instead of only thevalve adjacent to the RHR system.Therefore, operator failure to remove poweris applied to both isolation valves in eachRHR train.4. Where feasible, power should be removed from the No impact (this is not addressed in the faultR HR suction valves prior to their being leak-checked.

tree model).5. The RHR suction valve operators should be sized so No impact (this is not credited in the faultthat the valves cannot be opened against full system tree model).pressure.

E2-47 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportTABLE 4-4: UNCERTAINTY ASSESSMENT Area of Model Alternative Sensitivity Assessment Uncertainty ImpactHRA Developed using EPRI Alternate HRA Two HEPs were developed for FNP-specific analysis usingTHERP, whichUncertainty HRA Calculator methodologies was the state-of-practice at the time this WCAP was prepared.

TheseHEPs were re-developed using the EPRI HRA Calculator and one resultedin the same value while the other resulted in more conservative value.The more conservative HEP values were used in this analysis.

HRA Not modeled in this Include HRA If a low dependency between the three actions is assumed, theDependency analysis dependency combined human error probability is still very small. A review of thecutsets for the case without ACI identified four cutsets with the threeoperator actions.

A sensitivity case was performed assuming a lowdependency between these actions which resulted in the ISLOCAinitiating event frequency increasing from 7.16E-10/yr to 8.6E-10/yr.

This is still a reduction in the frequency compared to the case with ACI.Passive CCF Not modeled Include passive Common industry practice recommends only including active CCFCCF's in the events, and excluding passive CCF events. Including passive CCF failuresISLOCA model will result in ISLOCA models that may contain events that are notcontributors to ISLOCA precursors and unrealistic ISLOCA IF frequency.

Note that passive CCF events will have the same impact for both ACI andnon-ACI cases, therefore, including the passive CCF events will not__________________impact the conclusion of this analysis.

Pipe and Assumed all low Calculate a Assuming rupture of low pressure pipes and components when exposedComponent pressure pipe and probability for to RCS pressure is conservative and consistent with the ISLOCA modelingRupture components outside pipe and practice.

Pressure containment are subject component Uncertainty to rupture if exposed to rupture whenRCS pressure exposed to RCS___________pressure E2-48 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report4.5 CONSISTENCY WITH NRC SAFETY EVALUATION ON WCAP-11736 The bases for the NRC's determination of net positive safety Change are provided in the NRC'sSE included in WCAP-11736.

Section 2.6 states,"The staff has no requirements based on the absolute values in the PRA analysis andwill not require a plant-specific PRA for each licensee proposing to remove the ACI.However, the licensee should do sufficient PRA and safety analysis to ensure that itsplant will not show results that will invalidate the conclusions of WCAP-1 1736."The results of the FNP-specific probabilistic assessments, qualitative and quantitative, discussed in this report provide the "sufficient PRA and safety analysis" to support theconclusions of WCAP-1 1736.Five improvements were provided in the NRC's SE included in WCAP-1 1736. These aresummarized below along with the assumptions used in this analysis that credits some of thesecommitments.

1. An alarm will be added to each RHR suction valve which will actuate if the valve is open andpressure is greater than the open permissive setpoint and less than the RHR system designpressure minus the RHR pump head pressure.

The availability of alarms that would actuate if RHR suction valves were open at elevatedpressure is credited in the ISLOCA assessment in Section 4.4.5.2. Valve position indication to the alarm must be provided from stem-mounted limit switches, and power to .the stem mounted limit switches must not be affected by power lockout of thevalve.The availability of RHR suction valve position indication based on stem-mounted limitswitches is credited in the ISLOCA assessment in Section 4.4.5.3. Procedure improvements identified in WCAP-1 1736 should be implemented.

Appropriate procedure changes are assumed to be made to account for the removal of theACI circuitry.

In addition, alarm response procedures were credited in the ISLOCAassessment in Section 4.4.5. The analysis also is based on power lockout to both isolation

• valves in each RHR train.4. Where feasible, power should be removed from RHR suction valves prior to their being leakcheck.This was not credited in. the probabilistic assessments in Section 4.4.E2-49 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report5. The RHR suction valve operators should be sized so that valves cannot be opened againstfull system pressure.

This was not credited in the probabilistic assessments in Section 4.4.In addition, the FNP-specific assessment identified two other plant-specific changes for FNP:*Power Lockout below 180°F -Currently RHR suction MOVs are depowered open when RCStemperature is below 1 80°F to support the LTOP function.

However, depowering thesevalves open limits operators ability to isolate RHR from RCS in. the event of leakage in theRHR system. With the removal of ACI, this depowering is no longer needed to supportLTOP. Thus, the procedure should be changed to assure that the suction MOVs remainpowered while RHR shutdown cooling is in service.This procedure change to eliminate the power lockout below 1800°F is credited in thequalitative probabilistic assessment in Section 4.4.4.*Power Lockout in Modes 1 to 3 -Currently, in Modes 1 to 3 with RHR suction MOVs closed,power is removed only from the B-train-powered RHR suction MOVs (8701 B and 8702B).Power lockout should be extended to all four RHR suction MOVs in Modes 1 to 3 to supportISLOCA.The procedure changes to power-lockout all four RHR suction valves are credited in theISLOCA assessment in Section 4.4.5.E2-50 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report

4.6 CONCLUSION

S AND RECOMMENDATIONS Section 4.0 summarizes the probabilistic assessments of the impact of ACI removal on RHRshutdown

cooling, low temperature overpressure protection, and interfacing system LOCAinitiating event frequency.

For each area, the removal of A~l and the accompanying plantchanges provide a benefit to plant safety. Thus, these results for FNP support the conclusions of WCAP-1 1736 that the deletion of the autoclosure interlock is acceptable from a safetystandpoint.

E2-51 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportSECTION 4.0APPENDIX AFAULT TREE MODEL AND CUTSETS FOR ISLOCA INITIATING EVENTFREQUENCY ANALYSISWITH AUTOCLOSURE INTERLOCK E2-52 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report1.00E+002.77E-032.77E-03E2-53 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report'[ .65E-032.48Eo055.44E-04E2-54 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report3.97E.032.48E-0l5E2-55 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportE2-56 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Reportrl 823E-04"11.65E-03 2,48E-05E2-57 Enclosure 2 to. NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportOUTSET REPORT -ISL-RHR-SUCTION-ACI

= 8.46E-09 (PROBABILITY)

PROBABILITY f % CLASS INPUTS...

