LR-N17-0034, Salem Generating Station, Units 1 & 2, Revision 29 to Updated Final Safety Analysis Report, Section 6.3, Emergency Core Cooling System
Text
6.3 EMERGENCY CORE COOLING SYSTEM 6.3.1 Design Bases 6.3.1.1 Range of Coolant Ruptures and Leaks The Emergency Core Cooling System (ECCS) automatically delivers cooling water to the reactor core in the event of a loss-of-coolant accident (LOCA). This limits the fuel clad temperature and thereby ensures that the core will remain substantially intact and in place, with its essential heat transfer geometry preserved. This protection is afforded for: L All pipe break Coolant System sizes and locations in the Reactor (RCS) up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends. 2. A loss of coolant associated with the rod ejection accident. 3. Pipe breaks in the steam system, up to and including the instantaneous circumferential rupture of the largest pipe in the steam system. 4. A steam generator tube rupture. The criteria for LOCA evaluations are defined in Section 15. Furthermore, for the rupture of any steam or feedwater line, the criteria are: 1. Assuming a stuck rod cluster control assembly (RCCA), with or without offsite power, and assuming a single failure in the engineered safety features, there is no 6.3-1 SGS-UFSAR Revision 6 February 15, 1987
- 2. consequential damage to the primary system, and the core remains substantially in place and intact. Energy released to the containment from the worst steam pipe break does not cause failure of the containment structure. 3. Assuming a stuck RCCA, there will be no return to criticality after reactor trip, for a break equivalent to the spurious opening, with failure to close, of the largest of any single relief or safety valve. Redundancy and segregation of instrumentation and components are incorporated to assure that postulated malfunctions will not impair the ability of the system to meet the design objectives. The system is effective in the event of loss of normal station auxiliary power coincident with the loss of coolant, and is tolerant of failures of any single component or instrument channel to respond actively in the system. During the recirculation phase of a loss of coolant, the system is tolerant of a loss of any part of the flow path since backup alternative flow path capability is provided. 6.3.1.2 Fission Product Decay Heat The ECCS removes the stored and fission product decay heat from the reactor core such that fuel rod damage, to the extent that it would impair effective cooling of the core, is prevented. The acceptance criteria for accidents, as well as accident analyses, are provided in Section 15. 6.3.1.3 Reactivity Required for Cold Shutdown The ECCS provides shutdown capability for the accidents noted above by means of shutdown chemical (boron) injection. The most critical accident for shutdown capability is the steam line break. Following a steam line break, the RCS, in response to the apparent 6.3-2 SGS-UFSAR Revision 6 February 15, 1987 load increase, would increase reactor power. For larger breaks) an overpower reactor trip would occur. Continued secondary steam blowdown would cool the reactor coolant causing a positive reactivity insertion. Analyses described in Section 15 indicate that breaks large enough to produce a reactivity insertion sufficient to cause a return to criticality also produce sufficient depressurization and shrinkage of the primary coolant to initiate safety injection. The high pressure delivery of concentrated boric acid by the centrifugal charging pumps then re-establishes adequate shutdown margin even for the case where the highest worth control rod is stuck in the fully withdrawn position. 6.3.1.4 Capability to Meet Functional Requirements In order to ensure that the ECCS will perform its desired function during the accidents listed above, it is designed to tolerate a single active failure during the short-term immediately following an accident, or to tolerate a single active or passive failure during the long-term following an accident. The ECCS is designed to meet its minimum required level of functional performance with either onsi te electrical power system operation (assuming offsite power is not available) or with offsite electrical power system operation for any of the above abnormal occurrences assuming a single failure as defined above. Portions of the system located within the containment are designed to operate under the most adverse accident conditions without benefit of maintenance and without loss of functional performance for the duration of time the component is required following the accident. The ECCS is qesigned to perform its function of ensuring core cooling and providing shutdown capability following an accident under simultaneous safe shutdown earthquake loading. 6.3-3 SGS-UFSAR Revision 6 February 15, 1987 6.3.2 System Design 6.3.2.1 Schematic Piping and Instrumentation Diagrams The flow diagram of the ECCS is shown on Plant Drawings 205234 and 205334. The codes and standards to which the individual components of the ECCS are designed are listed in Table 6.3-1. Pertinent design and operating parameters for the components of the ECCS are given in Tables 6.3-2 through 6.3-5. The operation of the ECCS, following a LOCA, can be divided into two distinct phases: 1) the injection phase, in which any reactivity increase attending the accident is terminated, initial cooling of the core is accomplished, and coolant lost from the primary system is replenished, and 2) the recirculation phase, in which long-term core cooling is provided during the accident recovery period. A discussion of each phase is given below. Injection Phase of Operation The major equipment involved in the implementation of the injection phase functions are:
- 1. Two centrifugal charging pumps 2. Two safety injection pumps 3. Two residual heat removal (RHR) pumps 4. Four accumulators (one for each loop) 5. One boron injection tank (BIT)* 6. Refueling water storage tank (RWST) BIT only functions as part of pressure boundary within the safety injection path. 6.3-4 SGS-UFSAR Revision 27 November 25, 2013
---.. 7. Associated valves and piping The relative importance of the various pieces of injection equipment is dependent upon the size and location of the prtmary system break. For a large break, the accumulators represent the principal injection mechanism. They are the first piece of equipment to be effective. (For the double-ended cold leg break, they begin to inject approximately 10 seconds after the break, whereas the remainder of the system has a time delay associated with it on the order of 25 seconds). They deliver at a very high flow rate (approximately 47,000 qpm maximum for a double-ended break versus a maximum of 2, 400 gpm for the rem.ainder of the system). The accumulators, utilizing the stored energy of the compressed nitrogen, inject borated water into the cold legs of the reactor coolant piping when the prtmary system pressure falls below 600 psig. One accumulator is provided for each cold leg of the RCS. They are located inside the containment but outside the missile barrier and are therefore protected against possible missiles. Accumulator water level can be adjusted remotely during normal power operation. Borated makeup water from the RWST is added using a safety injection pump. Water level is reduced by draining to the Chemical and Volume control System (CVCS) holdup tanks. Samples of the solution in the accumulator tanks are taken at the sampling station for periodic checks of boron concentration. Proviaions are also included for remote nitrogen makeup. The accumulators are passive components of the injection system because they require no external source of power or aignal in order to function. The remainder of the major pieces of equipment comprising the Safety Injection system (SIS) are active components which are actuated by any of the following aafety injection signals: 1. Low pressurizer pressure (2/3) 2. High containment pressure (2/3 Hi) 6.3-S SGS-UFSAR Revision 6 February 15, 1987
- 3. High steam line differential pressure between any two steam generators (2/3) 4. High steam line flow in two of four lines (l/2 measurements per line) in coincidence with either low-low T (2/4) or low steam line avg pressure (2/4) 5. Manual actuation (1/2). The safety injection signal initiates a reactor trip (this may have already occurred), starts the diesel generators, and initiates the safeguards sequence, which in turn initiates the required action. Finally, a safety injection signal will produce a Phase A containment isolation signal, which results in the closure of the majority of the automatic containment isolation valves. The active components serve three functions during the injection phase: 1. Provide rapid injection of borated water as a shutdown chemical (boron dissolved in the form of boric acid). 2. Complete the reflooding process for large area ruptures where the initial refill is accomplished by the accumulators. 3. Provide injection for small area ruptures where the primary coolant pressure does not drop below the accumulator pressure for an extended period of time. In accident analyses with coincident loss of outside power, full flow from the SIS occurs at no later than 25 seconds. The basis of this value is discussed in a later section. This delay time is independent of whether or not the accumulators have injected. 6.3-6 SGS-UFSAR Revision 16 January 31, 1998 During safety injection, the centrifugal charging pumps deliver borated water at the prevailing Res pressure to the four cold legs of the RCS. The injection points are separate from those used by the accumulators. The safety injection path is through the BIT. The BIT contains diluted boric acid at the same concentration range as RWST (0 to 2500 ppm). The BIT is normally isolated on the inlet and outlet lines from the cold legs by parallel motor operated gate valves, Both Unit 1 and Unit 2 BIT inlet and outlet isolation valves receive a safety injection signal. However, the diluted boric acid in the BIT is not credited for accident mitigation. The safety injection signal also operates motor-operated valves which transfer the suction of the centrifugal charging pumps from the volume control tank to the RWST. The safety injection pumps take suction from the RWST and deliver borated water to four cold legs via the accumulator discharge lines. These pumps develop a maximum discharge pressure of about 1520 psig at shutoff, and as a result, deliver to the primary system only after its pressure is reduced below this value. Prior to this, they recirculate water back to the storage tank. This limitation on discharge pressure does not significantly reduce the effectiveness of the safety injection pumps since any break of sufficient size to require safety injection will reduce the coolant pressure below 1500 psig. In the safety injection mode each of the RHR pumps takes suction from the RWST and delivers borated water to each of the four cold leg connections used by the safety injection pumps, i.e., via the accumulator discharge lines. To ensure that each RHR subsystem can meet this design requirement, the discharge cross tie valves, RH-19's, are required to be open. The RHR pumps deliver only when the RCS is depressurized to about 170 psig, All active components of the SIS, which operate during the injection phase of a LOCA, are located outside the Containment. The centrifugal charging, safety injection, and RHR pumps discussed above are all located in the Auxiliary Building. 6.3-7 SGS-UFSAR Revision 20 May 6, 2003 Changeover from Injection Phase to Recirculation Phase The sequence, from the time of the safety ection from ection to recirculation is as follows: 1. First, containment sump level indication shows that sufficient water is delivered to the containment floor to provide adequate submergence of the sump strainer modules and to provide the net positive suction head (NPSH) required for the RHR pumps to change to recirculation. 2. Second, the low-level alarm on the RWST sounds. The operator, at this point, takes appropriate action to switch over to recirculation. One spray pump continues to run until the RWST is nearly empty. The spray additive tank is isolated when the sodium hydroxide solution is depleted. 3. Finally, the low-low level alarm on the RWST sounds. At this time, the operator stops the spray pump. Spraying is continued at this time for approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> (Unit 1) and 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (Unit 2) using the RHR pumps pumping to the spray header located at the RHR heat The changeover from injection to recirculation is affected by the operator in the control room via a series of manual switching operations. The changeover sequence is given in Table 6.3-6. Recirculation Phase of Operation After the ection water collected in the containment sump is
