B17542, Application for Amend to License DPR-65,requesting Review & Approval to Plant Fsar,Per 10CFR50.90.Changes to Plant FSAR Pages,Encl
| ML20197J574 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 12/10/1998 |
| From: | Olivier L NORTHEAST NUCLEAR ENERGY CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| B17542, NUDOCS 9812150147 | |
| Download: ML20197J574 (73) | |
Text
{{#Wiki_filter:. _ . . . . - . ~ - - .
- g. ;
Roge Ferry Rd. (Route 156), Teterford, CT 06385 1 Northeast Nuclear Energy m,,,, soci,,, po.,, s,,,io, Northeast Nuclear Energy Company . P.O. Box 128 . Waterford, CT 06385-0128 .I (860) 447-1791 l Fax (860) 444-4277 The Northeast Utilities System i DEC I 01998 l l l Docket No. 50-336 J B17542 l Re: 10CFR50.90
.U. S. Nuc!aar Regulatory Commission Attention: Document Control Desk Washington, DC 20555 Millstone Nuclear Power Station, Unit No. 2 Proposed Revision to Final Safety Analysis Report Post - LOCA Lona Term Core Coolina
. Introduction l
Northeast Nuclear Energy Company (NNECO) has determined that plant modifications to Millstone Unit No. 2 are necessary to ensure long term cora cooling capability after a Loss of Coolant Accident (LOCA). These plant' modifications will ensure boron precipitation can be prevented, post-LOCA, following various postulated single failures. . The plant modifications have been evaluated in accordance with 10CFR50.59 and have been determined to involve an unreviewed safety question. Therefore, per [ I
/
10CFRf0.59(c), NNECO requests the NRC review and approve this change to the Millstone Unit No.' 2 Final Safety Analysis Report (FSAR) through an amendment to Operating License DPR-65, pursuant to 10CFR50.90. Attachment 1 provides a discussion of the proposed changes and the Safety Summary. 60/ Attachment 2 provides the Significant Hazards Consideration. Attachment 3 provides the changes to the Millstone Unit No. 2 FSAR. Environmental Considerations NNECO has reviewed the proposed License Amendment Request against the criteria of 10CFR51.22 for environmental considerations. The proposed plant modifications will add altemate power supplies to several valves important for successful boron precipitation control following a LOCA at Millstone Unit No. 2. These changes do not significantly Ircrease the type and amounts of effluents that may be released off site. In addition, this amendment request will not significantly increase individual or cumulative occupational radiation exposures. Therefore, NNECO has determined the proposed
,..>4 "
9812150147 981210 PDR ADOCK 05000336 P_ PDR
. U.S. Nuctrar R:gul: tory Commission B17542/Page 2 changes will not have a significant effect on the quality of the human environment. Conclusions I The proposed plant modifications were evaluated utilizing the criteria of 10CFR50.59 and were determined to involve an unreviewed safety question since the cross-connection of Facility Z1 and Z2 power supplies, and the ability to bypass the open permissive for a shutdown cooling supply valve creates the possibility of a malfunction of a different type than previously evaluated. However, the plant modifications have been designed to minimize the potential, and subsequent impact, of any new malfunction of equipment important to safety. Therefore, we have concluded the proposed changes are safe. The proposed changes do not involve a significant impact on public health and safety I (see the Safety Summary provided in Attachment 1) and do not involve a Significant Hazards Consideration pursuant to the provisions of 10CFR50.92 (see the Significant Hazards Consideration provided in Attachment 2). Therefore, NNECO requests the NRC review and approve the proposed changes to the Millstone Unit No. 2 FSAR through an amendment to Operating License DPR-65, pursuant to 10CFR50.90. Plant Operations Review Committee and Nuclear Safety Assessment Board The Plant Operations Review Committee and Nuclear Safety Assessment Board have reviewed and concurred with the determinations. Schedule We request issuance at your earliest convenience, with the amendment to be implemented within 60 days of issuance. State Notification in accordance with 10CFR50.91(b), a copy of this License Amendment Request is being provided to the State of Connecticut. There are no regulatory commitments contained within this letter.
. U.S. Nucl;rr Regulatory Commission B17542/Page 3 If you should have any questions on the above, please contact Mr. Ravi Joshi at (860) 440-2080.
l Very truly yours, 4 NORTHEAST NUCLEAR ENERGY COMPANY l 2
)t ,,
42 & 1
' Leon J. Ofi9/er d
Senior vim President and Chief Nuclear Officer 1 Swom to and subscribed before me l this./d day of 1998
%% Mtary st~ Public MY COMMISSION EXPlRES My Commission expires JUNE 30 2nn?
Attachments (3) cc: H. J. Miller, Region i Administrator S. Dembek, NRC Project Manager, Millstone Unit No. 2 D. P. Beaulieu, Senior Resident inspector, Millstone Unit No. 2 W. M. Dean, Director, Millstone Project Directorate W. D. Lanning, Director, Millstone Inspections J. P. Durr, Chief, inspections Branch, Millstone inspections E. V. Imbro, Director, Millstone ICAVP inspections Director Bureau of Air Management Monitoring end Radiation Division Department of Environmental Protection 79 Elm Street Hartford, CT 06106-5127 e
i Docket No. 50-336 4 B17542 l l l 't i l l 1 i 1 l Attachment 1
)
1 Millstone Nuclear Power Station, Unit No. 2 Proposed Revision to Final Safety Analysis Report l Post - LOCA Long Term Core Cooling Discussion of Proposed Changes l l l l l December 1998
U. S. Nucl:tr Regulttory Commission B17542/Atttchm:nt 1/Pcgs 1 Proposed Revision to Final Safety Analysis Report Post - LOCA Long Term Core Cooling Discussion of Proposed Changes Introduction Northeast Nuclear Energy Company (NNECO) has determined that plant modifications to Millstone Unit No. 2 are necessary to ensure long term core cooling capability after a Loss of Coolant Accident (LOCA). These plant modifications will ensure boron precipitation can be prevented, post-LOCA, following various postulated single failures. The plant modifications have been evaluated in accordance with 10CFR50.59 and have been determined to involve an unreviewed safety question. Therefore, per 10CFR50.59(c), NNECO requests the NRC review and approve the change to the Millstone Unit No. 2 Final Safety Analysis Report (FSAR) contained in Attachment 3 through an amendment to Operating License DPR-65, pursuant to 10CFR50.90. Loss of Coolant Accident The plant response to a LOCA will depend on many variables including size of the break, available makeup capacity, and power history. A brief discussion of the plant response to a large break loss of coolant accident (LBLOCA) and to a small break loss of coolant accident (SBLOCA) will be presented to explain why the plant modifications are necessary. Large Break Loss Of Coolant Accident A LBLOCA will result in a rapid depressurization of the Reactor Coolant System (RCS). This will result in the generation of a Safety injection Actuation Signal (SIAS), followed by a Containment Spray Actuation Signal (CSAS). Borated makeup water from the Refueling Water Storage Tank (RWST) will be delivered to the RCS by the High Pressure Safety injection (HPSI) pumps when RCS pressure decreases below the shutoff head of the HPSI pumps (approximately 1200 psia), by the Safety injection Tanks (SITS) when RCS pressure decreases below approximately 250 psia, and by the Low Pressure Safety injection (LPSI) pumps when RCS pressure decreases below the shutoff head of the LPSI pumps (approximately 200 psia). Sufficient heat will be removed from the RCS by the safety injection water and the break flow to adequately l cool the reactor core. l Containment pressure will initially increase as RCS inventory is released to the l containment atmosphere. The Containment Spray (CS) pumps will deliver water from I the RWST to the containment atmosphere to remove heat and reduce containment pressure. The Containment Air Recirculation (CAR) fans will also remove heat from the containment atmosphere. ( 1
i .
. U. S. Nuclsar Regulatory Commission '
- B17542/Atttchmnnt 1/Pcga 2 After the inventory in the RWST has been depleted, a Sump Recirculation Actuation Signal (SRAS) will be generated which will transfer the suction of the HPSI and CS pumps to the containment sump, secure the LPSI pumps, and initiate cooling to the Shutdown Cooling (SDC) heat exchangers.
For a LBLOCA it is not expected that the RCS will refill. Therefore, decay heat will be removed by safety injection water and flow out of the break, and indirectly by the CS System and the CAR fans. At 8 to 10 hours after the LOCA, assuming the RCS has not refilled, simultaneous hot and cold leg injection will be established to provide core flushing to prevent boron precipitation. The preferred method of simultaneous hot and cold leg injection is LPSI flow to the RCS hot leg (one LPSI pump to the SDC warm-up line to the SDC suction line to the hot leg). Cold leg injection will be from HPSI flow and the running LPSI pump. If the preferred method can not be established due to a single failure, the alternative method of simultaneous hot and cold leg injection will be used. The alternate flowpath is HPSI flow to the hot leg (1 HPSI pump to the charging line to the pressurizer auxiliary spray line to the hot leg), and cold leg injection will be LPSI flow. These flowpaths are illustrated by Figures 1 and 2. Either of these , simultaneous hot and cold leg injection methods will provide flow that is adequate to l cool the core and prevent boric acid precipitation. The boron precipitation control hot leg injection paths, preferred - LPSI flow to the hot leg and alternate - HPSI flow to the hot leg, are consistent with the boron control approach accepted by the NRC in a Ytter dated June 29,1981.") The boron precipitatio i precipitation control cold leg injection paths have been modified to be consistent with l the newly completed long term cooling analysis. The preferred cold leg injection will include LPSI flow, in addition to HPSI flow. The alternate cold leg injection flow will be LPSI, instead of HPSI. These changes are consistent with the new analysis that has been performed to ensure sufficient flow will be provided for core cooling, boron precipitation control, and safety injection pump requirements. Small Break Loss Of Coolant Accident A SBLOCA will also result in depressurization of the RCS, but at a slower rate. This will result in the generation of a SlAS, and possibly a CSAS. Borated makeup water from the RWST will be delivered to the RCS by the HPSI pumps when RCS pressure decreases below the shutoff head of the HPSI pumps (approximately 1200 psia). If the break is too small, heat removal by injection flow and break flow will not be sufficient. I An additional heat sink, the steam generators, will be necessary. In this situation, the RCS will not continue to depressurize. Therefore, SIT injection and LPSI flow will not occur initially. Containment pressure will initially increase as RCS inventory is released to the containment atmosphere. The CS pumps, if actuated, will deliver water from the W R. A. Clark letter to W. G. Counsil, Resolution of Boron Solubility During Long Term Cooling issues for Millstone Nuclear Power Station, Unit No. 2, dated June 29,1981, 1
I
., U. S. Nucisar Regulttory Commission I B17542/ Attachment 1/Page 3 RWST to the containment atmosphere to remove heat and reduce containment pressure. The CAR fans will also remove heat from the containment atmosphere.
After the inventory in the RWST has been depleted, a SRAS will be generated which will transfer the suction of the HPSI and CS pumps to the containment sump, secure the LPSI pumps, and initiate cooling to the SDC heat exchangers, it may take a significant amount of time to deplete the RWST inventory and reach the SRAS setpoint, especially if a CSAS has not been generated. At 8 to 10 hours after the SBLOCA, the operator will determine if the RCS is filled by checking pressurizer level and subcooling margin. If the RCS is filled, natural circulation, using the steam generators, will prevent boric acid precipitation. If the RCS has not refilled, simultaneous hot and cold leg injection will be necessary, as previously , discussed. The operators will attempt to estabHsh SDC entry conditions. If SDC can l not be established, steam generator cooling will continue by feeding the steam l generators using the Auxiliary Feedwater (AFW) System and dumping steam to either ; the~ main condenser or the atmosphere. The natural circulation flow, which develops in ! the RCS, will provide sufficient core flow to prevent the boric acid solubility limit from being reached, and is also sufficient to remove fission product decay heat. The initial source of water to feed the steam generators is the Condensate Storage Tank (CST). The normal makeup to the CST is from the Ecolochem System, if normal makeup is not available, the AFW System can be connected to the Firewater Storage Tanks. These tanks can be replenished from the City Water Supply. Steam flow from the steam generators will be through the main condenser steam dump valves, if available, or through the atmospheric steam dump valves. Since a loss of offsite power is assumed concurrent with the LOCA, the main condenser steam dump valves will not be available. Therefore, the atmospheric steam dump valves are the assumed steam release path. As a result of the importance of the atmospheric steam dump valves to the mitigation of the LOCA, the operability of these components should be required by the Millstone ' Unit No. 2 Technical Specifications. A Technical Specification change to add these components was submitted in a letter dated August 4,1998.* Summary Figure 3 summarizes the Millstone Unit No. 2 LOCA long term core cooling mitigation strategy. At 8 to 10 hours after the LOCA, a determination is made whether or not the RCS is filled as indicated by pressurizer level and subcooling margin. The 8 to 10-hour timeframe is used as the decision point because it provides ample time to initiate j simultaneous hot and cold side injection prior to the occurrence of boric acid ' precipitation. l l m M. L. Bowling, Jr. letter to the NRC, " Millstone Nuclear Power Station, Unit No. 2 Proposed Revision to Technical Specifications Condensate Storage Tank and Atmospheric Steam Dump Valves," dated August 4,1998.
\
. U. S. Nucl::r R!gulatory Commission B17542/ Attachment 1/Page 4 The left branch of Figure 3 applies to break sizes for which the RCS is filled at 8 to 10 hours. For these breaks, SDC System operation, or continued steam generator cooling via natural circulation, will provide heat removal, and will prevent further boric acid buildup in the core.
The right branch of Figure 3 applies to break sizes for which the RCS is not filled at 8 to 10 hours. For these breaks, simultaneous hot and cold side injection is used to maintain core cooling, and to provide boric acid precipitation control. Post LOCA Lona Term Core Coolina ! Recently, two separate issues related to long term core cooling following a LOCA have been identified. The first issue is whether radiation levels will prevent the necessary operator actions to place the SDC System into operation after a SBLOCA. If the size of the LOCA is such that the RCS is refilled prior to 8-10 hours, significant fuel damage is not expected, unless multiple failures occur. (The assumption of multiple failures during a LOCA is beyond the design basis of Millstone Unit No. 2). Therefore, it is not expected that radiation levels would prevent the local operator actions necessary to place the SDC System in operation. However, if radiation levels are high enough to prevent the operator actions necessary to place the SDC System in operation, or if a failure in the SDC System occurs, heat removal using natural circulation and the steam generators would be continued. The use of either method, SDC or steam generators, for long term core cooling following a LOCA will provide long term core cooling and prevent boron precipitation. The second issue involves the susceptibility of the SDC/LPSI Systems to a single failure when used for boron precipitation control via dual-path injection. This has been addressed in LER-98-002-00." A failure modes and effects analysis, FSAR Table 6.3-8, " Failure Modes and Effects Analysis for Boron Precipitation Control," (FSAR change, Attachment 3), has been performed for the various boron precipitation control lineups. The results of this analysis indicate that to eliminate single failure vulnerability, plant modifications to install an alternate AC power supply to valve 2-SI-651, " Shutdown Cooling Header Containment Isolation Valve," in the SDC supply line from the RCS, and an alternate DC power supply to valves 2-CH-517, " Auxiliary Spray Charging Header Supply Valve," and 2-CH-519, " Loop 1A Charging Header Supply Valve," in the Charging System are necessary. However, these modifications will only be used following a LOCA of sufficient size such that the RCS is not refilled, and simultaneous hot and cold leg injection will be necessary for boron precipitation control. In addition, a failure of a Facility Z1 or Z2 power supply will be necessary. The modifications will not be used during normal plant operations, and will not be necessary when using the SDC System, or the steam generators, for long term core cooling.