3.86E-093.86E-091.75E-101.75E-101.75 E-101.75 E-101.72EF-11 1 .72E-1 13.17E-123.1 7E-128.72E-1 38.72E-1 37.81 E-137.81 E-133.12E-133.12 E-131.88 E-131.88 E-1345.6%91.2%93.3%95.3%97.4%99.5%99.7%.99.9%99.9%99.9%100. 0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%/ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION PAF%ISL.-RHR-SUCTION PAFLHMVK-8701 BRUPTURE-RHR-SUCTION LHMVK-8702B RUPTURE-RHR-SUCTION LHMVK-8701 BRU PTU RE-RH R-S UCTIONLH MVK-8701 ARU PTU RE-RH R-S UCTIO NLHMVK-8702B RUPTURE-RH R-SUCTION LHMVK-8702A RUPTURE-RHR-SUCTION LHMVR-8701B RUPTURE-RHR-SUCTION LHMVR-8702B RU PTU RE-RH R-S UCTIONLH MVK-8701 APAFLHMVK-8702A PAF,1 RHOECLOSE-1 BRUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION LHMVR-8701 ARUPTURE-RHR-SUCTION LHMVR-8702A RUPTURE-RHR-SUCTION LHMVU-8701A PAFLHMVU-8702A PAF1RHO EC LOSF-1 BRCPTF-PT402 1 RHOECLOSE-2B RCPTF-PT403 LHMVU-8701A LH MVU-8702A LHMVR-8701A LHMVR-8701 BLH MVR-8702A LHMVR-8702B LHMVU-8701A LHMVU-8702A LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVU-8701A SAADF-PS402 LH MVU-8702A SAADF-PS403 LHMVR-8701 BLHMVR-8702B LHMVU-8701 BRUPTURF-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LH MVU-8702A RU PTU RE-RH R-SU CT IONLHRVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LH RVD-8708B LH RVD-8708A LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B E2-58 Enclosure 2 to NL-15-1 055FNP RHR Autoclosure Interlock Removal ReportProbability f % Class Inputs...

Probability

% Class Inputs...

3.98E-143.98E-1 43.98E-143.98E-143.96E-1 43.96E-143.96E-143.96E-141.41 E-141.41 E-148.52E-1 58.52E-1 58.52E-1 58.52E-1 51.81 E-151.81 E-151.81 E-151.81 E-151.81EF-15

1. 81 E-15100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%IS L-R HR-S UCTIONPAF%IS L-R HR-S UCTIONOA-DEPOWER-RH R-1%ISL-RHR-SUCTION OA.-DEPOWER-RHR-2

%IS L-RH R-S UCTIO NPAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF1 RHOECLOSE-1 BRU PTU RE-RH R-S UJCTION1 RHOECLOSE-2B RU PTU RE-RH R-S UCTION1 RHOECLOSE-1 BRUPTURE-RH R-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION 1 RHOECLOSE-1A RUPTURE-RHR-SUCTION 1 RHOECLOSE-1 BRUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION LH MVR-8701 APAFLH MVR-8702A PAF1 RHOECLOSE-1A RCPTF-PT402 1 RHOECLOSE-1 BRCPTF-PT402 1 RHOECLOSE-2A RCPTF-PT403 1 RHOECLOSE-2B RCPTF-PT403 1 RHOECLOSE-1A RU PTU RE-RH R-S UCTION1 RHOECLOSE-1 BRU PTU RE-RH R-S UCTION1 RHOECLOSE-1A RU PTU RE-RH R-SUCOTIO N1 RHOECLOSE-1 BRUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION LH MVU-8701 ASAREF-PY402X LHMVU-8702A SAREF-PY4O3X LHMVU-8701 ASAREF-K454 LHMVU-8702A SAREF-K454 LHMVR-8701 BSAADF-PS402 LH MVR-8701 ASAADF-PS402 LH MVR-8702B SAADF-PS403 LH MVR-8702A SAADF-PS403 LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LHMVR-8701 BRUPTURE-RH R-SUCTION LH MVR-8701 ARUPTURE-RHR-SUCTION LHMVR-8702B RUPTURE-RHR-SUCTION LH MVR-8702A RUPTURE-RH R-SUCTION LHMVR-8701 BSAREF-PY402X LH MVR-8701 ASAREF-PY402X LHMVR-8701 BSAREF-K1 54LHMVR-8701A SAREF-K454.

LHMVR-8702B SAREF-PY403X LHMVR-8702B SAREF-K1 54LHRVD-8708A LHRVD-8708B LHRVD-8708A LHRVDJ-8708B LHRVD-8708A LH RVD-8708A LH RVD-8708B LH RVD-8708B LH RVD-8708A LH RVD-8708B LH RVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LH RVD-8708A LH RVD-8708A LHRVD-8708A LHRVD-8708B LH RVD-8708B E2-59 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportProbability

% Class Inputs...

1.81E-15 100.0% %ISL-RHR-SUCTION 1RHOECLOSE-2B LHMVR-8702A LHRVD-8708B PAF RUPTURE-RHR-SUCTION SAREF-PY403X 1.81 E-1 5 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2B LHMVR-8702A LHRVD-8708B PAF RUPTURE-RHR-SUCTION SAREF-K454 7.1 8E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1 A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAADF-PS402 7.1 8E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER--RHR-2 PAF RUPTURE-RHR-SUCTION SAADF-PS403 1 .54E-1 6 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RH R-1 PAF RCPTF-PT402 RU PTU RE-RHR-SUCTION 1 .54E-16 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RH R-2 PAF RCPTF-PT403 RU PTURE-RHR-SUCTION 3.27E-1 7 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAREF-PY402X 3.27E-1 7 100.0% %ISL-RHR-SUCTION

.1RHOECLOSE-1A LHMVU-8701 B LHRVD-8708A OA-DEPOWER-RHR-1 PAF RUPTURE-RHR-SUCTION SAREF-K1 543.27E-17 100.0% %ISL-RHR-SUCTION

' 1RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RHR-2 PAF RUPTURE-RHR-SUCTION SAREF-PY403X 3.27E-17 100.0% %ISL-RHR-SUCTION 1 RHOECLOSE-2A LHMVU-8702B LHRVD-8708B OA-DEPOWER-RHR-2 PAF RUPTURE-RHR-SUCTION SAREF-K1 54E2-60 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal ReportSECTION 4.0APPENDIX BFAULT TREEMODEL AND CUTSETS FOR ISLOCA INITIATING EVENTFREQUENCY ANALYSISWITHOUT AUTOCLOSURE INTERLOCK E2-61 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report1 .00E+00/Y 1.00 E+002.7715-03 2.77E-03E2-62 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportE-038.509-06E2-63 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reporta.97E-031.852-038.50E-06E2-64 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report3.97E'038.50E-06E2-65 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report3.97E-038.50E-06E2-66 EnlsReO2AtoILTY 5- 055 IPTS.CUTSET REPORT -ISL-RHR-SUCTION-NO-ACI

= 7.1 6E-1 0 (Probability)

PROBABILITY

% CLASS INPUTS...