- cooled and returned to the RCS by the low head/high head recirculation flow path. The RCS can be supplied simultaneously from the RHR pumps, and from a portion of the discharge from the residual heat exchangers that is directed to the charging pumps and safety injection pumps, which return the water to the RCS. The latter mode of operation assures flow in the event of a small rupture where the 'depressurization proceeds more slowly, such that the RCS pressure is still in excess of the shutoff head of the RHR pumps at the onset of recirculation. 6.3-8 SGS-UFSAR Revision 24 May 11, 2009 NRC issued Information Notice 87-631 which identified the possibility of unintended flow paths during the recirculation modes of operation1 which could increase RHR pump maximum flow potential. With "loop around" flow considered, the highest RHR pump flow was calculated to occur during the cold leg recirculation mode of *operation following a postulated failure of one of two operating RHR pumps. At approximately 14.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> (Unit 1) and 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (Unit 2) after the switchover to cold leg recirculation, hot leg recirculation will be initiated to assure termination of boiling. To ensure adequate flow performance, simultaneous flow delivery to the RCS cold legs and RCS hot legs are required. At a minimum, one safety injection pump is required to be aligned and operated in a hot leg recirculation flow mode. For a LOCA during Mode 4, with RCS cold leg temperature <312°F, a SI pump may not be available for the hot leg recirculation. In this instance, the RHR flowpath through RH26 would be utilized to provide hot leg recirculation. Since the injection phase of the accident is terminated before the RWST is completely emptied, all pipes are kept filled with water before recirculation is initiated. Water level indication and alarms on the RWST inform the operator that sufficient water has been injected into the containment to allow initiation of recirculation with the RHR pumps and to provide ample warning to terminate the injection phase while the operating pumps still have adequate NPSH. In addition, two level switches are provided inside the containment that provide a signal to the control room console when the water level in containment is sufficient to provide adequate submergence of the strainer modules and to provide adequate NPSH to the RHR pumps. Redundancy in the external recirculation loop is provided for by the inclusion of duplicate charging, safety injection, and RHR pumps and residual heat exchangers. Inside the containment, the High Pressure Injection System is divided into two separate flow trains. For cold leg recirculation, the charging pumps deliver to all four cold legs and the safety injection pumps also deliver to all four cold legs by separate flow paths. For hot leg recirculation, each safety injection pump delivers through separate paths to two reactor coolant loops. The low head pumps take suction through separate lines from the containment sump and discharge through separate paths to the RCS. The sump design provides adequate NPSH for the RHR pumps to operate in the recirculation mode. 6.3-9 SGS-UFSAR Revision 24 May 11, 2009 A debris interceptor is installed around the perimeter of each strainer to obstruct debris transport to the strainer. The debris interceptors consist of grating with 1/8" perforated plate attached to the downstream side of the grating. All debris is conservatively assumed to be transported to the debris interceptor or the even though there are some areas of the sump pool where debris would be stopped. The ECCS is not impacted by the debris passing downstream of the sump screen. The sump isolation valves are located in small steel-lined controlled leakage compartments. This arrangement contains any isolation valve leakage and assures that leakage during long-term recirculation will not impair the integrity of the containment or recirculation system. The containment sump is described in Section 6. 3. 2. 2. attention is paid to the design, materials, and fabrication of the sump, the suction piping, guardpipes, and isolation valves to provide assurance that the sump and piping will remain functional under the accident environment and continue to provide suction for the long-term recirculation. A sample connection is provided in the RHR System to remotely sample recirculated in the sample room during post-accident operations. Additives can be supplied to the sump through the plant design features within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from switchover to cold recirculation mode, if measurements indicate the sump liquid is outside the desired pH range of 7.0 to 10.0. A minimum sump liquid pH of 7.0 will minimize the for chloride induced stress corrosion cracking of stainless steel components (Reference 3). Note: Branch Technical Position MTEB 6.1 supports a lower limit of 7.0. 6. 3. 2. 2 ,Equipment and Component Description The major components of the ECCS are described below. Accumulators The accumulators are pressure vessels containing borated water and pressurized with nitrogen gas. During normal operation, each accumulator is isolated from the RCS by two check valves in series. Should the RCS pressure fall below the accumulator pressure, the check valves open and borated water is forced into the RCS. One accumulator is attached to each of the cold legs of the RCS. Mechanical operation of the swing disc check valves is 6.3-10 SGS-UFSAR Revision 24 May 11, 2009 the only action required to open the injection path from the accumulators to the core via the cold leg. The accumulators are passive engineered safety features because the gas forces inj action; no external source of power or signal transmission is needed to obtain fast-action, high-flow capability when the need arises. One accumulator is attached to each of the cold legs of the RCS. The design capacity of the accumulators is based on the assumption that flow from one of the accumulators spills onto the containment floor through the ruptured loop, and the flow from the remaining accumulators provides sufficient water to fill the volume outside of the core barrel below the nozzles, the bottom plenum, and a portion of the core. This assumption is based on no water remaining in the vessel after blowdown but takes credit for the water delivered by three accumulators. All the effects that could cause loss of accumulator water are evaluated in Section 15. The accumulators are carbon steel, clad with stainless steel and designed to ASME Section III, Class C. Connections for remotely draining or filling the fluid space during normal plant operation are provided. The accumulator design parameters are given in Table 6.3-2. The margin between the minimum operating pressure and design pressure provides a band of acceptable operating conditions within which the Accumulator System meets its design core cooling objectives. The band is sufficiently wide to permit the operator to minimize the frequency of adjustments in the amount of contained gas or liquid to compensate for leakage. The accumulator tank pressure and level are continuously monitored during plant operation and flow from the tanks can be checked at any time using test lines. 6.3-ll SGS-UFSAR Revision 6 February 15, 1987 : ., I t j I I I ' i \ ! f i I ' ' 't The accumulators and the safety injection piping up to the final isolation valve are maintained full of borated water at refueling water concentration while the plant is in operation. The accumulators and injection lines will be refilled with borated water as required by using the safety injection pump. Any excessive flow from the safety injection pumps can be recirculated back to RWST through a bypass line off the pump discharge header. Level and pressure instrumentation are provided for each accumulator tank. Boron Injection Tank The BIT contains between 0 to 2500 ppm boric acid solution and is connected to the discharge of the centrifugal charging pumps. Upon actuation of the safety injection signal, the flow from the centrifugal charging pumps is routed through the BIT into the RCS. Although the BIT is part of the safety injection pressure boundary, the diluted form of boric acid in the BIT is not credited for accident mitigation. The BIT is maintained in a 100-percent full condition. The BIT is kept 100% full administratively by filling and venting periodically using procedural c9ntrols. The parallel motor-operated gate valves at the inlet and outlet of the BIT are kept normally closed. The BIT pressure also can be monitored from the Control Room console. Chapter 15, Accident Analysis, conservatively assumes that the BIT is filled with unborated water (0-ppm boric acid) when analyzing core response, containment integrity, and equipment environmental qualification. 6.3-12 SGS-UFSAR Revision 20 May 6, 2003
- *
- The normal temperature of the BIT and its associated lines is at ambient temperature. Heaters in the BIT and associated line heat tracing are not required because of the low concentration of boric acid . Add:iJtionally, a permanently installed facility is provided to enable periodic checking of boric acid concentration in the BIT to ensure that it is within acceptable .levels. The equipment employed with the BIT is designed to the same quality standards and codes as the rest of the engineered safety features equipment and is Seismic Class I design. Refueling Water Storage Tank In addition to its usual service of supplying borated water to the refueling canal for refueling operations, the RWST provides borated water to the centrifugal charging pumps, safety injection pumps, RHR pumps, and the containment spray pumps for the LOCA. During normal power operation, storage water is valved to the suction of the ection pumps, RHR pumps, and 'containment spray pumps. The suction of the centrifugal charging pumps is automatically valved to the storage tank by a safety injection signal. The positive displacement charging pump has a dedicated suction line to the RWST that may be used to safe shutdown of the unit if it loses all charging capability . The minimum quantity of the RWST is 364, 500 and is based on the requirement for filling the refueling canal. This volume also provides a sufficient amount of borated water to meet the following conditions: 1. Adequate volume during the injection objective 6.3-13 SGS-UFSAR to meet ECCS design Revision 21 December 6, 2004
- 2. Increase the concentration of recirculation water to a point that assures no return to criticality with the reactor at cold shutdown and all control rods, except the most reactive rod cluster control assembly, inserted into the core 3. Fill the containment sump to permit the initiation of recirculation 4. Fulfill spray requirements The water in the tank is borated to a concentration that assures reactor shutdown by approximately 5 percent L\k/k when all rod cluster control are inserted and when the reactor is cooled down for refueling. The parameters are presented in Table 6.3-4. The RWST is classified Class I seismic design. This requires that there will be no loss of function or spillage of its contents for loads from* two times the design earthquake when combined with the normal loads. The effect of water sloshing within the tank is considered in determining the seismic loads. Compressive stresses in the shell of the tank are limited by allowable buckling .sLress:es, determined in a manner similar to Paragraph I-1150 of the ASME Code,Section III, The 20" diameter suction line reinforcement plate on the Salem Unit 1 RWST is defined as the pressure boundary (Reference 4). The tank shell does not function as the pressure boundary at the area covered by the plate. The tank is provided with a high-level alarm, and the overflow line is piped to the ked area around the No. 13 Chemical and Volume Control holdup tank, from where any overflow can be pumped to the Liquid Waste Disposal System. The overflow line includes a collection pot, which is also provided with a high level .alarm. Both alarms are indicated in the control room. 6.3-14 SGS-UFSAR 21 December 6, 2004 * * *
- *
- Anti-vortex plates are installed in the containment spray suction line from the RWST. Verification of vortex control in the containment sump is discussed in Section 6.3.4.4. The temperature of the water in the RWST is prevented from dropping below 32°F by automatic initiation of a Circulating and Heating System, which draws water from the tank through the Safety Injection System suction pipe and the Containment Spray System suction pipe. The water is then pumped through a heat exchanger located in the Auxiliary Building and enters the tank via the return line from the refueling water purification pump. Thus, the water in the tank and the water in the connecting piping is heated and circulated. The instrumentation that actuates the Heating System senses the temperature in the SIS suction pipe. This temperature is monitored and alarmed in the Control I Room. The system has provisions for local manual actuation. Electrical heat tracing is provided for the instrument connections to the tank and for that portion of the tank drain piping which could otherwise freeze. Thermal insulation is also provided for the exposed piping. Valves lSJ30 and 1SJ69 (in the RWST suction line to the ECCS pumps) are provided with the same type of redundant position indication as the accumulator discharge valves, described in Section 6.3.2.15. Residual Heat Removal Pumps The two RHR pumps are vertical electric motor driven single stage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or of equivalent corrosion resistant material. 6.3-15 SGS-UFSAR Revision 19 November 19, 2001 A minimum flow bypass line is provided for the pumps to recirculate through the residual heat exchangers and return the cooled fluid to the pump suction should these pumps be started with their normal flow paths blocked. Once flow is established to the RCS, the bypass prevents deadheading the pumps operation. line is automatically closed. This line and permits pump testing during normal Centrifugal Charging Pump The two centrifugal charging pumps are horizontal electric motor driven multistage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or equivalent corrosion-resistant material. Min-flow protection is provided during ECCS operation. Because these pumps operate during safety injection the min-flow valves, 1 (2) CV139 and 140, are procedurally controlled to be closed only for operation during abnormal or accident conditions. Safety Injection Pump The two safety injection pumps are horizontal electric motor driven multistage pumps. All parts of the pump in contact with the pumped fluid are stainless steel or equivalent corrosion-resistant material. A minimum flow bypass line is provided on each pump discharge to recirculate flow to the RWST in the event that the RCS pressure is above the shutoff head of the pumps. In Unit 1, a 100 gpm test line is provided in parallel to the min-flow line. This line is used for inservice testing and is locked out at other times. A similar 100 gpm test line is not provided in Unit 2. Pump Design, Materials, and Fabrication The pressure-containing parts of the pumps are stainless steel castings conforming to ASTM A-351 Grade CF8 or CF8M, stainless steel forgings procured per ASTM A-182 Grade F304 and F316, or carbon steel forgings to ASTM A-181, Grade 1, clad with austenitic steel. Parts fabricated of stainless plate are constructed to ASTM A-240, Type 304 or 316. All bolting material meets or exceeds ASTM A-193, A-194 and ASME SA-564 Grade 360 condition H1100 or other equally or greater rated fasteners. 