LR-N17-0034, Salem Generating Station, Units 1 & 2, Revision 29 to Updated Final Safety Analysis Report, Section 9.2, Water Systems
Text
9.2 WATER SYSTEMS 9.2.1 Service Water System 9.2.1.1 Design Basis The Service Water System (SWS) is designed to supply an adequate supply of cooling water to the reactor safeguard and auxiliary equipment under all credible seismic, flood, drought, and storm conditions. Coolant flow is divided into two portions, namely, the nuclear area and the turbine generator area. These are illustrated on Plant Drawings 205242, 205342 and 205312 and Figure 9.2-2A, respectively. The following equipment is supplied with the SWS. Reactor Containment Building Reactor containment fan cooler units. Auxiliary Building 1. Component cooling heat exchangers 2. Diesel generator units 3. Chiller condensers 4. Auxiliary equipment lube oil coolers 5. Auxiliary equipment room coolers Turbine Generator Building 1. Steam generator feed pump coolers 2. Station air compressor units 9.2-1 SGS-UFSAR Revision 27 November 25, 2013
- 3. Turbine lube oil coolers 4. Turbine auxiliary cooling water heat exchangers 1. Traveling screenwash and strainer backwash 2. Service water pump bearing lubrication 3. Service water pump motor bearing coolers 4. Sodium hypochlorite dilution water 9.2.1.2 Each unit is equipped with six vertical turbine-type strained Delaware River Water to the plant before pumps which provide discharging via the circulating water outlet piping. The pumps for both units are installed in an enclosed intake structure which features four independent pump room compartments containing three pump units each. Each group of three pumps is valved into one of two independent, full-sized, supply headers per unit, which are situated in alternating compartments of the intake structure. Two 15,000 gallon pressurized storage tanks (10,000 gallon normal water volume) are connected to the SW piping downstream of the SW pumps. These normally-isolated tanks are designed to be rapidly placed in service through fast opening isolation valves in order to keep the CFCU SW piping solid following a Loss Of Off-site Power (LOOP) or a LOCA/MSLB concurrent with a LOOP event. A double-valved, normally open, interconnection between the two pump headers is provided to permit the continued operation of the system with any combination of pumps in the event of a supply line 9.2-2 SGS-UFSAR Revision 18 April 26, 2000 outage. Each supply line to the nuclear services portion of the SWS normally feeds approximately 1/2 of the total nuclear area requirement for one unit. In addition, each line is valved at all terminations and provided with double-valved interconnections to permit the removal of either supply line from service without affecting plant operations. Recirculation control (to enable smooth multiple combination pump operation) is provided for each pump room compartment. Pump discharge is recirculated back to the pump intakes through a valve serving the three pumps within each compartment. These valves are modulated by service water pressure measured within the common manifold connecting the discharge of the three pumps within each compartment. Pump requirements on a per unit basis for various plant conditions are outlined as follows: Plant conditions No. of Pumps 1. Normal Operation 4 2. Loss-of-Coolant Accident (LOCA) a. Safety Injection Phase 2 b. Recirculation Phase 3 (1) ( 1) Minimum recirculation requirements can be met with two pumps. Emergency diesel generators are provided to power three pumps during a failure of normal power supply. The total system requirements during various modes of plant operation are listed on Table 9. 2-1 which lists the required pumping requirements based on a maximum river temperature of 90°F. The reactor containment fan cooler (RCFC) units are supplied by individual lines from the containment area service water header. Each inlet and discharge line penetrating the containment wall is 9.2-3 SGS-UFSAR Revision 16 January 31, 1998 provided with a remotely-operated, automatically controlled shutoff valve. This provision allows each fan cooler to be isolated on an individual basis from outside the containment area, Protection from thermally induced overpressure events in the RCFC coils is provided by the installation of bypass lines. These bypass lines are installed in each RCFC loop and back into the SW downstream piping. These bypass lines overpressure conditions from developing in portions of the system during automatic valve sequencing. The Service Water supply and return piping for each RCFC loop contain two restricting orifices (four total for each RCFC) which establish flow during normal and accident modes to meet minimum RCFC containment heat removal Orifice bore sizes were calculated based on minimum flow established under worst case flashing in the Service Water System during conditions to accident operation. The orifice sizes were selected to provide the ability to perform a high flow flush of the RCFCs by starting additional Service Water Pumps (increasing header pressure) to prevent silt deposition. An air-operated valve with adjustable open limit stop downstream of the last orifice on the return side exists for final flow adjustment. The RCFCs will start in low speed during the accident mode of operation. 