ML021190542
| ML021190542 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 04/25/2002 |
| From: | Milano P Office of Nuclear Reactor Regulation |
| To: | |
| Milano P | |
| Shared Package | |
| ML021260067 | List: |
| References | |
| TAC MB4468 | |
| Download: ML021190542 (1) | |
Text
{{#Wiki_filter:2.2 SAFETY LIMIT: REACTOR COOLANT SYSTEM PRESSURE Applicability Applies to the rnaximum limit on Reactor Coolant System pressure. Objective To maintain the integrity of the Reactor Coolant System and to prevent the release of excessive amounts of fission product activity to the containrment. Specification The Reactor Coolant System pressure shall not exceed 2735 psig with fuel assemblies installed in the reactor vessel. Basis The Reactor Coolant System "' serves as a barrier preventing radionuclides contained in the reactor coolant from reaching the atmosphere. In the event of a fuel cladding failure the Reactor Coolant System is the primary barrier against the release of fission products. By establishing a system pressure limit, the continued integrity of the Reactor Coolant System is assured. The maxirmum transient pressure allowable in the Reactor Coolant System pressure vessel under the ASME Code, Section III is 110% of design pressure. The maximum transient pressure allowable in the Reactor Coolant System piping, valves and fittings under USAS Section B31.1 is 120% of design pressure. Thus, the safety limit of 2735 psig (110% of design pressure) has been established. The settings of the power operated relief valves (2335 psig)(2) and the reactor high pressure trip (2363 psig)(2' have been established to assure that the Reactor Coolant System pressure limit is never reached and that the system pressure does not exceed the design limits of the fuel cladding. In addition, the Reactor Coolant System safety valves (3 are sized to prevent system pressure fran exceeding the design pressure by more than 10 percent (2735) Revised by letter dated Arril 25, 2X02 Amendment No. 152 2.2-1
Services Company (RESCO) plant. The RESCO plant alone does not have the capability to supply all expected loads for Indian Point 2 and 3 and connected customer loads supplied by the Buchanan 13.8 kV substation. Therefore, the RESCO plant cannot be used to satisfy 3.7.A.1 or 3.7.B.2.a. The plant auxiliary equipment is arranged electrically so that multiple items receive their power from different sources. The charging pumps are supplied from the 480-volt buses Nos. 3A, 5A, and 6A. The five containment fans are divided among the 480-volt buses. The two residual heat pumps are on separate 480-volt buses. Valves are supplied from separate motor control centers. The station auxiliary transformer or a gas turbine is capable of providing sufficient power for plant startup. The station auxiliary transformer can supply the required plant auxiliary power during normal operation. There are two 13.8/6.9 kV transformers which can be used to supply 6.9 kV power to Indian Point 2. One transformer is associated with Feeder 13W92 and Indian Point 2, the other is associated with Feeder 13W93 and Indian Point 3. Each transformer is capable of supplying maximum safeguards loads and safe shutdown loads for both Indian Point 2 and 3 taken simultaneously. While during normal operation each unit will take credit for its associated transformer, during the time frame required to perform scheduled maintenance or to replace failed equipment both units may take credit for the same 13.8/6.9 kV transformer. Neither 13.8/6.9 kV transformer is capable of supplying all auxiliaries for either unit. Therefore, the automatic transfer of 6.9 kV buses 1, 2, 3 and 4 is defeated when the 13.8 kV source is supplying power to buses 5 and 6. The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries. With additional switching, more equipment could be out of service without infringing on safety. Two diesel generators have sufficient capacity to start and run, within design ratings, the minimum required equipment. If one diesel is inoperable, the minimum required equipment associated with the remaining two diesels must be operable. Equipment that is not required such as a third non-essential service water pump, a third charging pump or a third component cooling water pump associated with the remaining two diesels is not required to be operable when a diesel is inoperable as long as the remaining two diesels can not be overloaded by this configuration. Component Cooling Pump 22 cannot be inoperable while either Diesel Generator 21 or 23 is out of service because this configuration would overload one of the-remaining two diesels. Revised by letter dated Ap:*l 25, MXY0 Amendment No. 196 3.7-6