6.3-16 SGS-UFSAR Revision 29 January 30, 2017 Materials such as weld-deposited Stellite or Colmonoy are used at points of close running clearances in Lhe pumps to prevent galling and to ehsure continued performance ability in high velocity areas subject to erosion. In other cases, wear points are of ASTM A-420 Grade stainless steel, heat treated to give the required antigalling properties. All pressure-containing parts of the pumps are chemically and physically analyzed and the results are checked to assure conformance with the American society for Testing and Materials' specification. In addition, all pressure-containing parts of the pump are liquid penetrant inspected in accordance with Appendix VIII of Section VIII of the ASME Code. The acceptance standard far the penetrant test is the ASME Pump and Valve Code. Pump is reviewed with special attention to the reliability and maintenance aspects of the working compone.nts. Specific areas include evaluation of the shaft seal and bearing design to determine that they are adequate for the specified service. During pump fabrication and installation, where welding of pressure-containing parts was necessary, a welding procedure including joint detail was submitted for review and approval by Westinghouse. This procedure included evidence of qualification necessary for compliance with Section IX of the ASME Code Welding Qualifications. This requirement also applied to any repair welding performed on pressure-containing parts. Subsequent to construction, Welding Procedure Specifications (WPS) are approved and in accordance to the current requirements of Section IX of the ASME and Pressure Vessel Code. The pressure-containing parts of the pump were assembled and hydrostatically tested to 1.5 times the design pressure for 30 minutes. Each pump v1as given a complete shop performance test in accordance with Hydraulic Institute Standards. The pumps were run at design flow and head, shut-off head and three additional points to verify 6. 3-17 SGS-OFSAR Revision 18 April 26, 2000 I performance characteristics. Where NPSH is critical, this value is established at design flow by means of adjusting suction pressure. A qualitative analysis shows that any flooding resulting from a leak in one pumping train will not incapacitate the redundant pump. Heat Exchangers The two residual heat exchangers of the RHR system cool the recirculated sump water. These heat exchangers are sized for the cooldown of the RCS. The design parameters of the heat exchangers are presented in Section 5.5. The residual heat exchangers are designed to the ASME Code and to conform to the requirements of the Tubular Exchanger Manufacturers' Association for Class R heat exchangers. Additional design and inspection provisions include: 1. Confined-type gaskets 2. General construction and mounting brackets sui table for the plant seismic design requirements 3. Tubes and tube sheet capable of withstanding full shell side pressure and temperature with atmospheric pressure on the tube side 4. Radiographic inspection in accordance with sections UW-11, UW-12-b, and UW52 of ASME Section VIII 5. Ultrasonic inspection in accordance with Paragraph N-324.3 of Section III of the ASME Code of all tubes before bending 6.3-18 SGS-UFSAR Revision 6 February 15, 1987
- 6. Penetrant in accordance with N-627 of Section III of the ASME Code of all welds and all hot or cold formed parts 7. A hydrostatic test duration of not less than 30 minutes 8. The witnessing of hydro and penetrant tests by a qualified inspector 9. A thorough final inspection of the unit for workmanship and the absence of any gouge marks or other scars that could act as stress concentration lO.A review of the radiographs and of the certified chemical and physical test reports for all material used in the unit. The residual heat exchangers are conventional vertical shell and 0-tube type units. The tubes are seal welded to the tube sheet. The shell connections are flanged to facilitate shell removal for and of the tube bundle. Each unit has a SA 515GR70 carbon steel shell, SA-213 TP-304 stainless steel tubes, SA-105 with Type 304 stainless steel channel cover and a tube sheet of forged steel SA-105 GR.III with 1/4-inch minimum TP-304 weld overlay. features to minimize valve include the 1. Other valves that are normally open, except those valves which a control function, are provided with backseats to limit stem leakage. 6.3-19 SGS-UFSAR Revision 18 April 26, 2000
- 2. Normally closed globe are installed with recirculation fluid pressure under the seat to prevent stem leakage of recirculated (radioactive) water. 3. Relief valves are enclosed, i.e., they are *provided with a closed bonnet and discharge to a closed system or the containment sump. 4. Control and motor valves (3 inches and above) exposed to recirculation flow may have double boxes and stem leakoff connections to the Waste Processing All parts of valves used in the SIS in contact with borated water are austenitic stainless steel or equivalent corrosion-resistant material. The motor operators on the injection line isolation valves are capable of rapid operation. All valves required for initiation of injection or isolation of the have remote limit position indication in the control room. Valving is specified for leak All valves, except those which perform a control function, are provided with backseats that are capable of limiting leakage to less than 1. 0 cc per hour per inch of stem diameter, assuming no credit taken for valve packing. Normally closed globe valves are installed with recirculation flow under the seat to prevent leakage of recirculated water through the valve stem packing. Relief valves discharge to an enclosed system or the containment sump. Control and valves, 3 inches and above that are to may be provided with double-packed boxes and stem leakoff connections which are piped to the Equipment Drain System. The check valves that isolate the ECCS from the RCS are installed near the reactor coolant piping to reduce the probability of an injection line rupture causing a LOCA. 6.3-20 SGS-UFSAR Revision 26 May 21, 2012 Portions of the ECCS piping are protected by relief valves. The relieving capacity of these valves is based on a flow several times greater than the expected leakage rate through the check valves. pressurizer relief tank. The valves relieve to the The RHR System is protected by four relief valves: one on the header from the RCS to the pumps, two on the cold leg injection headers, and one on the hot leg return header. These valves discharge to the containment sump. The gas relief valves on the accumulators protect them from pressures in excess of the design value. Motor-Operated Valves The pressure containing parts (body, bonnet, and discs) of the motor-operated valves employed in the SIS are designed per criteria established by the ANSI B16.5 or MSS SP66 specifications. The materials of construction for these parts are procured per ASTM Al82, F316 or A351, GR CFSM, or CFS. All material in contact with the primary fluid, except the packing, is austenitic stainless steel or equivalent corrosion-resistant material. The pressure-containing cast components are radiographed in accordance with ASTM E-94 and the acceptance standard as outlined in ASTM E-71. The body, bonnet, and discs are liquid penetrant inspected in accordance with ASME Pump and Valve Code. The liquid penetrant acceptable standard is outlined in the ASME Pump and Valve Code. When a gasket is employed, the body-to-bonnet joint is designed per ASME Code Section VIII and/or ANSI Bl6.S with a fully trapped, controlled compression, spiral wound gasket with provisions for seal welding, or of the pressure seal design with provisions for seal welding. The body-to-bonnet bolting and nut materials are procured per ASTM A193 and Al94, respectively, or equivalent. 6.3-21 . SGS-UFSAR Revision 17 October 16, 1998 The entire assembled unit is hydrotested as outlined in MSS SP-61 with the exception that the test is maintained for a minimum period of 30 minutes. Any leakage is cause for rejection. The seating design is of the Darling parallel disc design, the Crane flexible wedge design, or the equivalent. These designs have the feature of releasing the mechanical holding force during the first increment of travel. Thus, the motor operator has to work only against the frictional component of the hydraulic unbalance on the disc and the packing box friction. The discs are guided throughout the full disc travel to prevent chattering and provide ease of gate movement. The seating surfaces are hard faced (Stellite No. 6 or equivalent) to prevent galling and reduce wear. The stem material is ASTM A276, Type 316, Condition B or precipitation hardened 17-4 PH stainless procured and heat treated to Westinghouse Specifications. These materials are selected because of their corrosion resistance, high tensile properties, and their resistance to surface scoring by the packing. The valve stuffing box of motor-operated valves having leakoff is designed with a lantern ring leak-off connection with a minimum of a full set of packing below the lantern ring; a full set of packing is defined as a depth of packing equal to 1 1/2 times the stem diameter. The experience with this stuffing box design and the selection of packing and stem materials have been very favorable in both conventional and nuclear power plants. The motor operator is extremely rugged and is noted throughout the power industry for its reliability. The unit incorporates a "hammer blow" feature that allows the motor to impact the discs away from the fore or backseat upon opening or closing. This "hammer blow" feature not only impacts the disc but allows the motor to attain its operational speed. Each valve is assembled, hydrostatically tested, seat-leakage tested (fore and back), operationally tested, cleaned and packaged per specifications. All manufacturing procedures employed by the 6.3-22 SGS-UFSAR Revision 6 February 15, 1987 valve supplier such as hard facing, welding, repair welding, and testing are submitted to Westinghouse for approval. For fast operated valves up to and including 8 inches, 10-second maximum operators are provided, For all fast operated valves above 8 inches, the operating speed is 49 inches per minute. For slow operators, 12 inches per minute is specified for valves up to and including 8 inches. For all slow valves above 8 inches, 120-second maximum closing time is specified. Manual Valves The stainless steel manual globe, gate, and cheek valves are designed and built in accordance with the requirements outlined in the motor-operated valve description above. The carbon steel valves are built to conform with ANSI B16.5. The materials of construction of the body, bonnet, and disc conform to the requirements of ASTM AIOS Grade II, A181 Grade II, or A216, Grade WeB or Wee. The carbon steel valves pass only non-radioactive fluids and are subjected to hydrostatic test as outlined in MSS SP61 except that the test pressure is maintained for at least 30 minutes. Since the fluid controlled by the carbon steel valves is not radioactive, the double packing and seal weld provisions are not provided. Accumulator Check Valves The pressure-containing parts of this valve assembly are designed in accordance with ASHE Boiler and Pressure Vessel Code,Section III, 1968. All parts in contact with the operating fluid are of austenitic stainless steel or of equivalent corrosion-resistant materials procured to applicable ASTM or WAPD specifications. The cast pressure-containing parts are radiographed in accordance with ASTM E-94 and the acceptance standard as outlined in ASTM E-71. The cast pressure-containing parts, machined surfaces, finished hard facings, and gasket 6.3-23 SGS-UFSAR Revision 6 February 15, 1987 bearing surfaces are liquid penetrant inspected per ASME Pump and Valve Code and the acceptance standard is as outlined in the ASME Pump and Valve Code. The final valve is hydrotested per MSS SP-66 except that the test pressure is maintained for at least 30 minutes. The seat leakage test is conducted in accordance with the manner prescribed in MSS SP-61 except that the acceptable leakage is 3 cc/hr/in., nominal pipe diameter. The valve is designed with a low pressure drop configuration with all operating parts contained within the body, which eliminates those problems associated with packing glands exposed to boric acid. The clapper arm shaft is manufactured from 17-4 PH stainless steel heat treated to Westinghouse Specifications. The clapper arm shaft bushings are manufactured from StelHte No. 6 material. The various working parts are selected for their corrosion resistance, tensile and bearing properties. The disc and seat rings are manufactured from a forging. The mating surfaces are hard faced \>.'i th Stellite No. 6 to improve the valve seating life. The disc is permitted to rotate, providing a new seating surface after each valve opening. The valves are intended to be operated in the closed position with a normal differential pressure across the disc of approximately 1600 psi. The valves shall remain in this position except for testing and safety injection. Since the va 1 ves will not be requir-ed to normally operate in the open condition and hence be subjected to impact loads caused by sudden flow reversal, it is expected that these valves will perform their required functions without difficulty. When the va 1 ve is required to operate, a differential pressure of less than 25 psig will shear any particles that may otherwise prevent the va 1 ve from functioning. Although the working parts are exposed to the boric acid solution contained within the reactor coolant loop, a boric acid ufreeze up'1 is not expected with the low boric acid concentrations used. 6.3-24 SGS-UFSAR Revision 6 February 15, 1987 The experience derived from the check valves employed in the Emergency Injection System of the Carolina-Virginia Tube Reactor (CVTR) in a similar --...