1.75E-101.75 E-101.75 E-101 .75E-1 03.1 7E-1 23.17E-123.17E-123.17E-127.81 E-137.81 E-133.12E-133.12 E-131.08E-131.08E-131.08 E-131.08 E-133.96E-143.96E-1424.5%48.9%73.4%97.8%98.3%98.7%99.1%99.6%99.7%99.8%99.8%99.9%99.9%99.9%99.9%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RH R-1%IS L-R HR-S UCTIONOA-DEPOWER-RHR-2

%ISL-RHR-SUCT IONOA-DEPOWER-RH R-2%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION LH RVD-8708A

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAFLHMVK-8701 BRUPTURE-RH R-SUCTION LHMVK-8701A RUPTURE-RH R-SUCTION LHMVK-8702B RUPTURE-RHR-SUCTION LHMVK-8702A RUPTURE-RHR-SUCTION LHMVK-8701A PAFLHMVK-8701 BPAFLH MVK-8702A PAFLHMVK-8702B PAFLHMVR-8701A RUPTURE-RHR-SUCTION LHMVR-8702A RUPTURE-RHR-SUCTION LHMVU-8701A PAFLHMVU-8702A PAF1 RHOECLOSE-1A PAF1iRHOECLOSE-1iB PAF1 RHOECLOSE-2A PAF1 RHOECLOSE-2B PAF1 RHOECLOSE-1A R-SUCTION 1 RHOECLOSE-1 BRUPTURE-RHR-SUCTION LH MVR-8701 ALHMVR-8701 BLH MVR-8702A LHMVR-8702B LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION LI-MVU-8702A RUPTURE-RHR-SUCTION LHMVR-8701 BLHMVR-8702B LH MVU-8701 BRUPTURE-RHR-SUCTION LH MVU-8702B RUPTURE-RHR-SUCTION ACSWF-TRAINA RUPTU RE-RH R-SUCTION ACSWF-TRAINA RUPTURE-RHR-SUCTION ACSWF-TRAINB RUPTURE-RHR-SUCTION ACSWF-TRAIN BRUPTURE-RHR-SUCTION LHMVR-8701 BSAADF-PS402 LHMVR-8701A SAADF-PS402 LH RVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LHRVD-8708A LH RVD-8708B LHRVD-8708B LH RVD-8708A LHRVD-8708B LHRVD-8708A LHRVD-8708B LHMVR-8701 BLHMVR-8701 ALHMVR-8702B LHMVR-8702A LHRVD-8708A LHRVD-8708A E2-67 EnRO toBILTY 1055 S NPTS.PROBABILITY

% ]_CLASS INPUTS...

3.96E-143.96E-141 .94E-141 .94E-141.94E-141 .94E-141.41 E-141.41 E-141.41 E-141.41 E-148.52E-1 58.52E-1 58.52E-1 58.52E-1 51.96E-151.96 E-151.96 E-151.96 E-157.1 8E-1 6100.0%100.0%100.0%100. 0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LH RVD-8708A

%ISL-RHR-SUCTION LH RVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION pAF%IS L-RH R-S UCT IONPAF%ISL-RHR-SUCTION PAF%ISL-RHR-SUCTION PAF%IS L-RH R-S UCTIO NLHRVD-8708A

%ISL-RHR-SUCTION LH RVD-8708A

%IS L-RH R-S UCTIO NLHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION OA-DEPOWER-RHR-1 1 RHOECLOSE-2A RUPTURE-RHR-SUCTION 1 RHOECLOSE-2B RUPTURE-RHR-SUCTION 1 RHOECLOSE-1A-PAF1RHOECLOSE-1B PAF1 RHOECLOSE-2A PAF1 RHOECLOSE-2B PAFLH MVR-8701 APAFLHMVR-8701 BPAFLH MVR-8702A PAFLHMVR-8702B PAF1 RHOECLOSE-1A RCPTF-PT402 1 RHOECLOSE-1 BRCPTF-PT402 1 RHOECLOSE-2A RCPTF-PT403 1 RHOECLOSE-2B RCPTF-PT403 1 RHOECLOSE-1 BOA-DEPOWER-RH R-11 RHOECLOSE-1A OA-DEPOWER-RHR-1 1 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 1RHOECLOSE-1iB PAFLHMVR-8702B SAADF-PS403 LHMVR-8702A SAADF-PS403 1 RHOEDETAN-1 RUPTURE-RHR-SUCTION 1 RHOEDETAN-1 RUPTURE-RHR-SUCTION 1 RHOEDETAN-2 RUPTURE-RHR-SUCTION 1 RHOEDETAN-2 RUPTU RE-RH R-SUCTION LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTU RE-RH R-SUCTION LHMVU-8702A RUPTU RE-RH R-SUCTION LHMVR-8701 BRUPTURE-RHR-SUCTION LHMVR-870 1ARUPTURE-RHR-SUCTION LHMVR-8702B RUPTU RE-RH R-SUCTION LHMVR-8702A RUPTU RE-RH R-SUCTION ACSWF-TRAINA PAFACSWF-TRAINA PAFACSWF-TRAIN BPAFACSWF-TRAIN BPAFLH MVU-8701 ARUPTURE-RHR-SUCTION LH RVD-8708B LHRVD-8708B LHMVR-8701 BLHMVR-8701A LHMVR-8702B LHMVR-8702A LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHRVD-8708A LHRVD-8708A LHRVD-8708B LHRVD-8708B LHMVU-8701A RUPTURE-RHR-SUCTION LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RH R-SUCTION LHRVD-8708A SAADF-PS402 E2-68 PROBABoLITY 2 toASSL-NPUTS..

PROBABILITY

% { CLASS INPUTS...