- J. A. Price letter to the NRC, Millstone Nuclear Power Station, Unit No. 2 Licensee Event Report 98-002-00, " Emergency Core Cooling System Single Failure Vulnerability," dated February 6,1998.
, U. S. Nuclur Regulatory Commission B17542/ Attachment 1/Page 5 Boron Precipitation if, at 8 to 10 hours after a LOCA, the RCS has not re-filled, based on pressurizer level and subcooling margin, simultaneous hot and cold leg injection will be established to provide core flushing to prevent boron precipitation. The preferred method of simultaneous hot and cold leg injection is LPSI flow to the hCS bot leg (one LPSI pump ,
to the SDC warm-up line to the SDC suction line to the hot leg). Cold leg injection will ! be from HPSI flow and the running LPSI pump. This is illustrated by Figure 1. If the preferred method can not be established due to a single failure, the alternative method of simultaneous hot and cold leg injection will be used. The alternate flowpath is HPSI flow to the hot leg (1 HPSI pump to the charging line to the pressurizer auxiliary spray line to the pressurizer surge line to the hot leg). Cold leg injection will be from LPSI flow. This is illustrated by Figure 2. Either of these simultaneous hot and cold leg injection methods will provide adequate flow to cool the core and prevent boric acid precipitation. An evaluation has determined that the normal and alternate boron precipitation control methods are susceptible to single failures. A LOCA coincident with a loss of a Facility ' Z1 power source could prevent the opening of 2-SI-651. This would prevent the use of the LPSI pumps and the SDC System for boron precipitation control (Figure 1). In addition, a Facility Z1 loss could disable HPSI pump P41 A, and prevent the closing of HPSI header injection valves 2-SI-617,2-SI-627,2-SI-637, and 2-SI-647. It could also prevent the opening of HPSI suction and discharge cross-connect valves 2-SI-411 and 2-Sl455, which would be required to use the HPSI swing pump, P41B, to provide boron precipitation control (Figure 2). A LOCA coincident with a loss of a Facility Z2 AC power source could prevent the opening of 2-SI-652, which would prohibit the use of the LPSI pumps and the SDC System for boron precipitation control (Figure 1). In addition, a Facility Z2 DC power loss would prevent the opening of auxiliary spray line valve 2-CH-517, and the closing of charging header supply valve 2-CH-519. Operation of these valves would be required to establish the alternate flow path which uses a HPSI pump to provide boron precipitation control (Figure 2). The most limiting failure which will require valve 2-SI-651 to be powered from its alternate source is a failure of breaker B0503 "22E Feeder to MCC-22-1E (B51)." A failure of B0503 will doenergize motor control center (MCC) B51. A loss of MCC B51 will disable 2-SI-651 and the four HPSI header valves 2-SI-617, 2-SI-627, 2-SI-637 and 2-SI-647. Opening 2-SI-651 is required to use the LPSI method of hot leg injection. i Also, to preclude net positive suction head (NPSH) problems for HPSI pump P41 A due l to high pump flowrate, the four HPSI header valves need to be closed when trying to use the HPSI method of hot leg injection. Since important valves in both.the LPSI and HPSI hot leg injection flowpaths would be disabled, the ability to establish boron precipitation control is compromised by a failure of MCC B51. Therefore, valve 2-SI-651 needs to be powered from an alternate source, Facility Z2, to establish boron precipitation control. ! l l
I i , U. S. Nuclar Regulctory Commission l B17542/Attrchment 1/Page 6 l 4-The most limiting failure which requires valves 2-CH-517 and 2-CH-519 to be powered from their alternate source is a failure of breaker D0208 "125V DC Bus 201B to 125V DC Instrument Panel DV20." A failure of D0208 will deenergize 125V DC Instrument Panel DV20. A loss of DV20 will require Facility Z2 diesel generator to be secured due to the loss of DC control power. It will also disable valves 2-CH-517 and 2-CH-519. Securing Facility Z2 diesel generator will cause a complete loss of Facility Z2 AC power and will prevent the opening of 2-SI-652. Opening 2-SI-652 would be required to use the LPSI method of hot leg injection. Valve 2-CH-519 needs to be closed and
- valve 2-CH-517 needs to be opened to use the HPSI method of hot leg injection. Since 4
important valves in both the LPSI and HPSI lineups would be disabled, the ability to l establish boron precipitation control is compromised by a failure of DV20. Therefore,
! valves 2-CH-517 and 2-CH-519 need to be powered from an alternate source, Facility i
Z1, to establish boron ysipitation control. l l Plant Modifications Modifications to Millstone Unit No. 2 will alleviate single failure concerns for boron i precipitation control by providing an altemate source of power for 2-SI-651, 2-CH-517 and 2-CH-519. The alternate power sources will ensure motive power is available to open 2-SI-651 and 2-CH-517, and to close 2-CH-519 to establish boron precipitation
; control following a LOCA.
A local control switch will be added to bypass the disabled low pressure permissive to open 2-SI 651 after a LOCA with a Facility Z1 failure. This permissive, which could be disabled with a Facility Z1 failure, prevents opening 2-SI-651 unless RCS pressure is below SDC System design pressure.
- i 3 To ensure proper valve alignment for either hot or cold leg injection from the LPSI
, pumps, connection points for determining the valve position of 2-SI-615,2-SI-625,2-SI-635, and 2-SI-645 will be added. Correct valve alignment will ensure proper flow distribution, and that LPSI pump NPSH requirements are met.
t The plant modifications to address single failure concerns for boron precipitation control are listed below.
- 1. Provide an alternate AC source of power for 2-SI-651, a Facility Z1 component, from Facility Z2.
- 2. Provide an altemate DC source of power for 2-CH-517, a Facility Z2 component, from Facility Z1.
- 3. Provide an alternate DC source of power for 2-CH-519, a Facility Z2 component, from Facility Z1.
- 4. Provide test jacks to determine the valve position of LPSI injection valves
I
, U. S. Nuclecr Regulatory Commission !
l B17542/Attachm:nt 1/Page 7 i i 2-SI-615,2-SI-625,2-Sl435, and 2-SI-645 at the respective MCC (MCC B51 for 2-SI-615 and 2-SI-625, MCC B61 for 2-SI-635 and 2-SI-645).
- 5. Provide bypass capability of the low pressure open permissive for 2-SI-651. l l
Alternate Power Supplies
- Millstone Unit No. 2 has various components that can be supplied from alternate power sources during normal plant operation. These components are classified as Facility 4
Z5. The FSAR defines Facility Z5 components as spare units of emergency equipment that can be transferred from one power source to another. The FSAR description of spare units states that the components can be aligned to either bus depending on which redundant piece of equipment is out of service. For example, if Service Water i pump PSA (Facility Z1) is out of service, Service Water pump PSB (Facility Z5) can be i aligned to Facility Zi as the redundant pump to Service Water pump PSC (Facility Z2).
- Service Water pump P5D can also be aligned to Facility Z2 if PSC is out of service.
I Reactor Building Component Cooling Water pump P118 and HPSI pump P41B are j additional examples of Facility Z5 components. j 2-SI-651, 2-CH-517 and 2-CH-519 do not meet the same design intent of Z5 :
- components. These valves are not installed spares. Therefore, changing the power j 4
I feed to these valves will not be allowed during normal operation. The alternate power supplies for these valves will only be used after a LOCA to mitigate various single failures. i a The alternate power source for 2-SI-651 will be provided by Facility Z2 MCC B61 l (Figure 4), A spare breaker from MCC B61 will be cross tied into the circuitry for valve
- 2-SI-651. The Facility Z1/Z2 power feeds will be cross connected via manual j disconnect switches. The manual disconnect switches will be equipped with Kirk Key l interlocks to ensure only one disconnect switch can be closed at a time. This type of i
cross connect scheme is identical to the existing scheme used for the 480 volt swing charging pump and swing service water strainer. Additionally, aligning 2-SI-651 to its
- alternate power will isolate the Main Control Room for the alternate power supply.
. Aligning 2-SI-651 to the alternate power supply will be annunciated in the Main Control l Room. In addition, a local control panel, C530, will be installed near MCC B51 to house the motor starter and the bypass and local control switch required to open 2-SI-651 upon a loss of Facility Z1. An open permissive for SDC isolation valve 2-SI-651 prevents the j opening of the valve when RCS pressure is above 280 psia. This permissive is accomplished via a Facility Z1 powered relay. To open 2-SI-651, this relay must be energized. During a postulated LOCA and a loss of a Facility Z1 power source, this i relay may not be energized which would prevent 2-SI-651 from being opened.
) Therefore, a local control switch will be installed to bypass the disabled permissive and i
s y -ws. . + - - . _ , . . . ~ . ., . . - - ~ , - , - _ - . . - , , , - . - , -,
- U. S. Nucinr Regulatory Commission
. j l B17542/ Attachment 1/Page 8 l l allow 2-SI-651 to be operated locally. Bypassing the open permissive for 2-SI-651 will !
be annunciated in the Main Control Room. The open permissive for 2-SI-652 (Figure 1), which is upstream of 2-Sl451, will still be available. 1 i. The alarm for when 2-SI-651 is open and RCS pressure is above 280 psia may also be ! disabled upon a complete loss of Facility Z1. Although the annunciator for 2-SI-651 will ! be disabled, position indication for 2-SI-651 will be available at the local control panel, j C530, via Facility Z2 power. In addition, the Main Control Room annunciator for 2-SI- , 652, which operates the same as the disabled annunciator for 2-SI-651, will be j available. l l The alternate power source for 2-CH-517 and 2-CH-519 will be provided by Facility Z1 DC Instrument Panel DV10 (Figure 5). A spare breaker from DV10 will be cross tied into the circuitry for 2-CH-517 and 2-CH-519. 2-CH-517 and 2-CH-519 are air operated valves (AOVs) which require DC control power. Since these valves only require DC control power, large disconnect switches with Kirk Key interlocks are not required. The Facility Z1 DC power feed will be cross connected via key lock switches rated to handle the control power load. The keys for these switches will be captured in one position to ensure only one power source can be aligned to the valves at a time. Additionally, aligning 2-CH-517 and 2-CH-519 to the alternate power will be annunciated in the Main Control Room. The disconnect switch / breaker combination provides double isolation to ensure proper Facility Zi/Z2 electrical separation. The Kirk Key interlock system on the 480 volt 3 I phase disconnect switches ensures only one disconnect switch can be closed at a time. Similarly, the key lock switches with the key removable in only one position provides the same level of protection. The alternate power feed breakers will administratively be kept in the open position. Therefore, a single failure (i.e. short circuit) of any isolation l component will not compromise the separation between the Facility Z1 and Z2 power sources. To provide alternate power to 2-SI-651, 2-CH-517 and 2-CH-519, new cables and internal wiring will be required. The new cable and wiring routings will maintain the required separation. New cables / wiring, which will be energized during normal operation, will be run in conduits and trays associated with the facility providing normal power. Although, these components will not be classified as Z5 components, Z5 separation requirements for redundant power routed to the ss.me switch will be maintained. The FSAR will be revised to identify these valves as having an alternate power source. Diesel generator, MCC and battery loading will be affected by these modifications. Aligning these valves to the redundant power will change the loading for MCC B61, DV10, Battery 201 A, and both diesel generators. The slight increase in load will not impact the ability of any of these components to supply the required loads.
1
) . U. S. Nuclear Regulatory Commission B17542/ Attachment 1/Page 9 Breaker coordination for MCC B61 and DV10 will not be affected by this modification.
Both MCC B51 and B61 consider the 100A charging pump breaker as the most limiting breaker. The new breaker in MCC B61 will be a THED 35A breaker similar to the existing breaker in MCC B51. The new breaker in DV10 will be the same size as existing breakers in DV20 which have been shown to have proper coordination. Therefore, addition of the breakers in MCC B61 and DV10 will not invalidate the existing coordination calculations. Safety Summary The proposed plant modifications (Figures 4 and 5) will add the capability to provide either Facility Z1 or Z2 safety related power to valves 2-Sl451, 2-CH-517 and 2-CH-519. The physical connection between the redundant power trains (i.e. mechanically interlocked disconnect switches) is consistent with the requirements of ; the Millstone Unit No. 2 FSAR and Safety Guide 6,W and is similar to current designs ; utilized for the swing battery charger, swing charging pump and swing service water strainer. However, unlike these other components, the load side of the disconnect ' switches for valves 2-Sl451,2-CH-517 and 2-CH-519 will not be classified Facility Z5, as discussed earlier. Valves 2-Sl451,2-CH-517 and 2-CH-519 are not designed to be installed spare units of emergency equipment, and realigning the power feed to these valves will not be required during normal operation. The alignment to the ! alternate power feed will only be accomplished after a LOCA with a single failure in either the Facility Z1 or Z2 power distribution system. The cables for 2-Sl451 will remain routed in Facility Z1 cable trays, conduits and containment penetration. Similarly the cables for 2-CH-517 and 2-CH-519 will remain routed in Facility Z2 cable trays, conduits and containment penetration. When aligned to the alternate power, the potential for rc.uting Facility Z1 and Z2 power in the same cables, cable trays, conduits, and containment penetrations exists. Although the physical cross connection of the redundant power trains (Facility Z5) has been previously evaluated, the routing of the load side cables which can be supplied from either facility in Facility Z1 or Facility Z2 cable trays and conduits has not previously been evaluated. Additionally, a local control switch which bypasses the pressure permissive for 2-Sl451 will be added. This capability has not previously been j evaluated. Therefore, the proposed plant modifications create the possibility of a j malfunction of a different type than previously evaluated. The independence and physical separation of the redundant power systems is provided 1 by a normally open disconnect switch, and a normally open circuit breaker wired in series. No single component failure can result in the redundant power trains being paralleled or routed together during normal operation. Multiple operator errors would be required to align 2-Sl451, 2-CH-517 or 2-CH-519 to the alternate power source W Safety Guide 6, " Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems," dated March 10,1971.