-system indicates that the system is reliable and workable. The CVTR Emergency Injection System, normally maintained at containment ambient conditions was separated from the main coolant piping by a single 6-inch check valve. A leak detection was provided at a proper elevation to accumulate any leakage coming back through the check valve and level alarm provided a signal on excessive leakage. The pressure differential was 1500 psi and the system was stagnant. The valve was located 2 to 3 feet from the main coolant piping, which resulted in some heat up and cooldown cycling. The CVTR went critical late in 1963 and operated until 1967, during which time the level sensor in the leak detector never alarmed due to check valve leakage. The accumulator relief valves are sized to pass nitrogen gas at a range in excess of the gas fill line delivery rate. The relief valves will also pass water in excess of the expected leak rate, but this is not necessary because the time required to fill the gas space gives the operator ample opportunity to correct the situation. For an inleakage rate 15 times the manufacturing test rate, there will be an excess of 1000 days before water will reach the relief valves. been actuated. Prior to this, level and pressure alarms would have The ECCS relief valves are provided to relieve any pressure, above design, that might build up in the safety injection piping. The valve will pass a flow rate which is far in excess of the manufacturing design leak rate of 24 cc/hr. 6.3-25 SGS-UFSAR Revision 6 February 15, 1987 I Valve Leakage Specifications The specified leakage across the valve disc required to meet the equipment specification and hydrotest requirements is as follows: 1. Conventional globe -3 cc/hr/in. of nominal pipe sizes 2. Gate valves -3 cc/hr/in. of nominal pipe size; 10 cc/hr/in. for 300 and 150 pound ANSI Standard 3. Motor-operated gate valves 3 cc/hr/in. of nominal pipe size; 10 cc/hr/in. for 300-and 150-pound ANSI Standard 4. Check valves -3 cc/hr/in. of nominal pipe size; 10 cc/hr/in. for 300-and 150-pound ANSI Standard 5. Accumulator check valves -3 cc/hr/in. of nominal pipe size Piping All ECCS piping in contact with borated water is austenitic stainless steel. All major piping joints are welded except for the flanged connections at pumps, heat exchangers, relief valves, filter housings, removable spools, and in-line flow instrumentation. The piping beyond the accumulator stop valves is designed for RCS conditions. The safety injection pump suction piping from the RWST is designed for low pressure losses to meet NPSH requirement of the pumps. The sa injection high pressure branch lines are designed for high pressure losses to limit the flow rate out of the branch line in the event of rupture at the connection to the reactor coolant loop. The branch lines are sized so that a break will not result in a violation of the design criteria for the ECCS. 6.3-26 SGS-UFSAR Revision 19 November 19, 2001 The piping is designed to meet the requirements set forth in (1) the ANSI B31.1 Code for Pressure Piping, (2) ANSI Standards B36.10 and B36.19, and (3) ASTM Standards. Pipe fitting materials are procured in conformance with all requirements of the latest ASTM and ANSI specifications. All materials are verified for conformance to specifications and documented by certification of compliance to ASTM material requirements. Specifications impose additional quality control upon the suppliers of pipes and fittings as listed below: 1. Check analyses are performed on both the purchased pipe and fittings. 2. Pipe branch lines between the reactor coolant pipes and the isolation stop valves conform to ASTM A376 and meet the supplementary requirement S6 covering an ultrasonic test, on 100 percent of the pipe wall volume. The 86 supplementary requirement applies to pipes of nominal sizes 3 inches and larger. 3. Pipe fittings in the branch lines between the reactor coolant pipes and the isolation stop valves conform to the requirements of ASTM A403; all fittings have requirements for liquid penetrant examination. Shop fabrication of piping subassemblies is performed by reputable suppliers in accordance with specifications that define and govern material procurement, detailed design, shop fabrication, cleaning, inspection, identification, packaging, and shipment. Welds for pipes sized 2 1/2 inches and larger are of the full penetration type. Reducing tees are used where the branch size exceeds one-half of the header size. All welding is performed by welders and welding procedures qualified in accordance with the ASME Code Section IX, Welding Qualifications. 6.3-27 SGS-UFSAR Revision 6 February 15, 1987 All high pressure piping butt welds containing radioactive fluid, at greater than 600°F temperature and 600 psig pressure or equivalent, are radiographed. The remaining piping butt welds are randomly radiographed. The technique and acceptance standards are those outlined in Appendix B of ANSI B31. 7. In addition, butt welds are liquid penetrant examined in accordance with the procedures of Appendix B of ANSI B31.7. Finished branch welds are liquid penetrant examined on the outside and where size permits, on the inside root surfaces. A post-bending solution anneal heat treatment is performed on hot-formed stainless steel pipe bends. Completed bends are then completely cleaned of oxidation from all affected surfaces. The shop fabricator is required to submit the bending, heat treatment, and clean-up procedures for review and approval prior to release for fabrication. General cleaning of completed piping subassemblies (inside and outside surfaces) is governed by basic ground rules set forth in the specifications. Packaging of the piping subassemblies for shipment is done so as to preclude damage during transit and storage. Openings are closed and sealed with tight-fitting covers to prevent entry of moisture and foreign material. Flange facings and weld end preparations are protected from damage by means of wooden cover plates and securely fastened in position. The packing arrangement proposed by the Shop Fabricator is subject to approval. Pump and Valve Motors Emergency Core Cooling System pump motors are used on the following pumps: 1. Centrifugal charging 2. Safety injection SGS-UFSAR 6.3-28 Revision 6 February 15, 1987
- 3. Residual heat removal The motors are designed in accordance with the National Electric Manufacturers' Association (NEMA) Standards. These standards are used by the industry and provide requirements for construction, test, performance, and manufacture of ac and de motors and generators, that by experience demonstrate a high quality level. (NEMA, Standard Publication for Motors and Generators, No. MG 1-1967.) Core Cooling System motors are specified to an Equipment Specification and the following design classifications: 1. proof enclosure 2. Class B insulation system or better 3. Service factor rating of 1.15 4. 80 percent starting voltage capability. The of the insulation system is considered of prime importance. To assure this integrity, motors are sized such that NEMA temperature limits for the service factor rating of the motor are not exceeded (NEMA MG ll. Table 6. 3-shows system parameters and brake horsepower for both normal and accident conditions. The brake horsepower reguirements are well below NEMA horsepower ratings. These motors will operate below the temperature limits as fied by NEMA MG 1. Further, complete engineen.ng tests are performed on all prototype motor frame sizes to confirm design calculations. Motor electrical insulation systems are supplied in accordance with USAS, IEEE, and NEMA standards and are tested as required by 6.3-29 SGS-UFSAR Revision 18 April 26, 2000 such standards. Temperature rise design selection is such that normal long life is achieved even under accident loading conditions. Criteria for motors of the ECCS require that under normal plant operating conditions the motors operate below their nameplate rated horsepower, i.e., below a 1.0 service factor. For no other anticipated operating mode including safeguards operation do the motors exceed the maximum rating allowed by the nameplate, including their specified 1.15 service factor. Motors Inside the Containment (Valve Motor Operators) Tests which demonstrate the adequacy of valve motor operators to be functional after exposure to high temperatures, pressures, and radiation have been conducted. The results of the tests are confirmed in Reference 1. Containment Sump The physical location of the containment sump is shown on Plant Drawing 208915. All water entering the containment sump will have been strained by the train of strainer modules with 1/12-inch diameter holes that connect to the sump pit. Pump cavitation is minimized by the design of the sump enclosure, so an anti-vortex baffle is not needed. The sump design differs from Regulatory Guide 1.82 in the following ways: 1. The small drainage sump for collecting and monitoring normal leakage within the containment is at the same location as the RHR sump (see Figure 6. 3-3) . The Liquid Radwaste and RHR Systems share a common sump pit. A plate is installed to isolate normal drainage from the RHR pump suction. SGS-UFSAR 6.3-30 Revision 27 November 25, 2013
- 2. The containment sump screening consists of a train of strainer modules, interconnected with a channel leading back to the sump pit. During a postulated Loss Of Coolant Accident (LOCA), debris is generated due to jet impingement from RCS pipe break within the bioshield area. All generated debris is conservatively assumed to be transported to the debris interceptor or the strainer, even though there are some areas of the sump pool where debris would be stopped. The debris is also transferred towards the sump by containment spray. The debris generated and subsequently transported to the containment sump is documented in References 6 and 7. The following is a summary of insulation materials used inside containment: Reflective: Encapsulated: This is an all-metallic stainless steel insulation. This material is used on the RCS as well as portions of the SGBD and SGFW piping inside containment and on the Unit 2 steam generators and on the Unit 2 steam generator blowdown lines inside the steam generator cubicles. This is a ceramic fiber insulation "cera-blanket" totally enclosed in a rigid stainless steel structure. This material is used on the ECCS piping and equipment in the containment. Semi-Encapsulated: This application of "cera-blanket" insulation utilizes (Kaowoll an outer heavy gage stainless steel surface with an Ceramic Fiber) SGS-UFSAR interior surface of formed stainless steel foil or heavy gage stainless steel channels and straps (panel insulation}. Foil-enclosed insulation .is used for heat retention on Nuclear Class 3 piping and equipment. 6. 3-31 Revision 24 May 11, 2009 I Min "K": Fiberglass: With Blanket (Nukon Insu-lation) : Calcium Silicate: Mineral Wool: This is a high-efficiency powder-like insulation totally enclosed in stainless steel. Small amounts of this insulation are used on the RCS where physical arrangement does not permit the use of thicker reflective insulation. This is a fibrous insulation covered by stainless steel and a vapor barrier used to prevent sweating of cold water systems (Component Cooling and Service Water) . This fibrous glass insulation is enclosed in woven fibrous glass fabric between two layers of fiberglass scrim sewn to the insulation. This material is used on the Pressurizer and the Unit 1 Steam Generators. On most areas of the Pressurizer and the Unit 1 Steam Generators where this material is used, this insulation is covered with a stainless steel jacket or a stainless steel mesh. Additionally, this style of insulation is used on the integrated head assembly to insulate the ring beam in the area local to where the L-Panel and RVCH Dome insulation converge. This rigid solid insulation is used on of the Feedwater and Main Steam Systems that are not to a LOCA pipe break inside the bioshield. !'his material is also covered with stainless steel. Welds in these systems are covered with encapsulated insulation. This fibrous insulation is applied to the lower 34 feet of the containment liner and is also covered with stainless steel lagging and a vapor barrier. Fiberglass Blanket: This fiberglass blanket material is jacketed with fiberglass fabric impregnated with silicone. This insulation is used as anti-sweat insulation on Service Water piping of 3" & 2" dia. at CFCUs in the Containment Building Units 1 & 2. 6.3-32 SGS-UFSAR Revision 24 May 11, 2009 6.3.2.3 Applicable Codes and Classifications The codes and standards to which the individual ECCS components are designed are listed in Table 6.3-1 6.3.2.4 Materials' Specification and Compatibility Materials are selected to meet the applicable material requirements of. the codes in Table 6.3-1 and the following additional requirements: 1. All parts of components in contact with borated water are fabricated of or clad with austenitic stainless steel or equivalent corrosion-resistant material. 2. All parts of components in contact (internal) with sump solution during recirculation are fabricated of austenitic stainless steel or equivalent corrosion-resistant material. 3. Valve seating surfaces are hard faced with Stellite No. 6 or equivalent to prevent galling and to reduce wear. 4. Valve stem materials are selected for their corrosion resistance, high tensile properties, and resistance to surface scoring by the packing. The elevated temperature of the sump solution during recirculation is well within the design temperature of all ECCS components. In addition, consideration has been given to the potential for corrosion of various types of metals exposed to the fluid conditions prevalent immediately after the accident or during long term recirculation operations. 6.3-33 SGS-UFSAR Revision 13 June 12, 1994 6.3.2.5 Design Pressures and Temperatures The component design pressure and temperatures are given in Tables 6. 3