7.18E-167.18E-167.18 E-166.19E-166.19E-166.19 E-166.19 E-163.5 1E-163.51 E-163.51 E-163.51 E-161 .54E-161,.54E-1 61 .54E-1 61 .54E-1 61.12 E-171.12 E-171.12 E-171.12E-17100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%100.0%%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B

%IS L-R HR-S UCTIONOA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-1

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION OA-DEPOWER-RHR-2

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708A

%ISL-RHR-SUCTION LHRVD-8708B

%ISL-RHR-SUCTION LHRVD-8708B 1 RHOECLOSE-1A PAF1 RHOECLOSE-2B PAF1 RHOECLOSE-2A PAF1 RHOECLOSE-1A PAF1 RHOECLOSE-1 BPAF1 RHOECLOSE-2A PAF1 RHOECLOSE-2B PAF1 RHOECLOSE-1 BOA-DEPOWER-RHR-1 1 RHOECLOSE-1A OA-DEPOWER-RHR-1 1 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 1 RHOECLOSE-1 BPAF1 RHOECLOSE-1A PAF1 RHOECLOSE-2B PAF1 RHOECLOSE-2A PAF1 RHOECLOSE-1 BOA-DEPOWER-RHR-1 1 RHOECLOSE-1A OA-DEPOWER-RH R-11 RHOECLOSE-2B OA-DEPOWER-RHR-2 1 RHOECLOSE-2A OA-DEPOWER-RHR-2 LHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RHR-SUCTION AFCNK-TRAINA RUPTURE-RHR-SUCTION AFCN K-TRAINARUPTURE-RHR-SUCTION AFCNK-TRAINB RUPTURE-RHR-SUCTION AFCNK-TRAINB RUPTURE-RHR-SUCTION 1 RHOEDETAN-1 PAF1 RHOEDETAN-1 PAF1 RHOEDETAN-2 PAF1 RHOEDETAN-2 PAFLHMVU-8701 ARCPTF-PT402 LHMVU-8701 BRC PTF-PT402 LHMVU-8702A RCPTF-PT403 LHMVU-8702B RCPTF-PT403 AFCNK-TRAINA PAFAFCNK-TRAINA PAFAFCNK-TRAINB PAFAFCNK-TRAINB PAFLHRVD-8708A SAADF-PS402 LH RVD-8708B SAADF-PS403 LH RVD-8708B SAADF-PS403 LHMVR-8701 BLHMVR-8701A LH MVR-8702B LHMVR-8702A LHMVU-8701A RU PTU RE-RH R-S UCTIO NLHMVU-8701 BRUPTURE-RHR-SUCTION LHMVU-8702A RUPTURE-RHR-SUCTION LHMVU-8702B RUPTURE-RH R-SUCTION LH RVD-8708A RUPTURE-RHR-SUCTION LH RVD-8708A RUPTURE-RHR-SUCTION LHRVD-8708B RUPTURE-RHR-SUCTION LH RVD-8708 BRUPTURE-RHR-SUCTION LHMVU-8701 ARUPTURE-RHR-SUCTION LHMVU-8701 BRUPTURE-RHR-SUCTION LH MVU-8702A RU PTU RE-RH R-S UCTIONLHMVU-8702B RUPTURE-RHR-SUCTION

______________

L _________

J _____________

+/-E2-69 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report.5.0 ADEQUACY OF THE RHR SYSTEM RELIEF VALVE CAPACITYThe FNP RHR System is protected from inadvertent overpressurization by ASME code relief valveslocated on each RHR System pumps suction line from the RCS hot leg, downstream of the inletisolation valves. The main purpose of the RHR System relief valve is to protect the RHR System fromoverpressurization during RHR System operation.

The original design basis of the relief valvesassumed the following limiting RHR System overpressurization event: the RCS is water solid, and thecontrol valves in the charging and seal injection lines fail fully open and the letdown line control valvefails closed. This causes a mass addition to the RCS, thus pressurizing the RCS and RHR System.Based on this event, the RHR System relief valves were sized to relieve the combined flow of twocharging pumps at the relief valve setpressure plus accumulation.

The setpressure of the relief valvesis 450 psig with a 10 percent accumulation.

This setpoint considers the additional pressure boost of thedownstream RHR System pumps in maintaining the 660 psig (110 percent of design pressure asrequired by the ASME Code Section NC-731 1) design overpressure limit of the RHR System.In order to meet the above criteria, the FNP relief valves are each designed to relieve 900 gpm of400°F water, relieving to a maximum allowable backpressure of 50 psig at a valve setpressure of 450psig (plus 10 percent accumulation).

E2-70 Enclosure 2 to NL-15-1055 FNP RHR Autoclosure Interlock Removal Report6.0 PROPOSED DOCUMENT CHANGESThe proposed document changes for FNP, to address the ACl and power lockout of the RHR Systemisolation valve removal, are similar to those indicated in WCAP-1 1736. The associated FNP, Units 1and 2 Technical Specification changes are addressed elsewhere in this License Amendment Request.The FNP specific FSAR and procedural changes are being addressed separately from this LicenseAmendment Request in accordance with the 10OCFR50.59 evaluation process.

The specific procedure changes to support the ACl deletion are as follows:1. Procedures will be revised to eliminate the current requirement to lockout power to the openRHR suction isolation valves below 180°F.2. Procedures will be implemented to lockout power to all four closed RHR suction isolation valvesin Modes 1, 2, and 3.3. Alarm response procedures will be implemented to support the addition of the alarm for theRHR suction isolation valves (described above).4. Other procedures will be revised as necessary to account for the deletion of the ACl.E2-71 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report

7.0 CONCLUSION

S AND RECOMMENDATIONS This section addresses the seven concerns expressed in the NRC internal memorandum (Reference

11) of January, 1985 stating the position of the Reactor Systems Branch (RSB) on requests for removalof the RHR System ACI. The memorandum stated that any proposal to remove the ACl should besubstantiated by proof that the change is a net improvement in safety and should assess as a minimumthe following:

1. The means available to minimize Event V concerns.

2. The alarms to alert the operator of an improperly positioned RHR System MOV.3. The RHR System relief capacity must be adequate.

4. Means other than the ACI to ensure both MOVs are closed (e.g., single switch actuating bothvalves).5. Assurance that the function of the open permissive circuitry is not affected by the proposedchange.6. Assurance that MOV position indication will remain available in the control room regardless ofthe proposed change.7. Assessment of the effect of the proposed change on RHR System reliability, as well as onLTOP concerns.

Each of the seven items above will be commented on separately and reference will be made tosupporting analysis contained in this report where applicable.