9.2-4 SGS-UFSAR Revision 24 May 11, 2009 The diesel generators can be provided with service water for cooling from either nuclear supply header through connections located upstream of the Auxiliary tie valves. Each nuclear header connection to the diesel generator coolers is provided with a normally open motor-operated isolation valve inside the Auxiliary Building, as indicated in Plant Drawing 205342. Either of the motor-operated isolation valves can be closed by the operator from the Control Room. Downstream of the motor-operated isolation valves, each service water supply and return header connections to each diesel generator cooler are provided with normally open manually operated inlet and outlet valves and check valves. Rupture of the Service Water piping in this area will result in leakage into the Diesel Fuel Oil Storage Tank rooms or the Cardox Storage Tank room. The Diesel Fuel Oil Storage Tank rooms are designed to contain a Fuel Oil leak and have no drains. Any leakage in these areas will fill the room to the curb elevation (Approximately 40") and spill back into the Cardox Storage Tank Room. The Cardox Storage Tank Room has no drains and therefore any leakage into this area will run out into the Auxiliary Building and into the Auxiliary Building Drain System. The maximum postulated leak rate from a crack in this piping will not affect the ability of the Service Water System to provide sufficient flow to all components. Operations will become aware of the leakage indirectly based on increasing sump levels. Action on this leakage will be based on increasing radwaste inventory rather than loss of function of Safety Related equipment. Onsite identification of the location of the leak will be required to determine which valves must be closed to isolate the leak. As required, either header can be isolated by closing the motor-operated isolation valve, or an 9.2-5 SGS-UFSAR Revision 27 November 25, 2013 individual diesel can be isolated by closing the manual inlet and outlet isolation valves. As required, the affected Diesel generator can be unloaded and shutdown. Note that the manual isolation valves are all accessible and are located above the maximum flood elevation in Fuel Oil Storage Tank Room permitting operator access and identification. Failure of one of the nuclear supply headers downstream of the tie valves in the Auxiliary Building will not interrupt the supply of service water to the equipment required to operate following a LOCA. Each of the two service water loops provides service water to one component cooling heat exchanger, one charging pump lube oil cooler, one safety injection pump lube oil cooler, and three containment fan cooler units. Each service water nuclear discharge header crosses the yard and enters a 120 inch diameter circulating water discharge pipe, which discharges directly to the Delaware River. An evaluation has demonstrated that the water discharge function of the circulating water discharge piping will be maintained during and after a postulated design basis event. Thus, a postulated seismic event will not interrupt the service water discharge from the plant. An access manway for personnel egress and isolation valve will be installed in the SW discharge headers near the tie-in to the CW piping allowing for the headers to be dewatered for inspections. During this evolution it is acceptable to use interim structural pipe supports that are designed to address angular deflection and axial movement capabilities under seismic loads. In addition, interim concrete missile shields are provided for any time the header is excavated. These missile shields meet the requirements to withstand applicable tornado missiles as defined in Section 3.5.2.1 of the UFSAR. The safety related auxiliary building pump room and lube oil coolers are fed by two independent room/lube oil cooler headers. Each of these headers is normally supplied from one of the two main service water headers. In the event that one main header is out of service downstream of the Auxiliary Building tie-valves, normally locked closed cross-connections provide the ability to operate both the room/lube oil cooler headers from the remaining operational main header. 9.2-6 SGS-UFSAR Revision 28 May 22, 2015 The cross connect consists of supply and return branches. These branches are located upstream and downstream of the component cooling heat exchangers in the component cooler heat exchanger rooms, and are sized to allow for acceptable flow to meet the design requirements for all the coolers in use with only one main service water header available. The service water pumps are of the vertical, multistage, turbine type, each rated at 10,875 gpm and 265 foot head, and directly driven by 1000-hp induction motors powered from the plant vi tal buses. Administration control may be required to maintain pump performance at a higher level in order to ensure acceptable system margins. The pumps for each unit are mounted in two individual dewaterable cells of the intake structure with three pumps to a cell. The intake structure, shown on Plant Drawing 211612, is physically apart from the turbine condenser circulating water pump intake. The pumps are arranged to afford adequate submergence during the lowest credible water level elevation of 76.0 feet. The motors are protected from flooding by the pump room compartments which are watertight to Elevation 126'-0" with wave run-up protection to Elevation 128 '-0", and which contain sump pumps. Automatic traveling water screens are provided at each intake cell and combine with full-depth trash racks to filter debris from the incoming flow. Trash racks are inspected