- 2 through 6.3-5. These pressure and temperature conditions are specified as the most severe conditions to which each component exposed during either normal plant operation or during operation of the ECCS. For each component, these conditions are considered in relation to the code to which it is designed. By designing the components in accordance with applicable codes and with due consideration for the design and operating conditions, the fundamental assurance of the structural integrity of the ECCS components is maintained. 6.3-33a SGS-UFSAR Revision 13 June 12, 1994
*****---------SGS-UFSAR THIS PAGE INTENTIONALLY LEFT BLANK 6.3-33b Revision 13 June 12, 1994 6.3.2.6 Coolant Quantity The minimum storage volume for the accumulator is given in Table 6. 3-2. The total volume of the RWST is 400, 000 At the minimum volume permitted by the Technical (364,500 gallons) approximately 313,000 for Unit 1 and 313,000 gallons for Unit 2 are available to the ECCS pumps. The RWST volume must be sufficient to support operator action time following the SI actuation and during the switchover alignment to cold leg recirculation. Following an SI actuation, all ECCS pumps (RHR, Charging/Safety Injection and Safety Injection) are automatically started. If the containment High-High setpoint is reached, the Containment Spray pumps are also automatically started with all pumps initially taking suction from the RWST. This time period is termed the injection phase of the RWST draindown. When the RWST reaches the low level setpoint, the operator begins to take action to switchover from the injection phase to the contair>..ment sump recirculation phase. During this switchover phase, the RHR pump suction is re-aligned to the containment sump and the charging/safety injection pump and safety injection pump suctio:.J are aligned to the RHR pump discharge. One of the two operating CS pumps is also stopped upon entering the switchover phase to reduce the outflow from the RWST. When the RWST reaches the low-low level alarm, the second CS pump is stopped. The RWST low-low level setpoint must also support NPSH for all ECCS pumps and CS pumps suction on the RWST. Once the ECCS is for containment recirculation, the RHR pump discharge may then be cross-tied to the containment spray header to provide containment recirculation spray flow after all CS pumps are stopped. In addition, the amount of water during the injection phase of a LOCA must be sufficient to provide adequate RHR NPSH in the containment sump and adequate submergence of the strainer modules prior to switchover to recirculation. The RWST volume to meet this requirement is 193,000 gallons. 6.3-34 SGS-UFSAR Revision 24 May 11, 2009 The available RWST water volume for the injection phase is the minimum volume between the Technical Specification requirement and the RWST low level setpoint. The available RWST water volume for the switchover phase is the minimum volume between the RWST low level setpoint and the RWST low-low level setpoint. These minimum volumes account for instrument accuracy in the RWST level channels which are used by the operators to monitor RWST inventory. The following water volumes are available: Injection Phase Switchover Phase Total Injection Phase Salem 1 207,800 gallons 105,200 gallons 313,000 gallons Salem 2 204,500 gallons 108, 500 gallons 313,000 gallons The available RWST water volume for the injection phase provides sufficient time for the operators to proceed through the Emergency Operating Procedures (EOPs) to the point where switchover to cold leg recirculation may be required. Following an S! actuation with a containment high-high signal, the RHR pumps, charging pumps, SI pumps and CS pumps are all started automatically, taking suction on the RWST. The highest drain rate for the RWST occurs with all pumps operating for a design basis large break LOCA when the RCS is rapidly depressurized to containment pressure and the RHR pumps inject flow to the RCS cold legs. ECCS pump flow rates vary with the RWST level and the RCS/containment pressures. Significantly conservative assumptions are used in determining the RWST drain flow rates as follows: (1) The RCS and Containment pressure average approximately 10 psig for the first 5 minutes following SI actuation. This is based on the minimum RCS/containment pressures calculated in the LOCA PCT analysis. The LOCA PCT analysis for minimum RCSjcontainment pressures predict conservatively low RCSjcontainment pressures based on maximum pump flow delivery similar to those used in the RWST draindown evaluation. (2) After the first 5 minutes, the RCS/containment pressures are conservatively assumed to be 0 psig. 6.3-35 SGS-UFSAR Revision 17 October 16, 1998 (3) The RHR pumps inject to the RCS in the same lines as the accumulators. Since the accumulators are at a higher pressure than the RHR pumps, the RHR pumps do not inject to the RCS until the accumulator pressures decrease. An average time period of 45 seconds for accumulator blowdown is assumed based on the LOCA analysis, during which time the RHR pumps de not drain down the RWST. (4) The pump flowrates are based on the maximum expected flow with the maximum allowable pump curves and conservative modeling of the piping and component resistances. The charging pump and SI pump flows are based on the balancing criteria provided in the Technical Specification. Based on these assumptions for pump flow rates and the available RWST water volume during the injection phase (20?,800 gallons for Unit 1 and 204,500 gallons for Unit 2), the RWST low level alarm will be reached in 12.9 minutes (Unit 1) and 12.5 minutes {Unit 2). This time is sufficient for the operators to proceed through the EOPs and begin switchover to containment recirculation. The RWST water volume required for RHR pump NPSH is also met. Switchover Phase Additional water storage is required in the RWST to accommodate the operator actions necessary to align the ECCS pump suctions from the RWST to the containment sump. The required operator actions for Salem 1 and 2 are provided in Table 6.3-6. The switchover is similar for both units with one exception. Salem Unit 1 requires a manual transfer while Salem Unit 2 is semi-automatic. This means that for Salem Unit 1, the RHR pumps are manually stopped, the RHR pump suctions are re-aligned to the containment sump and the RHR pumps re-started. For Salem Unit 2, the semi-automatic switchover is armed and the RHR pump suction is automatically switched from the RWST to the containment sump without stopping the RHR pumps. The time available for operators to complete the switchover is dependent on the flow rate out of the :RWST and the available RWST volume. A conservative analysis was performed to show that sufficient water is provided in the RWST to complete the switchover for all RCS break sizes assuming a limiting single failure while maintaining long term cooling consistent with the 10CFR50.46 analysis of record. The available water volume is that contained between the RWST low level and the RWST low-low level, taking into account instrument inaccuracies. At the RWST low-low level, all pumps taking suction on the RWST would be stopped to protect the pumps. Three limiting break sizes have been specifically evaluated for the Salem 1 and 2 switchover. 6.3-36 SGS-UFSAR Revision 17 October 16, 1998 Large Break LOCA -The design basis large break LOCA produces the lowest RCS pressure and the highest RWST draindown rate, which results in the time for RWST drain down during switchover to containment recirculation. All pumps are assumed to inject to a 0 psig back pressure. To maintain long term core cooling, one RHR pump injecting to two RCS cold legs (with one leg spilling to the containment and one leg delivering flow to the core) is sufficient to maintain long term core cooling. Small Break LOCA -The RWST drain down time for a small break LOCA is longer since the RCS pressure remains above the RHR pump discharge pressure. This provides the operator with additional time to complete the switchover and align the charging pumps and SI pumps to cold leg recirculation. To maintain long term core cooling, one charging pump and one SI pump (each delivering to 4 cold legs with one leg spilling to the containment) is sufficient to maintain long term core cooling. Accumulator Line Small Break LOCA -Due to the break location, the drain down time for an accumulator line small break LOCA is similar to that of a Large Break LOCA. The RHR pumps inject to the RCS through the accumulator line. With a break in the accumulator line, the RHR pumps directly to the containment even if the RCS pressure is above the RHR pump cut off head. This increases the RWST outflow and therefore reduces the time available for the operator to complete the recirculation alignment. To maintain long term core cooling, one charging pump one SI pump (each delivering to 4 cold legs with one line spilling to the containment) is sufficient to maintain long term core cooling. Each of these breaks has been evaluated with a limiting single failure to determine the minimum RWST drain down times. The limiting failure for Salem Unit 1 is one RHR pump failing to stop on demand. This results in the failed (running) RHR pump continuing to draw down the RWST. The limiting single failure for Salem Unit 2 is the RWST common suction line to RHR pumps sucdon isolation valve ( SJ69) failing to close during semi-automatic switchover. This results in draining of the RWST to the sump as the ECCS pumps continue to draw down the RWST during switchover. Additional assumptions used in the RWST drain down evaluation are as follows: (1) The containment pressure is assumed to be 0 psig. containment spray flow and RHR pump flow for the accumulator line small break LOCA. 6.3-36a SGS-UFSAR This maximizes break LOCA and Revision 24 May 11, 2009 (2) The RCS pressure is assumed to be 0 psig for the large break LOCA. For the small break LOCA, the RCS pressure is assumed to be above the RHR pump cut in pressure. For the accumulator line small break LOCA, the RCS pressure is also assumed to be above the RHR cut-in pressure, but one (3) ection line is spilling to the containment pressure of 0 psig. All pumps are RWST. in an alignment that maximizes outflow from the (4) For Salem Unit 2, during the semi-automatic switchover, both the RWST/RHR isolation valve (RH4) and the containment sump isolation valve (SJ44) are open at the same time. This creates a direct path from the RWST to the containment sump. Valve RH4 has a maximum allowable stroke time of 87 seconds and valve SJ44 has a maximum allowable stroke time of 36 seconds. The valves are assumed to be fully open during the stroke time to maximize the RWST drain flow. With the failure of one RH4 valve to close, this drain path exists for the entire duration of the switchover for one of the containment sump lines. This drainage path also exists for the small break LOCA even though the RHR pumps are not injecting directly into the RCS. This results in reduced swi tchover times for Salem Unit 2 small break LOCA when compared to Salem Unit 1. Salem Unit 1 has an interlock between valves RH4 and SJ44 such that the containment sump isolation valve (SJ44) cannot be open unless the RWST/RHR isolation valve (RH4) is closed. This interlock a direct drainage path from the RWST to the containment sump for Salem Unit 1. Unit 1 Analysis of Manual Switchover For Unit 1, manual switchover from the RWST to the containment sump is initiated at an RWST level of 15.2 feet (RWST low or low-backup alarm setpoint). Two significant actions are modeled in the RWST drain down evaluation. This simplified approach provides clearer training rather than modeling each specific operator action in the RWST to containment sump switchover. The first timed operator action is initiating a close on the RHR pump suction valves from RWST valves (RH4). As shown in Table 6.3-6, once the operator reaches this step, the RHR pumps have been stopped (or isolated) and one containment spray pump is about to be stopped (if two are running). The second significant time modeled is the time at which the RWST low-low level alarm is reached for the limiting large break LOCA. The Charging/SI and SI pumps must have their suctions re-aligned to the RHR pump ( s) before reaching the RWST low-low level alarm. SGS-UFSAR Revision 24 May 11, 2009 The available times for operator actions to ensure that long term cooling will be maintained consistent with the 10CFR50.46 analysis for Unit 1 are: Initiate Close RH4s 4 minutes Complete Switchover 11.7 minutes For the limiting design basis large break LOCA, the time to complete switchover is sufficient for the required operator actions. Unit 2 -Semi-Automatic Switchover For Salem Unit 2, the semi-automatic switchover is armed and the RHR pump suction is automatically switched from the RWST to the containment sump without stopping the RHR pumps. The timings of two operator actions are used as input to the RWST draindown evaluation, which determines the maximum time available for operators to complete the switchover to recirculation while maintaining RWST water level above the Low-Low level setpoint. First, operators must initiate shutting SJ69, the isolation valve for the common RWST suction line to the RHR pump suctions 1 within 3. 7 minutes of receipt of the RWST Low level alarm. Second, operators must stop one containment spray pu1np within 5. 