Means Available To Minimize A LOCA Outside The Containment An interfacing systems LOCA is the failure of a low pressure piping system that interfaces with the RCSwhen the low pressure system is subject to the high RCS pressure.

An RHR System LOCA, initiated by failure of the boundary between the RCS and RHR System, is classified as a non-mitigable LOCAoutside containment.

It is assumed to occur if the Valves in the RHRS suction line fail open when theRCS is at normal operating pressure (2235 psia) and the RHR relief valve(s) fail to mitigate thepressure increase.

Since the RHR System is designed for a much lower pressure (600 psig), the resultof both suction/isolation valves failing open and failure of the RHR relief valve(s) is overpressurization of the RHR System. The RHR System for Farley, Units 1 and 2, is located outside of containment.

Afailure of the RHR System pressure boundary is assumed to result in a LOCA outside of containment.

The RHR System has two-motor operated suction/isolation valves on the hot leg suction line from theRCS. These valves on each suction line serve as the primary RCS pressure boundary.

They areremotely operated from the Main Control Room, and are powered by separate Class 1 E electrical power sources.

Continuous valve position indication is provided from the valve stem mounted limitE2-72 Enciosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportswitches with indication in the Main Control Room. Plant operating procedures instruct the operator toisolate the RHR System during plant heatup, so the likelihood of these valves being left open isremote. Additionally, this report recommends the following:

• Installation of a Main Control Room alarm to alert the operator if a RHR System suction/isolation "VALVE NOT FULLY CLOSED" in conjunction with a "RCS PRESSURE HIGH" signal, and* Procedures be implemented to lockout power to all four closed RHR suction isolation valves inModes 1, 2, and 3As noted above, should a failure of the boundary between the RCS and RHR System occur, thepressure effect on the low pressure RHR System could be mitigated by the RHR System suction linerelief valves. These relief valves discharge inside containment to the Pressurizer Relief Tank (PRT). Adischarge would be detected by high temperature, level, and pressure alarms in the PRT.The results of the interfacing systems LOCA probabilistic analyses (Sections 4.2.2 (for the originalanalyses) and Section 4.4.5.3 (for the updated analysis) showed a reduction in frequency with thedeletion of the RHR System A~l.In conclusion, sufficient means are available to minimize a LOCA outside of containment and removalof the ACI feature is desirable in that it reduces the frequency of interfacing systems LOCA in Modes 1,2, and 3.Alarms To Alert The Operator Of An Improperly Positioned RHR System Isolation ValveThe proposed interlocks and functional requirements for FNP recommend the addition of an alarm foreach suction/isolation valve that will actuate in the Main Control Room given a "VALVE NOT FULLYCLOSED" signal in conjunction with a "RCS PRESSURE-HIGH" signal. A more detailed description ofthe modifications to the individual valve control circuitry are presented in S;ection 3.0. The intent of thealarm is to alert the operator that a RCS-RHR System, series, suction/isolation valve(s) is not fullyclosed, and that double valve isolation from the RCS to the RHR System is not being maintained.

Valve position indication to the alarm should be provided from the valve stemn mounted limit switchesand power to the stem mounted limit switches must not be affected by power lockout to the valve. Aswith other power lockout valves, there is no requirement for opposite train power for the stem mountedlimit switches, only that power to the stemn mounted limit switches is not affected by the power lockout.This alarm meets the intent of the requirements of Regulatory Guide 1.139, "Guidance For ResidualHeat Removal,"

which states that it is the regulatory position on RHR System isolation that "... Alarmsin the control room should be provided to alert the operator if either valve is open when the RCSpressure exceeds RHR System design pressure."

Verification Of The Adequacy Of RHR System Relief Valve CapacityThe proposed design change as described in Section 3.0 of this report has no impact on theperformance and/or design basis assumption used in the original sizing of the valve. As such, the RHRE2-73 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal ReportSystem relief valves perform adequately to meet their original design basis criteria as described inSection 5.0.Means Other Than Autoclose Interlocks to Ensure Both Isolation Valves Are Closed (e.g., SingleSwitch Actuating Both Valves)Current FNP operating instructions, along with redundant position indication and the proposed alarm,are sufficient to insure isolation.

The addition of a single switch to close both valves would prevent thecycling of individual suction/isolation valves. This would require FNP to lift leads and add jumpersduring valve maintenance.

The location of the hand switches (for both valves) is such that they arenear enough to each other on the main control board to ensure timely operator action.In addition, this report recommends that procedures be implemented to lockout power to all four closedRHR suction isolation valves in Modes 1, 2,.and 3Assurance That the Open Permissive Circuitry is Neither Removed or Affected by the ProposedChangeThe proposed design change, as described in Section 3.0 of this report, leaves the open permissive circuit intact. Hardware changes are limited to removal of the ACl portion of the valve control circuitry and the addition of an alarm. Neither one of these changes will affect the operation of the RHR SystemOPI.Assurance That Isolation Valve Position Indication Will Remain Available in the Control RoomRegardless of the Proposed ChangeThe proposed design change, as described in Section 3.0 of this report leaves the valve positionindication at the main control board intact. This indication will be provided by two means:1. Continuous valve position indication (Main Control Board status lights),

and2. Alarms will be added with the ACI removal.Assessment of the Effect of the Proposed Change on RHR System Availability, as Well as LowTemperature Overpress ure Protection RHR SYSTEM UNAVAILABILITY ANALYSISThe availability of the RHR System to remove decay heat was considered in three phases for the RHRSystem Unavailability Analysis.

The first phase covers the period during which the RHR System isplaced into service and goes through a warm-up period needed to minimize the thermal shock to thesystem and insure boron mixing. The second phase covers the initial period of cooldown when thedecayheat load is high. During this phase, two trains of the RHR System (two pumps and two heatexchangers) are assumed to be required for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The third phase covers the final long-term E2-74 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Reportperiod of cooldown when the heat load is smaller.

For this phase only one train of the RHR System(one pump and one heat exchanger) is required to be in operation.

Six weeks was the time periodassumed for this phase (based on the average refueling outage time period).

The results of thequantification of the FNP RHR System unavailability fault trees, as discussed in Section 4.2.2 (for theoriginal analyses) and in Section 4.4.3 for the gap analysis evaluation) show that with power lockout,deletion of the ACI has little impact on the system unavailability.

