NL-16-109, Indian Point, Unit 2, Amendment Update to the Updated Final Safety Analysis Report (Ufsar), Revision 26 - Chapter 8, Electrical Systems
Text
IP2 FSAR UPDATE Chapter 8, Page 1 of 30 Revision 2 6, 2016 CHAPTER 8 ELECTRICAL SYSTEMS 8.1 DESIGN BASES
The main generator supplies electrical power at 22
-kV through an isolated
-phase bus to two half-sized 20.3/345
-kV main power transformers. Power required for station auxiliaries during normal operation is split between a 22/6.9
-kV unit auxiliary transformer connected to the isolated phase bus and a 138/6.9
-kV station auxiliary transformer. This practice provides significant diversity of normal supply power to the redundant safeguards power trains.
Following any turbine trip when there are no electrical faults, which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. Upon generator trip, other than a generator over
-frequency trip, auxiliaries fed from the unit transformer are "dead
-fast" transferred to the station transformer. Provisions for standby (13.8
-kV system) and emergency power (diesels) have been included to ensure further the continuity of electrical power for critical loads. The function of the auxiliary electrical system is to provide reliable power to those auxiliaries required during any normal or emergency mode of plant operation.
Sufficient independence and isolation between the various sources of electrical power is provided in order to guard against concurrent loss of all auxiliary power.
8.1.1 Principal Design Criteria 8.1.1.1 Performance Standards Criterion:
Those systems and components of reactor facilities, which are essential to the prevention or to the mitigation of the consequences of nuclear accidents, which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condition, high wind or heavy ice. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design. (GDC 2)
All electrical systems and components vital to plant safety, including the emergency diesel generators, are seismic Class I and are designed so that their integrity is not impaired by the design-basis earthquake, certain wind storms, floods, or disturbances on the external electrical system. Power, control and instrument cabling, motors, and other electrical equipment required for operating the engineered safety features are suitably protected against the effects of a design-basis event or severe external environmental phenomena to ensure a high degree of confidence in their operability in the event that their use is required.
IP2 FSAR UPDATE Chapter 8, Page 2 of 30 Revision 2 6, 2016 8.1.1.2 Emergency Power Criterion:
An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single component. (GDC 39 and GDC 24)
Emergency power systems are provided with adequate independency, redundancy, capacity, and testability to supply the required engineered safety features and protection systems.
The plant is supplied with emergency power sources as follows:
- 1. Three independent emergency diesel generators, located in the Diesel Generator Building adjacent to the Primary Auxiliary Building, supply emergency power to the engineered safety features buses in the event of a loss of AC auxiliary power. There are no automatic bus ties associated with these buses. Each diesel generator is started automatically on a safety injection signal or upon the occurrence of an undervoltage condition on any vital 480
-V switchgear bus. The system is sufficiently redundant such that any two diesels have adequate capacity to supply the engineered safety features for the design basis accident concurrent with a loss of offsite power. One diesel is adequate to provide power for a safe and orderly plant shutdown in the event of a loss
-of-offsite electrical power.
- 2. Emergency power for vital instrumentation and control and for emergency lighting is supplied from the 125 VDC system via four independent DC channels. The station batteries supply emergency power to the instrumentation and control systems when their associated battery chargers are not available.
8.1.2 1980 Review of 10 CFR 50 Appendix A GDC 17 and GDC 18 Our August 11, 1980 response to the NRC's February 11, 1980 Confirmatory Order included a study of how the plant complied with 10 CFR 50 regulations in effect at that time. The following paragraphs provide a discussion of the extent to which the Indian Point Unit 2 design complies with Criteria 17 and 18 of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." 8.1.2.1 10 CFR 50 Appendix A General Design Criterion 17 - Electric Power Systems An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.
The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.
IP2 FSAR UPDATE Chapter 8, Page 3 of 30 Revision 2 6, 2016 Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss
-of-coolant accident to assure that the core cooling, containment integrity, and other vital safety functions are maintained.
Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.
Independent alternate power systems are provided with adequate capacity and testability to supply the required engineered safety features and protection systems.
The plant is supplied with normal, standby, and emergency power sources as follows:
- 1. The normal source of auxiliary power for 6.9
-kV buses 1, 2, 3, and 4 during plant operation is the unit auxiliary transformer, which is connected to the main generator via the isophase bus.
- 2. The normal source of auxiliary power for 6.9
-kV buses 5 and 6 and standby power required during plant startup, shutdown, and after reactor trip is the station auxiliary transformer, which is supplied from the Con Edison 138
-kV system by either of two separate overhead lines from the Buchanan substation approximately 0.5 mile from the plant. Alternate feeds from the Buchanan 13.8
-
kV system are also available for immediate manual connection to the auxiliary buses.
- 3. Three diesel
-generator sets supply emergency power to the engineered safety features buses in the event of a loss of AC auxiliary power. There are no automatic bus ties associated with these buses. The Station Blackout (SBO) / Appendix R emergency diesel
-generator is installed in the Unit 1 Turbine Buildin g and is used to supply power for Appendix R fires and a Station Blackout.
- 4. Power for vital instrumentation and controls and for emergency lighting is supplied from the four 125
-V DC systems. The station batteries supply emergency power to the instrumentation and control systems when their associated battery chargers are not available.
The emergency diesel
-generator sets are located in the Diesel Generator Building adjacent to the Primary Auxiliary Building and supply emergency power to separate 480
-V switchgear buses. Each set will be started automatically on a safety injection signal or upon the occurrence of an undervoltage condition on any 480
-V switchgear bus. Any two diesels have adequate IP2 FSAR UPDATE Chapter 8, Page 4 of 30 Revision 2 6, 2016 capacity to supply the required engineered safety features for the design basis accident concurrent with a loss of offsite power. One diesel is adequate to provide power for a safe and orderly plant shutdown in the event of loss
-of-offsite electrical power.
All electrical systems and components vital to plant safety, including the emergency diesel generators, are seismic Class I and are designed so that their integrity is not impaired by the design-basis earthquake, certain wind storms, floods, or disturbances on the external electrical system. Power, control and instrument cabling, motors, and other electrical equipment required for operating the engineered safety features are suitably protected against the effects of a design-basis event or severe external environmental phenomena to ensure a high degree of confidence in their operability in the event that their use is required.
The electrical system equipment is arranged so that no single contingency can inactivate enough safeguards equipment to jeopardize plant safety. The 480
-V equipment is arranged on four buses (three power trains). Buses 2A and 3A are supplied by the same emergency diesel generator power supply. Buses 5A and 6A are each supplied by one of the remaining two emergency diesel generator power supplies. The 6.9
-kV equipment is supplied from six buses.
The plant auxiliary equipment is arranged electrically so that redundant or similar equipment receive power from different sources. The charging pumps are supplied from 480
-V buses 3A, 5A, and 6A. The six service water pumps and the five containment fans are similarly supplied from the four 480
-V switchgear buses. The two service water pumps, one safety injection pump, and the emergency diesel associated with buses 2A and 3A can be connected to either bus 2A or 3A. Safeguards motor
-operated valves are supplied from motor control centers 26A/26AA and 26B/26BB, which are supplied from buses 5A and 6A, respectively.
The 138-kV outside source of power and the 138
-kV/6.9-kV station auxiliary transformer are adequate to run all of the plant auxiliary loads.
The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries.
Two diesel generators have enough capacity to start and run a fully loaded set of engineered safeguards equipment.
The safeguards equipment with any two of the three power trains can adequately cool the core for any loss
-of-coolant incident and maintain the containment pressure within the design value.
The 125-V DC power supplies consist of four separate systems, each having its own battery, battery charger, and power panel. Under normal conditions, each battery charger supplies its DC loads, while maintaining its associated battery at full charge. The battery provides power to the DC loads when the battery charger is not available. DC control power for the 480
-V ESF Switchgear and the emergency diesel generators is supplied via automatic transfer switches.
Should normal battery voltage fall below a specified level, the associated transfer switch(es) transfer control power from the preferred source to the alternate source. This design eliminates any transfer of load between redundant DC systems 21 and 22, which power the reactor protection and safeguards logics and ensures that adequate DC power is available for starting the emergency diesel generators and for other emergency uses.
The plant turbine generator is the main source of 6.9
-kV auxiliary electrical power during "online" plant operation. Power to the auxiliaries is supplied by a 22/6.9
-kV two-winding unit auxiliary transformer that is connected to the isophase bus from the generator.
IP2 FSAR UPDATE Chapter 8, Page 5 of 30 Revision 2 6, 2016 The 6.9-kV system is arranged as six buses. Under normal conditions, two buses (5 and 6) receive power from the 138
-kV system via bus main breakers and the 138
-6.9-kV station auxiliary transformer. Buses 1, 2, 3, and 4 receive power from the main generator via bus main breakers and the unit auxiliary transformer. Buses 1 and 2 can be tied to bus 5, and buses 3 and 4 can be tied to bus 6 via bus tie breakers when the turbine-generator is shutdown. Buses 2, 3, 5, and 6 each serve one of the four 6900
-480-V station service transformers. Normal and offsite power to the 480
-V switchgear buses is supplied through these station service transformers.
The 480-V system is arranged as four ESF switchgear buses. Each 480
-V switchgear bus supplies several 480
-V motor control center buses for power distribution throughout the station. The 480-V switchgear buses are supplied from the 6.9
-kV buses as follows: 2A from 2, 3A from 3, 5A from 5, and 6A from 6. Tie breakers are provided between 480
-V switchgear buses 2A and 3A, 2A and 5A, and 3A and 6A. These tie breakers are racked out under administrative control when the RCS temperature exceeds 350°F.