5 minutes (if two are running) . Based on this, the minimum time to reach the RWST Low-Low level setpoint is 11.2 minutes. Operators must complete switchover to recirculation within 11.2 minutes to ensure that adequate NPSH is available to the operating ECCS pumps. For the design basis LOCA, one RHR pump provides adequate cooling flow. When the semi-automatic switchover is armed, the suction of the RHR pumps is automatically switched from the RWST to the containment sump, adequate cooling flow is available. This makes the design basis LOCA less limiting with respect to switchover time. Therefore, available operator action times are dictated by the small break LOCA. For small break LOCA (accumulator line small break LOCA is limiting), the time to complete switchover is sufficient for the required operator actions. 6.3-36c SGS-UFSAR Revision 24 May 11, 2009 THIS PAGE INTENTIONALLY BLANK 6.3-36d SGS-UFSAR Revision 16 January 31, 1998 The available times for operator actions to ensure that long term cooling will be maintained consistent with the 10CFR50.46 analysis for Unit 2 small break LOCA are: Initiate SJ69 Closure 3.7 minutes 6.3.2.7 Pump Characteristics Stop One CS Pump 5.5 minutes Complete Switchover 11.2 minutes Pump performance curves for the RHR are shown on Figure 6.3-4. 6.3.2.8 Heat Exchanger Characteristics Residual heat exchanger characteristics are presented in Section 5.5. 6.3.2.9 Emergency Core Cooling System Flow Diagrams An ECCS flow diagram is given on Plant Drawings 205234 and 205334. 6.3-37 SGS-UFSAR Revision 27 November 25, 2013 6.3.2.10 Relief Valves The ECCS relief valve capacities and leak rates are given in Section 6.3.2.2. 6.3.2.11 System Reliability Specific design features of the ECCS to assure its ability to meet single failures include the following: 1. Inclusion of two charging pumps in the Injection System which deliver into the four cold legs through l. 5 inch diameter lines. Accumulator injection into the cold legs employ completely independent piping and connections from the charging pumps. The two charging pumps will supply recirculation flow from the containment sump (via the RHR pump discharge/charging pump suction cross tie} to the four cold legs through the same line. 2. (Deleted). 3. Inclusion of two safety injection pumps in the Injection System, which delivers to four cold leg injection points via the accumulator discharge lines during the injection phase and initial SGS-UFSAR portion of the recirculation phase. Later in the recirculation phase of operation, flow from each of these pumps will be directed via a separate 4-inch header to two hot leg injection points in order that subcooling of the core can be completed. Redundant headers are provided for this phase of operation to assure at least one pump can deliver even in the case of a passive failure in one line. During recirculation operation, the safety injection pumps (as well as the charging pumps mentioned previously) take suction from 6.3-38 Revision 19 November 19, 2001 the recirculation sump via the RHR pump discharge or safety pump suction crosstie. This connection from the suction of the to the suction of the ection pumps assures that during recirculation with either a or an active failure, at least one and one ection pc.mp or t1vo ection or two charging pumps will deliver. 4. Inclusion of two RHR pumps in the Injection System which delivers to four cold leg injection points (one on each loop) via the accumulator discharge lines during ection phase and initial portion of the recirculation phase of operation. To ensure each RHR pump can deliver to the four cold ection the SGS-UFSAR cross conr::ect valves, RH-19's, are the ection During to be oper. the RHR pumps take suction from the recirculation sump and also flow t:o the suction of the charging and safety injection pumps. Later in the recirculation period, the injection flow provided by the RHR pumps via safety injection pumps will be redirected from the cold legs to tvJO hot connections in order -:o complete subcooling of the core. In addition, one RHR pump will be flow to two cold Thus, ection flow of borated water from the R\'JST is to all four RCS cold from the three pumping systems. the recirculation phase of the accident all three pumping systems are capable of providing recirculation sump fluid flow to aL_ four cold legs with the low head pumps (RHR} providing flow to the high head pumps (safety ection and charging pumps). The capability of long term recirculation flow to the RCS hot legs is provided crom the injection pumps. 6.3-39 Revision 25 October 26, 2010 Failure Analysis Separate single failure analyses were performed for both the injection and recirculation phases of an accident. Two basic types of failures were considered: 6.3-39a SGS-UFSAR Revision 7 July 22, 1987 --
THIS PAGE INTENTIONALLY BLANK 6.3-39b SGS-UFSAR Revision 7 July 22, 1987 I 1. Active failure, which is defined as the inability of any single dynamic component or instrument to perform its design function when called upon to do so by the proper actuation signal. Such functions include change of position of a valve or electrical breaker, operation of a pump, fan, or diesel-generator action of a relay contact, etc. 2. Passive failure which is defined as a failure affecting a device involved with the transport of fluid which limits its effectiveness in carrying out its design function. Most passive failures involve the development of abnormal leakage in valve stern packings, pump seals, etc, although passive failures concerned with abnormal flow restriction in lines are also considered. Table 6. 3-9 summarizes the results of the single failure analysis applied during the injection phase. All failures during this phase are assumed to be active failures. It is during this phase that the pumps are starting and automatic isolation valves are required to move. All credible active failures are considered, and are included in the accident analyses described in Section 15. A comprehensive failure analysis for post-accident electrical and control components is presented in Section 7. The accumulators which are a principal factor of the Injection System are not ect to active failure. The only moving parts in the accumulator injection train are the two check valves. The working parts of the check valves are exposed to fluid of relatively low boric acid concentration. Even if some unforeseen deposition accumulated, calculations indicate that a reversed differential pressure of about 25 psi can shear any particles in the bearing surfaces that may tend to prevent valve When the RCS is being pressurized during the normal plant heatup operation, the check valves are tested for leakage as soon as there is at least 100 psi differential across the valve. This test 6.3-40 SGS-UFSAR Revision 19 November 19, 2001 confirms the seating of the disc and provides a quantitative leakage rate measurement which can be compared with the results of earlier tests. When this test is completed, the discharge line test valves are opened and the RCS pressure increase continued. There should be no increase in leakage from this point on since increasing reactor coolant pressure increases the seating force and decreases the probability of leakage. The accumulators can accept some back from the RCS without their availability. Table 6.3-10 indicates the frequency that the accumulator level would have to be readjusted as a function of leakage It should also be noted that an accumulator can be isolated with a motor-operated valve if leakage becomes excessive. Tables 6.3-9 and 6.3-11 summarize the single failure analyses of recirculation phase. Leakage During Recirculation Table 6. 3-12 summarizes the potential leakage sources from the recirculation loop during the recirculation phase of an accident. The table lists the type of leakage control utilized for each leak source. A value of 50 gpm is employed as a design basis for be to of this Auxiliary Building sump pumps which will to the Waste Disposal System. The ECCS is into two either of which is Should a leak develop in n,ecessary to isolate it starting/stopping of pumps. during the of providing the minimum core cooling functions. either of these two subsystems, the only actions are the closing/opening of valves and the Leakage from the valve stem leakoffs is piped to the Equipment Drain System. The total from all sources is 0.45 gpm as described in UFSAR Section 15.4.1 6.3-41 SGS-UFSAR limited to Revision 26 May 21, 2012 Recirculation loop sources are summarized in Table 6.3-12. is monitored by procedure to ensure this leak rate is not exceeded. With respect to piping and mechanical equipment outside the containment, considering the provisions for visual inspection and leak detection, leaks will be detected before they propagate to major proportions. A review of the equipment in the system indicates that the sudden leak would be the sudden failure of a pump shaft seal. Evaluation of the leak rate assuming only the presence of a seal retention around the pump shaft showed that flows less than 50 gpm would result. Piping leaks, valve packing leaks, or flange gasket leaks have been of a nature to build up slowly with time and are considered less severe than the seal failure. Means are also provided to detect and isolate such leaks in the emergency core cooling flow path within 30 minutes. The RHR pumps and heat exchangers are located in individual compartments. Each compartment has a volume of 200 ft3 to accommodate a 50-gpm leak for a period of 30 minutes. Valving is provided to allow an operator to isolate, drain, and flush the RHR heat exchangers and pumps. The of the drain valves will be done by means of remote valve reach rod located in a shielded valve The radiation shielding criterion for this valve will be the same as for manual containment isolation valves. Post-accident radiation levels around recirculation loop equipment are discussed in Section 15. The layout permits the detection of a leaking recirculation loop component by means of a radiation monitor which samples the air in the plant vent. Alarms in the control room will alert the operator when the activity exceeds a preset level. Sump level and of sump pumps will be indicated in the control room as a SGS-UFSAR for detection of water leaks. 6.3-42 Revision 16 January 31, 1998 Should a tube aide to ahell aide leak develop in a residual heat exchanger, the operator will be warned by a component cooling water high radiation alarm. Por large leaks the operator will also be warned by a component cooling water surge tank high level alarm. In the event that the leak cannot be isolated before the tank fills, the tank relief valve will pass the excess water to the waste holdup tank. The operator actions required to detect, isolate, and realign a leaking component and, subsequently, realign the system, depend upon the location of the leak (i.e., which system, actual physical location). Depending on the location of the leak, the operator will carry out a series of actions. For each break location, a different set of actions will be required. The actions taken by the operator will be manual (e.g., starting or stopping pumps, opening or closing valves). These actions would be performed from the Control Room. For the Service Water System, the rupture of a large pipe will be indicated to the operator by decreasing pump discharge header pressure. Low pump header pressure will cause a backup service water pump to start. In the event that a pipe rupture occurs in a watertight pump compartment of the intake structure, which is larger than the capacity of the sump pump, high sump level for the affected compartment will be alarmed in the control room. The operator can remotely close the tie valves and header block valves at the intake structure to isolate the affected compartment. In the event that a main yard supply header is ruptured, the affected header can be isolated and the tie valves at the Auxiliary Building opened. Rupture of a header pipe in the pipe tunnel can be detected by a pipe tunnel sump high level alarm. The operator can determine the affected header by remotely closing the intake tie valves and observing which pump header is affected by low pressure. Once the ruptured header is isolated, the intake 6.3-43 SGS-UFSAR Revision 6 February 15, 1987 tie valves can be reopened and all service water pumps made available. In the avant that a service water pipe rupture occurs inside the containment, the difference between flows entering and leaving the containment will be sensed and alarmed in the Control ROom. High level alarms in the containment sump and fan cooler drain pots will also be indicated in the control Room. The operator can remotely close the isolation valves to isolate the leaking fan cooler. In the event that radiation is detected at one of the service water outlets from the containment, the condition is alarmed in the Control Room. 6.3.2.12 Protection Provisions All four injection lines penetrate the containment adjacent to the Auxiliary Building. one portion of the High Head Injection Syatem within the containment ia connected to the low head injection lines attached to each loop's accumulator injection piping. The other portion of the High Head Injection System within the containmant is connected directly to the injection nozzles on the cold leg piping of the loops. For most of the routing, these lines are outside the reactor and steam generator shielding, and hence they are protected from missiles originating within these areas. The coolant loop supports are designed to restrict the motion to about one-tenth of an inch, whereas the attached safety injection piping can sustain a 3-inch displacement without exceeding the working stress range. 6.3-44 SGS-UFSAR Revision 16 January 31, 1998 Hangers, stops, and anchors are designed in accordance with ANSI B31.1 Code for Pressure Piping, and ACI 318 Building Code Requirements for Reinforced Concrete, which provide minimum requirements on materials, design, and fabrication with ample safety margins for both dead and operational dynamic loads over the life of the equipment. Materials used are in accordance with ASTM specifications which establish quality levels for the manufacturing process, minimum strength properties, and for test requirements which ensure compliance with the specifications; qualification of welding processes and welders for each class of material welded and for types and positions of welds. Allowable stress values are established which provide an ample safety margin on yield strength for normal loads and ultimate strength for design basis accident or maximum hypothetical seismic loads. 