Without power lockout, deletion of theACI reduces the number of spurious closures of the suction valves and thus increases the availability ofthe RHR System. These results are summarized in Table 4-1.OVERPRESSURIZATION ANALYSISThe effect of an overpressure transient at cold shutdown conditions will be altered by the removal of theRHR System ACI feature.

An overpressurization analysis was conducted that used event trees tomodel the mitigating actions (both automatic and manual) following the occurrence of low temperature overpressurization events. These mitigating actions affect the severity of the overpressurization eventsand reduce the possibility of damage to the plant. The analysis was conducted in two parts:1) determination of the frequency of cold overpressurization events, and 2) the effect of mitigation onthe transients.

Nine initiating events which fell into two broad categories, heat input transients andmass input transients, were considered.

For the heat input transients considered the pressure peak is either acceptably low with reference tothe RHR System suction relief valves or the transient proceeds so quickly that the RHR System AClcould not cause the slow acting RHR System suction/isolation valve to close in time to affect thetransient.

The analysis concludes that the removal of the RHR System ACl feature will have no effecton the heat input transients.

(Refer to WOG WCAP-1 1736 for discussion).

For the slower mass input transients event trees were utilized to model the mitigating actions that occurfollowing the transients.

Operator actions and mitigating systems were included in the event trees.Success criteria for each event tree top event were developed and system/component failureprobabilities were calculated.

The conclusion to be drawn from the overpresssure analysis (as discussed in Section 4.2.2 (for theoriginal analyses) and Section 4.4.4 (for the gap analysis evaluation) is that removal of the ACl has littleimpact on the consequences of LTOP events for FNP.It should be understood that the ACl was not installed to mitigate overpressure transients.

The RH-RSystem suction valves are slow-acting and take approximately two minutes to close. The ACl will notprotect the RHR System from a fast-acting overpressure transient such as the startup of a RCP.The major impact with respect to overpressure concerns is that removal of the ACl will significantly reduce the number of letdown isolation transients.

E2-75 Enclosure 2 to NL-1 5-1 055FNP RHR Autoclosure Interlock Removal Report

8.0 REFERENCES

1. WASH-1400, "Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants,"

October 1975.2. "Safety Evaluation Report by the Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory

• Commission, in the Matter of Westinghouse Electric Company Reference Safety Analysis*Report RESAR-41, Docket No. STN 50-480,"

NUREG-75/1103, December 31, 1975, pages 5-17to 5-19, 7-15, 7-16, and Appendix C..3. "Branch Technical Position RSB 5-1, "Design Requirements of the Residual Heat RemovalSystem,"

Revision 2, July 1981.'4. WCAP-11736, Revision 0, Volume l and II "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners,"

October 1989.5. Nuclear Regulatory Commission "Safety Evaluation of Removal of RHR Autoclosure Interlock Function and Installation of an Alarm at Diablo Canyon Units 1 and 2 (TAC NOS. 66030 and66031),"

February 17, 1988.6. ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications".

7. U.S. NRC Regulatory Guide 1.200, Rev. 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities",

March 2009.8. EPRI TR-1 021176, "An Analysis of Loss of Decay Heat Removal and Loss of Inventory EventTrends (1990-2009)",

EPRI, December 2010.6. Joseph M. Farley Nuclear Plant, Units 1 and 2, Data Analysis

Notebook, PRA Model Revision 9,March 2010.7. NUREG/CR-6928, "Summary of SPAR Component Unreliability Data and Results 2010Parameter Estimation Update".8. Memorandum from B.W. Shearon, NRC to RSB members, "Auto Closure Interlocks for PWRResidual Heat Removal (RHR) Systems,"

January 28, 1985.E2-76 Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 3FNP Technical Specification And Bases Markups Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases Markups No ChangePage Included ForInformation Only3.4 REACTOR COOLANT SYSTEM (RCS)3.4.14 RCS Pressure Isolation Valve (PiV) LeakageRCS PIV Leakage3.4.14LCO 3.4.14APPLICABILITY:

Leakage from each RCS PlV shall be within limit.MODES 1, 2, and 3,MODE 4, except valves in the residual heat removal (RHR) flow path whenin, or during the transition to or from, the RHR mode of operation.

ACTIONS--------------------

NOTES--------------

1. Separate Condition entry is allowed for each flow path.2. Enter applicable Conditions and Required Actions for systems made inoperable by aninoperable PlV.CONDITION REQUIRED ACTION COMPLETION TIMEA. One or more flow paths-------NOTE-----

with leakage from one or Each valve used to satisfymore RCS PIVs not Required Action A.1 and Requiredwithin limit. Action A.2 must be verified to meetSR 3.4.14.1 and be in the reactorcoolant pressure boundary or thehigh pressure portion of thesystem.________________________________________________(continued)

Farley Units 1 and 23.4.14-1Amendment No. 146 (Unit 1)Amendment No. 137 (Unit 2)E3 -1 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases MarkupsRCS PIV Leakage3.4.14ACTIONS ________CONDITION REQUIRED ACTION COMPLETION TIMEA. (continued)

A.1 Isolate the high pressure 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sportion of the affectedsystem from the lowpressure portion by use ofone closed manual,deactivated automatic, orcheck valve.ANDA.2 Isolate the high 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />spressure portion ofthe affected systemfrom the lowpressure portion byuse of a secondclosed manual,deactivated automatic, or checkvalve.B. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion Time for Condition A not ANDmet.B.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sC. RHR System C.1 Place the affected valve(s) 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sautoclosure or open in the closed position andpermissive interlock maintain closed underfunction inoperable, administrative control.-- --NOTE----.........................

Not applicable to the autoclosure interlock for Unit 1 afterrestart from 1 R27 and for Unit 2 after restart from 2R25.Farley Units 1 and 23.4. 14-2Amendment No. 146 (Unit 1)Amendment No. 137 (Unit 2)E3 -2 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases MarkupsROS PIV Leakage3.4.14SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY

+SR 3.4.14.1-----------

NOTES- ------1. Not required to be performed in MODES 3and 4.2. Not required to be performed on the RCS PIVslocated in the RHR flow path when in theshutdown cooling mode of operation.

3. RCS PIVs actuated during the performance ofthis Surveillance are not required to be testedmore than once if a repetitive testing loopcannot be avoided.Verify leakage from each RCS PIV is equivalent to< 0.5 gpm per nominal inch of valve size up to amaximum of 5 gpm at an RCS pressure

> 2215 psigand < 2255 psig.18 months, priorto enteringMODE 2ANDFollowing valveactuation due toautomatic or manualaction or flowthrough the valve(except for RCSPIVs located in the~iJIN rxIX, lX IIUVV ISR 3.4.14.2 NOTE hi/Not required to be met when the RHR Systemvalves are required open in accordance withSR 3.4.12.3.