i
. U. S. Nuclecr Regulatory Commission B17542/ Attachment 1/Page 10 during normal operation. To misalign these valves, an equipment operator would have l to perform steps located only in an Emergency Operating Procedure. Additionally, control room operators would have to disregard annunciators that indicate the valves are being transferred to their alternate power source. Although these multiple operator i actions constitute more than one single failure (an operator error is an active single failure), the magnitude of this misoperation warrants consideration. Therefore, this evaluation will be conservative and consider these multiple operator errors as one single failure. Additionally, the disconnect switches will be mechanically interlocked as required by the FSAR and Safety Guide 6. The mechanical interlock ensures that the i alternate feed disconnect switch cannot be closed until the primary disconnect switch is open. Therefore, during normal operation a single failure of either the alternate breaker or disconnect will not result in the cross connection of the two redundant power ;
facilities. ' The integrity of the valve and valve circuitry (cables, breakers and disconnect switches) ensures that although the two redundant trains are routed together, both trains are adequately protected. The new cables for these valves have been sized such that they have adequate ampacity for their expected loads. The new breakers, B6172 and DV10 Ckt 12, and the motor starter for 2-SI-651 are sized such that they protect the cables from damage during any potential over current condition. Breaker coordination ensures that alternate supply branch over current protection devices will trip prior to the alternate source feeder breaker. Therefore, any additional failure that causes an i increase in current is adequately protected, and will not compromise the redundant power train. If the valves are aligned to their alternate power source during normal operation, redundant safety related power would be routed in the same cable trays and conduits. Since a single failure (operator error) is required to align the valve to its alternate power source, additional failures need not be considered. Additionally, it is reasonable to consider that the valves, their cabling, containment penetrations, circuit breakers and disconnect switches are all undamaged and operating properly since the operator error would cause no collateral damage to these components. Since the cabling and protective devices for these valves will be operational, an overload condition, while aligned to the alternate power, would be detected and cleared prior to affecting the redundant power system. After a LOCA has occurred, a single failure in either Facility Z1 or Facility Z2 is required prior to transferring to the alternate power source. Based on the Facility Z1 or Z2 failure, it is reasonable to consider that no collateral damage exists which could impact 2-Sl451, 2-CH-517 and 2-CH-519. Therefore, when aligned to the alternate power, no additional failures beyond the failure in the power distribution system need to be considered, and there will be no collateral damage to the safety related cables, cable trays, conduits, circuit breakers, and penetrations associated with 2-Sl451, 2-CH-517 and 2-CH-519. With all protective devices operational, and with proper
1 ! . U. S. Nuclur Regulatory Commission ' . B17542/ Attachment 1/Page 11 breaker coordination, the alternate branch breaker will trip prior to the alternate feeder j breaker (MCC B61 or DV10). Additionally, the isolation of all Main Control Room ! indication and control for 2-SI-651, when aligned to the alternate power feed, j eliminates separation concerns for cables routed to the Main Control Room. 4 l 2-Sl451 is equipped with a pressure permissive that allows the valve to be opened . when pressurizer pressure is below 280 psia. This pressure permissive would be ! disabled upon a loss of Facility Z1 power. This would prevent the opening of 2-SI-651. j The new local control switch for 2-Sl451, which bypasses this pressurizer pressure j oermissive, is isolated by normally open relay contacts. When aligned to its alternate i power, local control is enabled, and remote control in the Main Control Room is isolated. As stated before, several operator actions would be required to align this i~ valve to its alternate feed during normal operation. Therefore, the only time the valve is expected to be opened by the local control switch is after a LOCA with a Facility Z1 failure. Currently, the potential exists for an operator to open the valve when pressure j is above 280 psia. A undetectable single failure of the contact which provides the
- permissive would allow an operator to open the valve even when pressure is above 280 i psia. During normal operation, this condition would be annunciated in the Main Control i Room. During accident conditions, this annunciator may be disabled. Therefore,2-SI-
] 651 could be opened with pressurizer pressure above 280 psia without annunciation. 1 Although 2-SI-651 could be opened, the pressure permissive for 2-SI-652, the i upstream isolation valve (Figure 1), would prevent 2-SI-652 from opening. This would i protect the shutdown cooling suction line from overpressurization. During accident
- conditions, if both valves were opened and pressure increased above 280 psia, j annunciation of 2-SI-652 being open would be available to provide indication of the
! potential overpressure condition. Local valve position indication will also be provided ! for the operator controlling the valve. During normal operation the local control switch 1 and local indication will be disabled. Any malfunction of the local control switch during ] normal operation will not impact the ability to control 2-SI-651 from the Main Control ) Room. 1 l } This modification will also provide test jacks to determine the valve posilico of the four l } LPSI injection valves, 2-SI-615, 2-SI-625, 2-SI-635 and 2-SI-645 (Figure 1) during a l i loss of Facility Z1 or Z2. LPSI injection valve position is required to ensura proper line- l l ups are established for boron precipitation control. The new position indication connection Jacks, which will be added to the respective MCC, provide no control functions. The connection points will be wired in parallel with the existing valve limit i switches providing valve position indication. The disconnect switches, breakers, control switches, and auxiliary components are designed for the rated voltages and currents. They are QA Category 1. components seismically and environmentally qualified for their proposed locations. Ali equipment added will be located in mild environments.
. U. S. Nuclecr Regulatory Commission B17542/Attechment 1/Page 12 The proposed plant modifications will add equipment that will require operator action outside of the Main Control Room. To align 2-SI-651 to its alternate power source will require operator actions within the Radiological Controlled Area (RCA). The current methods for establishing hot leg injection also require the operator to enter the RCA to open manual valves. The new components being added will be located in low dose areas to minimize the operator dose. An evaluation has been done to confirm that l environmental conditions, including radiation levels, will not prevent operator access to {
the new equipment. ' The proposed plant modifications will ensure long term core cooling equipment is available for LOCA mitigation. Although the proposed activity creates the possibility of . a malfunction of a different type than previously evaluated, the design is safe and ) reliable. There is no single failure during normal operation that could result in the redundant safety related power trains being paralleled or routed in the same cable trays or conduits. When the valves are required to be aligned to the alternate power supply during accident conditions, the valve protection devices will prevent the tripping of the redundant power train. Also, the new electrical components, cabling and position indication connection Jacks are designed for the rated voltages and currents, and are QA Category I seismically and environmentally qualified, as required.- They will not degrade the separation of the redundant power systems. Therefore, the proposed plant modifications will not adversely impact the health and safety of the public. 1 l l 1 1 i
4 - 3b s en Ss
=w 2m S'
s5' RCS HOT 2s LEG INJECTION gy SDC SUPPLY m
= W +- o a
=
$a e
-g (HOT LEG INJECTION) '
P42A U 2-51-652 2-51-65I ZI FACILITY T g Z2 FACILITY Z1 FACILITY 2-SI-709 Q ;;;- (ALTERNATE (REACH ROD) ~" **~ LOW PRESSURE TT POWER Z2 :3. x FACILITY) 2-SI-400 (REACH ROD) SAFETY INJECTION ggy g g-o
~ roa eo i I
- 2-51-635 2-SI-306 R Z2 FACILITY (BLOCKED OPEN) P428 -
- c. 9. '
F M
=
- c RCS 2-SI-645 r" COLD Z2 FACILITY T LEG @
INJECTION u 2-SI-625 - Z1 FACILITY u 2-51-615 21 FACILITY __________._______________m _ _ _ _ _ _ _ . _ _ _ _ _
- ;.;' U3 C AOV 2-CH-519 Z2 FACILITY
$b (ALTERNATE POWER yZ sC ZI FACILITY) D O.
FO g I tk4 AOV 2-CH-518 2-CH-429 (NORMALLY OPEN) @ '@ ZI FACILITY 3[ eo 2-CH-338 (NORMALLY OPEN)
- h Wi TO PZR AUX SPRAY
~
? Q (HOT LEG INJECTION)
(AL Rt A
~ '
b O POWER Z1 FACILITY) k
$33 2-CH-440 (REACH RODI l RwST OR
- CNMT SUMP ~ $ y~
[ ! 6-2-SI-617 m2 ~3 oe Z1 FACILITY ' [ 1 p x ::t m u SI-008 2-SI-656 2-SI-428
/'
2-51-427 ga pg gog u NORMALLY OPEN Z1 IL M 2-SI-627 1 COLD LEG 2-SI-616 2-SI-655 3r ZI FACILITY J L 2-h -411 1 db INJECTION u Z2 FACILITY Z] FACILITY J
-{E.
&. u 2-SI-415 2-SI-414 G 21 FACILITY P41B 2
-S -626 15 FACILITY T u RCS Z2 FACILITY 2-51-653 1 P u 2-SI-412 7 COLD LEC 22 FACILITY J L Z2 FACILITY J L INJECTION u 2-51-647 Z1 FACILITY 2-SI-636 2-51-654 t .
a O* RWST OR CNMT SUMP 2-SI-406 2-51-405 Z2 FACILITY P41C Z2 FACILITY u 8 HPSI TRAIN 2-SI-646 Z2 FACILITY
. U. S. Nuclear Regulrtory Commission B17542/ Attachment 1/Page 15 Figure 3 Long Term Cooling Plan LOCA I
IDCA tr :f>'" Accidset SIAS SIAS Safety Iqpechen Actuohon Signal [ l y HPSI High Pressee Safety Injedian Punp LPSI Imw Preenwe Safety bijechan Fusmy HPSI and LPSI
-AFAS Auxiliary Feedwaser Actushan Signal Actuated (Cold Side)
SIT Safety Iqischon Tank SDC shuidown Cooing Sye. SO , Seeane Osnerator i Tmie Aher Start d1DCA l AFAS l 1
"Manuar'indicanes ace. automatic functions Aux. Feed Flow Actuated Auto Yes O- -
No I l Activate iI 1 hr **'* AI"""M Tubine Bypass Stearn Durnp Manual Manual I I I laolate or Vent the SITS Manual I Yes RCS No Establish initiate simultaneous Hot SDC Conditions 8 hr 5 t 510 hr and Cold leg Injection Manual Yes DC No i Actuak P i i Maintain SO SDC 8 Ileat Removal Mouel l Existing I L___________! Secure Stearn Generators Manual i i
. U. S. Nuclhcr R:gul: tory Commission '
B17542/ Attachment 1/Page 16 Figure 4 Alternate Power For Valve 2-SI-651 FACILITY Z1 FACILITY Z2 480V,3PH,60HZ. ! A 480V,3PH,60HZ.' B C i A B C
@)____@y @) m
@}.___@.) - @) -
j T1 T2 T3 T1 T2 T3 A B C A B C
/- - /
KIRK KEY INTER (OCK_, __j / , A B1 C1 At Bt C1 I 1 1 10 20 30 CONTROL g CIRCUIT
.cm
- 42.o h ::42. c 49 ,
)
T1 T2 T3 I A1 B1 C1 l: A2 B2 C2 I I I TO VALVE St651 VIA ELECT. PENETR. 1 +
. U. S. Nuclxr Regul* tory Commission B17542/ Attachment 1/Page 17 Figure 5 Alternate Power For Valves 2-CH-517 and 2-CH 519 TAP
%~, 10A 125VDC FROM DV10, CKT,12 p 3 HI + ll N 4 -
FACILITY Zi wm, i GE CR104
~~KE
- f (YLOCKSW.
NOTE 1) - l 1 GE CR104 KEYLOCK SW. TCJ 10A (NOTE 1) l 125VDC FROM p _10A DV20, CKT.12 1 y il + !,'
!! ll , g N 2 -
If It i EACILITY Z2 ' 10A CHS17 l i fl - Il-- 10A l
-HI + If--
10A CH519
---U ".-,N~~
TO OTHER FACILITY Z2 FUSES IN PANEL CO2 NO TE:
- 1. KEY REMOVADLE IN "OFF" POSITION ONLY, ONLY ONE KEY FOR BOTH SWITCHES, SO THAT THEBE"ON" CAN SWITCH TURNED ON. MUST BE TURNED OFF AND THE KEY REMOVED DEFORE THE "OFF" SWITC l
l l l i I' l-l' l . . _ - .-
..g.
Docket No. 50-336 B17542 Attachment 2 Millstone Nuclear Power Station, Unit No. 2 Proposed Revision to Final Safety Analysis Report Post - LOCA Long Term Core Cooling Significant Hazards Consideration l December 1998
. U. S. Nucber Reguiltory Commission B17542/ Attachment 2/ Pag 31 Proposed Revision to Final Safety Analysis Report Post - LOCA Long Term Core Cooling Significant Hazards Consideration Significant Hazards Consideration in accordance with 10CFR50.92, NNECO has reviewed the proposed changes and has concluded that they do not involve a significant hazards cor sideration (SHC). The basis for this conclusion is that the three criteria of 10CFR50.92(c) are not compromised. The proposed changes do not involve an SHC because the changes would not:
- 1. Involve a significant increase in the probability or consequences of an accident previously evaluated.
The proposed plant modifications will ensure proper flow paths can be established for boron precipitation control after a Loss of Coolant Accident (LOCA). This will be accomplished by the following plant modifications:
- a. Provide an alternate AC source of power for 2-SI-651, " Shutdown Cooling Header Containment Isolation Valve," a Facility Z1 component, from Faci lity Z2.
- b. Provide an alternate DC source of power for 2-CH-517, " Auxiliary Spray Charging Header Supply Valve," a Facility Z2 component, from Facility Z1.
- c. Provide an altemate DC source of powcr for 2-CH-519, " Loup 1' Charging Hegder Supply Valve," a Facility Z2 component, from Facility
. Z1.
- d. Provide test jacks to determine valve position for LPSI injection valves 2-SI-615, 2-SI-625, 2-SI-635, and 2-SI-645 at the respective motor control center (MCC B51 for 2-SI-615 and 2-SI-625, MCC B61 for 2-SI-635 and 2-SI-645).
- e. Provide bypass capability of the low pressure open permissive for 2-SI-651.