6.3.2.13 Provisions for Performance Testing The provisions incorporated to facilitate performance testing of components are discussed in Section 6.3.4. 6.3.2.14 Pump Net Positive Suction Head Net positive suction head data for pumps which are required to operate post-accident are provided in Table 6.3-13. 6.3.2.15 Control of Motor-Operated Isolation Valves Position indication and alarm circuits for the motor-operated valves, located between the accumulator tanks and the primary cooling system, are designed to provide assurance that these valves will be open when required. These valves are normally open and under administrative control with the motive power for the valves locked out during normal power operation. Redundant and 6.3-45 SGS-UFSAR Revision 6 February 15, 1987 independent information is provided in the Control Room to indicate when any one valve is not in the fully open position. Valve status (fully open or fully closed) is indicated on the main control board via backlighted pushbuttons. These status lights are actuated by limit switches on the valve motor operator. In addition, an alarm is provided on the Overhead Annunciator System in the event the valve is not in the fully open position. Another independent means of determining that the valve is not in its proper position is provided through the Auxiliary Alarm System which will initiate an audible signal and print out an alarm message indicating when the valve is not in the fully open position. This indication and alarm is derived from a separate valve stem limit switch and is energized from an independent power supply from that used for the overheat annunciator. A safety injection signal also automatically initiates the opening of these valves. 6.3.2.16 Motor-Operated Valves and Controls Remotely operated valves in the SIS which are in the "ready11 position and which do not receive an "S11 signal, are assured to be in the proper position for injection by means of the following; 1. Redundant indication of valve position in the control room for those valves in common, or non-redundant flow paths of an ECCS subsystem, or valves whose inadvertent operation could degrade the ECCS. The indication provided is identical to that of the accumulator discharge valves, described in Section 6.3.2.15. 2. Valves in redundant flow paths are provided with position indication on the main control console and 11off-norma 111 indication in the Auxiliary Annunciator 6.3-46 SGS-UFSAR Revision 6 February 15, 1987 System (i.e., 11RH4, 12RH4, 11SJ33, 12SJ33, 11SJ134, 12SJ134. 3. Manually-operated control to assure Additionally, t:he valves are that they are valves cited under administrative in the proper in Item 1 position. above are placed in the proper position for injection with the motive power removed from the valve. Valves with redundant position indication {as described Section 6.3.2.15) and power lockouts are: lSJ30* ISJ69* ISJ135* 11SJ49* 12SJ49* IISJ40* 12SJ40* 1RH26* 1CS14* ISJ67* 1SJ68* llSJS4* 12SJ54* 13SJ54* 14SJ54* 11SJ44* 12SJ44* in Requirements for locking them in Specifications. disconnecting ac position are set power to forth in these valves and for the plant Technical Valves marked with an asterisk (*) are provided with the capability to restore control power from the Control Room. The safety injection initiation signal was removed from the centrifugal charging pump (CCP) miniflow isolation valves, CV139 and CV140, thus preventing automatic termination of miniflow. In addition, manual valve CV197, which directs reactor coolant pump sealwater return flow to the suction of the centrifugal charging pumps will be locked closed and manual valve CV130 will be locked open which will route reactor coolant pump sealwater return and centrifugal charging pump miniflow water to the volume control tank. This valve alignment will cause the volume control tank to fill solid during a safety injection initiation; the control tank relief valve, CV241, would then open, directing volume 6.3-47 SGS-UFSAR Revision 7 July 22, 1987 miniflow to the CVCS holdup tanks. Procedurally, when the high-head safety injection pumps are operating in the ECCS mode, the operator will be instructed by Emergency Operating Procedures to terminate miniflow below an RCS pressure of 1500 psig and to re-establish miniflow if RCS pressure rises again to 2000 psig.
6.3.2.17 Manual Actions
No manual actions are required of the operator for proper operation of the ECCS during the injection mode of operation. The only manual actions required to be taken by the operator are those necessary to complete the realignment of the system for its cold leg recirculation mode of operation and, subsequently, to
realign the system for its hot leg recirculation mode of operation.
The transfer from the injection phase to the recirculation phase is described
in Section 6.3.2.1 and in Table 6.3
-6. 6.3.2.18 Process Instrumentation
Process instrumentation available to the operator in the control room to assist
in assessing post
-LOCA conditions are tabulated in Section 6.3.5 and Section 7.
6.3.2.19 Materials Materials employed for components of the ECCS are given in Table 6.3-14. These materials are chosen based upon their ability to resist pyrolytic decomposition.
6.3.3 Design Evaluation 6.3.3.1 Evaluation Model
This information is provided in Section 15.
6.3-48 SGS-UFSAR Revision 29 January 30, 2017
6.3.3.2 Small Break Analysis This information is presented in section 15. 6.3.3.3 Steam Line Rupture Analysis This information is presented in Section 15. 6.3.3.4 Fuel Rod Perforations Results for accidents that have acceptance criteria based on radiological consequences, metal-water reaction, or peak clad temperature are presented in Chapter 15. 6.3.3.5 Effects of Core Cooling System Operation on the Core The effects of the ECCS on the reactor core are discussed in Section 4. 6.3.3.6 Use of Dual Function components The ECCS contains components which have no other operating function, as well as components which are shared with other systems and perform normal operating functions. Components of the ECCS which perform no other operating functions are the following: 1. One accumulator for each loop which discharges borated water into its respective cold leg of the RCS. 2. one BIT. 3. Associated piping, valves, and instrumentation. 6.3-49 SGS-UFSAR Revision 16 January 31, 1998 Components which also have a normal operating function are as follows: The two RHR pumps and residual heat exchangers: These components are normally used during the latter of normal reactor cooldown and when the reactor is held at cold shutdown for core decay heat removal. However, during all other plant operating periods, they are aligned to perform the low head injection function. 2. The RWST: This tank is used to fill the refueling canal for refueling operations, provide a makeup source to the. spent fuel pit as well as an emergency makeup source to the RCS via the eves charging pumps. These functions place no limitations on the function of the ECCS. During all plant operating periods, the RWST is aligned to the suction of the safety injection pumps, RHR pumps, and the containment spray pumps. 3. The two high head safety injection pumps: These pumps are normally aligned to perform their high head injection function. One of the two may be used to provide normal continuous charging during normal plant operation. 4. Two boric acid tanks. An evaluation of. all components required for ECCS operation demonstrates that either: SGS-UFSAR Revision 21 December 6, 2004 * * *
- 1. The component is not shared with other systems, or 2. If the component is shared with other systems, it is aligned during normal plant operation to perform its accident function. Dependence on Other Systems Other systems which operate in conjunction with the ECCS are as follows: 1. The Component Cooling System cools the residual heat exchangers during the recirculation mode of operation. It also supplies cooling water to the RHR pumps during the injection and recirculation modes of operation. 2. The Service Water System provides cooling water to the component cooling heat exchangers and to the safety injection pumps. 3. The Electrical System provides normal and emergency power sources for the EGGS. 4. The Engineered Safety generates the initiation cooling. Features Actuation System signal for emergency core 5. The Auxiliary Feedwater System supplies feedwater to the steam generators. Limiting Conditions for Maintenance During Operation The Technical governing the Specifications maintenance of operation with the core critical. establish limiting conditions EGGS components during plant It is expected that maintenance on a component will be permitted if the remaining components meet 6.3-51 SGS-UFSAR Revision 7 July 22, 1987 the minimum conditions for operation and the following conditions are also met: Maintenance on an active component will be permitted if the remaining components meet the minimum conditions for operation and the following conditions are also met: 1. The remaining equipment has been demonstrated to be in operable condition, ready to function just before the initiation of the maintenance. 2. A suitable time limit is placed on the total time span of successful maintenance which returns the components to an operable condition, ready to function. The design philosophy with respect to active components in the High Head/Low Head Injection System is to provide backup equipment so that maintenance is possible during operation without impairment of the safety function of the system. Routine servicing and maintenance of equipment of this type would generally be scheduled for periods of refueling. and maintenance outages. 6.3.3.7 Lag Times To provide protection for large area ruptures of the RCS, the ECCS must respond to rapidly reflood the core following the depressurization and core voiding that is area ruptures. The accumulators act reflooding function with no dependence on characteristic of large to perform the rapid the normal or emergency power sources, and actuation signal. delivering their also with no dependence on the receipt of an With three of the four available accumulators contents to the reactor vessel, the peak clad temperature is maintained below the cladding melting temperature as discussed in Section 15. 6.3-52 SGS-UFSAR Revision 6 February 15. 1987 The function of the centrifugal charging, safety injection, and RBR pumps is to complete the refill of the vessel and ultimately return the core to a subcooled state. The starting sequence of the ECCS pumps and the related emergency power equipnent will enable minimum required flows which are bounded by the delay times and associated flows assumed in the safety.analyses. The starting sequence is discussed in section 7. 6.3.3.8 Thermal Shock Considerations Thermal shock considerations are discussed in section 15. 6.3-53 SGS-UFSAR Revision 16 January 31, 1998 6.3.3.9 Limite on System Parameters The limiting conditions for operation are detailed in the Technical specifications. These conditions will apply to both active components and coolant storage components of the ECCS. 6.3.4 Tests and Inspections All active and passive components of the ECCS are inspected periodically to demonstrate system readiness. The pressure-containing systems are inspected for leaks from pump seals, valve packing, flanged joints, and safety valves during system testing. In addition, to the extent practical, the critical parts of the injection nozzles, pipes, valves, and safety injection pumps are inspected visually or by boroscopic examination for erosion, corrosion, and vibration wear evidence. A plan for periodic component and system testing and material examinations will be prepared prior to plant operation for use throughout plant life. Environmental testing of ECCS components which are located inside the containment and are required to operate following a LOCA is discussed in Reference 1. 6.3.4.1 Component Testing Preoperational performance tests of the components are performed in the manufacturer's shop. An initial system flow test demonstrates proper functioning of the system. Thereafter, periodic tests demonstrate that components are functioning properly. Active components of the ECCS may be individually actuated on the normal power source during plant operation to demonstrate operability. The test of the safety injection pumps employs the 6.3-54 SGS-UPSAR Revision 6 February 15, 1987 minimum flow recirculation test line which connects back to the RWST. Remote operated valves are exercised and actuation circuits tested. The automatic actuation circuitry, valves, and pump breakers also may be checked during integrated system tests performed when the plant is cooled down and the RHR loop is in operation. Containment sump isolation valves are normally closed. Inadvertent opening is prevented by using control power lockouts and electrical interlocks which prevent the opening of the valves whenever the corresponding RHR pump suction isolation valve is open. The valves will be exercised and tested after closing the appropriate RHR pump suction isolation valve during normal operation or refueling at a frequency specified in the Technical Specifications. The containment sump valves will be tested only after closing the suction and discharge valves of the associated RHR pump. The isolated RHR line is located at Elevation 46 feet-10 inches and the center line of the sump valves at Elevation 53 feet-0 inch. Due to the elevation difference, no stagnant refueling water is expected to interfere with the sump valve tests. If the necessity arises for the draining of this line, provisions have been provided to drain it through the RHR pump to the RHR sump. Sump interconnection with the Liquid Radwaste System provides satisfactory processing provisions for this drainage. Inleakage through each of the check valves which isolate the SIS from the RCS can be tested by opening the remote test valves in the appropriate test line. Flow through the test line can be measured and the opening and closing of the discharge line stop valves can be verified by the flow instrumentation. 