and cleaned periodically to maintain unobstructed passageways at the trash racks. Two-foot-wide fish-escape passages are located abreast of the traveling screens to minimize the entrapment of fish in the individual intake cells. The primary method to prevent organic buildup in the heat exchangers and piping is by injecting sodium hypochlorite into the suction of each service water pump. In addition, the system provides for injection of sodium hypochlorite downstream of the SW strainers when conditions require the SW strainers to be placed in continuous backwash operation. Each pump discharges to an automatic, self-cleaning strainer and check valve prior to entering the compartment supply header. The SWS intake structure is located about 200 yards from the Delaware River shipping channels. It is expected that shipping will not approach the intake since the channel is marked by buoys and lights. Due to the large distance between the intake and the shipping channel, vessels which may be adrift can be secured, anchored, or grounded before coming into the vicinity of the intake. In the event that small unattended barges do drift into the vicinity of the intake, marine dock bumpers have been installed to prevent damage to the structure. 9.2-6a SGS-UFSAR Revision 28 May 22, 2015 The six service water pumps for each unit are arranged in groups of three pumps each, and each group of pumps for one unit is installed in alternate watertight compartments inside the intake structure, as indicated on Plant Drawings 205242 and 205342. Each service water pump is recessed approximately 50 feet from the river face of the intake. Based on the above, damage or blockage to two adjacent compartments of the intake can occur without cutting off the supply of service water to each unit. In the event that a river borne oil spill occurs which could affect the service water intake, floating oil spill booms will be installed as needed to protect the two end cell fish-escape passages opening to the river to prevent oil from entering the intake at any river water level above 81 feet. A curtain wall at Elevation 81 feet extending across the entire intake structure, except in the fish escape passages, prevents any oil from entering the intake at any river level above this elevation. Lowest recorded river water level is 83 feet-1 inch. The vertical turbine type service water pumps take suction at Elevation 71'-6" for Johnston Pump Co. pumps, which is below the minimum credible river water level of 76 feet. Based on the above, oil floating on the river surface will not be drawn into the pumps. Should the river water level drop below elevation 81 feet with water borne oil present, the plant would be shut down. The SWS is designed for Class I (seismic) conditions except for the turbine area service water piping outside of the service water intake structure, which is of non-Class I (seismic) design. The Class I (seismic) service water piping inside the service water intake structure which supplies the turbine area is provided with two motor-operated valves, SW-20 and SW-26, in series, to isolate the non-Class I (seismic) portion of the system upon receipt of a safety injection signal or a loss of off site power. The two motor-operated valves in series are powered from separate vi tal buses to ensure isolation of the non-Class I (seismic) portion of the SWS. 9.2-6b SGS-UFSAR Revision 28 May 22, 2015 The hypochlorite system piping inside the service water intake structure is designed for Class II (seismic) conditions, but the pipe supports are designed to Class I (seismic) criteria. The separated redundant service water lines between the service water pumps and the Unit 1 component cooling heat exchangers are not located in open trenches as such, but rather are constructed of reinforced concrete pipe completely buried in trenches." the ground. Thus, in effect, they are The principal supply line piping runs are located in separated by about 13 feet. This separation, in buried, makes these lines conjunction with the depth at which they have been essentially invulnerable to damage from a single event. The above discussion also applies to the service water piping to the Unit 2 component cooling heat exchangers except for one section of piping running along the west side of the Auxiliary Building. Though not buried, this piping is located within a 4 foot-6 inch thick reinforced concrete pipe tunnel. The redundant supply lines within the tunnel are separated by a 3-foot thick reinforced concrete wall, again precluding coincident failure due to a single event. Status is displayed and control of each service water pump is available on the main control so that an operator can determine if an abnormal number of pumps is operating. In addition, indication of the 14 and 24 pump in "TEST" is displayed on the auxiliary annunciator during performance of surveillance . Status and control of all SWS isolation valves and motor-operated header block and tie valves is also available to the operator in the Control Room. The motor-operated valve operators (with the exception of the Turbine Area isolation valves) their closing or opening cycle in 1 minute wh1le the containment isolation valves can close in 10 seconds. The Turbine Area isolation motor operated valves have a more rapid operating time of a maximum of 37 seconds. The rupture of a large pipe or other event causing a high system flow demand will be indicated to the operator by decreasing pump header pressure shown on the main control panel. Low pump header pressure will be alarmed to the main control room. If pump discharge header pressure continues to'fall, and outside power is available, a backup service water pump will start automatically. 