The alternate power supply to valves 2-SI-651,2-CH-517 and 2-CH-519, and the position indication for valves 2-SI-615, 2-SI-625, 2-SI-635, and 2-SI-645 cannot initiate an accident. The proposed modifications will not change the design parameters, failure positions or design requirements of the valves. The
, roposed plant modifications will ensure valves 2-SI-651, 2-CH-517 and 2-CH-519 can operate after a LOCA to perform their accident mitigating functions.
l l . U. S. Nucimr Regulatory Commission j B17542/ Attachment 2/Page 2 i, j Therefore, providing an additional power source to 2-Sl451, 2-CH-517 and 2- . CH-519, and a local means of determining the position of valvos 2-SI-615,2-SI- i
- 625,2-S1-635, and 2-SI-645 cannot initiate an accident and will not adversely l l affect the function of these components to mitigate the consequences of an !
j accident. l The proposed plant modifications will also bypass the open permissive for 2-SI-1 651. This pressure permissive, which protects the low pressure Shutdown Cooling (SDC) System from the nigh pressure Reactor Coolant System (RCS), j allows 2-Sl451 to be opened only when pressurizer pressure is below 280 psia. 1 This pressure permissive would be disabled upon a loss of Facility Z1 power. . This would prevent the opening of 2-Sl451. The new local control switch for 2- I j Sl451, which bypasses this pressurizer pressure permissive; is isolated by l l normally open relay contacts. When aligned to its alternate power, local control I j is enabled, and remote control in the Main Control Room is isolated. Multiple 1 operator errors would be required to align 2-SI-651 to the alternate power source during normal operation. To misalign these valves, an equipment operator i j, would have to perform steps located only in an Emergency Operating Procedure. l l Additionally, control room operators would have to disregard annunciators that {
- indicate the valves are being transferred to their alternate power source.
l Therefore, the only time the valve is expected to be opened by the local control ; j switch is after a LOCA with a Facility Z1 failure. Currently, the potential exists Mr an operator to open the valve when pressure is above 280 psia. An i undetectable single failure of the contact which provides the permissive would i allow an operator to open the valve even when pressure is above 280 psia. j During normal operation, this condition would be annunciated in the Main { Control Room. During accident conditions, this annunciator may be disabled. Therefore,2-SI-651 could be opened with pressurizer pressure above 280 psia without annunciation. Although 2-SI-651 could be opened, the pressure permissive for 2-SI-652, the upstream isolation valve (Attachment 1 Figure 1), would prevent 2-SI-652 from opening. This would protect the shutdown cooling suction line from overpressurization. During accident conditions, if both valves were opened and pressure increased above 280 psia, annunciation of 2-Sl452 being open would be available to provide indication of the potential overpressure condition. Therefore, the installation of the capability to bypass the open permissive for 2-SI-651 will not result in a significant increase in the probability or consequences of an accident previously evaluated. The proposed plant modifications have no adverse effect on how any of the associated systems or components function to prevent or mitigate the consequences of design basis accidents. Also, the proposed changes have no adverse effect on any design basis accident previously evaluated since the modifications will ensure that accident mitigation equipment will be available to function as essumed in the LOCA analysis. Therefore, the proposed plant
l i
. U. S. Nucler Regulatory Commission B17542/ Attachment 2/Page 3 modifications do not result in a significant increase in the probability or consequences of an accident previously evaluated.
n 2. Create the possibility of a new or different kind of accident from any accident previously evaluated. The proposed plant modifications will provide the capability of powering 2-SI-651,2-CH-517 and 2-CH-519 from either Facility Z1 or Facility Z2, and will add test Jacks to MCC B51 and B61 to determine the position of valves 2-Sl415,2-SI-625, 2-Sl435, and 2-Sl445. Additionally, this activity adds a local control switch which will bypass the open permissive for 2-SI-651 when aligned to the alternate power source. A single failure in any of the breakers or disconnect switches which allow 2-Sl451, 2-CH-517 and 2-CH-519 to be powered from either facility is bounded by the failure of the valve. A failure of any of the test . Jacks may result in a loss of control power to the associated valves. This failure is also bounded by the failure of the valve. During normal operation the local control switch which bypasses the pressure permissive is isolated by normally open contacts. A single failure of the local control switch or isolating relay during normal operation cannot disable the pressure permissive. Since a single failure of any component added by this activity is bounded by existing component failures, a failure of these components cannot create a new accident. Therefore, the proposed plant modifications will not create the 1 possibility of a new or different kind of accident from any accident previously ! evaluated.
- 3. Involve a significant reduction in a margin of safety.
The proposed plant modifications will ensure boron precipitation control can be established. This will be accomplished by providing an attemate power source for 2-SI-651, 2-CH-517 and 2-CH-519, and adding test jacks to determine the position of valves 2-SI-615,2-SI-625,2-SI-635, and 2-SI-645. Additionally, this activity adds a local control switch which will bypass the open permissive for 2-SI-651 when aligned to the alternate power source. Although the potential exists to route redundant power trains in the same cable trays, conduits and cable, the design of the modifications ensures that a single failure will not compromise the redundant power distribution system. The installation of the connection jacks and local control switch will not alter the failure analysis for the valves, and will not change the design parameters of the valves (i.e. pressure rating). Therefore, the proposed plant modifications will not compromise RCS pressure boundaries, containment integrity, or fuel cladding. In addition, the new disconnect switches, breakers, cabling, and auxiliary components are all designed for the rated voltages and currents, and are QA Category I seismically and environmentally qualified, as required.
e , I
. U. S. Nucirr R gulatory Commission B17542/ Attachment 2/Page 4 t
l \ i Based on the above, the proposed plant modifications will not reduce the i integrity of the plant protective boundaries, or adversely affect the LOCA l analysis. These modifications will have no adverse effect on equipment l important to safety. The equipment will continue to function as assumed in the l design basis accident analysis. This will ensure that the acceptance criteria of ; 10CFR50.46(b)(5) for long term core cooling will be met. Therefore, there will ; be no significant reduction in a margin of safety. I The NRC has provided guidance concerning the application of standards in l 10CFR50.S2 by providing certain examples (March 6, 1986, 51 FR 7751) of amendmer;ts that are considered not likely to involve an SHC. The changes proposed herein are not enveloped by any specific example. As described above, this License Amendment Request does not impact the probability l of an accident previously evaluated, does not involve a significant increase in the consequences of an accident previously evaluated, does not create the possibility of a new or different kind of accident from any accident previously evaluated, and does not ; result in a significant reduction in a margin of safety. Therefore, NNECO has I concluded that the proposed plant modifications do not involve an SHC. l l I f
3 Docket No. 50-336 l B17542 l i l l
-)
i 1 l Attachment 3 Millstone Nuclear Power Station, Unit No. 2 Proposed Revision to Final Safety Analysis Report Post - LOCA Long Term Core Cooling Marked Up Pages p l l December 1998 j l I
i 1 MNPS 2 FSAR Tf-17// ? -Id l Coolant is returned to the reactor coolant system by the charging pumps, through the regenerative heat exchanger. Prior to entering the charging pumps, the coolant boron concentration is adjusted to meet the rear. tor reactivity requirements, in addition, provision ! i is made tocontrol. chemistry inject chemical additives to the suction of the charging pumps for coolant The volume control system automatically controls the rate at which coolant must be
- removed from the reactor coolant system to maintain the pressurizer level withirbthe l
prescribed control band, thereby compensating for changes in volume due to coolant ! temperature changes. Using the volume control tank as a surge tank decreases the quantity of liquid and gaseous wastes which would otherwise be generated. Reactor coolant system makeup water is taken from the primary water storage tank and the two concentrated boric acid storage tanks. The boric acid solution is maintained at a temperature which prevents crystallization. The makeup water is pumped through the regenerative heat exchanger into the reactor coolant loop by the charging pumps. Boron concentration in the reactor coolant s', stem can be reduced by diverting the letdown flow away from the volume control tank to the radioactive waste processing system. Domineralized water is then used for makeup. When the boron concentration in the reactor coolant system is low, the feed and bleed procedure previously described would generate excessive volumes of waste to be pro-cessed. Therefore, the chemical and volume control system is equipped with a deborating ion exchanger is given in Section which 9.2. reduces boron concentration late in cycle life. A domplete descripti y, x& . + 1.2.10.2 Shutdown Cooling System ,, yyy - y ,w q g ggggg A ' The shutdown cooling system (see Section 9.3)is used to reduce the reactor coolant temperature,at a controlled rate, from 300*F to a refueling temperature of approximately 130"F. It also maintains the proper reactor coolant temperature during refueling. 4 The shutdown cooling system utilizes the low pressure safety injection pumps to circulate the reactor coolant through two shutdown cooling heat exchangers. It is returned to the reactor coolant system through the low pressure safety injection header. The reactor buildirig closed cooling water system (RBCCW) supplies cooling water for the
, shutdown heat exchangers.
1.2.10.3 Reactor Building Closed Cooling Water System . I The RBCCW system consists of two separate independent headers, each of which includes a RBCCW pump, a service water (seawater)-cooled RBCCW heat exchanger, inter-connecting piping, valves and controls. A third RBCCW pump and a third RBCCW heat exchanger are provided as installed spares. The corrosion inhibited, demineralized water in this closed system is circulated through the RBCCW heat exchanger where it is cooled to 85*F by seawater which has a maximum design inlet temperature of 75 F (see Section 9.4). I _ i s2.up2 1.2 8 June 1994 l
- FSARCR-98-MP2-169 i
INSERT A ) l l Once entry conditions are met, the shutdown cooling system can provide long ! term cooling capability in the event of a LOCA after the reactor coolant system has re-filled (see Section 14.6.5.3 ). l 1 l I 1 1 I l l I ,-
l i
. 9 F-/ # 2 -/ d l MNPS 2 FSAR 1
b. One of the two on-line, high-pressure safety injection pumps functions. For ' a cold leg break, one-quarter of the pump discharge is spilled via the break. For a hot leg break, the entire pump discharge reaches the core: c. One of the two low-pressure safety injection pumps functions. For a cold leg break, one-half of this pump's discharge reaches the core. For a hot leg l break, the entire discharge from this pump reaches the core. ' l l The assumed maximum delay time for operation of the safety injection pumps is ' 45 seconds after the SlAS - a 45 second delay for the LPSI system and a 25 second delay for the HPSI system. This is based on the assumption that outside power has been iost g and includes an allowance for the start-up and loadings of the emergency diesel genera-tors. These and other conservative assumptions are given in the Loss of Coolant Analysis. Section 14.6.5. . 6.3.3.2 Cold Shutdown and Refueling 'mseri b 1 To obtain cold shutdown, operation of the system is discussed in Section 9.3. During the ' refueling,' the shutdown cooling heat exchangers are aligned with the low-pressure safety injection pumps and used to cool the refueling water, 6.3.4 Availability and Reliability i 6.3.4.1 Special Features The design basis and system requirements during a dbl are met with the operation of the safety injection tanks and one high-pressure and one low-pressure safety injection pump, delivering rated flow and assuming spillage through the break as defined in Section 6.3.3.1. ~ During recirculation, one high-pressure safety injection pump has sufficient capacity to maintain the water level in the reactor vessel above the core. Ability to meet the core protection criteria is assured by the following design features: a. A high-capacity passive system (safety injection tanks) which requires no power source and will supply large quantities of borated water to rapidly recover the core after a major LOCA up to a break of the brgest reactor coolant system pipe. b. Low-pressure and high-pressure pumping and water Morage systems with intcmal redundancy which willinject borated wate. to provide core protec-tion for .mactor coolant system break sizes equal to and smaller than the largest line connected to the reactor coolant system (the 12-inch pressurizer surge lines or de shutdown cooling and and safety injection lines). The pumping systems also provide borated water to keep the core covered and to continue cooling the core after the passive water supply has been exhausted in addiVon, the high-pressure system will remove reactor core decay and sensible heat during long-term operation after the reactor coolant system rupture. Instrumentation and sampling provisions allow monitoring of the recirculated coolant. suwr 6.3 9 March 1998
FSARCR-98-MP2-169 i INSERT B The safety injection system can provide both long term cooling and boron precipitation control in the event of a LOCA. This is accomplished by simultaneous injection to both the hot and cold legs of the RCS. Hot leg injection is necessary for cold leg breaks to provide a flushing flowpath through the core region such that boric acid solubility limits are not reached during post-LOCA boiloff periods. The preferred method of boron precipitation control is to employ one LPSI pump to inject via the shutdown cooling system warmup and return line piping, past 2-SI-400,2-SI-709,2-S1-651 and 2-SI-652, into the RCS hot leg. Cold leg injection would be provHed by a HPSI pump and also by LPSI flow diverted through at least one of ;he four LPSI injection lines. No more than two of the LPSI injection valves 2-SI-015,625 and 645 are to be open in this configuration and valve 2-SI-635 cannot be open in combination with any other cpen LPSI injection valve. An alternate method of providing boron precipitation flushing flow is to use HPSI pump P-41 A to inject via the charging system header to the pressurizer auxiliary spray line and thus to the hot leg through the pressurizer surge line. This alternate alignment is provided by flow past manually opened 2-CH-440 and 2- l
'1 340 through the regenerative heat exchanger, and past 2-CH-517 to the au>uliary spray line. Normal HPSI injection lines to the cold leg from pump P-41 A are blocked by closing 2-SI-617,627,637 and 647. In this arrangement, cold leg injection is accomplished by the LPSI system.
Adequate flushing flow to preclude boron precipitation as well as adequate long term cooling are provided by either the preferred LPSI or alternate HPSI hot leg injection methods. I
* '9 8 ~ n1P2- /G 'l MNPS-2 FSAR in the system; e.g., a failure of a diesel generator canlot occur simul-taneously with a safety injection valve failure,
- b. Only one active failure is considered for the injection mode and only one i
passive or active failure is considered for the recirculation mode. l c. Failures of check and stop valve internals are credible during the recirculation mode of operation. 1
- d. Failure to respond to an external signal is considered an active failure, internal valve failures are considered passive.
l
- e. The transition to the recirculation mode of operation occurs upon initiation of I recirculation from the sump.
- f. The analysis considers only failures or malfunctions which occur during the time period of SIS operation. Failures or malfunctions that might occur during normal reactor operation are not considered.
Abbreviations used in the Table 6.3-6 are: CRI - Control Room Indication HPSI - High-Pressure Safety injection LPSI - Low-Pressure Safety injection l SlAS - Safety injection Actuation Signal I SRAS - Sump Recirculation Actuation Signal RWST - Refueling Water Storage Tank - ' RCS - Reactor Coolant System SIS - Safety injection System An administrative error analysis has been performed which evaluates the effect of improper positioning of administratively controlled safety injection system valves. The results of this analysis can be found in Table 6.3-7. " 6.3.4.2 Tests and Inspections lM Each safety injection pump is shop tested for hydraulic performance at sufficient head-capacity points to generate complete performance curves. Figures 6.3-2 and 6.3-3 show i the resultant curves for one high-pressure and one low-pressure safety injection pump, respectively. Nondestructive examinations are performed on all pressure-retaining components of each l safety injection pump and tank in accordance with the Draft ASME Code for Pumps and Valves for Nuclear Power, Class 11,1968, and ASME Boiler and Pressure Vessel Code, 1968 Edition through Summer 1969 Addendum, Section lit, Class C, respectively. The safety injection system undergoes a preoperation test prior to plant startup. The test procedure is described in Chapter 13.0. The following preoperational tests and checks are planned: I I 653 MP 6.3 13 October 19971
. FSARCR-98-MP2-169
{ INSERT C The HPSI and LPSI systems may be relied upon to provide long term cooling and boron precipitation flushing flow in the event of a LOCA. A break size of sufficient magnitude that the reactor coolant system is not filled at 8 to 10 hours after the start of the accident requires a simultaneous hot and cold leg injection alignment to provide both long term cooling and boron precipitation control because the break location is unknown. Operator action both inside and outside the control room would be required to align for simultaneous injection. The preferred method of boron precipitation control is to have LPSI pump injection to the RCS hot leg past opened valves 2-SI-400,709,651 and 652 in the shutdown cooling system warmup and suction piping. Some of the LPSI flow would be diverted to the cold leg by having at most two of valves 2-SI-615,625 and 645 open. LPSI injection valve 2-SI-635 cannot be open in combination with any other open LPSI injection valve. The ability to align an alternate vital power source to 2-SI-651 in the shutdown cooling return line ensures single failure criteria are met when aligning for boron precipitation control. Cold leg injection is provided by a HPSI pump and the diverted LPSI flow. An alternate method of boron precipitation and long term cooling can be accomplished by aligning HPSI pump P-41 A to the charging header past valves 2-CH-440,340, the regenerative heat exchanger and 2-CH-517 for injection to the RCS hot leg through the p 'Wrizer miliary spray line and surge line. The ability to align an alternate vital ~ power source to 2-CH-517 and 2-CH-519 in the charging lines ensures single failure criteria are met. Adequate margin to HPSI and LPSI pump NPSH exists for the various boron precipitation control alignments. A failure modes and effects analysis has been completed for post-LOCA periods of combined hot and cold leg injection necessary for boron precipitation control and long term cooling. The results of this analysis are presented in Table 6.3-8. See Section 14.6.5.3 for a description of boron precipitation control and long term cooling under post-LOCA conditions. l .- . .