The required safeguards equipment circuits are supplied from the 480
-V ESF switchgear buses. The normal source of power for buses 5A and 6A is the 138
-kV system (via the station auxiliary transformer, 6.9
-kV buses 5 and 6, and station service transformers); no transfer is required in the event of a unit trip. Buses 2A and 3A will receive power from the 138
-kV system in the event of a unit trip via a "dead fast" transfer of buses 2 and 3 to buses 5 and 6, respectively.
One emergency diesel
-generator set supplies emergency power to bus 5A, one to bus 6A, and the third to buses 2A and 3A. Each set will be started automatically on a safety injection signal (see Section 7.2) or upon undervoltage on any 480
-V switchgear bus.
Power for the safeguards valve motors is supplied from four motor control centers (26A/26AA and 26B/26BB), which in turn are supplied from the 480
-V ESF Switchgear. Motor Control Centers 26A and 26B are provided protection by 480
-V circuit breakers. These circuit breakers are on different 480
-V switchgear buses, and the bus associated with each circuit breaker has a dedicated emergency diesel generator MCC's 26AA and 26BB are supplied from MCC's 26A and 26B, respectively.
Two independent sources of DC control power are available to the breakers on each 480
-V switchgear bus via automatic normal power seeking transfer switches. The preferred and alternate sources of DC control power for the breakers are detailed under Section 8.2.2.3.
Power for instrumentation and control is provided by four 118
-V AC Instrument Supply Systems. Each system consists of one inverter, one manual bypass switch, two 118
-V AC buses, and associated interconnections. The four inverters are dedicated, one to each system. Each inverter receives power from a different DC Power Panel (DC Power Panel 21 supplies Inverter 21. DC Power Panel 22 supplies Inverter 22, etc.) In the event an inverter, is taken out of service, a backup supply from the 480
-V system is available to supply the 118
-V AC loads. Failure of a single inverter or its static transfer to switch will not cause the loss of a basic protective system or prevent the actuation of the minimum safeguards devices.
Several sources of offsite power are available to Indian Point Unit 2. These consist of two 138
-kV overhead supplies from the Buchanan 138
-kV substation, and three separate underground feeders from the Buchanan 13.8
-kV substation. The 13.8-kV line is rated 19.8 MVA at 13
-kV. The 13.8/6.9
-kV transformer is rated 20 MVA. The maximum engineered safety feature and IP2 FSAR UPDATE Chapter 8, Page 6 of 30 Revision 2 6, 2016 safe shutdown loads are 9.2 MVA. No safety or emergency power is required from these sources for the retired Indian Point Unit 1.
The Buchanan 138
-kV substation supply to Indian Point Unit 2 has two connections to the Millwood 138
-kV substation, a connection to the Peekskill Refuse Burning Generating Station and a connection via auto
-transformer to the Buchanan North 345
-kV substation. The Indian Point Unit 2 345
-kV connection to the system goes to the Buchanan North 345
-kV substation, which has connections to Ramapo and Eastview 345
-kV substations. System stability studies show that the system is stable for the loss of any generating unit including Indian Point Unit 2.
Each 138-kV overhead tie line can provide offsite power to Indian Point 2 via the station auxiliary transformer. The loss of this transformer would interrupt the 138
-kV supply to the station. For this reason, an alternate 13.8/6.9
-kV supply is provided.
An additional source of offsite power from the 13.8
-kV distribution system at Buchanan is available to 6.9-kV buses 5 and 6 through supply breakers GT
-25 and GT-26. The transfer from the normal to the reserve supply (or vice versa) must be accomplished manually.
Each of these circuits is designed to be available in sufficient time following a loss of all onsite AC power supplies and other offsite electric power circuits, to ensure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The 138
-kV system is designed to be available instantaneously following a loss
-of-coolant accident to ensure that core cooling, containment integrity, and other vital safety functions are maintained. This is accomplished by a "dead
-fast" transfer scheme that uses stored energy breakers to transfer the auxiliaries on the four 6.9
-kV buses supplied by the unit auxiliary transformer to the station auxiliary transformer, which is supplied from the 138
-kV system. However, when buses 5 and 6 are supplied from the alternate 13.8
-kV supply, the "dead fast" transfer scheme is defeated by manual action to protect the 13.8
-kV-6.9-kV transformer.
The diversity and redundancy inherent in the combination of offsite electrical systems minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of onsite power sources.
The electrical power sources and systems have been evaluated as meeting the requirements of 10 CFR 50.63 (the Station Blackout Rule) (References 3, 4, 5, 6, 7, 8 and 9).
The adequacy of the station electric distribution system voltages was reviewed (as requested by the NRC in Reference 1) for expected normal operating voltage ranges and potential degradations of both the offsite power system and the unit's main electrical generator. The offsite power sources were analyzed under the extremes of load and offsite voltage conditions and credited the automatic load tap changers. To protect safeguards equipment from degraded voltage conditions, which could impair their operation, separate sets of undervoltage relays on each 480-V ESF switchgear bus will alarm to alert the operator that voltage has fallen below approximately 94
-percent on any bus and will trip the normal (offsite or main electrical generator) supply breakers to any bus if voltage remains below approximately 88
-percent for 180 +/- 30 sec. In addition, the 480
-V supply breaker to the ESF Switchgear buses will trip upon sustained (10 +/- 2 sec) degraded voltage conditions coincident with a safety injection signal. By Reference 2, the NRC concluded that the Indian Point Nuclear Station Unit 2 design is acceptable with respect to the adequacy of station electrical distribution system voltages.
IP2 FSAR UPDATE Chapter 8, Page 7 of 30 Revision 2 6, 2016 8.1.2.2 10 CFR 50 Appendix A General Design Criterion 18 - Inspection and Testing of Electric Power Systems Electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The systems shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems as a whole and, under conditions as close to design as practical, the full operation sequence that brings the
systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.
At each refueling interval the 480
-V emergency power system is tested to verify that it and vital equipment control systems will respond as designed. The test is initiated by simulating a loss of normal AC station service power.
Testing and surveillance of the station batteries is accomplished as follows: 1. Every month the voltage of each cell, the specific gravity and temperature of a pilot cell in each battery, and each battery voltage are measured and recorded.
- 2. Every three months the specific gravity of each cell, the temperature reading of every fifth cell, the height of electrolyte, and the amount of water added are measured and recorded.
Also, an equalizing charge is applied if deemed necessary based on the recorded cell voltages and specific gravities.
- 3. Each time data are recorded, the new data are compared with the old to detect signs of abuse or deterioration.
- 4. At each refueling interval, each battery is subjected to a load test and a visual inspection of the plates.
Functional testing is performed in the automatic transfer switches that provide DC control power to the circuit breakers of 480
-V Switchgear, Buses 2A, 3A, 5A, and 6A and the emergency diesel-generator control panels. This testing demonstrates that:
(a) Each automatic transfer switch will transfer from its preferred source to its alternate source when the preferred source is unavailable or its voltage falls below a predetermined value, (b) The preferred and alternate sources of each transfer switch are available to supply DC control power to the breakers and for control of the emergency diesel-generators, and
(c) Each transfer switch will automatically transfer back to its preferred source when the voltage of the preferred source is re
-established to an acceptable level.
IP2 FSAR UPDATE Chapter 8, Page 8 of 30 Revision 2 6, 2016 The safety injection system is tested:
- 1. To verify that the various valves and pumps associated with the engineered safeguards system will respond and perform their required safety functions.
- 2. To ensure that each diesel generator will start automatically and assume the required load, within 60 sec after the initial start signal by simulating loss of all normal alternating current station service power supplies and simultaneously simulating a safety injection signal. This test is performed at each refueling interval. 3. To verify that the required bus load shedding takes place.
- 4. To verify the restoration of particular vital equipment to operation.
Environmental qualification of electrical equipment important to safety is addressed in Section 7.1. REFERENCES FOR SECTION 8.1
- 1. Letter from William Gammill, U.S. Nuclear Regulatory Commission, to all Power Reactor Licensees (except Humboldt Bay),
Subject:
Adequacy of Station Electric Distribution Systems Voltages, dated August 8, 1979.
- 2. Letter from Steven A. Varga, U.S. Nuclear Regulatory Commission, to John D. O'Toole, Con Edison,
Subject:
Adequacy of Station Electric Distribution System Voltages, dated October 18, 1982.
- 3. Letter from Francis J. Williams, U.S. Nuclear Regulatory Commission, to Steven B. Bram, Con Edison,
Subject:
Supplemental Safety Evaluation of Indian Point Nuclear Generating Unit No. 2, Response to the Station Blackout Rule (TAC No. M68556), dated June 4, 1992.
- 4. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated April 14,1989. 5. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated March 27,1990.
- 6. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated October 22, 1993.
- 7. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated November 30,1993.
- 8. Letter from Francis J. Williams, U.S. Nuclear Regulatory Commission, to Stephen B. Bram, Con Edison,
Subject:
Safety Evaluation of the Indian Point Nuclear Generating Unit No.2, Response to the Station Blackout Rule (TAC No.
M68556), dated November 21, 1991.
IP2 FSAR UPDATE Chapter 8, Page 9 of 30 Revision 2 6, 2016 9. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated December 23, 1991.
8.2 ELECTRICAL SYSTEM DESIGN 8.2.1 Network Interconnections Con Edison's external transmission system provides two basic functions for the nuclear generating station: (1) it provides auxiliary power as required for startup and normal shutdown and (2) it transmits the output power of the station.