9.2-7 SGS-UFSAR Revision 18 April 26, 2000 In the event that a pipe rupture occurs in a watertight pump compartment in the service water intake structure, which is beyond the capacity of the 125-gpm sump pump, high sump level for the affected compartment will be alarmed to the Control Room. 1'he Room operator can remotely close the tie valves and header block valves at the intake structure to isolate the affected compartment and remotely start the remaining pumps in the other pump an orderly plant shutdown. 'In the event that a main yard supply header J.s ruptured, can be isolated by the Control Room who can also at the Amdliary Building. Ruptu.re of a header pipe for tunnel can also be detected by high level to the Control to the affected header open the tie valves Onit 2 in the pipe Room alarm from the sumps containing a 100 gpm pump. The Control Room operator can determine the affected header by remotely closing the intake tie valves and observing which pump header is affected by low-low pressure. Once the rupture yard header is isolated, the intake tie valves can be opened and all service water pumps made available. Service water piping in the Auxiliary Building is, for the most accessible during operation for by the operators. Generic Letter (GL) 96-06 was issued by the NRC to notify utilities of safety significant issues that could affect containment integrity and equipment operability during accident conditions. The SW system is designed to withstand the effects of events described in GL 96-06. These GL concerns of thermal1y induced overpressure, the development of two-phase flow regions, and column or voiding leading to the possibility of waterhammer events are addressed by system modifications. A pressurized tank in each of the two service water headers is installed to serve the containment .fan cooler unit (CFCU) loops. 'l'he supply lines between the tanks and the SW headers have fas.t opening valves to allow flow in the event of a LOOP (l,oss Of Off-site Power). or LOOP/LOCA. The tanks have a volume of 151000 gallons each and are pressur.ized *with nitJ:ogen, and discharge into the SW system upon a loss of off-site power. The vessels are sized to contain sufficient . water inventory to keep the SW pip:Lng full for all postulated operating and single failure conditions. A building houses the .,. storage tanks, piping and the storage tank instrumentation and controls, 9.2-8 SGS-UFSAR Revision 23 October 17, 2007 * *
- Each storage tank has non-safety related redundant level, temperature and pressure instruments. Local instrumentation will include level, and pressure indications. The main control room is provided with a common "tank troublen overhead annunciator and an individual alarm for each storage tank. The non-safety related classification is considered acceptable on the basis that critical system parameters are periodically monitored during normal operation to assure operational readiness of the system. During normal operations and following a LOOP, the supply tanks are filled by a makeup water pump located at each storage tank. The pumps are manually controlled and are supplied from the SW system. The storage tank discharge valves are air operated butterfly valves designed to spring open rapidly upon a Loss of Offsite Power. The valves are powered from redundant safety related 125 VDC channels and are designed to be energized to open and fail closed on a loss of control power. This design assumes one of the two flow paths for each tank will be operable while ensuring against spurious operation. Air is required to close the valves. Redundant undervoltage relays installed on the 4KV vital buses are combined in a 3 out of 3 logic to energize the valve solenoid, venting air from the operators to open the valves. Bypass lines are installed to protect from thermally induced overpressure events in the CFCU piping. These bypass lines are installed in each CFCU loop and discharge back into the SW system's downstream piping. In the event that a pipe rupture occurs in the service water piping inside the containment, high level alarms in the containment sump and the fan cooler drain pot will be transmitted to the Control Room. The Control Room operator can remotely close the containment isolation valves to isolate the leaking fan cooler unit. 9.2-Sa SGS-UFSAR Revision 24 May 11, 2009 THIS PAGE INTENTIONALLY BLANK 9.2-Bb SGS-UFSAR Revision 18 April 26, 2000 ._,