6.3-55 SGS-UFSAR Revision 6 February 15, 1987 6.3.4.2 System Testing Testing is conducted during plant shutdown to demonstrate proper automatic operation of the ECCS. A test signal is applied to initiate automatic action and verification made that the safety injection pumps attain required discharge heads. The test demonstrates the operation of the valves, pump circuit breakers, and automatic circuitry. The operation of the RHR pumps is verified periodically. Performance of the centrifugal charging pumps is verified by their operation during normal plant operation and cooldown. Starting of these pumps by a safety injection signal is also verified during plant shutdown. The test is considered satisfactory if control board indication and visual observations indicate all components have operated and sequenced properly. The periodic testing of pumps in the RHR, SIS, and Containment Spray Systems requires recirculation of water from the RWST. Demonstration of proper operation of these pumps will also demonstrate the operability of the line from the RWST. The BIT and piping normally contain 0 to 2500 ppm boric acid solution. The concentration of boric acid in the BIT is tested periodically to detect the inadvertent introduction of any higher concentrated boron into the system. The pressure of the BIT is monitored routinely from the Control Room. The accumulator pressure and level are continuously monitored during plant operation, and flow from the tanks can be checked at any time using test lines. The accumulators and the injection piping up to the final isolation valve are charged with borated water while the plant is in operation. The accumulator boron concentration is checked periodically by sampling. The accumulators and injection lines are 6.3-56 SGS-UFSAR Revision 9 July 22, 1989 replenished with borated water as required by using the safety 6,3-56a SGS-UFSAR Revision 9 July 22, 1989 THIS PAGE INTENTIONALLY BLANK 6.3-56b SGS-UFSAR Revision 9 July 22, 1989 injection pumps to recirculate refueling water through the injection lines. A small test line is provided for this purpose in each injection header. Flow in the centrifugal charging pumps' common discharge line, safety injection pumps' main flow lines, and in the main flow line for the RHR pumps is monitored by flow indicators in the Control Room. Pressure instrumentation is also provided for the main flow paths of the safety injection and RHR pumps and is located in the Control Room. 6.3.4.3 Operational Sequence Testing The ECCS and the Containment Spray System were operationally tested prior to initial reactor fueling. The tests included individual pump performance tests, accumulator operation, and an integrated system test. Each centrifugal charging, safety injection, RHR and containment spray pump were tested at rated flow capacity. The containment spray pumps discharged through a test line to the refueling canal, while the others discharged to the open RCS through the normal injection path. Additionally, the pumps were run for a minimum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to ensure reliable operation. The purpose of these tests is to evaluate the hydraulic and mechanical performance of the pumps and to detect deficiencies which might occur during sustained operation. Flow distribution tests will also be performed in which the pumps will deliver from the RWST to the RCS through the normal injection paths for emergency core cooling. Adjustments will be made where flow resistances are unacceptably low or high to limit pump runout and balance the flow between piping branches. Total flow and relative flows between branch lines will be compared with minimum acceptable flows as determined in the safety analysis. 6.3-57 SGS-UFSAR Revision 6 February 15, 1987 The accumulators will be tested by charging them to between 67 and 70 psig, accumulator level between 96% and 100%, with the isolation valves closed. The isolation valves will be opened, reactor vessel. Performance will discharging the accumulator into the open be verified by extrapolating the data to normal accumulator pressure. It is neither practical nor feasible to perform these tests at simulated reactor operating conditions. and pressure, there are no With the reactor at normal operating temperature means available to change the primary system parameters as rapidly as required to simulate a 100 percent LOCA, thereby allowing the ECCS to inject water into the system. The system will be tested during hot functional testing, however, to verify that the high pressure components (centrifugal charging pumps) can deliver water to the reactor through pressure. the normal injection path while The test will be conducted injection sequence. the plant by manually is at normal initiating operating the safety A complete operational test will also be performed to demonstrate overall system performance. The purpose of this test is to demonstrate the proper functioning of actuation and instrumentation circuits, emergency power sources, and electrical load sequencing of the Integrated Safeguards System. Data obtained will be used to verify design operation and confirm various sequencing and operating times and logic. The systems are accepted only after demonstration of proper actuation of all components and after demonstration of flow deli very of all components within design requirements. 6.3.4.4 The Salem preoperational testing program meets the requirements of Regulatory Guide 1.79, "Preoperational Testing of Emergency Core Cooling Systems for Pressurized Water Reactors." The scheduled tests, however, may deviate in part from certain specific test 6.3-58 SGS-UF'SAR Revision 19 November 19, 2001 descriptions included in the Guide. enumerated below. Regulatory Position C.3.a.(2) These deviations are Not all injection pumps will be tested at operating conditions, nor will the Auxiliary Feedwater System be actuated by a safety injection signal. Check valves on the charging/safety injection cold leg injection path will be tested utilizing a charging/safety injection pump which will be started by manually initiating a safety injection signal. The check valves on the safety injection hot leg and cold leg injection paths will be tested by pressurizing the test line and throttling water through the check valves. A significant portion of safeguards equipment not directly involved in the delivery of emergency core cooling water to the RCS will be omitted from the test. Thermal shock is not expected, since the total quantity of water injected will be minimized. Branch line throttle valves will be initially shut and then slowly opened, one at a time, to demonstrate flow through the check valves. Regulatory Position C.3.b.(2) Adequate NPSH from the containment sump will be verified by taking a suction from a full sump with one RHR pump and discharging into the RCS. Duration of test run is estimated to be 45 seconds. Vortex control verification will be accomplished by visual observation at the sump. not be measured as it Pressure drop across sump screen will is considered negligible and will not compromise NPSH evaluation. Regulatory Position C.3.c.(l) The accumulators will be discharged, one at a time, into the open reactor vessel. With the RCS closed, pressurized, and solid, as the Guide infers, there is no convenient way to rapidly 6.3-59 SGS-UFSAR Revision 6 February 15, 1987 depressurize at a rate which would provide a meaningful accumulator discharge. The discharge flow rate will be calculated from the measurement of accumulator pressure changes versus time vice level versus time. Regulatory Position C 3 c(2) Only the normal power supply will be used for this test. Emergency Power System capability will be demonstrated during other tests utilizing the emergency diesel-generators. Regulatory Position C.3 c(3) Flow through accumulator check valves will be demonstrated at normal operating temperature and pressure by pressurizing test lines with a charging/safety injection pump. 6.3.5 Instrumentation Application Instrumentation and associated analog and logic channels employed for initiation of ECCS operation are discussed in Section 7. This section describes the instrumentation employed for monitoring ECCS components during normal plant operation and also ECCS post-accident operation. All alarms are annunciated in the Control Room. 6.3.5.1 Temperature Indication 6.3-60 SGS-UFSAR Revision 9 July 22, 1989 Residual Beat Exchanger Outlet Temperature The fluid temperature at the outlet of each residual heat exchanger is recorded in the Control Room. 6.3.5.2 Pressure Indication Boron Injection Tank Pressure Boron injection tank pressure is indicated in the Control Room. A high pressure alarm is provided. Safety Injection Header Pressure Safety injection pump discharge header pressure is indicated in the Control Room. Accumulator Pressure Duplicate pressure channels are installed on each accumulator. Pressure indication in the Control Room and high and low pressure alarms are provided by each channel. Test Line Pressure A local pressure indicator used to check for proper seating of the accumulator check valves between the injection lines and the RCS is installed on the leakage test line. 6.3-61 SGS-VFSAR Revision 9 July 22, 1989 Residual Heat Bamoval PumP Discharge Pressure Reaidual heat removal discharge preasure for each pump is indicated in the Control Room. A high presaure is actuated by each channel. 6.3.5.3 Flow Indication Safety Injection PumP H9ader Flow Flow through each safety injection pump header is indicated in the Control Room. Test Line Flow Local indication of the leakage test line flow is provided to check for proper seating of the accumulator check valves between the injection linea and the Res. Residual Beat Removal Pump Flow The flow of reactor coolant throuqh each RHR header durinq injection or recirculation is indicated in the Control Room. Safety Iniection Pump MinH!um Flow A flow indicator ia installed in the aafety injection pump minimum flow line. 6.3-62 SGS-UFSAR Revision 16 January 31, 1998 6.3.5.4 Level Indication Refueling Water Storage Tank Level The level of water in the RWST is continuously measured by two separate instrument channels (Unit 2 is provided with four instrument channels) with readouts on the main control board. Alarms are set at the proper level to initiate the switchover from injection to cold leg recirculation. Accumulator Water Level Each accumulator tank has two level measuring instruments with readouts on the main control board. Each instrument is set to alarm if the tank level falls or rises by more than a set amount from the normal operating level. Boric Acid Tanks Level Two level indicators give indication and alarm in the Control Room. The Containment Building has two sumps -containment recirculation sump and Reactor Building sump. The containment recirculation sump has two redundant sump water level indicators on the console bezel in the main control room and two redundant sump water level switches that actuate separate console bezel lamps when the minimum required sump water level to support ECCS recirculation operation has been reached. 6.3.5.5 Valve positions which are indicated on the control board are done so by a "normal off" system; i.e. 1 should the valve not be in its proper position a bright white light will be lit and thus give a highly visible indication to the operator. Accumulator Isolation Valve Position Indication The accumulator motor-operated valves are provided with red (open) and green (closed) position indication lights located at the control switch for each valve. These lights are energized from independent power 1 other than the valve's control power, and actuated by valve motor-operator limit switches. 6.3-63 SGS-UFSAR Revision 24 May 11, 2009 I A monitor light that is on when the valve is not fully open is provided in an array of monitor lights that are all off when their respective valves are in proper position enabling safeguards operations. This light is energized from a separate monitor light supply and actuated by a valve motor-operated limit switch. An alarm annunciator point is activated by both a valve motor-operator limit switch and by a valve position limit switch activated by stem travel whenever accumulator is not fully open for any reason with the system at pressure (the pressure at which the safety injection block is unblocked) . A separate annunciator point is used for each accumulator valve. The motor-operator limit switch alarm will be recycled at approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> intervals to remind the operator of the improper valve lineup. 6.3.6 References for Section 6.3 1. Igne, E. G. and Locante, J., "Environmental Testing of Engineered Safety Features Related Equipment (NSSS-Standard Scope), n WCAP-7410-L (Proprietary) December 1970 and WCAP-7744 (Non-Proprietary), Volume 1, August 1971, and Volume 2, September 1970. 2. Nystrom, J. B., "Experimental Evaluation of Flow Patterns in an RHR Sump With Simulation of Screen Nuclear " Alden Research Center, Worcester Polytechnic Institute, January 1981. 3. Nuclear Safety Advisory Letter NASL-93-016, Revision 1, "Containment Spray System Issues," Westinghouse, October 4, 1993. 4. Design-.. Change Package 80068486 Rev. 0, "Relocation of RWST *Pressure Boundary/Plugging of Weep Hole". 5. Design Change Packages 80080787 and 80080788, "Salem Units 1 & 2 Sump Upgrades". 6. S-C-RHR-MDC-2039, "Debris Generation due to LOCA within Containment for Resolution of GSI-191". 7. S-C-RHR-MDC-2056, "Post-LOCA Debris Transport to Containment Sump for Resolution of GS0-191". 6. 3-64 SGS-UFSAR Revision 24 May 11, 2009