LR-N17-0034, Salem Generating Station, Units 1 & 2, Revision 29 to Updated Final Safety Analysis Report, Section 7.6, All Other Instrumentation Required for Safety
Text
7.6 ALL OTHER INSTRUMENTATION REQUIRED FOR SAFETY 7.6.1 Residual Heat Removal Isolation Valves There are two motor-operated isolation valves (RHl and RH2), in series, in the single letdown line connecting the low-pressure Residual Heat Removal (RHR) System to the high-pressure Reactor Coolant System (RCS). Valve RHl is the upstream valve (closest to the RCS), and RH2 is the downstream valve. The position indication provided for these valves consists of "open-closed" indication on the main control console. The open-closed indication for RHl and RH2 is powered from separate 125 *vdc buses. This power is different than the source control power to the valve operators. Using separate power for control and indication ensures that indication will be maintained when control power is locked out. The control system consists of the following: 1. Valve RHl is interlocked with a pressure control signal derived from a pressure transmitter to prevent its opening whenever the RCS pressure is greater than the RHR System design pressure. 2. The pressure transmitter used in (1) is connected to the reactor coolant loop which contains the RHR suction line. The pressure transmitter is connected into RHR suction line inside the containment. 3. The control for valves RHl and RH2 is administratively locked to prevent inadvertent manual opening. 4. A second pressure channel is provided as a pressure control signal to interlock valve RH2 located adjacent to the RHR System. This will be used to prevent its 7.6-1 SGS-UFSAR Revision 11 July 22, 1991 opening whenever the reactor coolant pressure is greater than the RHR system design pressure. 5. This RH2 associated pressure transmitter is connected by a separate connection into the RHR suction line inside the containment. Therefore, the RHR suction line 7.6-la SGS-UFSAR Revision 11 July 22. 1991 THIS PAGE INTENTIONALLY BLANK SGS-UFSAR Revision 10 July 22, 1990 will contain two separate connections, one for each pressure transmitter. The interlocks are designed to conform to IEEE Standard 279-1971. Two overhead alarms are provided in the control room for RHl and RH2: 1. The overhead alarm for RHl is activated when the RHl valve is not fully closed in conjunction with high reactor pressure. 2. The overhead alarm for RH2 is activated when the RH2 valve is not fully closed in conjunction with high reactor pressure. 7.6.2 Accumulator Isolation Valves Position indication and alarm circuits for the motor-operated valves, located between the accumulator tanks and the primary cooling system, are designed to provide assurance that these valves will be open when required. These valves are normally open and under administrative control with the motive power for the valves locked out during normal power operation. Redundant and independent information is provided in the control room to indicate when any one valve is not in the fully open position. Valve status (fully open or fully closed) is indicated on the main control board via backlighted pushbuttons. These status lights are actuated by limit switches on the valve motor operator. In addition, an alarm is provided on the overhead annunciator system in the event that the valve is not in the fully open position. Another independent means of determining that the valve is not in its proper position is provided through the auxiliary alarm message indicating when the valve is not in the fully open position. This indication and alarm is derived from a separate 7.6-2 SGS-UFSAR Revision 11 July 22, 1991 "'-"""' . .......,.