Verify RHR System autoclosure interlock In accordance withcauses the valves to close automatically the Surveillance with a simulated or actual RCS pressure Frequency Controlsignal _> 700 psig and _< 750 psig. Program2. Not applicable to Unit 1 after restart from 1 R27 and not applicable to Unit 2after restart from 2R25.IFarley Units 1 and 23.4. 14-3Amendment No. 185 (Unit 1)Amendment No. 180 (Unit 2)E3 -3 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases MarkupsNo ChangePage Included ForInformation OnlyRCS Ply Leakage3.4.14SURVEILLANCEREQUIREMENTS________

SR 3.4.14.3----------NOTE---------

Not required to be met when the RHR System valvesvalves are required open in accordance withSR 3.4.12.3.

Verify RHR System open permissive interlock In accordance withprevents the valves from being opened with a the Surveillance simulated or actual RCS pressure signal Frequency Control> 295 psig and < 415 psig. ProgramFarley Units 1 and 23.4. 14-4Amendment No. 185 (Unit 1)Amendment No. 180 (Unit 2)E3 -4 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases MarkupsNo Change RCS PIV LeakageB 3.4.14Page Included ForInformation OnlyBASESACTIONS A.i and A.2(continued)

The flow path must be isolated by two valves. Required Actions A.1and A.2 are modified by a Note that the valves used for isolation mustmeet the same leakage requirements as the PIVs and must be withinthe RCPB or the high pressure portion of the system. However, thevalves used to isolate the flow path (which are not PIVs) do not haveto be pre-qualified by periodic testing.

When Required Action A isentered and the flow path isolated, the valves will be verified at thattime to meet the leakage requirements of SR 3.4.14.1.

This isaccomplished using the methodology of SR 3.4.13.1 (RCS waterinventory balance) with the leakage limits of SR 3.4.14.1 applied.Required Action A.1 requires that the isolation with one valve must beperformed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Four hours provides time to reduceleakage in excess of the allowable limit and to isolate the affectedsystem if leakage cannot be reduced.

The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Timeallows the actions and restricts the operation with leaking isolation valves.Required Action A.2 specifies that the double isolation barrier of twovalves be restored by closing some other valve qualified for isolation or restoring one leaking PlV. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time afterexceeding the limit considers the time required to complete the Actionand the low probability of a second valve failing during this timeperiod.B.1 and B.2If leakage cannot be reduced, the system isolated, or the otherRequired Actions accomplished, the plant must be brought to aMODE in which the requirement does not apply. To achieve thisstatus, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> andMODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This Action may reduce the leakage andalso reduces the potential for a LOCA outside the containment.

Theallowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full powerconditions in an orderly manner and without challenging plant'systems.C.1The inoperability of the RHR autoclosure interlock renders theassociated RHR suction isolation valves incapable of isolating inresponse to a high pressure condition.

The inoperability of the RHRopen permissive interlock renders the associated RHR suction(continued)

Farley Units 1 and 2 B 3.4.14-4 Revision 0E3 -5 Enclosure 3 to NL-15-1 055FNP Technical Specification And Bases MarkupsRCS PIV LeakageB 3.4.14BASESACTIONSRequired Action 0.1is modified by a Notethat states theRequired Action forthe autoclosure interlock is notapplicable to Unit 1after 1R27 and notapplicable to Unit 2after 2R25. TheRequired Action forthe autoclosure interlock is no longerapplicable after theserefueling outagesbecause theautoclosure interlock will be removedduring the outagesand will no longer berequired OPERABLE.

SURVEILLANCE REQUIREMENTS 0.1. (continued) isolation valves incapable of preventing inadvertent opening of thevalves at RCS pressures in excess of the RHR systems designpressure.

If the RHR autoclosure or open permissive interlocks areinoperable, operation may continue as long as the affected RHRsuction valves are closed and administrative controls are in place inthe control room to maintain them closed (e.g., tags on the maincontrol board handswitches, etc.) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This Actionaccomplishes the purpose of the autoclosure or open permissive function.

Rto _Operators:

The location of the electrical switchgear contain te breakers for the RHR isolation valves is subje ot- veryhigh dose ra *ns the event of a small break LOCA. T efore,opening the break o-sr the RHR isolation valve ould place theplant in a condition wher ould a small b-=a' LOCA occur, theplant could not be placed on n- a-:l 4twithout unacceptably highexposures to plant personnel.

.s the issue of dose during asalbekLOCA, h e*edAto dition C requiresislton of the valve .der administrative con teLfrom the controlroom to allow ,l'5ishment of RHR operation, shou b~e required, without u u.rcceptable dose to plant personnel in the event s~mallbre OAS/R 3.4.14.1Note to Operators:

After 1R27 (Unit 1) and2R25 (Unit 2) when the RHR autoclosure interlocks are removed from each unit, the RHRsuction isolation valves will be required to beclosed with power removed from the valves inMODES 1, 2, and 3. The requirement to isolatethe valves with power removed in theseMODES is necessary to satisfy the conditions for removal of the RHR autoclosure interlock.

If the open permissive interlock becomesinoperable after the removal of the autoclosure interlock, the Required Action to ensure thevalves are closed using the administrative controls described above would only beapplicable in MODE 4. In MODES 1, 2, and 3, ifan open permissive interlock becomesinoperable, the Required Action to close andmaintain close the valves by administrative controls would be met by the administrative controls in place to ensure the valves areclosed with power removed (as required for theremoval of the autoclosure interlock).

Farley Units 1 and 2Performance of leakage testing on each RCS PIV or isolation valveused to satisfy Required Action A.1 and Required Action A.2 isrequired to verify that leakage is below the specified limit and toidentify each leaking valve. However, the valves used to isolate theflow path to satisfy Required Actions A.1 and A.2 (which are not PIVs)do not have to be pre-qualified by periodic testing.

When RequiredAction A is entered and the flow path isolated, the valves will beverified at that time to meet the leakage requirements of SR 3.4.14.1.

This is accomplished using the methodology of SR 3.4.13.1 (RCSwater inventory balance) with the leakage limits of SR 3.4.14.1applied.

The leakage limit of 0.5 gpm per inch of nominal valvediameter up to a 3 or 5 gpm maximum applies to each valve.Leakage testing requires a stable pressure condition.