Electrical energy generated at 22
-kV is raised to 345
-kV by the two main transformers. Power is delivered to the system via a 345
-kV overhead tie line routed between the main transformers and the 345
-kV North Ring Bus at Buchanan Substation. The North Ring Bus is configured with three circuit breakers rated 362
-kV, 3000A, 40/63kA. Two of these breakers have synchronizing capability to connect the main generator to the system. The North Ring Bus is also connected to Ramapo and Eastview Substations via overhead transmission circuits and to the Buchanan 138
-kV Substation via a 335/138
-kV auto-transformer.
The electrical one
-line diagram for the Indian Point Station is presented in Plant Drawing 250907 [Formerly UFSAR Figure 8.2-1]. Standby power is supplied to the station from the Buchanan 138
-kV Substation, which has two connections to the Millwood 138
-kV Substation, one connection to the Peekskill Refuse Burner, and one connection to the Buchanan 345
-kV Substation via an auto-transformer. Several power flow paths exist to connect 13.8
-kV buses through 13.8/6.9 kV autotransformers to Buses 1 and 6.
A single-line diagram showing the connections of the main generator to the power system grid and standby power source is shown i n Plant Drawing 250907 [Formerly UFSAR Figure 8.2-2]. 8.2.1.1 Reliability Assurance
T wo external sources of standby power are available to Indian Point Unit 2. They are the 138
-kV tie from the Buchanan 345
-kV substation and the 138-kV Buchanan
-Millwood ties. Loss of any of these sources will not affect the other. Substantial flexibility and alternate paths exist within each source.
The 138-kV supply from the Buchanan substation with its connections to the Con Edison 345
-kV system provides a dependable source of station auxiliary power. Upon loss of 345/138
-kV auto-transformer supply at Buchanan, two 138
-kV ties are designed to provide additional auxiliary power from the Millwood 138
-kV substation. A further guarantee of reliable auxiliary power, independent of transmission system connections, is provided by the SBO / Appendix R Diesel for the Appendix R fire or a loss of all AC (Station Blackout). The SBO / Appendix R Diesel, associated switchgear and breakers minimum operating requirements are specified in the Unit 2 Technical Requirements Manual (TRM). The minimum quantity of fuel for the SBO / Appendix R Diesel to operate 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> shall be available at all times the SBO / Appendix R Diesel is considered operable. Support systems for cooling include the City Water Storage Tank and the Service Water System (SWS) (first the city water and then a switch to the SWS). If these requirements cannot be met, then the diesel is considered inoperable and the TRM requirements are followed.
IP2 FSAR UPDATE Chapter 8, Page 10 of 30 Revision 2 6, 2016 The fuel supply consists of two onsite 30,000
-gal fuel oil tanks and a 200,000
-gal storage tank located at the Buchanan substation site. A minimum amount of fuel is maintained available and dedicated for the SBO / Appendix R Diesel. This minimum fuel inventory ensures that the SBO / Appendix R Diesel will be capable of supplying the maximum electrical load for the Indian Point Unit 2 alternate safe shutdown power supply system (i.e., 1600kW) for at least 3 days. Commercial oil supplies and trucking facilities exist to ensure deliveries of additional fuel within one day's notice.
In the event of the loss of the Indian Point Unit 2 138
-kV supply (the primary preferred offsite supply), the Indian Point Unit 2 13.8/6.9
-kV supply is manually connected to 6.9
-kV buses 5 and
- 6. The capacity of this supply is limited and is not capable of supplying full plant load. However, the 13.8-6.9-kV supply is capable of supplying the normal load on buses 5 and 6 and is also capable of supplying all 480
-V safeguards and safe shutdown loads. The "dead
-fast" transfer of 6.9-kV buses 1, 2, 3, and 4 is prevented by manual action when buses 5 and 6 are supplied from the 13.8/6.9
-kV supply.
8.2.2 Station Distribution System
The auxiliary electrical system is designed to provide a simple arrangement of buses requiring a minimum of switching to restore power to a bus in the event that the normal supply is lost.
The basic components of the station electrical system are shown on the electrical one
-line diagrams (See Plant Drawings 208377, 231592, 208088, 9321
-3004, 249956, 9321
-3005, 208507, 249955, 208241, 9321
-3006, 248513, 208500, 208502, 208503, 9321
-3008, and UFSAR Figure 8.2
-4 [Formerly UFSAR Figures 8.2-3, and 8.2-5 through 8.2
-16]), which include the main generator, the 345
-kV, the 6.9
-kV, the 480-V, the 118
-V AC instrument, and the 125
-V DC systems.
8.2.2.1 Unit Auxiliary, Station Auxiliary, and Station Service Transformers The plant turbine generator is a main source of 6.9
-kV auxiliary electrical power during "online" plant operation. Power to the auxiliaries on 6.9
-kV Buses 1 thru 4 is supplied by a 22/6.9
-kV two-winding unit auxiliary transformer that is connected to the main generator via the iso
-phase bus. Power to the auxiliaries on 6.9
-kV buses 5 and 6 during "on line" plant operation is supplied by a 13.8/6.9
-kV two-winding station auxiliary transformer connected to an offsite supply. Power to the 480
-V buses is supplied from four 6900/480
-V, air-insulated, dry
-type station service transformers.
These transformers were designed and constructed in accordance with ANSI C57.11, as the applicable standard of record at the time of fabrication. During engineered safeguards loading and operation, these transformers are loaded within their rating. Manufacturer shop tests of the transformers were conducted in accordance with the American Standard Test Code C 57.12.90. This series of tests consisted of the following:
- 1. Resistance measurements of all windings.
- 2. Ratio tests.
- 3. Polarity and phase relation tests.
- 4. No-load losses.
- 5. Exciting current.
- 6. Impedance and load loss.
- 7. Temperature test.
IP2 FSAR UPDATE Chapter 8, Page 11 of 30 Revision 2 6, 2016 8. Applied potential tests.
- 9. Induced potential tests.
The normal source of power to buses 5 and 6 and auxiliary power required during plant startup, shutdown, and after a unit trip is supplied from the 138
-kV switchyard. After a unit trip, the auxiliary loads on 6.9
-kV Buses 1 through 4 are transferred from the unit auxiliary transformer to the station auxiliary transformer by automatic relay transfer scheme using stored energy breakers. The transfer is monitored by synchrocheck relays (Device 25). The 138
-kV system is the normal supply for two of the three power trains of the auxiliary loads associated with plant engineered safeguards.
8.2.2.2 6.9-kV System The 6.9-kV system is arranged as six buses. During normal plant operation, two buses (5 and 6) receive power from the 138
-kV system by bus main breakers and the 138/6.9
-kV station auxiliary transformer, while buses 1, 2, 3, and 4 receive power from the main generator by bus main breakers and the unit auxiliary transformer. On a generator trip, other than a generator over-frequency trip, a "dead
-fast" transfer scheme ties buses 1 and 2 to bus 5, and bus 3 and 4 to bus 6, by bus tie breakers. In the case of a generator over
-frequency trip, the transfer is blocked by an over
-frequency transfer interrupt circuit provided for bus protection of out of phase transfer. Plant Drawing 225097 [Formerly UFSAR Figure 7.2-4] is the logic diagram of the transfer scheme. Buses 2, 3, 5, and 6 each serve one 6900/480
-V station service transformer.
8.2.2.3 480-Volt System
The 480-V system arranged as ESF Switchgear buses 2A, 3A, 5A, and 6A and numerous motor control center buses. The 480
-V switchgear buses are supplied from the 6.9
-kV buses as follows: 2A from 2, 3A from 3, 5A from 5, and 6A from 6 (buses 2A and 3A are within the same power train). Tie breakers are provided between 480
-V Switchgear buses 2A and 3A, 2A and 5A, and 3A and 6A.
The required safeguards equipment circuits are supplied from the 480
-V Switchgear buses. The normal source of power for buses 5A and 6A is the 138
-kV system (via the station auxiliary transformer, 6.9
-kV buses 5 and 6, and station service transformers); since the normal source of power to these buses is not the main generator, no transfer is required in the event of a unit trip. Buses 2A and 3A are supplied from buses 5 and 6, respectively, via a "dead
-fast" transfer of the 6.9-kV buses in the event of a unit trip.
One emergency diesel
-generator set provides emergency power to bus 5A, one to 6A, and the other to buses 2A and 3A. Each set will automatically start on a safety injection signal or upon undervoltage on any 480
-V switchgear bus.
Power for the safeguards valve motors is supplied from four motor control centers (MCC's 26A, 26AA, 26B, and 26BB). Motor Control Centers 26A and 26B are supplied through separate circuit breakers on different 480
-V switchgear buses. Each of these 480
-V switchgear buses has a dedicated emergency diesel
-generator set. Motor Control Centers 26AA and 26BB are sub fed from MCC's 26A and 26B, respectively.
Loads required for safe shutdown and accident mitigation are supplied from the 480
-V switchgear buses and from certain 480
-V motor control centers. Other loads are segregated IP2 FSAR UPDATE Chapter 8, Page 12 of 30 Revision 2 6, 2016 onto other motor control centers. In the event of loss
-of-offsite power, loads are stripped from the 480-V buses, the diesel generators are started, and required loads are added in sequence, as described in section 8.2.3.4.