FSARCR-98-MP2-169 i Table 6.3-8 Insert attached Table 6.3-8 after Table 6.3-7. l l e j ! l 1 i 1 4 4 4 l 4
,/
FSARCR-98-MP2-169 Table 6.3-8: Failure Modes and Effects Analysis for Boron Precipitation Control Single Failure Effects of Failure Actions Required Cold Leg injection Path Boron Precip Control Path
- 1. Loss of Fac Z1 LPSI LPSI 1. B HPSI train (using P42B LPSI Pump via (B61) coincident 1. 2-SI-651,2-SI-615,2 SI-625 remain Open 2-SI-651 with Fac Z2 power. P41C pump) 2-SI-306 through 2-St-with SIAS closed Close 2-SI-635 2. P428 LPSI pump via 651 and 2-SI-652
- 2. P42A LPSI pump cut of service Open 2-SI-400 and 2-SI-709 2-SI- 645
- 3. 125V DC (DV10) will not be available HPSI (battery has 8 hr coping factor) Verify B HPSI train in service to HPSI cold leg injection
- 1. 2-CH-518 fails open due to loss of DC Close 2-SI-636 and 2-SI-646 power (unused)
- 2. A HPSI train out of service
- 2. Loss of Fac Z2 LPSI LPSI P42A LPSI pump via 2- HPSI pump P41A via (B61) coincident 1. 2-St-652,2-St-635,2-SI-645 remain Establish LPSI to cold leg injection SI-615 and 625 2-CH-517 to with SIAS closed 2-SI-615 & 625 are open. pressurizer aux spray
- 2. P428 LPSI pump train out of service line
- 3. 125V DC (DV20) will not be available HPSI 4 (battery has 8 hr coping factor) Power 2-CH-517 snd 2-CH-519 HPSI with 125V DC (D MO)
- 1. 2-CH-517 fails closed due to F3c Z2 AUgn A HPSI pump to Pressurizer DC battery. Aux Spray Line via: Open 2-CH-
- 2. 2-CH-519 fails open 340,440 and 517
- 3. B HPSI train out of service Close 2-CH-518 and 2-CH-519
- 3. Loss of Fac Z1 LPSI LPSI 1. B HPSI train (using P42B LPSI Pump via (B51) Post SIAS 1. 2-St-651 remains closed Open 2-Si-651 with Fac Z2 power P410 pump) 2-SI-306 through 2-SI-
- 2. 2-SI-615 and 2-SI-625 remain open Close 2-SI-635 and 2-SI-645 2. P428 LPSI pump via 651 and 2-SI-652
- 3. LPSI P42A out of service Open 2-SI-400 an12-SI-709 2-SI- 615 and 625
- 4. 125V DC (DV10) will not be available HPSI (battery has 8 hr coping factor) Verify B HPSI train in service to HPSI cold leg injection
- 1. 2-CH-518 fails open due to loss of DC Close 2-St-616 and 626 power (unused) -
- 2. HPSI P41 A out of service r i
f l 7 _ _ _ . _ . _ _ _ _ . _ _ _ _ . _ _ . _ . . _ _ _ . _ _ . _ . _ _ _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___ __________I
FSARCR-98-MP2-169 Table 6.3-8: Failure Modes and Effects Analysis for Boron Precipitation Control Single Failure Effects of Failure Actions Required Cold Leg injection Path Boron Precip Control Path
- 4. Loss of Fac Z2 LPSI LPSI P42A LPSI pump via 2- P41 A HPSI pump via (B61) Post SIAS 1. 2-SI-652 remains closed Establish LPSI to Cold Leg SI-635 and 645 2-CH-517 to
- 2. 2-SI-635 and 2-SI-645 remain open injection pressurizer aux spray
- 3. 125V DC (DV20) will not be available Close 2-SI-615 and 2-SI-625 line (battery has 8 hr coping factor) HPSI HPSI Power 2-CH-517 and 2-CH-519
- 1. 2-CH-517 fails closed due to Fac Z2 with 125V DC (DV10)
DC battery. Align P41 A HPSI pump to
- 2. 2-CH-519 fails open Pressurizer Aux Spray Line via:
- 3. HPSI P41C pump out of service Open 2-CH-340,440 and 517 Close 2-CH-518 and 2-CH-519.
- 5. Loss of 125V DC LPSI LPSI 1. B HPSI train (using P428 LPSI Pump via (DV10) coincident 1. Fac Z1 Diesel is shutdown. Open 2-SI-651 with Fac Z2 power P41C pump) 2-St-306 through 2-SI-with SIAS 2. P42A LPSI pump out of service Close 2-SI-635 2. P42B LPSI pump via 651 and 2-S1452
- 3. 2-SI-615,2-SI-625 remain closed Open 2-SI-400 and 2-SI-709 2-SI- 645
- 4. 2-SI-651 remains closed HPSI Verify B HPSI train in service to HPSI cold leg injection
- 1. 2-CH-518 fails open (unused) Close 2-SI-636 and 646
- 2. P41 A HPSI train out of service
- 6. Loss of 125V DC LPSI . LPSI P42A LPSI via 2-SI-615 P41 A HPSI pump via (DV20) coincident 1. Fac Z2 Diesel is shutdown Establish LPSI to Cold Leg and 625 2-CH-517 to with SlAS 2. P428 LPSI pump out of service injection pressurizer aux spray
- 3. 2-St-635 and 2-SI-645 remain closed 2-SI-615 &625 are open. line.
- 4. 2-SI-652 remains closed HPSI HPSI Power 2-CH-517 and 2-CH-519
- 1. 2-CH-517 fails close with 125V DC (DV10) l
- 2. 2-CH-519 fails open Align P41 A HPSI pump to ;
- 3. B HPSI train out of service Pressurizer Aux Spray Line via: !
Open 2-CH-340,440 and 517 Close 2-CH-518 and 2-CH-519.
- 7. Mechanical P42A or P42B LPSI pump fails to operate LPSI P42A or P428 LPSI via P42A or P428 LPSI l Failure of a LPSI Align the_ operating LPSI pump hot 2-SI-645 Pump via 2-St-306 '
pump leg injection HPSI B train through 2-SI-G51 and 2-SI-645 is open. Close 2-SI-636 & 646 2-SI-652 Close 2-St-615,625 and 635
. o FSARCR-98-MP2-169 i
Table 6.3-8: Failure Modes and Effects Analysis for Boron Precipitation Controi . Single Failure Effects of Failure Actions Required Cold Leg injection Path . Boron Precip Control PWh ,
- 8. Mechanical or 2-SI-306 is pinned open at 50% and 1 Loss of air Failure remains open. Therefore this case is not of 2-SI-306 considered a credible failure case.
- 9. Mechanical Failure of any one of these valves will Establish HPSI to Hot Leg injection One LPSI pump through P41A HPSI pump via f Failure of 2-St- disable LPSI hot leg injection. any two of the four LPSI 2-CH-517 to ,
651,2-SI-652,400 injection valves. pressurizer aux spray or 709 line. A HPSI train out of service None B HPSI train (using P42A/B LPSI Pump I
- 10. Mechanical 1.
Failure of P41A P41C pump) via 2-SI-306 through HPSI pump or 2- 2. P42A/B LPSI pump 2-SI-651 and 2-SI-652 CH-340, 440, 429, via 2-SI-645 517, 518 or 519
- 11. Mechanical 2-SI-635 remains open. Establish HPSI to Hot Leg injection One LPSI pump through P41 A HPSI pump via Failure of 2-SI-635 any two of the four LPSI 2-CH-517 to injection valves. pressurizer aux spray line.
l i
MNPS-2 FSAR i switches are positioned (under administrative control) to feed the third pump from the i power source redundant to that which is feeding the operating pump. Thus,in case of an accident, two charging pumps are available, each fed from a separate and redundant { power source. As noted in Subsection 8.2.3.3 and in Figure 8.2-1, the third service water pump is fed from 4160-volt bus AS, which can be energized from either a channel 21 of Z2 source. The service water strainer associated with this pump has a feeder from each of two 480-volt emergency motor control centers fed from these two vital sources. Two power selector switches (under administrative control) with electrical and Kirk key interlocks prevent tying the two motor control center buses together, as shown in Figure 8.4-2. If l the selector switches are not positioned to complete the supply circuit, an alarm is given l on the main control board. Interlocking also assures that the power supply for the third strainer is aligned to the same source as the power for the associated service water pump. l Thus, two service water pumps and their related strainers are always available, each with a l separate and redundant power cource. 8.4.4.2 Tests and inspections hse.rT The 480-volt circuit breakers, motor starters, and associated equipment are tested while individual equipment is shut down or not in service. Circuit breakers and starters are withdrawn individually and their functions tested. Accidental groeis on the load center l buses or feeders are monitored continuously by ground detectors and are alarmed in the main control room, i Load center transformers are given an insulation resistance test during each refueling { period. i k auw2 8.4-G August 1998
, FSARCR 98-MP2-169 INSERT E Shutdown Cooling Suction Header Containment Isolation valve 2-SI-651 also has the capability of being supplied power from either Facility Z1 or Facility Z2.
This valve is not an installed spare unit of emergency equipment as discussed in Section 8.2.3.3. The alternate power provides a means to open 2-SI-651 post-LOCA for boron precipitation control and will not be utilized during normal plant operation. Therefore, this valve is not considered a Facility 25 component. To prevent placing the plant in an unanalyzed condition for separation concerns, the cross connection of 2-SI-651 to Facility Z2 is limited to boron precipitation control post-LOCA combined with a loss of power to MCC B51 or for testing purposes. Emergency operating procedures provide guidance for aligning 2-SI-651 to its alternate power. l l 1 I I l
r MNPS 2 FSAR ! The 125-volt protection switchgear circuit breakers have magnetic series trip elements for overcurrent as follows: Battery charger - instantaneous, short-time and long-time elements Other feeders - short-time and long-time elements l 8.5.4.2 i Tests and inspections insect F To ensure battery functionalcapability and to assure detection of battery degradation, the* following tests and inspections are performed periodically:
- a. Float voltage is measured.
l
- b. Cells are checked for cracks or leakage.
- c. The plates of cells are checked for buckling, discoloring, grid cracks and plate growth.
- d. Specific gravity of each cellis measured.
- e. Voltage of each cellis measured.
- f. Electrolyte level of each cellis checked, and all water additions are recorded.
- g. Temperature and specific gravity of the electrolyte of a pilot cellis measured.
- h. Battery charger alarms and battery charger voltages are checked.
lM
- i. Bottoms of cells are visually inspected for flaking buildup and.for abnormal cell plate deterioration. m.n
}. Periodically a battery charger AC supply breaker will be opened to verify the load-carrying ability of the battery. During this test an undervoltage annunciator willindicate that the battery chargers are out of service.
Batteries will deteriorate with time, but precipitous failure is extremely unlikely. The surveillance specified is that which has been demonstrated over the years to provide an indication of cell degradation tong before it fails. Battery replacement will be made when a capacity test indicutes the battery capacity is at or below 80 percent of the manufacturer's rating. i l l l l l l l
! l l l BSS.MP2 8.5-5 October 199 7
, FSARCR 98-MP2-169 l
l INSERT F Auxiliary spray charging header supply valve 2-CH-517 and Loop 1 A charging header supply valve 2-CH-519 have the capability of being supplied power from either Facility Z1 or Z2. These valves are not an installed spare unit of l emergency equipment as discussed in Section 8.2.3.3. The alternate power provides a means to open 2-CH-517 and close 2-CH-519 post-LOCA for boron precipitation control and will not be utilized during normal plant operations. Therefore, these valves are not considered Facility Z5 components. To prevent placing the plant in an unanalyzed condition for separation concerns, the cross l connection of 2-CH-517 and 2-CH-519 to Facility Z1 is limited to boron l precipitation control post LOCA, coincident with a loss of normal power, l combined with a loss of Facility Z2 DC power, or for testing purposes. Emergency operating procedures provide guidance for aligning 2-CH-517 and 2- ! CH-519 to their alternate power. I l l i i
MNPS-2 FSAR A "Z" prefix on a cable, conduit or tray number indicates a vital system. The absence of the Z prefix indicates nonvital service. The first figure of a cable, conduit or tray number designates the channel. Such an alpha-numeric prefix is called the Facility Code, and its use is further explained in Table 8.7-4. Vital power and control cables fall mainly into two redundancy classifications: Chan-nel 21 and Channel Z2. In a few cases there is also a Channel Z5, which is a system that can be transferred from one source to another, and is run as described below. Cables such as those in reactor protection service are assigned to Channels Z1, Z2, Z3 and Z4. As shown in Table 8.7-4, nonvital Channel 1 may be routed with vital Channel Z1, and Channel 2 with Channel Z2. Low level butfered signal outputs from 23 and Z4 channels of a four-channel instrument system may be run with nonvital channels 1 and 2 respectively. Where the system lacks a current limiting feature, Z3 and Z4 are run separately. Channel Z5 is associated with the spare units fed from 4160-volt emergency bus A5: namely, service water pump P5B, Reactor Building Closed Cooling Water (RBCCW) pump P11B, and High Pressure Safety injection (HPSI) pump P41B. The power circuits and the control circuits for this equipment are all transferred simultaneously to Chan-nel Z1 or Z2 sources. Thus, their circuits are routed together as Channel 25. The Z5 control circuit and power circuit for the spare 480-volt charging pump P18B, are transferred to Z1 or Z2 sources independent of the above circuits. Hence, the 25 charging pump circuits are routed separately from those associated with bus A-5. Nonvital Channel 5 circuits are those associated with instrument loops or metering circuits. Channels 5 and Z5 circuits are routed together only where it can be demon-strated that their transfer to Channel 1 (Z1) or 2 (Z2) sources does not impair the separation of redundant safety related circuits. p Computer and annunciator circuits are considered nonvital. Their inputs are from nonvital Channels 1 and 2 that may be routed with vital circuits as shown in Table 8.7-
- 4. The Channel 1 and 2 segregation for the nonvital circuits is lost when they enter the final raceways at the computer or the annunciator terminal cabinets. The 480 volt power supply to the computer is reduced to 120-volts by an uninterruptible power supply (preferred) or a regulating transformer (alternate). The internal power supply provides 36 volts (fused one-half amp) to the digitalinputs, and the analog inputs are 10-50 mA. The power supply to the annunciator is from two separate redundant AC to DC power supply systems which isolate the annunciator DC voltage from the AC power sources and isolate the two AC power sources from each other.