In the event that radiation is detected at one of the service water outlets from the containment, the condition is alarmed in the Control Room. The final decision to isolate the coils is based on plant conditions, analyses, and indications. The service water flow through the containment fan cooler units is indicated on the control console. A temperature detector monitors the fan cooler outlet temperature, which is indicated on the control console; high water temperature could be an indication of inadequate flow. The service water flow through each Component Cooling Heat Exchanger is controlled by means of a cascade control system which simultaneously throttles both the inlet and outlet control valves with a common control air signal. The valves are throttled to maintain component cooling water outlet temperature as the primary parameter, and flow will be limited to a nominal operating value of 10,000 GPM as the secondary parameter. The indicating valve control system is mounted on an instrument panel which is located in the Auxiliary Building in the vicinity of the heat exchanger. In addition, a flow transmitter alarms a service water high flow condition on the overhead annunciator in the Control Room. In certain post-accident alignments, available system pressure will be limited such that the Component Cooling Heat Exchanger original design flow of 10,000 gpm may not be attainable for both heat exchangers. As noted in Table 9.2-1, the currently evaluated design (minimum required) flow has been defined to be 8, 000 gpm with 90° F water. The capability of meeting or exceeding this flow, where required, is demonstrated in detailed system calculations. 9.2-9 SGS-UFSAR Revision 24 May 11, 2009 I I I Material inspection, fabrication, and quality control conform to ANSI B31. 7. Where not possible to comply with ANSI 831.7, the requirements of ASME III-1971, which incorporated ANSI 831. 7, were adhered to. In addition, the weld inspection criteria of later Editions and Addenda of ASME III, as approved by the NRC, can be specified. Radiographs of Nuclear Class 3 cement-lined pipe were difficult to interpret. The 1970 addenda to 831.7 allowed 100-percent magnetic particle inspection in lieu of random radiography. This provision was also incorporated into Section III, 1971 Edition. The SWS contains Nuclear Class 3 cement-lined pipe for which thls alternate inspection method was utilized. In addition, the weld inspection criteria of later Editions and Addenda of ASME III, as approved by the NRC, can be specified. For the original cement lined piping the use of a later code was restricted to inspection and did not involve any requirements from Section III such as material, stress calculations, etc., that would modify our original design. Consequently, Therefore it other requirements is believed that from a later code would not be applicable. the integrity of field welds has not been compromised and that we have complied with our commitment to use ANSI B31. 7 whenever In addition, the weld inspection criteria of later Editions and Addenda of ASME III, as approved by the NRC, can be As part of a reliability improvement program, replacement of portions of the system piping was initiated in 1988 for both Unit 1 and Unit 2. The replacement material selected after an extensive qualification program is a 6% molybdenum Austenitic Stainless Steel, which is furnished to the material requirements of the ASME code Section III, Division 1. However, fabrication, and installation of this piping material is in accordance with ANSI B31.7 and therefore compliance with the commitment to utilize ANSI 831.7 wherever possible has again been maintained. In addition, the weld inspection criteria of later Editions and Addenda of ASME III, as approved by the NRC, can be specified. In order to provide enhanced accuracy and repeatability for periodic ASME Section XI performance testing, a full flow Service Water Pump surveillance test line was added to the Service Water Intake 9.2-9a SGS-UFSAR Revision 18 April 26, 2000 -
Structure by DCP lEC-304 7 in 1991. This line is connected to the Unit 1 Service Water pipe at the 30" crossover line between the SW17 valves in a section of pipe located in bay #2 (Ref. Plant Drawing 205242) and into the Unit 2 Service Water pipe at the 30" crossover line between the SW17 valves in a section of pipe located in bay #3 (Ref. Plant Drawing 205342). These connections are 16" in size and are connected to two 16" butterfly valves which are normally closed. The 16" lines reduce down to 12" lines and penetrate outside the east wall of the Intake Structure through watertight seals. Outside the wall the two lines connect together and run around to the north wall. The line expands to 20" for the flow measuring section which has a long straight run that is essential for the flow measurement element located along the north wall. The line then runs through a butterfly valve used for initial filling prior to each flow test and exhausts to the Trash Basket back to the river. The two 16" butterfly valves provide double isolation and form the boundary between the safety related and non-safety related portions of the line. All the supports on this line are designed to Seismic Class I criteria. The surveillance line provides the capability to accomplish a performance test for each individual Service Water Pump utilizing a direct recirculation flow path around the Intake Structure through a high accuracy flow element that is independent of the rest of the plant. 9.2-9b SGS-UFSAR Revision 27 November 25, 2013 9.2.1.3 Design Evaluation The SWS is designed to remain operable under each of the following conditions: 1. Any one pump failure and one pump under maintenance 2. Any one pump failure and two pumps under maintenance provided that: 1. No more than one pump per intake bay is removed from service, and 2. No more than one pump per vital bus is removed from service 3. One main supply header failure 4. Loss-of-coolant accident coincident with loss of offsite power and subsequent 4-kV vital bus failure. 