The basis for the minimum total required fuel oil quantity is to provide for operation of two diesel generators for 7 days. The specified minimum quantity of fuel oil is based on operation of two diesel generators for 7 days at the maximum load profile permitted by the diesel generator rating. Each diesel is rated for operation for 0.5 hours of operation out of any 24 hours at 2300 kW plus 2.0 hours of operation out of any 24 hours at 2100 kW with the remaining 21.5 hours of operation out of any twenty four hours at 1750 kW. Operation of the diesel generators at the maximum load profile ratings bounds the postulated accident load profile. Using this maximum load profile and the associated fuel consumption rates, the total fuel oil consumed by 2 diesel generators for 168 hours is approximately 43,500 gallons. This quantity of fuel oil necessary to operate two diesel generators is conservatively less than the specified minimum fuel oil requirement of 48,000 gallons by approximately 4,500 gallons. There are three onsite fuel oil storage tanks adjacent to the diesels. Each tank has an associated fuel oil transfer pump, which has the capability to automatically feed two of the three diesels through either of two redundant supply headers. If one of the three storage tanks is not available, there is sufficient fuel oil available in the remaining two tanks to run two diesels at the maximum load profile for at least 45 hrs. Similarly, if three diesels are available, there is sufficient fuel oil in the three associated storage tanks for at least 45 hours of operation at the maximum load profile. Additional fuel oil suitable tor use in the diesel generators will be stored either onsite or at the Buchanan Substation. If one EDG storage tank or transfer pump is unavailable, the remaining tanks or pumps with the additional 29,000 gallons of fuel oil can supply the two diesels if required to supply at 'east minimum engineered safeguards equipment for at least 160 hours.(2ý Commercial oil supplies and trucking facilities exist to assure deliveries within one day's notice. If a diesel generator is out of service due to planned maintenance or testing, testing of the remaining diesel generators is not required. In this case, testing is not required because a planned emergency diesel generator maintenance or testing outage does not directly affect the availability or reliability of the remaining emergency diesel generators and is not indicative of a potential failure in the remaining emergency diesel generators. One battery charger shall be in service on each battery so that the batteries will always be at full charge in anticipation of a loss-of-ac power incident. This ensures that adequate dc power will be available for starting the emergency diesel generators and other emergency uses. The plant can be safely shut down without the use of off site power since all vital loads (safety systems, instruments, etc.) can be supplied from the emergency diesel generators. Revised by letter dated Atil 25, 2002 Amendment No. 196 3.7-7
Any two of three diesel generators, the station auxiliary transformer or the separate 13.8 to 6.9 kV transformer are each capable of supplying the minimum safeguards loads and therefore provide separate sources of power immediately available for operation of these loads. Thus, the power supply system meets the single failure criteria required of the safety systems. Three (3) gas turbine generators are directly available to the Indian Point site. One is located onsite (GT-1) and two additional units are located at the adjacent Buchanan Substation (GT-2 and GT-3). One gas turbine generator is more than adequate to provide an additional contingency of backup electrical power for maintaining the plant in a safe shutdown condition. The specified gas turbine generator minimum fuel inventory of 54,200 gallons assures that one gas turbine generator will be capable of supplying more than the maximum electrical load for the Indian Point Unit No. 2 alternate safe shutdown power supply system (i.e., 750 kW) for at least three (3) days. Commercial oil supplies and trucking facilities exist to assure deliveries of additional fuel oil within one day's notice. Conditions of a system-wide blackout could result in a unit trip. Since normal offsite power supplies as required in Specification 3.7.A are not available for startup, it is desirable to be able to blackstart this unit with onsite power supplies as a first step in restoring the system to an operable status and restoring power to customers for essential service. Specification 3.7.D.1 provides for startup using the onsite gas turbine to supply the 6.9 kV loads and the diesels to supply the 480-volt loads. Tie breakers between the 6.9 kV and 480-volt systems are open so that the diesels would not be jeopardized in the event of any incident and would be able to continue to supply 480-volt safeguards power. The scheme consists of starting two reactor coolant pumps, one condensate pump, 2 circulating water pumps and necessary auxiliaries to bring the,init up to approximately 10% power. At this point, loads can be assumed by the main generator and power supplied to the system in an