The control element drive system (CEDS), including the CEDS logic cabinets, are also considered nonvital. Two separate feeders, one from each of the two nonvital 120 vac instrument buses, supply control power to the logic cabinets. The feeder cables are g.n routed in separate raceway from the distribution panels to the cabinets, but are ultimately bundled together within a common logic cabinet. Separation of the nonvital ihr 120 vac instrument buses is maintained, however, because separate double pole circuit breakers installed in each of the nonvital distribution panels provide isolation between the two buses. No redundancy is intended, or required, for the CEDS logic cabinet power supplies. uem.ue2 8.7-5 September 1995
, FSARCRo98-MP2-169 INSERTO Shutdown Cooling Suction Header Containment Isolation valve 2-SI-651, Auxiliary spray charging header supply valve 2-CH-517 and Loop 1 A charging , header supply valve 2-CH-519 have the capability of being supplied power from either Facility Z1 or Z2. However, these valves are not Facility Z5 components (Section 8.4 and 8.5). The load side of the disconnect switches for 2-SI-651 are routed Z1 and the load side of the transfer . switches for 2-CH-517 and 2-CH-519 are routed Z2. The transfer from the normal 480 volt for 2-SI-651, is accomplished through manual operation of local Kirk-keyed transfer switches ' which prevent tying the two motor control center buses together. Upon transfer to Facility Z2, the control for valve 2-SI-651 will be transferred from the control room to the local control panel. The transfer from the normal 125VDC for 2-CH-517 and 2-CH-519, is accomplished through manual operation of key-locked selector switches, located on panel CO2, which prevent tying the two 125VDC power sources together. These manual transfer schemes are consistent with the requirements of Safety Guide 6.
7_.___ MNPS-2 FSAR proper shutdown margin is maintained. A portion of the charging flow is used as an auxil-iary spray to cool the pressurizer when the pressure of the reactor coolant system is bel that required to operate the reactor coolant pumps. 9.2.3.4 Safety injection Operation (Emergency Operation) Under emergency conditions, the charging pumps function t'o inject concentrated boric a into the reactor coolant system. Either the pressurizer level control or the SlAS will auto-matically start all three charging pumps. Normally one of these pumps will already be running. The SlAS signal will also function to transfer the charging pump suction from the volume control tank to the discharge of the boric acid pumps. If the boric acid pumps are
' not operable, boric acid flows by gravity from the concentrated boric acid tanks to the charging pump suction header. If the charging line inside the reactor containment bu
'is inoperative, this line may be isolated outside the reactor containment building, and the concentrated pressure safety boric injection acid solution may be injected by the charging pumps through the high-header.
9.2.4 Availability and Reliability jyggd h 9.2.4.1 Special Features To assure reliability, the design of the CVCS incorporates component redundancy as well as operational redundancy. This is provided as follows: Component Redundancy Purification lon Exchangers Parallel Standby Unit Charging Pumps Two Parallel Standby Units Letdown Flow Control Valves Parallel Standby Valve Boric Acid Pumps and Tanks Parallel Standby Unit Backpressure Control Valves Parallel Standby Valve
't7.u 2 l
In addition to the component redundancy it is possible to operate the CVCS in a manner sht_. l l such that some components are bypassed. While the normal charging path is through the i regenerative heat exchanger, it is also possible to charge through the high-pressure safety injection header. It is possible to transfer boric acid to the charging pump suction header by bypassing the volume control tank, or by bypassing the makeup flow controls and the volume control tank. On SlAS two separate paths to the charging pump suction header are lined up for boric acid transfer (through boric acid pumps and through the gravity feed 1 line), if the letdown temperature exceeds 140* F, the, flow will automatically bypasss the l ion exchangers and flow to the process radiation monitor and boronometer is stopped. The charging pemps and boric acid pumps are powered by an emergency bus if normal i power is lost. The boric acid pumps and the motor-operated gravity feed boric acid valves are powered from different buses. Separation is provided between the power and control circuits for the redundant boration paths. l %7[
' Standby features are provided so that at least one charging pump is running after SIAS.
The charging pump and boric acid pumps may be controlled locally at their switch gear. Separate power supplies and control circuits are provided among the charging pumps, boric { <g 4 9S2.MP2 9.2 12 June 1998 _ = .
l ! . FSARCR-98-MP2-169 l INSERT G Portions of the charging system may be employed to provide long term cooling and boron precipitation control in the event of a LOCA by simultaneous hot and cold leg injection. In the event that the preferred LPSI hot leg injection method is unavailable, HPSI pump P-41 A is aligned to inject to the pressurizer auxiliary spray line, and thus the hot leg, through piping in the charging system. l i l I l I I i-l t i
. c. _ . . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ . _.__ _
4 MNPS-2 FSAR 9.3 SHUTDOWN COOLING SYSTEM I 9.3.1 Design Bases 9.3.1.1 Functional Requirements The shutdown cooling system in conjunction with the main steam and feedwater syste are designed to reduce the temperature of the reactor coolant in post shutdown periods i from normal operating temperature to the refueling temperature. The main steam and feedwater system is utilized in the initial phase of the cooldown. The shutdown coo system functions to reduce the coolant temperature to the refueling temperature and also maintains this temperature during refueling. ' Refueling water transfer from the refueling water storage tank (RWST) to the refuelingI cavity in the containment building is normally accomplished after the reactor vessel head has been removed by using the high-pressure safety injection pumps, low-pressu injection pumps or the refueling water purification pumps. The high-pressure safety l injection pumps take suction from the RWST and discharge into the reactor coolant! and then to the refueling cavity via the open reactor vessel. Pumping continues until the refueling from the refueling cavity cavity is filled, The to the low pressure pumps can be used to return the refueling wate RWST. ! The shutdown cooling system heat exchangers are normally used during the recirculation phase by either the containment spray system or the shutdown cooling system, when RCS conditions permit following a LOCA. If permissible RCS conditions exist post-LOCA, the shutdown cooling heat exchangers may be aligned to the shutdown cooling system and shutdown cooling may be initiated for long term cooling. Otherwise, the shutdown 97,g cool 6/9y heat exchangers remain aligned to the containment spray system which is used to cool the recirculated water. g Also, if shutdown cooling is not initiated post-LOCA, portions of the shutdown cooling system may be aligned to provide hot leg injection to prevent boron precipitation. The .. functional performance requirements for the shutdown cooling heat exchangers used in this mode of operation are given in Table 9.31. 9.3.1.2 Design Critena mg1 t i . .- Code selection and materials requirements are primarily related to the emergency operation l capability of the system and are presented in Chapter 6. The shutdown cooling system i components are designed to meet the design parameters listed in Table 9.3-2. t I System components whose design pressure and temperature are less than the reactor coolant system design limits are provided with overpressure protection devices and L redundant isolation means. System discharge from over-pressure protection devices is { collected in closed systems. Materials are selected to meet the appik ble code material requirements of the codes given in Table 6.3-3. All parts of components e clad with austenitic stainless steel. contact with borated water are fabricated or 17 Si 1 ! == 9 3-1
*ne 199R -,
, FSARCR-98-MP2-169 INSERT H The functional performance requirements for the shutdown cooling heat exchangers during normal alignment or during LOCA recirculation mode are provided in Table 9.3.1. Following a LOCA, when the containment spray system is no longer required, the RCS is filled, and the shutdown cooling system entry conditions have been met, the preferred method by which to provide long term cooling and boron precipitation control is with the shutdown cooling system in its normal plant operation alignment. In the event that the RCS is not filled 8 to 10 hours after the start of the LOCA, then portions of the shutdown cooling system may be aligned for simultaneous hot and cold leg injection to provide long term cooling and boron precipitation control. l l l l 1
MNPS 2 FSAR OAlrd DN d equalization with the RWST(through the SIT test line) or warm-up (t irM SI. 400). When dumping steam is no longer effective in cooling down the reactor, and pressure has been reduced to within the design pressure of the shutdown cooling system, shutdown cooling is initiated. This is done preferably with two reactor coolant pumps still operating, but may be done while cooling down on natural circulation. Use of the reactor coolant pumps is preferred due to better control of the cooldown rate and the ability to cool the entire RCS simultaneously. Initiation of shutdown cooling is done by opening the suction isolation valves and gradually opening the injection valves with the heat exchanger flow control valve shut. When flow through the system is established, the heat exchanger flow control valve is opened gradually to begin removing heat if reactor coolant pumps are running, vessel temperature is taken as the cold leg temperature, if initiating shutdown cooling from natural circulation, 97-so vessel temperature is taken as cold leg temperature until shutdown cooling retum tempera-TIT 8' ture becomes lower than cold leg temperature. Then vessel temperature is taken as shutdown cooling retum temperature. The RCS is then cooled down at a rate governed by Technical Specifications. Heat removalis controlled by controlling flow through the heat exchangers with the flow control valve. As cooldown progresses, this flow is increased to i l compensate for reduced temperature difference. Relatively constant total flow is main-tained through the use of the heat exchanger bypass valve and/or the injection valves. Componer cooling water flow through the heat exchangers may need to be adjusted at some point in the cooldown dependent on whether the reactor coolant pumps are being used and the level of decay heat. During cold shutdown and refueling, as long as there is fuelin the reactor, shutdown cooling operation is continuous (with brief exception to support refueling). ) l 9.3.3.4 Refueling The transfer of refueling water from the refueling storage tank to the reactor cavity may be accomplished using the safety injection system at the start of refueling. The reactor vessel head is removed and the high-pressure safety injection pumps are started. These pumps take water from the RWST and inject it into the reactor coolant loops through the normal flow paths. The low pressure safety injection pumps or the containment spray pumps may ) also be used for this operation. At the end of refueling operations, refueling water is returned from the reactor cavity through the reactor coolant system and safety injection system to the RWST. A connection is provided from the shutdown cooling heat exchanger discharge to the h97'% l refueling water storage tank for this purpose. The low pressure safety injection pumps are used for the transfer operation.
- I i
9.3.3.5 Emergency Conditions I Components of the shutdown cooling system are also used for emergency core cooling and their operation in this mode of operation is discussed in Chapter 6.0. 9.3.4 Reliability and Availability
\ h OV $C) QC b 93 3. MP2
% m p 9u sec krn 9.3-5 August 1998
MNPS 2 FSAR - l 9.3.4.1 Special Features i The unit can be cooled to refueling temperature within the 271/2 hour time period using one LPSI pump and two heat exchangers. The unit can still be cooled to refueling l temperature if only one heat exchanger is available, but it would take considerably longer. ; The unit can be maintained at refueling temperature with one pump and one heat exchangl er after decay heat has decreased sufficiently. I In the event of a tube to shellleak in the heat exchanger, a high level alarm on the compo- 1 nent cooling system. water surge tank will be generated. The tank overflows to the waste disposal I Two motor operated valves in series isolate the shutdown cooling system suction piping from the reactor coolant system. An interlock with pressurizer pressure prevents them from opening when reactor coolant system pressure exceeds the design pressure of the shutdown cooling system. Refer to section 4.3.8.2.3 for further details. %'(( Pressure relief valves are provided to protect isolated sections of piping from overpressure. The source of overpressure for which they are sized is thermal expansion for all but j l 2-St-468, which is sized to protect the system from tha simultaneous injection of all three charging pumpsinto a solid system. j Relief valve 2-St-469, which is located between two suction isolation valves, has a setpoint of 300 psig and relieves to the primary drain tank, if reactor coolant system > pressure is increased with 2 SI-652 inadvertently left not fully closed, or if it is opened prior to sufficiently reducing reactor coolant system pressure,2 SI-469 will open and relieve to the drain tank which is equipped with pressure, temperature, and level alarms. This arrangement results in an extremely low interfacing systems LOCA frequency associated with the SDC suction path,
% Se d 1 t
9.3.4.2 Test and Inspections Each component is inspected and cleaned prior to installation. Demineralized water is used to flush each system, initially, the system is operated and tested to verify that the flow path, flow, thermal capacity, and mechanical operability meet the design requirements, instruments are calibrated during testing. The automatic flow controlis tested. Periodic testing of the low-pressure safety injection pumps as described in Chapter 6.0, assures the availability of this equipment for shutdown cooling. Data can be taken during refueling operations to confirm heat transfer capacity. r I y l i i amm 9.3-6 August 1998 l . -
FSARCRc98-MP2-169 INSERTI The pressure interlock associated with valve 2-SI-651 in the shutdown cooling system has an installed local control switch which can override the pressure interlock to align the shutdown cooling system for boron precipitation control post-LOCA. Use of the override would only be required if vital bus power to motor control center BS1 were lost in conjunction with the LOCA. The operators would verify RCS pressure below the shutdown cooling relief valve setting prior to overriding the pressure interlock. The pressure interlock for 2-SI-652 does not have override capability and cannot be opened if reactor coolant system pressure is greater than 280 psia.