5. Failure of components such as individual valves that receive active control signals to change position or modulate are addressed as active failures. Updates to the design evaluation were made in 1997 to address GL 96-06 concerns relative to maintaining the containment cooling portions of the system free of voids or column separations, above saturation pressure and protected from thermally induced overpressure. In order to support these updates, were established based on the design and licensing basis of the Service Water System regarding certain types of single failures. The key positions are identified below: a. The failure, or spurious actuation of a remotely operated, manually controlled, or power operated (i.e., either that does not have any automatic actuation s to be a credible failure. air or motor) valve is not considered b. Failures of check valves to move to their intended position following an accident scenario are considered passive failures. The minimum engineered safeguards equipment required to safely shut down the unit will not be limited by any of these failures. 9.2-10 SGS-UFSAR Revision 18 April 26, 2000 -
As part of the GL 96-06 modifications, RCFCs are maintained free of voids or column separation, above saturation pressure, and protected from thermally induced overpressure events during all normal operating and abnormal events. 9.2.1.4 Tests and Inspections The system was hydrostatically tested prior to station operation. All active components (valves, pumps, and controls) were functionally tested prior to startup. Surveillance requirements for inservice inspection and testing of components are in accordance with the Technical Specifications. 9.2.2 Component Cooling System An independent Component Cooling System, shown on Plant Drawings 205231 and 205331, is provided for each unit. All information in this section refers to one unit. Unit 2 is of a similar design. 9.2.2.1 Design Bases The system is designed to remove residual and sensible heat from the Reactor Coolant System (RCS) via the Residual Heat Removal (RHR) System during plant shutdown, cool the spent fuel pool water and the letdown flow to the Chemical Volume and Control System (CVCS) during power operation and provide cooling to dissipate waste heat from various primary plant components. The design of the Component Cooling System is based on a maximum service water supply temperature Active system components which are considered vital to the cooling function are redundant. Redundancy of components in the Component Cooling System, when provided, does not degrade the performance or reliability of any system which the Component Cooling System serves. Any single active or passive failure in the system will not prevent the system from performing its design function. The system design provides means for detection of radioactivity entering the system from the RCS and its associated auxiliary systems and includes provisions for isolation of system components. 9.2-11 SGS-UFSAR Revision 27 November 25, 2013 9.2.2.2 Codes and Classifications All piping and components of the Component Cooling System will be designed to the applicable codes and standards listed in Table 9.2-2. Component cooling water contains a corrosion inhibitor to protect the carbon steel. 9.2.2.3 System Description The component Cooling System consists of three component cooling pumps, two component cooling heat exchangers, a component cooling surge tank, cooling lines to various components being cooled, and associated piping, valves, and instrumentation. The component coolant flows from the pumps, through the shell side of the component cooling heat exchangers, shell and tube type, or through the component cooling water side of the component cooling heat exchangers, plate type, through the components being cooled, and back to the pumps. The surge tank is connected to the suction side of the component cooling pumps. Makeup water is supplied to the loop near the surge tank. During normal full power operation, one or two component cooling pumps and one component cooling heat exchanger accommodate the heat removal loads. The standby pump and the standby heat exchanger provide backup during normal operation. Operation of all component cooling pumps and both component cooling heat exchangers is required for removing residual and sensible heat during a normal plant shutdown. Failure of one of these components increases the time required for shutdown but does not affect the safe operation of the plant. In the event of a LOCA one pump and one heat exchanger are capable of fulfilling system requirements. Three main cooling headers are provided: two isolable headers which supply cooling water to essential safety equipment, and one header which supplies cooling water to the other plant auxiliaries. With this arrangement, long-term cooling of the Engineered Safety Features under accident 9.2-12 SGS-UFSAR Revision 6 February 15, 1987 conditions is assured considering an active component failure or the development of excessive leakage in one header in the Component Cooling System. Cooling water for the component cooling heat exchangers is supplied from the sws insuring a continuous source of cooling under all conditions. Component cooling is provided for the following heat sources: 1. Residual heat exchangers 2. Reactor coolant pump motor bearing oil coolers and thermal barriers 3. Letdown heat exchanger 4. Excess letdown heat exchanger s. Seal water heat exchanger 6. Spent fuel pool heat exchanger 7. Sample heat exchangers (Unit 1 COmponent Cooling system serves the sample heat exchangers for both units.) a. Boric acid evaporator condenser and condensate cooler 9. cooling for residual heat removal, safety injection, and