All four 480
-V switchgear buses are safety
-related and supply power to ESF systems and equipment. Therefore, two independent sources of DC control power are provided for control of 480-V breakers, protective circuits and other devices. This is accomplished by automatic transfer switches located near each switchgear. A transfer from the preferred source to the alternate source occurs when the voltage of the preferred source falls below a predetermined value (100
-V DC), provided the voltage of the alternate source is above a predetermined value (112.5-V DC). When the preferred source is restored to 112.5
-V DC or higher, the transfer switch will transfer back to the preferred source. With only one source energized, the transfer switch seeks the energized source. Lights indicate the available energized source. Thus, the DC supply for the protection and control of the ESF Switchgear is maintained in the event of a loss of one DC source.
The preferred and alternate sources of DC control power for the breakers are:
Transfer Switch Associated Bus Preferred Source Alternate Source EDD1 6A DC PP #24 DC PP #22 EDD2 2A DC PP #22 DC PP #24 EDD3 3A DC PP #23 DC PP #21 EDD4 5A DC PP #21 DC PP #23 8.2.2.4 125-V DC Systems
There are four separate safety
-related 125
-V DC systems serving the various DC loads throughout the station. Each system consists of one battery, one battery charger, one main power panel and one or more DC distribution panels (sub panels). The systems are similarly arranged, however equipment capacities are not necessarily the same.
Each battery charger is supplied from a different 480
-V switchgear bus. Under normal and emergency conditions, the battery charger supplies the DC loads and float charges the battery. The battery provides power to the DC loads under the following conditions:
(a) When the load exceeds the capacity of the battery charger, such as during DC motor starting or simultaneous breaker operation.
(b) When the battery charger is not available, such as a battery charger failure or loss of input voltage.
Bus ties between the main power panels (DC Power Panel 21 and DC Power Panel 22) permit battery and battery charger maintenance.
8.2.2.5 118-V AC Instrument Supply Systems
There are four independent safety
-related 118
-V AC instrument supply systems serving the various instrumentation and control systems throughout the station. Each system consists of one solid-state inverter with an internal static transfer switch, one manual bypass switch and two 118-V AC instrument buses (See Plant Drawing 250970 [Formerly Figure 8.2-2] for system IP2 FSAR UPDATE Chapter 8, Page 13 of 30 Revision 2 6, 2016 arrangement and connections to power sources).
All four inverters are supplied from different 125-V DC power panels. Each inverter has an alternate input power source (120
-V AC nominal), which is used to synchronize the inverter output to the auxiliary electrical system and to provide power to the vital 118
-V AC loads in the unlikely event of an inverter failure. The alternate input power source to the inverters is provided by step
-down transformers connected to the inverter's static transfer switch. These transformers are supplied from safety
-related 480
-V MCCs. These feeds are electrically separated from the feeds to the associated battery charger. In the event that an inverter or static transfer switch is out of service, each 118
-V AC system has a manual transfer switch mounted in a separate enclosure that can bypass the static transfer switch and provide backup power from the step
-down transformers directly to the 118-V AC buses. To ensure that a single failure of an emergency diesel
-generator will not result in the unavailability of more than one 118
-V AC system, the normal and backup supplies for three of the instrument buses 21, 22, and 24 are unitized (i.e. fed from the associated emergency diesel
-generator). Instrument bus 23 is fed from emergency diesel generators 21 and 22, providing diverse sources to prevent loss of this bus due to loss of a single emergency diesel-generator. Voltage drop calculations demonstrate that equipment supplied from Buses 21 and 21A are operable with the postulated minimum voltage at Inverter 21. This is typical of all instrument buses.
8.2.2.6 Evaluation of Layout and Load Distribution Electrical distribution system equipment is located to minimize the exposure of vital circuits to physical damage as a result of accidents or natural phenomena. To a certain extent the Diesel
-Generator Building is protected from tornados and major tornado generated major missiles because it is situated between large buildings as shown in the site plot plan (Plant Drawing 9321-1002 [Formerly UFSAR Figure 1.2-3]). The diesel
-generator installation is considered redundant to other lines of power supply. As described in Section 8.1, there are alternate power supplies. In the case of a tornado, reliance is placed on power supply redundancy and not solely on the diesel installation.
Station Auxiliary, Unit Auxiliary, and the main transformers are located outdoors and are spaced to minimize their exposure to fire, water, and other physical damage. Surge arresters are installed near the high
-voltage terminals of the main and standby transformers to protect the windings from lightning and switching transients, which can cause transformers to fail. All oil
-filled transformers are provided with automatic deluge systems to extinguish oil fires quickly and prevent the spread of fire.
The 6.9-kV buses are housed in two metal
-clad switchgear units. The enclosures for switchgear 21 and 22 are located at elevation 15 ft in the turbine building. Each breaker is mounted in a separate compartment. Switchgear 21 and 22 have a solid top with cable penetrations and some openings on the side. The cable openings at the top are sealed to minimize bus exposure to fire, water, and other physical damage. An overcurrent condition on any of the 6.9
-kV buses actuates the associated bus protection lockout relays, which isolate the bus by tripping and locking out both the normal supply breaker and the 6.9
-kV tie breaker for that bus.
The 480-V buses are housed in two metal
-enclosed switchgear units located at the 15
-ft elevation of the Indian Point Unit 2 control building. The switchgear structure provides protection to minimize exposure from mechanical, fire, and water damage. Buses 5A and 2A are contained in switchgear enclosure 21; Buses 6A and 3A constitute switchgear enclosure 22.
The switchgear contains the buses, the bus supply breakers, the tie breakers, the load (feeder)
IP2 FSAR UPDATE Chapter 8, Page 14 of 30 Revision 2 6, 2016 breakers, the station service transformers, and the potential transformers for synchronizing and under-voltage relay protection. The normal 480
-V switchgear supply breakers 52/2A, 52/3A, 52/5A, and 52/6A are tripped under the following conditions:
- 1. Safety injection or unit trip, and loss of voltage (~46
-percent) on bus 5A or 6A.
- 2. Actuation of manual trip pushbuttons on each breaker.
- 3. Actuation of control switches in the Central Control Room.
- 4. Actuation of control switches in the Diesel
-Generator Building.
- 5. Individual breaker overcurrent protection.
- 6. Degraded voltage (~88
-percent) for 180 30 seconds on each respective bus.
- 7. Degraded voltage (~88
-percent) coincident with a safety
-injection signal for 10 2 seconds.
The "short time" undervoltage relays provide input signals to the sequencing logic and emergency diesel generator start circuitry. Their setpoints (~46
-percent) are designed to provide a fast trip response under complete loss
-of-power ("dead bus") conditions.
The trip of the normal 480
-V supply breakers to the safeguards buses upon sustained under voltage is actuated by two undervoltage relays (set at ~88
-percent) on each bus. Two out of two logic will operate an Agastat timing relay (set at 180 30 sec), which in turn trips its respective 480
-V supply breaker. This function was added to provide additional protection to the safeguards loads against degraded
-voltage conditions. Tripping the 480
-V supply breakers to the safeguards buses, upon sustained degraded
-voltage conditions coincident with a safety
-injection signal for 10 2 sec, protects the motors in addition to providing an alternate power supply to establish a correct voltage.
A separate category alarm and bullet lights in the central control room will alert the operator when any 480
-V switchgear bus voltage falls to 94
-percent. These may operate during load sequencing operations but they are primarily intended to alert the operator to sustained degraded voltages that result from problems on the offsite power system.
Remote manual and automatic control of the 480
-V switchgear breakers and associated relays requires 125
-V DC control power. Automatic transfer switches are provided to increase the reliability and availability of DC control power for operation of the 480
-V switchgear under normal conditions and during safeguards actuation.
The original plant design provided for transfer between 125
-V DC Systems 21 and 22 for each switchgear's DC control power. To improve the reliability of the system and eliminate any potential for transfer
-related common
-mode failures of DC systems 21 and 22, the transfer schemes were changed to utilize DC systems 23 and 24, which were added after the plant was commissioned. The NRC reviewed this plant change in their safety evaluation report dated 5/2/80, and determined that it met the requirements of Regulatory Guide 1.6 and was therefore acceptable (Reference 1). See Section 8.2.2.3 for the preferred and alternate sources of DC control power for the 480
-V switchgear breakers.
Control power for the operation of equipment supplied from each 480
-V switchgear bus is arranged to match the preferred and alternate sources of DC control power to the 480
-V switchgear breakers. For example, for the equipment supplied from Switchgear Bus 2A, the preferred source of control power is 125
-V DC System 22 and the alternate source of control power is 125
-V DC System 24.
IP2 FSAR UPDATE Chapter 8, Page 15 of 30 Revision 2 6, 2016 Four ASCO transfer switches, one per bus, provide DC control power to the 480
-V switchgear. Each transfer switch is mounted in a separate enclosure near its respective switchgear breakers.
A similar improved design is provided for the DC control power supplies to the control panels associated with each of the three emergency diesel generators located in the diesel building. DC system 21 is the preferred source and DC System 23 is the alternate source for Diesel
-Generator 21; DC System 23 is the preferred source and DC System 22 is the alternate source for Diesel
-Generator 22; DC System 24 is the preferred source and DC System 22 is the alternate source for Diesel
-Generator 23.
Each 480-V switchgear breaker, with the exception of the Rod Power Supply M
-G Set input breakers (52/MG1, 52/MG2) and the reactor trip breakers (52/RTA, 52/RTB, 52/BYA, 52/BYB), is equipped with a Westinghouse "Amptector 1A"* solid-state overcurrent trip unit to protect the auxiliary equipment supplied by the breaker (including cables) and the associated switchgear.
The settings of the solid
-state overcurrent trip unit are based on the supplied load. The solid
-state trip unit is provided with an instantaneous and/or short
-time setting(s) to protect against fault conditions, and long
-time setting to protect against over
-load conditions.