valve stem limit switch and is energized from an independent power supply from that used for the overhead annunciator. A safety injection signal also automatically initiates the opening of these valves. 7.6-2a SGS-UFSAR Revision 10 July 22, 1990 THIS PAGE INTENTIONALLY BLANK 7.6-2b SGS-UFSAR Revision 10 July 22, 1990 The valve status and alarm provisions are shown functionally on Figure 7.6-1. 7.6.3 Pressurizer Overpressure Protection System 7.6.3.1 Design Bases The Pressurizer Overpressure Protection System (POPS) instrumentation measures RCS pressure and temperature. It initiates opening of pressurizer relief valves during pressure transients which could occur when the RCS is below 312°F. The equipment used to open the relief valves is designed to essentially the same criteria as that used in the design for the Protection System described in Section 7.2. Design Criterion: Credit for Operator Action Criterion: No credit can be taken for operator action until 10 minutes after the operator is aware that a pressure transient is in progress. The POPS requires no operator action other than to arm the system prior to entry into a water-solid condition during startup, or prior to reaching 312°F during shutdown from power. All protective action is performed automatically. Design Criterion: Single Failure Criteria Criterion: The Pressure Protection System should be designed to protect the vessel given a single failure that initiates the pressure transient. In this area, redundant or diverse Pressure Protection Systems would be considered as meeting the single failure criteria. The POPS incorporates redundancy and separation of pressure transmitters, logic, and valves in a channelized system. Single 7.6-3 SGS-UFSAR Revision 6 February 15, 1987 failures within the POPS will not defeat the safety function. Single failures which are capable of initiating a pressure transient cannot cause failures in the POPS which would render it unable to provide protection. Design Criterion: Testability Criterion: The equipment design should include some provision for testing on a schedule consistent with the frequency that the system is used for pressure protection. The POPS design provides for testing of the analog circuitry any time the RHR suction valves for the RCS are closed. The relief valves can be tested prior to entry into a water-solid condition by use of the POPS functional test pushbutton. The POPS is designed to function during the relatively infrequent occurrences of potential low temperature pressure transients, therefore periodic testing of the system during power operation is not planned. Design Criterion: Seismic Design and IEEE Standard 279-1971 Criteria Criterion: Ideally, the pressure protection system should meet both seismic Category I and IEEE Standard 279-1971 criteria. The basic objective, however, is that the system should not be vulnerable to an event which both causes a pressure transient and causes a failure of equipment needed to terminate the transient. The POPS design meets seismic Category I criteria for all equipment required to open the relief valves. The instrumentation and actuating circuitry meet the applicable requirements of IEEE Standard 279-1971. 7.6-4 SGS-UFSAR Revision 6 February 15, 1987
- 7. 6. 3.2 The POPS is a two-train system which uses separate and independent pressure transmitters to open two pressurizer relief valves if RCS pressure exceeds a preset value of 375 psi. This automatic action takes place provided the system has been armed by placing two keylocked pushbuttons in the "ON" position. The system is required to be armed whenever the RCS is below 312°F. Each relief valve is actuated by its own logic output relay, which is energized by a bistable device. The bistable is energized if RCS pressure exceeds the setpoint. Existing pressure sensors are used to develop the signal for valve actuation. These are the same sensors which provide the open permissive interlock function of the RHR System. The operation of the POPS is governed by two administratively controlled, keylocked pushbuttons which perform three functions. When the RCS temperature is less than 312°F, the system is armed by depressing the "ON" pushbutton for each POPS train. This action opens the motor-operated valves upstream of the relief valves and provides an alarm permissive to indicate that the POPS is armed should temperature increase above 312°F, In this mode of operation, the relief valve will automatically open if RCS pressure exceeds 375 psi. Actuation of the relief valve is alarmed in the Control Room. When RCS temperature is above 3l2°F, is depressed. This action removes the "OFF" pushbutton for each POPS train the opening permissive from the relief valve, removes the opening signal from its associated motor-operated valve, and an alarm input to indicate that the system is disarmed should RCS temperature fall below 312°F. When POPS is armed and either relief valve is opened by POPS, open until the system pressure falls below 375 psi. it will remain I 7.6-5 SGS-UFSAR Revision 19 November 19, 2001 I A testing provision in the POPS circuitry allows for test opening of the relief valves prior to use of the system below 312°F. The "TEST" pushbutton, when depressed, will operate the relief valve that the associated motor-operated valve is closed. Other of the POPS can be tested in a manner similar to other protection system functions. The existing power operated relief valves (PORVs) are utilized for overpressure protection at low temperature in Units 1 and 2. 