(continued)

B 3.4.14-5Revision 0E3 -6 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases MarkupsRCS PIV LeakageB 3.4.14BASESSURVEILLANCE REQUIREMENTS SR 3.4.14.1 (continued) shutdown cooling mode of operation.

PIVs contained in the RHRshutdown cooling flow path must be leakage rate tested when RHR issecured and stable unit conditions and the necessary differential pressures are established.

Leak rate testing is performed

manually, with test personnel in the vicinity of the system connections incontainment during setup and testing.

Should the check valve thatwas being tested rupture or pressure in the system cause a rupture ofthe test equipment, there would be a concern for the safety of thepersonnel in the area. In addition, testing with RCS temperature above 212 °F would result in any leakage past the RHR valvesflashing into steam making accurate measurement of the leakage rateimpossible.

Therefore, testing of the RHR System PIVs shouldnormally be performed in Mode 5, as the test results are meaningful and plant conditions in Mode 5 minimize the potential impact onpersonnel safety.Any change in the components being tested by this SR will requirereevaluation of STI Evaluation Number 558904 in accordance with theSurveillance Frequency Control Program.SR 3.4.14.2Verifying that the RHR autoclosure interlock is OPERABLE ensuresthat RCS pressure will not pressurize the RHR system beyond 125%of its design pressure of 600 psig. The autoclosure interlock isolatesthe RHR System from the RCS when the interlock setpoint is reached.The Setpoint ensures the RHR design pressure will not be exceeded.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

/,i two Notes. Note 1The SR is modified by an exception to therequirement to perform this surveillance when using the RHR Systemsuction relief valves for cold overpressure protection in accordance with SR 3.4.12.3.

Note 2 states theSurveillance is notapplicable to Unit 1after 1 R27 and notapplicable to Unit 2after 2R25. TheSurveillance is nolonger applicable after these refueling outages because theautclosure interlock will be removedduring the outagesand will no longer berequired OPERABLE.

(continued)

Farley Units 1 and 2B 3.4.14-7Revision 59E3 -7 Enclosure 3 to NL-1 5-1 055FNP Technical Specification And Bases NO ChangePage Included ForInformation OnlyRCS PIV LeakageB 3.4.14BASESSURVEILLANCE REQUIREMENTS (continued)

SR 3.4.14.3Verifying that the RHR open permissive interlock is OPERABLEensures that the RCS will not pressurize the RHR system beyonddesign of 600 psig. The open permissive interlock prevents openingthe RHR System suction valves from the RCS when the RCSpressure is above the setpoint.

The setpoint upper value ensures theRHR System design pressure will not be exceeded at the RHR pumpdischarge and was chosen taking into account instrument uncertainty and calibration tolerances.

This value also provides assurance thatthe RHR System suction relief valves setpoint will not be exceeded.

The minimum value of the setpoint range is chosen based uponoperational considerations (differential pressure) for the RCP sealsand thus does not have a safety-related function.

The Surveillance Frequency is controlled under the Surveillance Frequency ControlProgram.The SR is modified by a Note that provides an exception to therequirement to perform this surveillance when using the RHR Systemsuction relief valves for cold overpressure protection in accordance with SR 3.4.12.3.

REFERENCES

1. 10OCFR 50.2.2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, Section V, GDC 55.4. WASH-1400.(NUREG-75/014),

Appendix V, October 1975.5. NUREG-0677, May 1980.6. Technical Requirement Manual (TRM).7. ASME, Boiler and Pressure Vessel Code,Section XI.8. 10 CFR 50.5ha(g).

Farley Units 1 and 2B 3.4.14-8Revision 52E3 -8 Joseph M. Farley Nuclear Plant -Units 1 and 2License Amendment Request to Revise Technical Specification 3.4.14, "RCS Pressure Isolation Valve Leakage" To Eliminate The RHR Autoclosure Interlock Function From The Technical Specifications Enclosure 4FNP Technical Specifications Clean Typed Pages Enclosure 4 to NL-1 5-1 055FNP Technical Specifications Clean Typed PagesRCS PIV Leakage3.4.14ACTIONS_____

___CONDITION REQUIRED ACTION COMPLETION TIMEA. (continued)

A.1 Isolate the high pressure 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sportion of the affectedsystem from the lowpressure portion by use ofone closed manual,deactivated automatic, orcheck valve.ANDA.2 Isolate the high 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />spressure portion ofthe affected systemfrom the lowpressure portion byuse of a secondclosed manual,deactivated automatic, or checkvalve.B. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion Time for Condition A not "ANDmet.B.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />s-NOTE-- --Not applicable to theautoclosure interlock for Unit1 after restart from 1 R27 andfor Unit 2 after restart from2R25.C. RHR System C.1 Place the affected valve(s) 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sautoclosure or open in the closed position andpermissive interlock maintain closed underfunction inoperable, administrative control.Farley Units 1 and 23.4.14-2Amendment No.Amendment No.(Unit 1)(Unit 2)E4 -1 Enclosure 4 to NL-15-1055 FNP Technical Specifications Clean Typed PagesRCS PIV Leakage3.4.14SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY

+SR 3.4.14.1-~~~~NOTES--------

1. Not required to be performed in MODES 3and 4.2. Not required to be performed on the RCS PIVslocated in the RHR flow path when in theshutdown cooling mode of operation.

3. RCS PIVs actuated during the performance ofthis Surveillance are not required to be testedmore than once if a repetitive testing loopcannot be avoided.Verify leakage from each RCS Ply is equivalent to< 0.5 gpm per nominal inch of valve size up to amaximum of 5 gpm at an RCS pressure

> 2215 psig.and < 2255 psig.18 months, priorto enteringMODE 2ANDFollowing valveactuation due toautomatic or manualaction or flowthrough the valve(except for RCSPIVs located in theRHR flow path).4-SR 3.4.14.2-~~~~NOTES--------

1. Not required to be met when the RHR Systemvalves are required open in accordance withSR 3.4.12.3.

2. Not applicable to Unit 1 after restart from 1 R27 andnot applicable to Unit 2 after restart from 2R25.Verify RHR System autoclosure interlock causes the valves to close automatically with a simulated or actual RCS pressuresignal >_ 700 psig and _< 750 psig.In accordance withthe Surveillance Frequency ControlProgramFarley Units 1 and 23.4. 14-3Amendment No.Amendment No.(Unit 1)(Unit 2)E4 -2