Each circuit breaker is tripped on overcurrent conditions (overload or short circuit) by the combined operations of three components:
- 1. Sensors 2. Amptector solid-state trip unit
- 3. Actuator All necessary tripping energy (for a breaker trip on an overcurrent condition only) is derived from the load current flowing through the sensors; no separate power source is required. The tripping characteristics for a specific breaker rating, as established by the sensor rating, are determined by the continuously variable settings of the Amptector* static trip unit. This unit supplies a pulse of tripping current (when preselected conditions of current magnitude and duration are exceeded) to the actuator, which produces a mechanical force to trip the breaker.
If an overcurrent condition occurs on one of the 480
-V switchgear buses while the bus is supplied from the normal source, lockout relays trip (if required) and prevent the closing of the alternate supply breakers (diesels and bus ties) associated with the bus. These relays must be manually reset after the overcurrent condition is cleared to allow these breakers to close.
The 480-V motor control centers are located in the areas of electrical load concentration. In general, those associated with the turbine generator auxiliary system are located below the turbine generator operating floor level, and those associated with the nuclear steam supply system are located in the primary auxiliary building.
Non-segregated, metal
-enclosed 6.9
-kV buses are used for all major bus runs where large blocks of current are carried. The routing of this metal
-enclosed bus minimizes its exposure to fire, water, and other physical damage.
- Note that the "Amptector" may be replaced by the equivalent Westinghouse device, "Westector."
IP2 FSAR UPDATE Chapter 8, Page 16 of 30 Revision 2 6, 2016 The original plant design philosophy maintains all 480VAC breaker controls for engineered safeguards equipment operational following the loss of a 125VDC bus / battery. In the original plant design, two batteries supported three trains of breaker controls by utilizing Battery 21 (Train A), Battery 22 (Train B), and dual inputs from Battery 21 and 22 routed together in a third routing channel to effectively create a Train C. To provide additional capacity, reliability and independence, Indian Point 2 subsequently installed two additional batteries, Battery 23 and Battery 24, which are independent of, and serve as "Swing buses" for the 480VAC breaker and emergency diesel generator controls (Battery 23 with Battery 21 and Battery 24 with Battery 22). This arrangement eliminates any transferring of loads between Batteries 21 and 22.
Train A loads are primarily supported by Diesel Generator 21 and Train B loads are primarily supported by Diesel Generator 23. Selected Train A and Train B loads are supplied from Diesel Generator 22. Train C loads are supported by Diesel Generator 22, with selected Diesel Generator 21 loads.
Thus, each load group requires power from a minimum of two diesel generators to fully supply the load group.
The Indian Point Unit 2 cable raceway systems are divided into a maximum of four instrument, four small power & control and three heavy power channels. Where conditions warrant, small power & control and instrumentation cables utilize common raceway to efficiently service localized areas of the plant. For small power and control, a third train is provided.
The application and routing of control, instrumentation, and power cables minimize their exposure to damage from any source. All cables are designed using conservative margins with respect to their current carrying capacities, insulation properties, and mechanical construction. Cable insulation in the reactor building has sheathing selected to minimize the harmful effects of radiation, heat, and humidity. All cables are fire resistant.
The conductors of instrumentation cables are shielded to minimize induced voltages and twisted to minimize magnetic interference. Wire and cables related to engineered safeguards and reactor protection systems are routed and installed to maintain the integrity of their respective redundant channels and to protect them from physical damage.
Cable loading of trays and consequently heat dissipation of cable throughout the plant has been carefully studied and controlled to ensure that there is no overloading. The criteria for electrical loading were developed using IPCEA (now ICEA) Standard P 426, manufacturer recommendations, and good engineering practice.
Derating factors for cables in trays without maintained spacing are taken from Table VIII of the IPCEA publication. Derating factors for the maximum ambient temperature existing in any area of the plant are also taken from the IPCEA publication. These factors are applied against ampacities selected from appropriate tables in other portions of the standard.
For physical loading of trays, the following criteria are followed: for 6.9
-kV power, one horizontal row of cables is allowed in a tray; for heavy power, two horizontal rows of cables are allowed; for medium power, small power & control or instrumentation, 70
-percent of the cross
-sectional area of a tray is the maximum fill, with the heavy power cables limited to two horizontal rows
. During initial plant construction, a computer program monitored the loading and prevented the routing of anything greater than this amount.
IP2 FSAR UPDATE Chapter 8, Page 17 of 30 Revision 2 6, 2016 For instrumentation cables, four basic channels are routed through the plant. These channels include cables for systems of 65
-V or less. Cables assigned to these four channels are in their respective channels throughout the run.
Certain other cables such as thermocouple cable, public address system cable, and instrument power supplies are run in the four instrument channels. Control cables are separated into two basic channels with a third channel provided as needed for redundant circuits. These groups of cables are set up for systems more than 65
-V and less than 600-V and include multi
-conductor control cable or other cable as required. Cables assigned to these two channels for separation are in their respective channels and are so designated from the beginning of the cable to the final termination. These cables include:
- 1. Motor-operated valves - two channels for the redundant valves.
- 2. Solenoid valves - two channels where required for redundant valves and safeguards. Otherwise not separated.
- 3. Detector drives - run in any channel as convenient.
- 4. Motor controls - except safeguards, run in any channel as convenient. 5. Small power cables - run in any channel as convenient.
- 6. Safeguard control cables - run in two channels as required.
- 7. Safeguard power cables - separated into sufficient channels to provide minimum functions, e.g., three channels are provided for the containment fan cooler motors. In response to the NRC's February 11, 1980 Confirmatory Order, Consolidated Edison's August 11, 1980 letter to the NRC identified differences in cable raceway separation between Indian Point Units 2 and 3. Consolidated Edison determined, evaluated, and provided justification for each design difference between Indian Point Units 2 and 3 in submittals to the NRC (References 2, 3) demonstrating that a single failure would not preclude a safety function from being performed. The NRC reviewed these design differences and corresponding justifications and determined the Unit 2 design to be acceptable in their safety evaluation report (Reference 4).
Physical channeling is accomplished by either separate trays or trays with meta l dividers and in some cases by separate conduit. The safeguard channeling and control train development, and cable tray separations are shown in Plant Drawings 208376 and 208761 [Formerly UFSAR Figures 8.2
-17 and 8.2
-18].
In general, redundant circuits are separated horizontally rather than vertically. When physical conditions prevent this, horizontal barriers (i.e., transite or sheet metal barriers) separate heavy power trays from redundant small power & control and instrument trays. To ensure tha t only fire retardant cables are used throughout the plant, a careful study of cable insulation systems was undertaken early in the design of the plant. Insulation systems that appeared to have superior flame retardant capability were selected and manufacturers were invited to submit cable samples for testing. An extensive flame testing program was conducted including ASTM vertical flame and Con Edison vertical flame and bonfire tests. A report summarizing the testing was prepared by Con Edison. These tests were used as one of the means of qualifying cables, and the specifications were written on the basis of the results.
The following tests were made to determine the flame retardant qualities of the covering and insulations of various types of cables for Indian Point Unit 2:
IP2 FSAR UPDATE Chapter 8, Page 18 of 30 Revision 2 6, 2016 1. Standard Vertical Flame Test - made in accordance with ASTM-D-470-59T, "Tests for Rubber and Thermoplastic Insulated Wire and Cable." 2. Five-Minute Vertical Flame Test - made with cable held in vertical position and 1750F flame applied for 5 min.
- 3. Bonfire Test - consisted of exposing bundles of three or six cables to flame produced by igniting transformer oil in a 12
-in. pail for 5 min. The cable bundles were supported horizontally over the center of the pail with the lowest cable 3 in. above the top of the pail. The time required to ignite the cable and the time the cable continued to flame after the fire was extinguished were noted.
On the basis of these tests, cables were selected for the reactor containment vessel penetration. New cables are selected to conform with IEEE 383
-1974. The design and use of fire stops, seals and barriers to meet 10 CFR 50.48 criteria for the prevention of flame propagation where cable and cable trays pass through walls and floors is found in the document under separate cover entitled, " IP2 Fire Hazards Analysis."
In areas where missile protection could not be provided (such as near the reactor coolant system), redundant instrument impulse lines and cables are run by separate routes. These lines are kept as far apart as physically possible or are protected by heavy (0.24 in.) metal plates interposed where inherent missile protection could not be provided by spacing.
In 1989, the NRC approved changes to the design basis with respect to dynamic effects of postulated primary loop ruptures, as discussed in Section 4.1.2.4.
In those areas where the compressed instrument air system is near the essential 480
-V switchgear, the following provisions have been incorporated to shield this essential switchgear and cabling from potential missiles or pipe whip:
- 1. The compressed instrument air lines in the vicinity of the switchgear are supported at the piping bends. This will resist any step loading of PA (which could occur in the event of an instantaneous circumferential rupture) without occurrence of a "plastic hinge." The possibility of pipe whip is eliminated.
- 2. A guard cover is supplied around the air compressor flywheel. This cover is designed to absorb the translational kinetic energy associated with a compressor flywheel missile.
- 3. A guard barrier is supplied adjacent to the compression chamber of the air compressor. This barrier is designed to absorb the kinetic energy associated with a compression chamber segment.
These provisions ensure that no missile or whipping pipe originating from postulated failures in the compressed instrument air system will strike the essential switchgear.