7.6.3.3 The POPS is designed as a "protection grade" system in accordance with the applicable portions of IEEE Standard 289-1971. The use of proven devices provides assurance that the is compatible with other Protection System equipment. The use of administrative controls to arm the POPS is considered acceptable due to the expected infrequent need for overpressure protection at low temperature. The POPS relief valves protect the RCS from pressure transients which could exceed the limits of G to l0CFR50 when one or more RCS cold leg is at or below 312°F. Either POPS has to protect the RCS from overpressurization as a result of the heat input or mass input cases: (1) the start of an idle Reactor Coolant Pump with the secondary water temperature of the steam generator less than or equal to 50°F above RCS cold leg temperature or ( 2) the start of an Intermediate Head Injection pump and its ection into a water solid RCS, or the start of a High Head Safety Injection pump in conjunction wit:h a running Positive Displacement charging pump and injection into a water soli.d RCS. The resultant limiting RCS peak pressure has been calculated to be 455 psig (Reference 1). A number of provisions for prevention of pressure transients below P-7 (when the RCS temperature Specifications. is below presently exists Unit 1 with Model-F steam generators was evaluated for the in ::he Technical of the POPS function. The POPS function was evaluated analytically (Reference 2), specifically for Unit 1 and was found acceptable. Unit 2 with Model 61/19T (AREVA NP) Steam Generators was evaluated for the adequacy of the POPS function. The POPS function was evaluated analytically (Reference 3), specifically for Unit 2 and was found acceptable. 7.6-6 SGS-UFSAR Revision 24 May 11, 2009 In order to cause an unwanted relief valve opening at normal operating pressures, an operator would have to erroneously arm the POPS system. This would require bypassing the administrative control of the key associated with the keylocked pushbutton station. Another potential way to initiate a relief
would be an unlikely short
-circuit of a relay contact in the relief valve control circuit. This latter case, however, is also true of the previous
circuitry for the relief valves.
Spurious opening of the relief valve at pressures below normal operations pressure could be caused by an unlikely failure of a pressure transmitter in the "high" direction. Such valve openings would result in a "low pressure" coolant inventory reduction similar to that associated with a "true" signal for relief valve operation. This type of incident could be readily terminated by the operator and poses no threat to the safety of the plant.
The effects of various failures have been considered in the POPS design. These
failures included "loss of station power." Failures within the POPS cannot cause a loss of protective function due to the dual train design, and failures capable of causing an overpressurization cannot cause failures within the POPS or prevent operation of the system.
The "loss of air" situation is accounted for by provision of an air accumulator for each relief valve. The accumulators are sized to provide control air for cycling POPS to ensure the RCS pressure transient does not exceed the limit of 10CFR50 Appendix G. The accumulators are designed to seismic Category I requirements. The air accumulators are provided with an alarm for low air pressure. The accumulator design precludes a total loss of control air to the
relief valves.
A "loss of station power" will have no effect on the POPS since the protection logic power is provided by inverters, and control power for the relief valves
originates at the batteries.
7.6.4 Feedwater Pump Turbine Trips There are two steam generator feedpumps and turbines. Each has its own trip sensing scheme which actuates a turbine trip for any of the following conditions:
7.6-7 SGS-UFSAR Revision 29 January 30, 2017
I 1. Low feedpump suction pressure 2. High turbine exhaust 3. Loss of vacuum at turbine exhaust 4. Excessive thrust bearing wear 5. Low lube oil pressure 6. Low oil reservoir level 7. Over speed sensor and detector 8. Over speed trip-mechanical (internal to turbine) 9. Safety injection or high-high level in any steam generator 10. Manual lever at turbine 11. Remote manual switch 12. Low HPU Control Oil Pressure Automatic trip of either feedwater pump turbine will activate a audible and visual alarm in the Control Room. 7.6.5 1. S-C-R200-MDM-0042, Rev. 2, RCS Overpressurization for Salem Units 1 & 2 2. FTI Doc. No. 77-1258763-00, Replacement Steam Generator Report and Evaluation for Public Service Electric & Gas Company, Salem Unit One, 1997. 3. PSEG VTD 328324, AREVA NP Document No. 32-5042030-01, "Salem Unit 2 RSG -Low Temperature Overpressure (LTOP) Analysis." 7. 6-8 SGS-UFSAR Revision 24 May 11, 2009