MNPS-2 FSAR The Millstone Units 1 and 2 fire pumphouses house three 2.000-gpm at 100 psi rated fire pumps which supply the yard loops; two with electdc-motor drives and one with diesel-engine drive. The Millstone Unit 1 pumphouse contains one electric driven pump (M7-8), fed from Millstone Unit 1 power, and the diesel-driven fire pump (M7-7). The Millstone Unit 2 pumphouse contains one electric driven pump (P-82) fed from Millstone Unit 2 power. All three pumps have individual connections to the underground supply system. Maximum system flow and pressure requirements can be met with any one of the thiae pumps out of service. The Millstone Unit 1 pumphouse also contains the jockey pump. g.& 4/W/ 3 System operation is such that a Millstone Unit 150 gpm electric jockey pump (M7-11) maintains system pressure by automatically starting when line pressure drops to 105 psig and will run until prossure reaches 120 psig as indicated by a line pressure switch. A hydro-pneumatic tank is provided in the system to prevent short cycling of the jocke'; pump. The electric fire pump is driven by an AC motor from MCC-CD-6. This pump is activated by a single pressure switch set at 85 psig. In the event this switch or pump fails to operate and line pressure continues to drop, the diesel-driven fire pump is activated by an additional pressure switch set at 75 psig and powered by the diesel battery system. The diesel pump is started by its own self-contained battery system. A battery charger is provided for recharging. Both the electric and diesel-driven fire pumps deliver 2000 pgm at 100 psi discharge pressure and remain in operation until they are manually shut down. Electricalinterlocks stop the jockey pump when either of the two fire pumps start. The fire pumps are supplied from two 245,000-gallon ground level suction tanks. The tanks are automatically filled through a water line fed from city water. Backup well water supply is provided through a reversible elbow connection (normally disconnected). If a major fire in any location of the Millstone Unit 2 site should occur, the combined water tank and makeup water capacity would provide an adequate water supply for Millstone , Unit 2. The necessary pressure and flow would be maintained through the use of any two simultaneously operating 2,000 gpm rated pumps. , in case of Inss of off-site power and service water is not available for cooling EDGs because of flooding in the intake structure, fire water may be used for cooling one %,gEDG operating up to 100% of its power via a temporary connection down stream of valve SIM 2-FIRE 258 in the fire main. 6-JBD-26. 9.10.2.1.1 Fixed Suppression Systems (1) Sprinkler and Waterspray Systems Fixed sprinkler and waterspray systems, brovided in various areas of the 1 plant where in situ combustible loading warrants such protection, have been designed using the guidance of National Fire Prutection Association (NFPA) Standard No.13. for the Installation of Sprinkler Systems or NFPA Standard No.15 for Waterspray Fixed Systems. Fixed water systems are provided in the following design arrangement: Automatic and manual operating, wet-pipe sprinkler; Automatic and manual operating waterspray; and 9310.MP2 9.10 2 May 1997
FSARCR-98-MP2-169 I INSERT J l l The site fire water system can be connected to the auxiliary feedwater system to provide an alternate source of water in the event that the primary source of water in the condensate storage tank is depleted and cannot be adequately ; replenished. The combination of the two storage tanks with the potential for l replenishment from the city water supply provide multiple, reliable sources of water with which to feed the steam generators and remove decay heat over an ' ( indefinite period of time. The Technical Requirements Manual insures the availability of fire water. i I
. . . - _ - _ _ .- . ~ . ~ _ _ ~ . - . - . .-- . -= = _ .- .- -
i MNPS-2 FSAR discharge as a function of time for this occurrence. The inadvertent operation of these valves is unlikely. Assuming a double-end break of an individual auxiliary steam supply line upstream of the common header and check valve with the reactor at 100 percent power (2700 MWt), (see Figure 10.3-1), the check valves will prevent one steam generator from blowing down and the other steam generator will blowdown at the rate of 133 lbs/sec. causing the reactor power to reach 105 percent of full power. This condition will continue until the operator stops the feedwater to the steam generator j associated with the break and shuts down the plant. No additional protective action is required. Assuming the the breaks in either one of the 4-inch auxiliar/ steam supply lines down-stream of the check valves or on the common header and with the reactor at 100 percent power, the ' steam Ilow through each of the 4-inch lines is 133 lbs./sec. The reactor power willincrease to 109 percent of full power and will stay at this new steady state condition. Each steam generator will continue to blowdown through the break until the operator closed the remote-manual, motor operated isolation valves in the 4-inch lines, at which time the reactor will return to its initial power level. No other protec,tive action is required. 10.3.4 Availability and Reliability MM % 10.3.4.1 Special Features The main steam piping, the isolation valves, the atmospheric dump, the main steam safety valves and the steam generators are designed in accordance with seismic Class I requirements. Three self-operating valve systems, using separate components, protect the steam generator from overpressure; however, safety valves alone can do the job. Each system operates as given in Table 10.3-3. l@} j 10.3.4.2 Tests an'd Inspection See Section 5.2.E.4.2 and Technical Specifications Section 4.7.1.5. I bb 1
?
i i w2io awa 10.3-5 February 1998 l
1 l FSARCR-98-MP2-169 l l \ ! l INSERT K 1 l l The feeding of the steam generators using AFW combined with the dumping of steam to the environment through the atmospheric steam dump valves may be employed to provide long term cooling during a LOCA. This would be required post-LOCA when the shutdown cooling system cannot be placed into operation or during simultaneous hot and cold leg injection. During a LOCA event an aggressive cooldown rate is to be initiated and maintained, using the atmospheric steam dump valves, within 1 hour after the start of the accident and at a minimum rate of 40*F/hr, until steam removal from the steam generators l l becomes limited by the fully open atmospheric steam dump valves. l l l w m
MNPS-2 FSAR be controlled from the fire shutdown panel C-10 in the Turbine Building. The electric- I driven pumps may be either automatically actuated or manually actuated. The steam-driven AFP can only be manually actuated, i For automatic actuation, each pump and its associated flow control valve have two ! switches on each panel. The first switch, the automatic permissive, either allows or blocks i the automatic start of the respective pump. This auto permissive switch has three positions: i i Pull to lock, which blocks the automatic signal. Reset, which resets the automatic function. Start, which will start the electric AFPs and open the flow control valves. The second switch selects the mode nf operation of the flow control valve associated with the pump. The three modes of selection a e: l Normal, which allows the valve to open fully for an automatic actuation. Override, which allows manual control of the valvo position follow ng an automatic l actuation. Reset, which resets the electricallogic for returning the mode of operations back i to normal. Auto actuation of the electric-driven pumps and the auxiliary feedwater regulating valves 3 occurs when 3 minutes,25 seconds have elapsed since the steam generator levels $~9f dropped to s12 percent. A manual bypass valve is provided around each air-operated AFW regulating valve, 2-FW-43A and 2-FW-43B,in the auxiliary feedwater (AF) line to each steam generator to ensure the availability of feedwater for decay heat removal should either one of the regulator valves failin the closed position. To meet the functional requirement of providing AFW to either or both steam generators with a limiting single failure, a normally open ( motor-operated cross-tie valve is provided between the AF regulating valves. l In addition, the AFW regulating valves,2-FW-43A and",2-FW-43B, are equipped with a (- r backup air supply to provide valve closure and valve control in the eve'nt of loss of the Instrument Air System The backup air supply is provided by high pressure air cylinders. %29} The system is designed to operate in a harsh environment caused by the beyond-design basis event of a feedwater line break inside the turbine building coincident with a failure of the main feedwater check valv5 (2-FW-5A or 2-FW-58). The Instrument Air system and 97'47 backup air supply are non-safety related. 10.4.5.4 Equipment i 10.4.5.4.1 Condensate Pumps IMPN b i 10S4.MP2 10.4_8 _ - J"nm144A.
. FSARCR-98-MP2-169 INSERT L l
l The auxiliary feedwater system can be used to provide long term cooling in the event of a LOCA in conjunction with the dumping of steam. The AFW pumps would initially take a suction on the condensate storage tank. If in the long term, the CST becomes depleted and cannot be replenished by normal makeup, the operators can corinect the fire water system, and its two,250,000 gallon storage tanks, to the AFW pump suctions. The fire watar storage tanks can be l replenished from the city water supply if necessary. See Section 14.6.5.3 for a description of long term cooling in the event of a LOCA. I 1 1 l i \
__ m -_ _ . _ __. _ _ _ _ __ _ _ _ - . . _ _ _ _ _ _ 7 l l l MNPS 2 FSAR I 14.6.5.2.6 Analysis Results The results of the arelysis showed the limiting break size with symmetric steam
)
l- generator tube plugging was the 0.1 ft 2break. The peak cladding temperature (PCT) l l l for this case was calculated to be 1707'F with a maximum local cladding oxidation of l 1.41%. The results of the delayed RCP trip sensitivity calculations are bounded by the limiting break calculation. The RCP trip delay calculations support up to a 300 second RCP trip delay time for all four pumps following the reactor scram signal. Justification is also provided to: (1) support a reduction in primary coolant temperature of up to g.g 12*F at full power operation and (2) conclude that asymmetric steam generator tube a j plugging would not significantly change the system results that were based upon l symmetric tube plugging. l 1 l The analysis supports full power operation at 2754 MWt (2700 MWt plus 2% uncer-tainty) without taking credit for water from the primary system charging pumps. A maximum LHR of 15.1 kw/ft and a radial peaking factor of 1.69 together with the j Cycle 13 new fuel rod design are supported by this analysis. The analysis demon- j strates that the 10 CFR 50.46(b) criteria are satisfied for the Millstone Unit 2 reactor. '
'14.6.5.2.7 Conclusions The results of the SBLOCA analysis for the Millstone Unit 2 reactor identified the 0.1 ft2 l
l break size to be the limiting break with the approved SBLOCA evaluation model. The , analysis supports full power operation at a power level of 2754 MWt (2700 + 2% J uncertainty) with a primary coolant flow rate of 360,000 gpm, a peak LHR of 15.1 kW/ft and a radial peaking factor of 1.69. Further, the analysis supports up to a 300-second primary coolant pump trip delay f.ollowing the reactor scram signal. SPC can continue to support a total steam generator plugging level of 1000 tubes with a maximum asymmetry of 500 tubes and a reduction in primary ccolant temperature of %-li up to 12'F at full power operation. A previous Millstone Unit 2 SBLOCA calculation ! (Ref.14.6-12) has shown that results for asymmetric steam generator tube plugging at ; ! the limiting break size are similar to symmetric tube plugging, when the asymmetry is . limited to 500 tubes Jurtification for a reduced primary system coolant temperature at ] full power operation is provided in Section 14.6.5.2.5.7. l l Operation of Millstone Unit 2 with SPC 14x14 fuel, within the limits stated above, assures that the NRC acceptance criteria for small break Loss-of-Coolant Accidents (10 CFR 50.46(b)) will be met with the emergency core cooling system for Millstone Unit 2. s 1
- 'mS ert N , M.UD SC. M l
. FSARCR-98-MP2-169 INSERT M l
14.6.5.3 POST-LOCA LONG TERM COOLING I Following the short term mitigation actions for a large or small break LOCA (as discussed in Sections 14.6.5.1 and 14.6.5.2 respectively), long term cooling will continue to maintain the core at an acceptably low temperature. LOCA mitigation in the long term will be accomplished by the methods referred to as I the Long-term Cooling (LTC) Plan. The LTC Plan (shown in Figure 14.6.5.3-1) consists of the events and actions that will assure acceptable long term core tooling and prevention of boric acid precipitation in the core region. The Post-LOCA Long-term Cooling Analysis, demonstrates that Post-LOCA Long-term I core cooling and boric acid precipitation prevention can be accomplished for all LOCAs. 14.6.5.3.1 The Post-LOCA Long-term Cooling Plan Figure 14.6.5.3-1 shows the basic sequence of events for the initial automatic actions and the subsequent operator actions of the LTC Plan. Tne operator's first action is to initiate a plant cooldown within 1 hour post-LOCA by releasing steam from the steam generators. The steam is released either through the turbine bypass system, if it is available, or through the atmospheric dump valves (ADVs). When pressurizer pressure is less than 600 psia and stable with a controlled cooldown in progress, the Safety injection Tanks (SITS) are isolated to avoid injecting nitrogen, a non-condensable gas, into the reactor coolant system (RCS). At 8 to 10 hours post-LOCA the operator will determine if the RCS is filled by checking pressurizer level. If the RCS is filled, then natural circulation will prevent boric acid precipitation and simultaneous hot and cold leg injection will not be necessary. The operators will attempt to establish shutdown cooling (SDC)if entry conditions exist or can be established. If SDC can not be established (whether due to single failure, SDC pressure / temperature limits unsatisfied, or RCS activity beyond appropriate limits) then steam generator (SG) cooling will be continued. If the RCS is not filled at 8 to 10 hours post-LOCA, then simultaneous hot and ! cold leg injection will be established to provide core flushing. The preferred ' method of simultaneous hot and cold leg injection is low pressure safety injection (LPSI) to the hot side (one LPSI pump to the SDC warm-up line to the SDC suction line to a hot leg.) Cold side injection will be via a high pressure safety r l
1
. FSARCR-98-MP2-169 INSERT M (cont'd)
I injection (HPSI) pump and the running LPSI pump. If the preferred method
~
cannot be established then the alternative method of simultaneous hot and cold l leg injection, which is HPSI injection to the hot side (1 HPSI pump to a charging line to the pressurizer auxiliary spray line to a hot leg.), will be established. Cold I side injection will be via a LPSI pump. Either of these simultaneous hot and cold ; leg injection methods will provide flow that is adequate to cool the core and prevent boric acid precipitation. 14.6.5.3.2 Post-LOCA Long-term Cooling Equipment and Operator Actions The following discussion elaborates on equipment and operator actions that support the LTC Plan. As stated above, simultaneous hot and cold leg injection will be required if the ) RCS is not filled at 8 to 10 hours post-LOCA. If simultaneous hot and cold leg injection is required then either the preferred method (LPSI hot leg injection) or the alternative method (HPSI hot leg injection) ' can be established and operated despite various single failures to simultaneous hot and cold leg injection equipment. Either simultaneous hot and cold leg injection configuration will provide adequate delivery flows while ensuring acceptable HPSI and LPSI pump operation. Operator actions outside the control room will be required to realign manually operated valves. Additional operator actions outside the control room will be required in the event of either a facility Z1 or Z2 loss of power (when offsite power is unavailable). These additional operator actions are described as follows. For a failure of Facility Z1, the position of the LPSI injection valves 2-SI-615,2-SI-625 must be known, whereas a failure of Facility Z2 requires the position of LPSI injection valves 2-SI-635 and 2-SI-645 to be known. This is required to correctly align for simultaneous hot and cold leg injection. These positions would be determined by operator actions outside the control room. For the failure of the emergency Facility Z1 AC power to the safety injection system (SIS), the . operator actions to establish LPSI hot leg injection would include aligning an alternate power source to SDC suction line valve 2-SI-651. This manual aligning would require operator action outside the control room. For the failure of the emergency Facility Z2 DC power for the SIS train 2, the , operator actions to establish HPSI hot leg injection would include aligning an I 1 I l l l
. FSARCR-98-MP2-169 INSERT M (cont'd) alternate power source to charging valves 2-CH-517 and 2-CH-519. This manual aligning would require operator action outside the control room.
In addition to the above operator actions directly concerned with the simultaneous hot and cold leg injection realignment and operation, the following operator actions outside the control room may be required to support the LTC Plan. l If the condenser is unavailable, the auxiliary feedwater (AFW) system and the ADVs will be used to cooldown the RCS. The cooldown will be initiated within 1 i hour after the start of ihe LOCA. If, when initiating the cooldown, the ADVs are l in a closed position then they will be manually opened by operator action outside the control room. If the primary source of AFW to the steam generator - the condensate storage tank (CST) -- becomes depleted beyond the capability of the Ecolochem system to replenish, then operator action outside the control room will be required to manually realign the Fire Protection System to supply AFW. ; 14.6.5.3.3 Assumptions Used in the Long-term Cooling Analysis The major assumptions used in performing the LTC analysis are listed below: )
- 1. No offsite power is available.
- 2. The worst single failure is the failure of an emergency diesel generator. !
As a consequence of the failure, one ECCS train, one containment spray j pump and one motor-driven auxiliary feedwater pump are unavailable.
- 3. Plant cooldown begins at two hours post-LOCA. (The EOPs conservatively initiate the cooldown within one hour post-LOCA.) j
- 4. The analysis assumes that a cooldown rate of 40 F/hr is maintained until the ADVs are fully open (i.e., until flow limiting of the ADVs causes the cooldown rate to decrease from 40 F/hr.)