IP2 FSAR UPDATE Chapter 8, Page 19 of 30 Revision 2 6, 2016 8.2.3 Emergency Power 8.2.3.1 Source Descriptions The sources of offsite emergency power are: (1) the Con Edison 345
-kV system and (2) Con Edison's 138
-kV system. The emergency diesel
-generator sets provide three sources of onsite emergency power. Each set is an Alco Model 16
-251-E engine coupled to a Westinghouse 900 rpm, 3-phase, 60-cycle, 480
-V generator. The units have a capability of 1750 kW (continuous), 2300 kW for 1/2 hour in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, and 2100 kW for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period.
Any two units, backups to the normal standby AC power supply, are capable of sequentially starting and supplying the power requirement of at least one complete set of safeguards equipment. The units are installed in a seismic Class I structure located near the Primary Auxiliary Building.
Each emergency diesel is automatically started by two redundant air motors, each unit having a complete 53
-ft 3 air storage tank and compressor system powered by a 480
-V motor. The piping and the electrical services are arranged so that manual transfer between units is possible. The capability exists to cross
-connect a single EDG air compressor to more than one (1) EDG air receiver, via manual air tie valves. However, to ensure that the operability of two (2) of the three (3) EDGs is maintained for minimum safeguards in the event of a single failure, administrative controls are in-place to require an operator to be stationed within the EDG Building, whenever any of the starting air tie valves are opened. Each air receiver has sufficient storage for four normal starts. However, the diesel will consume only enough air for one automatic start during any particular power failure. Additionally, the engine control system is designed to shut down and lock out any engine that did not start during the initial try.
The emergency units are capable of starting and load sequencing within 10 sec after the initial start signal. The units have the capability of being fully loaded within 30 sec after the start of load sequencing.
To ensure rapid start, the units are equipped with water jacket and lube
-oil heating. A prelube pump circulates the oil when a unit is not running. The units are located in heated rooms.
Audible and visual alarms are located in the control room and in the diesel generator building.
Alarms on the electrical annunciator panels in the control room are:
- 1. Diesel-generator trouble.
- 2. Diesel-generator oil storage tank low level.
- 3. 21 Diesel-Generator Trouble.
- 4. 22 Diesel-Generator Trouble.
- 5. 23 Diesel-Generator Trouble
- 6. Diesel-Generator Service Water Flow Low
The activation of the emergency diesel generator trouble alarm in the control room will be caused by the initiation of any of the following alarms in the diesel generator building:
- 1. Low oil pressure.
- 2. Differential fuel strainer, secondary.
- 3. Overcrank.
- 4. High differential lube
-oil strainer.
- 5. High water temperature.
- 6. High differential pressure lube
-oil filter.
IP2 FSAR UPDATE Chapter 8, Page 20 of 30 Revision 2 6, 2016 7. High-high jacket water temperature.
- 8. Deleted. 9. Overspeed.
- 10. Overcurrent.
- 11. Low fuel oil level, day tank.
- 12. Reverse power.
- 13. Low start air pressure.
- 14. Exciter field shutdown. 15. High/Low lube
-oil temperature.
- 16. High differential pressure primary filter.
- 17. Deleted. The diesel
-generator oil storage tank low level alarm will be energized on a low level in any one of the three fuel
-oil storage tanks.
The alarms "21 Diesel-Generator Trouble", "22 Diesel
-Generator Trouble", and "23 Diesel
-Generator Trouble" located on Panel SG in the Central Control Room will be activated respectively by the following conditions at each EDG local control panel:
- 1. Loss of DC control powe
- r. 2. Engine control switch position (Off or Manual).
- 3. Breaker control switch position pulled
-out [Note - the breaker control switch in the CCR will activate the "Safeguards Equipment Locked Open" alarm (Window 1
-8 on Panel SB
-1) in the CCR].
- 4. Engine stop solenoid energized.
- 5. Day tank level low, primary and backup fuel pump fails to start.
- 6. For 23 diesel
-generator trouble only, loss of voltage on EDG 23 auxiliary load main feed.
There are six electrical contacts, each of which when activated will energize a diesel
-generator lockout relay. This lockout relay will, in turn, cause a diesel to shut down if it is operating or will prevent the diesel from responding to an automatic emergency start signal. These contacts are activated by one of the following conditions:
- 1. Activation of the diesel emergency stop push
-button in the diesel
-generator building.
- 2. Activation of the overcurrent relay. A phase
-to-phase fault or excessive loads on the diesel generator will operate this relay.
- 3. Activation of the reverse power relay.
- 4. Activation of the overcrank relay. If a diesel engine fails to attain speed within 13 sec, this relay will be energized.
- 5. Activation of the overspeed relay. When the mechanical governor senses 1070 rpm, this relay will be energized.
- 6. Activation of the low oil pressure relay. This relay is energized by the coincident sensing of lube
-oil pressure below 60 psi by two of the three oil pressure switches for each diesel. An oil pressure timer is set to allow 20 sec to pass IP2 FSAR UPDATE Chapter 8, Page 21 of 30 Revision 2 6, 2016 before tripping the diesel engine lockout relay. This circuit is designed to provide sufficient time for the oil pressure to build up following an engine start.
A safety injection signal will prevent the first three conditions from energizing the diesel engine lockout relay and tripping the diesel generator. Activation of any one of the latter three relays will cause a diesel to stop even when a safety injection signal is present. Shutdown permits corrective action to be taken before the engine is damaged, and the diesel generator can then be returned to normal operation. Once any of these six electrical contacts has been activated causing the diesel engine lockout relay to energize, the lockout relay must be manually reset locally before the diesel can be started.
8.2.3.2 Emergency Fuel Supply Each of the three emergency diesel generators has its own 175
-gal fuel-oil day tank plus an underground bulk storage supply tank and uses diesel oil Specification Number 2. Each day tank is located within the diesel-generator building and supplies its respective engine
-mounted fuel-oil pump. The day tank is automatically filled during engine operation from its separate underground storage tank located outside adjacent to the diesel
-generator building. Each storage tank has a capacity of 7700 gal and is provided with a motor
-driven transfer pump mounted in a manhole opening above oil level. Each pump can be aligned to discharge into the common normal or emergency makeup line to all three diesel
-generator fuel
-oil day tanks. If a low level is detected in the day tank for diesel generator 21, transfer pump 21 will automatically start to refill the tank to approximately 158 gal. If pump 21 fails to refill the day tank, transfer pump 22 will receive an automatic starting signal as a backup to the primary pump. In a similar manner, transfer pump 22 receives an automatic starting signal on low level in the day tank for diesel 22 and is backed up by transfer pump 23. Transfer pump 23 starts on low level in the day tank for diesel generator 23 and is backed up by transfer pump 21.
Each diesel oil transfer pump stops automatically when 15.5
-in. of oil remains in the associated underground tank which equates to a maximum of approximately 7000
-gal of available fuel oil per tank. A minimum fuel storage of 19,000 gal (i.e., approximately 6340 gal per tank) is maintained in the three underground storage tanks.
The 19,000 gal of storage ensures that two diesels can operate for at least 73 hours8.449074e-4 days <br />0.0203 hours <br />1.207011e-4 weeks <br />2.77765e-5 months <br /> at the maximum load profile permitted by the diesels' ratings. If one of the three storage tanks is not available, there is sufficient fuel oil to run two diesels at the maximum load profile for at least 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />. Similarly, if three diesels are available, there is sufficient fuel oil in the three storage tanks for at least 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> of operation at the maximum load profile. These values are based on the use of No. 2 diesel fuel oil at the lowest density of 6.87 lb/gal and engine fuel oil consumption rates based on operating at each load rating. For heavier oil, the time would be increased proportionally to the ratio of 6.87 lb/gal and the actual fuel density. An upper limit of 7.39 lb/gal is common for No. 2 diesel oil.
Additional fuel oil suitable for the diesel engines is stored on the site and at Buchanan substation. A minimum additional storage of 29,000 gal is maintained in the storage tanks dedicated for diesel
-generator use. This storage is sufficient for operation of two diesels for at least 111 hours0.00128 days <br />0.0308 hours <br />1.835317e-4 weeks <br />4.22355e-5 months <br /> at the maximum load profile permitted by the diesels' ratings. As previously mentioned (Section 8.2.1), commercial oil supplies and trucking facilities exist to ensure deliveries on one day's notice.
IP2 FSAR UPDATE Chapter 8, Page 22 of 30 Revision 2 6, 2016 The basis for the minimum total required fuel oil quantity of 48,000 gallons is to provide for operation of two diesel generators for 7 days. The specified minimum quantity of fuel oil is based on operation of two diesel generators for 7 days at the maximum load profile permitted by the diesel generator rating. Each diesel is rated for operation for 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of operation out of any 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 2300 kW plus 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of operation out of any 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at 2100 kW with the remaining 21.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of operation of any twenty four hours at 1750 kW. Operation of the diesel generators at the maximum load profile ratings bounds the postulated accident load profile. If one EDG storage tank or transfer pump is unavailable, the remaining tanks or pumps with the additional 29,000 gallons of fuel oil can operate two diesels at the maximum load profile permitted by the diesel generator rating for at least 160 hours0.00185 days <br />0.0444 hours <br />2.645503e-4 weeks <br />6.088e-5 months <br />.
8.2.3.3 Emergency Diesel Generator Separation The emergency diesel generators are located in a sheet metal, steel
-framed building immediately South of the Primary Auxiliary Building.
The diesel generators are arranged parallel to each other on 13
-ft centers, with approximately 10 ft of clear space between engine components. The engine foundations are surrounded by a 1 foot
-high concrete curb containing sufficient volume to hold all the lube-oil or fuel released from a single engine in the event of an inadvertent spill or line break.