orderly and routine manner. Specification 3.7.D.2 is identical with normal start-up requirements as in Specification 3.7.A except that off site power is supplied exclusively from gas turbines with a minimum total power of 37 MW (nameplate rating), which is sufficient to carry out normal plant startup. As a result of an investigation of the effect components, that might become submerged following a LOCA, may have on ECCS, containment isolation, and other safety-related functions, a fuse and a locked-open circuit breaker were provided on the electrical feeder to emergency lighting panel 218 inside containment. With the circuit breaker in the open position, containment electrical penetration H-70 is de-energized during the accident condition. Personnel access to containment may be required during power operation. Since it is highly improbable that a LOCA would occur during this short period of time, the circuit Revised by letter datr,-dp rjqs, 9ffl2 Amendment No. 196 3.7-8
breaker may be closed during that time to provide emergency lighting inside containment for personnel safety. When the 138 kV source of offsite power is out of erv's*, the automatic transfer of 6.9 kV Buses 1, 2, 3 and 4 to offsite power after a unit trip could result in overloading of the 20 MVA 13.8 kV/6.9 kV auto-transformer. Accordingly, the intent of Specification 3.7.B.4 is to prevent the automatic transfer when only the 13.8 kV source of offsite power is available. However, this specification is not intended to preclude subsequent manual operations or bus transfers once sufficient loads have been stripped to assure that the 20 MVA auto-transformer will not be overloaded by these manual actions. References (1) UFSAR Section 8.2.1 (2) UFSAR Section 8.2.3 3.7-9 Amendment No. 196 Revised by letter dated Apxi1 25, 21702
power escalation, however, a large tilt could be indicated. The numerical limits are set to be commensurate with design and safety limits for DNB protection and linear heat generation rate as described below. The radial power distribution within the core must satisfy the design values assumed for calculation of power capability. Radial power distributions are measured as part of the startup physics testing and are periodically measured at a monthly or greater frequency. These measurements are taken to assure that the radial power distribution with any quarter core radial power asymmetry conditions are consistent with the assumptions used in power capability analyses. It is not intended that reactor operation would continue with a power tilt condition which exceeds the radial power asymmetry considered in the power capability analysis. The quadrant tilt power deviation alarm is used to indicate a sudden or unexpected change from the radial power distribution mentioned above. The two percent tilt alarm setpoint represents a minimum practical value consistent with instrumentation errors and operating procedures. This asymmetry level is sufficient to detect significant misalignment of control rods. Misalignment of control rods is considered to be the most likely cause of radial power asymmetry. The requirement for verifying rod position once each shift is imposed to preclude rod misalignment which would cause a tilt condition of less than the 2% alarm level. The two-hour time interval in this specification is considered ample to identify a dropped or misaligned rod and complete realignment procedures to eliminate the tilt condition. In the event that this tilt condition cannot be eliminated within the two-hour time allowance, additional time would be needed to investigate the cause of the tilt condition. The measurements would include a full-core physics map utilizing the movable detector system. For a tilt condition < 1.09, an additional 22-hour time interval is authorized to accomplish these measurements. However, to assure that the peak core power is maintained below limiting values, a reduction of reactor power of three percent for each one percent of indicated tilt is required. Physics measurements have indicated that the core radial power peaking would not exceed a two to one relationship with the indicated tilt from the excore nuclear detector system for the worst rod misalignment. In the event a tilt condition of < 1.09 cannot be eliminated after 24 hours, the reactor power level will be reduced to less than 50% of rated power. To avoid reset of a large number of protection setpoints, the power range nuclear instrumentation would be reset to cause an automatic reactor trip at 55% of allowed power. A reactor trip at this power has been selected to prevent, with margin, exceeding core safety limits even with a nine percent tilt condition. If a tilt ratio greater than 1.09 occurs, which is not due to a misaligned rod, the reactor power level will be reduced to less than 50% of rated power for investigation. However, if the tilt Revised by letter dated Ap=LL 25. =2 Amendment No. 194 3.10-12}}