- 5. The SITS are isolated prior to establishing shutdown cooling. l l
l 6. The pressurizer is included in the mass that is cooled down in establishing shutdown cooling entry conditions.
- 7. A continuous supply of auxiliary feedwater is available for the duration of 1
- steam generator cooling. One turbine driven and one motor driven I auxiliary feedwater pump are assumed to be in operation.
, FSARCR-98-MP2-169 INSERT M (cont'd)
- 8. Initial boric acid concentrations and inventories and pump flow rates used in the boric acid precipitation analysis are selected to maximize the boric acid concentration in the core.
- 9. A boric acid precipitation limit of 27.6 wt% is used in the large break LOCA boric acid precipitation analysis. This is the precipitation limit in saturated water at 14.7 psia.
14.6.5.3.4 Method of Analysis The objective of the post-LOCA LTC analysis is to demonstrate that the LTC Plan provides conformance to 10CFR50.46 Criterion 5, Long Term Cooling, of the ECCS acceptance criteria (Reference 14.6-14). Conformance is demonstrated by showing that under the LTC Plan the calculated core temperature is maintained at an acceptably low value and that the boric acid concentration in the core is maintained below its solubility limit. The Millstone 2 post-LOCA LTC analysis was performed using the NRC-accepted computer codes described in Reference 14.6-15. As described in Reference 14.6-15, the CELDA computer code is used to analyze the post- , LOCA thermal-hydraulic response of the RCS for a spectrum of break sizes. The NATFLOW computer code is used to calculate RCS temperatures for the purpose of determining when the shutdown cooling entry temperature is - achieved. The steam generator cooldown transient that is used as a boundary condition in CELDA and NATFLOW is calculated using the CEPAC computer code. The BORON computer code is used to calculate the boric acid concentration in the core following the LOCA. The Millstone 2 post-LOCA LTC Plan was developed using the NRC-accepted methods described in Reference 14.6-15 with the following modification. In Reference 14.615, RCS pressure is used as the basis for determining whether to branch to shutdown cooling (or continue SG cooling if SDC is inoperable) or to branch to simultaneous hot and cold side injection. In the Millstone 2 LTC Plan, pressurizer level (i.e., the RCS is or is not filled) is used as the basis. This approach is consistent with the ABB CE emergency procedure guideliries (Reference 14.6-16). 14.6.5.3.5 Parameters Used in the LTC Analysis Significant core and system parameters used in the LTC analysis are presented in Table 14.6.5.3-1.
l
. FSARCR-98-MP2-169 l INSERT M (cont'd) l l 14.6.5.3.6 Results of the LTC Analysis j l
Figure 14.6.5.3-1 shows the Millstone 2 LTC Plan. At 8 to 10 hours post-LOCA, i the operator determines whether or not the RCS is filled as indicated by pressurizer level. 8 to 10 hours is used as the decision time because it provides the operator with ample time to initiate simultaneous hot and cold side injection prior to the earliest time that boric acid precipitation would occur. > l The left branch of the LTC Plan applies to those break sizes for which the RCS l is filled at 8 to 10 hours. For these breaks SDC operation or continued SG l cooling will provide heat removal and natural circulation will prevent further boric l L acid buildup in the core. i L The right branch of the LTC Plan applies to those break sizes for which the RCS l is not filled at 8 to 10 hours. For those break sizes, simultaneous hot and cold side injection is used to maintain core cooling and to provide for boric acid l precipitation control. l A double-ended guillotine break in the cold leg is the limiting break for boric acid l precipitation control; A double-ended guillotine break is limiting because the low RCS pressure associated with such a large break minimizes the boric acid l solubility limit in the core.' The cold leg is the limiting break location because it requires the initiation of hot side injection in order to create a core flushing flow to control boric acid precipitation. For a cold leg break, the core flushing flow is , l the difference between the hot side injection flow rate and the core boi!off flow ' l rate. , As shown in Figure 14.6.5.3-3, the initiation of a hot side injection flow rate of at !- least 180 gpm at 13 hours post-LOCA provides a substantial and time-l increasing core flushing. Figure 14.6.5.3-4 shows that with no core flushing flow, boric acid would begin to precipitate at approximately 15 hours post-LOCA. However, with a hot side injection flow rate of 180 gpm, initiated at 13 hours post-LOCA, the maximum boric acid concentration in the core is 25.4 wt% as compared to the precipitation limit of 27.6 wt%. The margin provided for the . prevention of boric acid precipitation by a constant core flushing flow of 20 gpm ) is also shown in Figure 14.6.5.3-4. The time by which the entrainment of hot side injection by the steam flowing in the hot leg would cease was calculated to be less than 2 hours post-LOCA. l Therefore, the initiation of hot side injection at 13 hours is well after the potential l .for the entrainment of the hot side injection has ended. t l
. FSARCR-98-MP2-169 INSERT M (cont'd)
In order for the most limiting configuration of simultaneous hot and cold leg injection to provide the required hot side injection flow rate of 180 gpm, the RCS pressure must be 86 psia or less. As shown in Figure 14.6.5.3-2, the RCS will not be filled at 8 hours for a bmak area as small as 0.01 2ft Consequently, this is the smallest break for which simultaneous hot and cold side injection would be required. The 0.01 ft' break was calculated to achieve a RCS pressure of 86 psia prior to 13 hours post-LOCA. Larger breaks will also reach B6 psia prior to 13 hours post-LOCA. This demonstrates that the simultaneous hot and cold leg inject!on configurations will provide sufficient hot side injection for all breaks for which it may be required. 14.6.5.3.7 Conclusions of the LTC Analysis The Millstone 2 post-LOCA LTC analysis demonstrates conformance to 10CFR50.46 Criterion 5 of the ECCS acceptance criteria (Reference 14.6-14) for a complete spectrum of break sizes and locations. For breaks that are small enough for the RCS to refill at 8 to 10 hours post-LOCA, shutdown cooling or SG cooling provides core cooling and boric acid precipitation control. For breaks that are too large for the RCS to refill at 8 to 10 hours, initiating simultaneous het and cold side injection provides core cooling and boric acid l precipitation control. A simuitaneous hot and cold side injection flow rate of 180 gpm (i.e., a flow rate of 180 gpm to both the hot side and cold side of the RCS) l initiated by 13 hours post-LOCA maintains the boric acid concentration in the I core below the solubility limit. i I i 4 4
--------------------a 91ir- rn P.2 - I C,9 MNPS-2 FSAR gg REFERENCES
~
14.6 1. " Description of the Exxon Nuclear Plant Transient Simulation Model for Pressurized Water Reactors (PTS-PWR), XN-NF-74-5(A), Rev. 2 and Supple-ments 3-6, Exxon Nuclear Company, Richland, WA 99352, October 1986. 14.6 2. "XCOBRA-IllC: A Computer Code to Determine the Distribution of Coolant During Steady-State and Transient Core Operation," XN-NF-75-21(A), Revision 2, Exxon Nuclear Company. 14.6 3. E. Daniel Hughes, "A Correlation of Rod Bundle Critical Heat Flux for Water in the Pressure Range 150 to 725 psia," IN-1412 (TID-4500),ldaho Nuclear Corporation, July 1970. 14.6-4. "RETRAN-02 A Program For Transient Thermal Hydraulic Analysis of Com-plex Fluid Flow Systems," EPRI NP-1850-CNN, dated October 1984. 14.6 5. W. G. Counsilletter to J. R. Miller, Docket No. 50-336, dated December 12, 1983. 14.6-6. Technical Specifications for Millstone Unit 2, Docket No. 50-336, Updated through Amendment No.116. 14.6 7. Letter, Dennis M. Crutchfield (USNRC Asst. Director division of PWR Licens-ing-B) to Gary M. Ward (ENC Manager, Reload Licensing), " Safety Evaluation , of Exxon Nuclear Company's Large Break ECCS Evaluation Model EXEM/PWR and Acceptance for Referencing of Related Licensing Topical Reports," dated July 8,1986. 14.6-8. EXEM PWR LBLOCA Evaluation Model as defined by the following references:
- a. XN-NF-62-20(A). Revision 1. and Sunclements 1 throuah 4, " Exxon Nuclear Company Evaluation Model EXEM/PWR ECCS Model Updates,"
Exxon Nuclear Company, Inc., Richland, WA 99352. Revision 1 dated January 1990, Supplements 1 to 4 dated January 1990.
- b. XN-NF-82-07(A). Revision 1, " Exxon Nuclear Company ECCS Cladding Swelling and Rupture Model," Exxon Nuclear Company, Richland, WA D 'D 99352, November 1982. O
- c. XN NF-81-58(A) Revision 2. and Supolements 1 throuah 4, "RODEX2 Fuel Rod Thermal-Mechanical Response Evaluation Model," Exxon Nuclear Company, Richland, WA 99352. Revision 2 and Supplement 2 dated March 1984, Revision 2, Supplements 3 and 4 dated June 1990,
- d. XN-NF-85-16(A), Volume 1 throuah Sunnlement 3: Volume 2. Revision 1 and Sunnlement 1, "PWR 17x17 Fuel Cooling Test Program," Exxon Nuclear Company, Inc., Richland, WA 99352, February 1990.
14sn w2 14.6 23 June 1996 i.a e
MNPS-2 FSAR e. XN-NF-85-105(A). Revision O and Suoniement 1, " Scaling of FCTF-Based Reflood Heat Transfer Correlation for Other Bundle Designs," c-s t Exxon Nuclear Company, Inc., Richland, WA 99352, January 1990. Cli' j 14.6-9. EMF-94-023. Revision 1, " Millstone Unit 2 Large Break LOCA/ECCS Analysis ' yf,5) for a Revised Fuel Design," Siemens Power Corporation, April 1994. 14.6-10. " Millstone Unit 2 Large Break LOCA/ECCS Analysis," ANF-88-118, Advanced Nuclear Fuels Corporation, August 1988. 14.6-11.
" Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power 1981. Plants," NUREG-0800, U.S. Nuclear Regulatory Commission, July 14.6-12. XN-NF-82-49(P), Revision 1, Supplement 1 " Exxon Nuclear Company Evaluation Model-EXEM PWh Small Break Model," dated April 1994. g g,, g 14.6-13. ANF-88-129," Millstone Unit 2 Small Break LOCA Analysis" Advanced Nuclear Fuel Corporation, October 1988.
i
" hsert 9 i
l - i 4 54ss up2 14.6-24 June 1998
, FSARCR-98-MP2-169 l
INSERT N l 14.6-14. Code of Federal Regulations, Title 10, Part 50, Section 50.46,
" Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors".
14.6-15. CENPD-254-P-A, " Post-LOCA Long Term Cooling Evaluation i Model", June 1980, (Proprietary). l l 14.6-16. CEN-152, " Combustion Engineering Emergency Procedure Guidelines". d
1 1
. FSARCR-98-MP2-169 l Table 14.6.5.3-1 l I
1 1 Insert attached Table 14.6.5.3-1 after Table 14.6.3-5 l l i l l
3- FSARCR-98-MP2-169 l l Table 14.6.5.3-1 Core and System Parameters Used in the LTC Analysis l' Parameter Value Reactor power level, MWt (102% of nominal) 2754 Number of plugged tubes per SG 1000 SG/RCS cooldown rate, *F/hr (maximum) 40 l Atmospheric dump valve capacity 879,028 at 1000 psia, Ibm /hr/ valve (minimum) Boric acid concentration, ppm (maximum) reactor coolant system 2640
- refueling water tank 2640 l safety injection tanks 2640
- l. boric acid storage tanks 6139 Initial inventory (maximum)
, reactor coolant system, Ibm 543,710 l refueling water tank, gal 448,520 l safety injection tanks, ff/ tank 1190 l boric acid storage tank, ff/ tank 865.7 l l l-i S
,, FSARCR-98-MP2-169 Figures 14.6.5.3-1, 2, 3, and 4 Insert attached Figures 14.6.5.3-1,2, 3, and 4 after Figure 14.6. 5.2-23 l
l l l i i i l l l ! l l 1 I l l l 1 i i t i 4
-e . --,..- - . ~ - - _ _ , - . . , , _ _ ._,,.4- , , _ ., - .,r._ - -, ,- -
S
.J FSARCR-98-MP2-169 ,
Figure 14.6,5.3-1 Long Term Cooling Plan LOCA I IDCA 1msef4'colant Accident sgAs l l SIAS Safetyinjection Actuation Signal y llPSI High Pressure Safety injection Pump LPSI low Pressure Safety injection Puny IIPSI and LPSI AFAS. Auxiliary Feedwater Actuation Signal Actuated (Cold Side) SIT Safety injection Tank Ato SDC Shutdown Cooling System SG Steam Generator I t Tune Aner Start of LOCA l AFAS l I
" Manual" indicates non automatic functions Aux. Feed Flow Actuated Auto ,
Yes condenser No I I Activate ^*""
- Turbine Bypass t$1hr Steam Dump
! nual Manual l
I Isolate or Vent the SITS Manual Yes RCS- No Establish SDC Conditions l M/ 8 hr$ t $ 10 hr initiaw Shu g l om Hot Manual DC W Yes No i i j Actuate : Maintain 50 l- SDC 1 Ilent Removal Manual Existmg l I 8____________l Secure Steam Ocnerators l Manua! l a i N 4 d
f. I. l.
'* FSARCR-98-MP2-169 1
l Figure 14.6.5.3-2 RCS Refill Time Versus B'reak Area i 16 i l 14 - > j. 12 - , l i 10-t 1 I i 1 8-l l 6-Y 4-l- 2-0 0 0.005 0.01 0.015 0.02 0.025 0.03 0.035 Break Area, R2
,.. . . ~ _ _- . _ - .. _ . . _ . . _ _ . . _ _ _ . . . _ _ . . . . . . _ _ . _ _ .. .. .
< 4. F
.. FSARCR-98-MP2-169 Figure 14.6.5.3-3 Core Flush by Hot Side Injection for a Double-Ended Guillotine Cold Leg Break 350 300-250 I
200
- u. 150 -
l l 8 i 1 1 1 1
~ 100 - l l
1 1 I t i 50 - FlusNng Flow = Hot Side Irjection Flow Rate - Core Boiloff l I I l 4 I I O ' O 2 4 6 8 10 12 14 16 18 20 Time, hrs l Core Boiloff -----Hot Side injection Flow Rad v \.. l i I I l<
l 1 1 . FSARCR-98-MP2-169 I l l Figure 14.6.5.3-4 l Inner Vessel Boric Acid Concentration Versus Time . l for a Double-Ended Guillotine Cold Leg Break 35 30 - l j i 25 - .,
~,
.., ~,
120 .. s,. i 1 15 - 10 - 5-0 0 2 4 6 8 10 12 14 16 18 20 Time, hrs No FlusNng Flow ----.180 GPM HSIat 13 hrs
. ... 20 GPM FlusNng at 13 hrs .._... Solubility Umit}}