Diesel generator separation and fire protection features necessary to meet the criteria of 10 CFR 50.48 are described in the document under separate cover entitled, "IP2 Fire Hazards Analysis". A control panel, which contains relays and metering equipment for all three diesel generators is located on the west end of the building. The panels are compartmentalized with controls for each engine separated from each other. The compartmentalized design minimizes the potential spread of fire to other electrical components. A reinforced
-concrete wall separates the diesel generators from the control panel.
Based on the engine manufacturer's case histories of engine failures, missile protection between machines is not considered necessary. Field case histories disclose a complete absence of damage to the engine environs as a result of engine component failure. Engine failures, usually the result of extreme operating conditions, can be classified as follows:
- 1. Stuck valve.
A valve sticks open and is struck by the piston. The damaged valve, and possibly part of the piston, enters the exhaust manifold, damages the turbo
-charger, and passes harmlessly up the stack. There is no record of a damaged piston generating a missile external to the engine.
- 2. Piston seizure.
A piston seizure causes bending and eventual fracture of the connecting rod. All damaged parts remain inside the engine block.
- 3. Turbo-charger failure. A turbo-charger wheel fouls the casing as a result of overspeed or overheat. The robust double
-walled casing contains all parts.
IP2 FSAR UPDATE Chapter 8, Page 23 of 30 Revision 2 6, 2016 4. Engine overspeed.
The engine's normal operating speed is 900 rpm. Overspeed trips shut off the fuel at each individual fuel injection pump. No cast iron is used in the engine block or base so even if the overspeed trip failed, the engine structure, which is not brittle by nature, would contain any fracture parts. Isolated cases of crank shaft fractures have not resulted in flying missiles.
- 5. Cylinder head failure.
Cylinder heads are secured to the block by high
-tensile studs. No cap gaskets are used between the head and cylinder liners. This prestressed design, which does not allow slackness to develop, has resulted in an assembly that has not had any incidents of heads flying off, even when failed pistons have pounded the heads. There are also cases on record of improperly timed engines resulting in excessively high firing pressures, over 2000 psi (normal pressure 1600 to 1700 psi), in which the heads have always remained intact.
Operating experience with the Alco engine indicates that internal missiles do not escape from the engine. Alco does not have any evidence of blades coming through the turbo casing. Valves from the engine have broken and been exhausted through the turbo and caused damage to the turbo, but are contained within the casing. There is no evidence of connecting rods escaping from the engine.
To generate any flying parts, the generator would have to be in an overspeed condition beyond what is normally possible with a diesel engine. The construction of the stator windings and stator barrel frame would have to be penetrated by a rotor part in order to escape. The rugged construction of each complements its ability to contain flying objects.
Since the engine has overspeed trips and would not operate much beyond this speed because the valves would hang up, it is concluded that the generator would never reach any critical speeds. 8.2.3.4 Loading Description Each emergency diesel
-generator unit is started on the occurrence of either of the following incidents:
- 1. Initiation of a safety
-injection signal.
- 2. Undervoltage on any 480
-V switchgear bus.
On safety injection or undervoltage on any bus, the engines run at idle and can be connected to deenergized buses by the operator from the control room. Upon blackout (loss of power to bus 5A or 6A) plus unit trip (with no SI), the emergency diesel
-generators will be automatically connected to de-energized buses and sequentially loaded, but will continue to idle for live buses. Upon the activation of a safety injection (SI) signal and blackout (loss of power to bus 5A or 6A) plus unit trip, automatic load sequencing is initiated as follows:
IP2 FSAR UPDATE Chapter 8, Page 24 of 30 Revision 2 6, 2016 1. All 480-V switchgear feeder breakers, except those supplying motor control centers 26A/26AA, 26B/26BB, 26C, and 211 are tripped on undervoltage and all automatically operated non
-safeguard feeder breakers are locked out. (Note - All engineered safeguards motors are supplied from the 480
-V system.)
- 2. The emergency diesel generators are connected to their respective buses. [Note
- An alarm (safeguards equipment locked open) will be energized in the Central Control Room if any control switch for the EDG breakers is in the "pull
-out" position.]
- 3. Required engineered safeguards are sequentially started. The list of loads is shown in Table 8.2
-2.
- 4. The operators may energize Motor Control Centers 24A, 27A, and 29A (which feed equipment required for safe shutdown and accident mitigation) and their loads as required.
In an August 11, 1980 response to the NRC's February 11, 1980 Confirmatory Order, Consolidated Edison determined and evaluated the design differences between Indian Point Units 2 and 3 for automatic starting and sequential loading of the emergency diesel generators (EDGs). Whereas the Unit 3 EDGs are automatically connected to supply the 480
-V emergency busses on an undervoltage signal, the Unit 2 EDGs will only supply the 480
-V emergency busses on a 480
-V bus undervoltage signal coincident with a safety injection or a unit trip signal. Each EDG receives automatic starting and sequential loading signals from both control logic Trains. The additional coincidence logic does not preclude manual starting and loading of the EDGs by the operators, and in the absence of a safety injection or unit trip signal, the steam generator water inventory and the steam
-driven auxiliary feedwater pump provide sufficient time for such operator action. Consolidated Edison presented each design difference and justification to the NRC (References 2, 3). The NRC reviewed these design differences and corresponding justifications and determined the Unit 2 design to be acceptable in their safety evaluation report (Reference 4).
Load sequencing for the emergency diesel generators during the safety
-injection phase of a loss-of-coolant accident is described in References 5 and 6. The logic diagrams for the starting of the emergency diesel
-generators and the safeguards sequence are presented in Plant Drawings 225100 and 225101 [Formerly UFSAR Figures 7.2
-7 and 7.2-8].
The recirculation phase is initiated manually by control switches on the supervisory panel in the control room as described in Section 6.2.2.1.4.
Loading studies show that the loads on the emergency diesel generators are maintained within their ratings for large loss
-of-coolant accidents (as described above), small
-break loss
-of-coolant accidents, steamline breaks, steam generator tube ruptures, and spurious safety-injection actuations.
Studies have also shown that, in the event of loss of both offsite and SBO / Appendix R Diesel power, one emergency diesel generator can provide adequate power to bring the plant to cold shutdown.
Tests performed on the emergency power system to verify proper response within the required time limit are detailed in the Technical Specifications. See Section 8.5, Tests and Inspections.
IP2 FSAR UPDATE Chapter 8, Page 25 of 30 Revision 2 6, 2016 8.2.3.5 Batteries and Battery Chargers Each of the four battery installations is composed of 58 individual lead
-calcium storage cells connected to provide a nominal terminal voltage of 125
-V DC. Each battery is fed from a separate charger and each charger is fed from a separate AC power panel. Each battery bus is equipped with a sensitive
-type undervoltage relay, which provides alarm/indication of an undervoltage condition. Ground alarms are also provided on each board. Improved status indication of the battery chargers and the direct current system has been provided by segregating the battery charger alarms into four ground alarms and by providing four DC bus trouble alarms, which include an input for low battery terminal voltage. Loads on each battery are shown on Plant Drawings 208501 and 9321
-3008 [Formerly UFSAR figures 8.2
-15 and 8.2
-16]. Loads on the 118
-V vital alternating current instrument buses are shown on Plant Drawings 208502 and 208503 [Formerly UFSAR figures 8.2
-13 and 8.2
-14]. Each battery has been sized to carry its expected shutdown loads for a period of 2 hr following a plant trip and a loss of all AC power. All equipment supplied by the batteries are maintained operable with minimum expected voltages at the battery terminals during the 2 hrs. Each of the four battery chargers has been sized to recharge its own discharged battery within 15 hrs while carrying its normal load.
Seismic design considerations have been adequately included in the design of the battery racks. Stress analyses of these racks assumed worst case conditions of static and dynamic loads in the vertical, horizontal transverse, and horizontal longitudinal direction; stresses were all within allowable values.
8.2.3.6 Reliability Assurance
The electrical system equipment is arranged such that no single accident or incident can inactivate enough safeguards equipment to jeopardize plant safety. The 480
-V equipment is arranged on four buses. The 6.9
-kV equipment is supplied from six buses.
The plant auxiliary equipment is arranged electrically so that redundant items receive power from different sources.
The charging pumps are supplied from 480
-V buses 3A, 5A, and 6A. The six service water pumps and the five containment fans are divided among the four 480
-V buses. Valves are supplied from motor control centers 26A/26AA and 26B/26BB, which are supplied from buses 5A and 6A, respectively.
The outside source of power is adequate to run all normal operating equipment. The 138/6.9
-kV station auxiliary transformer can supply all the auxiliary loads.
The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries.
Two diesel generators have enough capacity to start and run a fully loaded set of engineered safeguards equipment. These safeguards can adequately cool the core for any loss
-of-coolant incident and maintain the containment pressure within the design value.
The power supplies to the diesel generators' auxiliary equipment are arranged so that each diesel generator will feed its own auxiliary equipment.
IP2 FSAR UPDATE Chapter 8, Page 26 of 30 Revision 2 6, 2016 A total loss of DC feed to the switchgear and associated equipment will not cause a loss of offsite power through an inadvertent tripping of the Indian Point Unit 2 light and power supply circuit breakers, because DC is required to trip a breaker. Loss of DC feed to protective relaying will cause an alarm condition rather than initiation of a protective action. If necessary, the light and power circuit breakers in the Buchanan substation may be tripped manually at the breaker mechanisms.
Each independent battery installation is maintained under continuous charge by its associated self-regulating battery charger so that the batteries will always be at full charge in anticipation of a loss-of-ac-power incident. This ensures that adequate DC power will be available for starting and loading the emergency diesel generators and for other emergency uses.
The equipment arrangement in the Indian Point Unit 2 Central Control Room is discussed in Section 7.7.
REFERENCES FOR SECTION 8.2
- 1. Letter (with attachments) from S. A. Varga, NRC, to W. J. Cahill, Jr., Con Edison, Safety Evaluation Indian Point Unit 2 - Proposed Modification of the 125V DC Battery System, Dated May 2, 1980
- 2. Letter from William J. Cahill, Consolidated Edison, to Harold R. Denton, NRC, "Confirmatory Order", dated May 9, 1980
- 3. Letter from John D. O'Toole, Consolidated Edison, to Steven A. Varga, NRC, "Confirmatory Order", dated May 27, 1982
- 4. Letter from Steven A. Varga, NRC, to John D. O'Toole, Consolidated Edison, "Confirmatory Order", dated December 1, 1982.
- 5. "Emergency Diesel Generator Loading Study for Indian Point Unit 2," FEX-00039, Rev.3
- 6. Letter from Westinghouse to Entergy, IPP 187, "EDG Load Study Reconciliation," November 13, 2003.
IP2 FSAR UPDATE Chapter 8, Page 27 of 30 Revision 2 6, 2016 TABLE 8.2-1 Deleted TABLE 8.2-2 Diesel Generator Loads LOAD D.G. 21 (BUS 5A) D.G 22 (BUS 2A-3A) D.G. 23 (BUS 6A) 1. Auxiliary component cooling pumps 1 1 2. Safety injection pumps 1 1 1 3. Residual heat removal pumps 1 1 4. Nuclear service water pumps 1 1 1 5. Containment air recirculation cooling fans 2 2 1 6. Auxiliary feedwater pumps 1 1 7. Spray pumps (if start signal present) 1 1 TABLES 8.2-3 & 8.2-4 Deleted IP2 FSAR UPDATE Chapter 8, Page 28 of 30 Revision 2 6, 2016 8.2 FIGURES Figure No.
Title Figure 8.2-1 Electrical One
-Line Diagram, Replaced with Plant Drawing 250907 Figure 8.2-2 Electrical Power System Diagram, Replaced with Plant Drawing 250907 Figure 8.2-3 Main One-Line Diagram, Replaced with Plant Drawing 208377 Figure 8.2-4 345-KV Installation at Buchanan Figure 8.2
-5 6900-V One-Line Diagram, Replaced with Plant Drawing 231592 Figure 8.2
-6 480-V One-Line Diagram, Replaced with Plant Drawing 208088 Figure 8.2-7 Single Line Diagram 480
-V Motor Control Centers 21, 22, 23,25, 25A, Replaced with Plant Drawing 9321
-3004 Figure 8.2
-7a Single Line Diagram - 480-V Motor Control Centers 24 and 24A , Replaced with Plant Drawing 249956 Figure 8.2-8 Single Line Diagram - 480-V Motor Control Centers 27 and 27A , Replaced with Plant Drawing 9321
-3005 Figure 8.2-9 Single Line Diagram - 480-V Motor Control Centers 28 and 210 , Replaced with Plant Drawing 208507 Figure 8.2
-9a Single Line Diagram - 480-V Motor Control Centers 29 and 29A , Replaced with Plant Drawing 249955 Figure 8.2
-10 Single Line Diagram - 480-V Motor Control Centers 28A and 211 , Replaced with Plant Drawing 208241 Figure 8.2
-11 Single Line Diagram - 480-V Motor Control Centers 26A and 26B , Replaced with Plant Drawing 9321
-3006 Figure 8.2
-11a Single Line Diagram - 480-V Motor Control Center 26C, Replaced with Plant Drawing 248513 Figure 8.2
-12 Single Line Diagram - 480-V Motor Control Centers 26AA and 26BB and 120-V AC Panels No. 1 and 2, Replaced with Plant Drawing 208500 Figure 8.2
-13 Single Line Diagram - 118-VAC Instrument Buses No. 21 thru 24 , Replaced with Plant Drawing 208502 Figure 8.2
-14 Single Line Diagram - 118-VAC Instrument Buses No. 21A thru 24A, Replaced with Plant Drawing 208503 Figure 8.2
-15 Single Line Diagram - DC System Distribution Panels No. 21, 21A, 21B, 22, and 22A, Replaced with Plant Drawing 208501 Figure 8.2
-16 Single Line Diagram - DC System Power Panels No. 21 thru 24 , Replaced with Plant Drawing 9321
-3008 Figure 8.2
-17 Single Line Diagram of Unit Safeguard Channeling and Control Train Development, Replaced with Plant Drawing 208376 Figure 8.2
-18 Cable Tray Separations, Functions, and Routing, Replaced with Plant Drawing 208761
IP2 FSAR UPDATE Chapter 8, Page 29 of 30 Revision 2 6, 2016 8.3 ALTERNATE SHUTDOWN SYSTEM
The Indian Point Unit 2 alternate safe shutdown system provides the necessary functions to maintain the plant in a safe shutdown condition following a fire that damages the capability to power and control essential equipment from normal and emergency Indian Point Unit 2 sources.
In the unlikely event of a major fire or other external event affecting redundant cabling or equipment in certain areas, electrical power could be disrupted to safe shutdown components and systems. However, following the unlikely loss of normal and preferred alternate power, additional independent and separate power supplies from the Indian Point Unit 1 440
-V switchgear are provided for a number of safe shutdown components.
An independent SBO / Appendix R diesel generator is provided to power the Unit 1 440
-V switchgear in the unlikely event of loss of offsite power to Unit 1 switchgear. In addition, there is provision to cross
-connect the Unit 3 SBO / Appendix R diesel generator to the Unit 2 alternate shutdown loads; and Unit 2 SBO / Appendix R diesel generator to Unit 3 alternate shutdown loads. The Indian Point Unit 2 SBO / Appendix R diesel generator set is manufactured by Cummins Power Generation with a rating of 2700 kW (Standby Rating), 13.8 kV, 3 Phase, 60 Hertz, 1800 RPM, for operation on diesel fuel. The output of the generator is connected to SBO / Appendix R 13.8 kV Switchgear bus via circuit breaker SBO / Alternate Safe Shutdown (ASS) located at diesel generator breaker switchgear. The SBO / Appendix R 13.8 kV Switchgear section has two (2) feeder circuit breakers, ASS and SBO high (SBOH). The ASS breaker feeds the existing Unit 1 13.8 kV L&P Bus Section 3 in order to provide power to ASS System loads. The SBOH breaker feeds a 13.8 kV - 6.9 kV, 3750 KVA SBO transformer, that in turn feeds the 6.9 kV section of the SBO / Appendix R Switchgear via circuit breaker SBO low (SBOL). This breaker then feeds power to the plant 6.9 kV electrical distribution system via breakers GT
-25 and GT-26. In addition, there is provision to cross
-connect the Unit 3 SBO / Appendix R diesel generator to the Unit 2 alternate shutdown loads; and Unit 2 SBO / Appendix R diesel generator to Unit 3 alternate shutdown loads.
The SBO / Appendix R diesel generator and associated switchgear, fuel supply and breakers shall be operable and tested in accordance with the TRM.
A detailed description of the alternate safe shutdown system including its functions, components, and operation is provided in the document under separate cover entitled, "IP2 10 CFR 50, Appendix R Safe
-Shutdown Separation Analysis."
8.3 FIGURES
Figure No.
Title Figure 8.3
-1 Deleted IP2 FSAR UPDATE Chapter 8, Page 30 of 30 Revision 2 6, 2016 8.4 MINIMUM OPERATING CONDITIONS
The electrical system is designed such that no single contingency can inactivate enough safeguards equipment to jeopardize plant safety. The minimum operating conditions define those conditions of electrical power availability necessary (1) to provide for safe reactor operation and (2) to provide for the continuing availability of engineered safety features. The facility Technical Specifications, Section 3.8, include minimum operating conditions covering the following plant conditions:
- 1. Minimum electrical conditions for reactor criticality.
- 2. Minimum electrical conditions during power operation.
8.5 TESTS AND INSPECTIONS
Emergency Diesel generators are tested in accordance with technical specification requirements. The tests specified are designed to demonstrate that the emergency diesel generators will provide power for the operation of equipment. They also ensure that the emergency generator system controls and the control systems for safeguards equipment will function automatically in the event of a loss of all normal 480
-V AC station service power.
The testing frequency specified is often enough to identify and correct deficiencies in systems under test before they can result in a system failure. The fuel supply and starting circuits and controls are continuously monitored and any faults are alarm indicated. An abnormal condition in these systems would be signaled without having to place the emergency diesel generators on test. The Emergency Diesel Generators will be inspected in accordance with a licensee controlled maintenance program. The maintenance program will require inspection in accordance with the manufacturer's recommendation for this class of standby service. Changes to the maintenance program will be controlled under 10 CFR 50.65
Station batteries will deteriorate with time, but precipitous failure is extremely unlikely. The surveillance specified is that which has been demonstrated over the years to provide an indication of a cell becoming unserviceable long before it fails. The periodic voltage and specific gravity measurements will ensure that the ampere
-hour capability of the batteries is maintained.
The 'refueling interval' load test for each battery, together with the visual inspection of the plates, will assure the continued integrity of the batteries. The batteries are of the type that can be visually inspected, and this method of assuring the continued integrity of the battery i s proven standard power plant practice.
The SBO / Appendix R diesel and support systems shall be tested and have surveillances in accordance with the TRM. These tests and surveillances are designed to assure that the SBO / Appendix R diesel will be available to provide power for operation of equipment, if required.