charging pumps 10. waste Disposal system components Design flow rates under various conditions are tabulated in Table 9.2-3. All components served are arranged in three main headers with parallel flow circuits from each header. Cooling water is normally available to all components served by the system, even 9.2-13 SGS-UFSAR Revision 6 February 15, 1987 though one or more of the components 111ay be isolated. Motor-operated valves are used to provide the residual heat exchangers with cooling water should it become necessary to place these component* in service under LOCA conditions. At the reactor coolant pump, component cooling water removes heat from both the motor bearing oil and the thermal barrier. The component cooling Water system is considered an Engineered Safeguards System, since it is required for poet-accident decay heat removal. For that reason, it is designed to meet the single active or passive failure criteria. Two mechanical safety trains are provided, each of which is capable of satisfying the system safety function when operated independently. The mechanical safety trains are normally cross connected, with safety related heat loads split between the two trains. Each train is supplied by a common pump discharge header. Flow is through the cc Heat Exchangers, and then through parallel flow paths to the safety related heat loads. Return flow from each train is through separate piping into a common suction header. Three safety related pumps are provided. Each pump is powered from separate vital buses and discharges into a common discharge header. The pumps and associated heat exchangers are installed in two separate rooms on elevation 84 ft. in the Auxiliary Building. The surge tank is located on elevation 120 ft. in the Auxiliary Building, and is divided into two sections by a baffle. The tank sections are connected via independent piping runs to each train's return line. Following an accident, the control Room operator evaluates the status of available equipment and if necessary, manually realigns the system to assure heat removal requirements are satisfied. Redundant remote motor-operated valves, operated from the control room, are provided to allow the operator to accomplish any required system alignment, such as establishing two independent safety trains when necessary. This compliment of equipment provides sufficient redundancy to assure that the system safety function is maintained following the most limiting single electrical or mechanical failure. Since the heat is transferred from the component cooling water to the service water, the component Cooling System serves as an intermediate system between the RCS and the SWS and insures that any leakage of radioactive fluid from the components being cooled is contained within the plant. The surge tank accooaodates expansion, contraction, and in-leakage of water and insures a continuous component cooling water supply until a leaking cooling line can be isolated. Radiation monitors are provided on the component cooling heat exchanger discharge lines. The monitors actuate alarms and close the surge tank vent valve when the radiation level reaches a preset level above the normal background. 9.2-14 SGS-UFSAR Revision 16 January 31, 1998 Water chemistry control of the Component Cooling System is accomplished by chemical additions to the surge tank and by addition of demineralized water to the system through two lines connected to the suction header of the pumps. The operation of the system is monitored with the following instrumentation: 1. Temperature detectors in the inlet and outlet lines for each component cooling heat exchanger 2. Pressure detectors on the pump discharge headers 3. A temperature indicator in the outlet line from each heat exchanger 4. A radiation monitor in each component cooling heat exchanger discharge line 5. A level indicator and alarm on each side of the surge tank 9.2.2.4 Components Component Cooling System component design data are listed in Table 9.2-4. 9.2.2.4.1 Component Cooling Heat Exchangers Two component cooling heat exchangers are provided for each unit. Unit 1 has one tube and shell-type heat exchanger and one plate-type heat exchanger; Unit 2 has two tube and shell-type heat exchangers. Service water circulates through the cold side while component cooling water circulates through the hot side. Each component cooling heat exchanger is designed to remove one-half of the heat load occurring at 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after plant 9.2-15 SGS-UFSAR Revision 6 February 15, 1987 shutdown. Each heat exchanger is also capable of removing one-half of the maximum heat removal load occurring when the RHR System is first placed in operation during a plant cooldown operation. The heat removal load during normal full-power operation is transferred by one component cooling heat exchanger with the additional exchanger providing 100 percent standby capacity. The provision of two component cooling heat exchangers assures that heat removal capacity is only partially lost if one exchanger fails or becomes inoperative, and allows maintenance or replacement of one exchanger while the other unit is in service. 9.2.2.4.2 Component Cooling Pumps The three component cooling pumps which circulate component cooling water through the Component Cooling System are horizontal, centrifugal units of standard commercial construction. The pump motors receive electric power from the 4160-V vital buses. The component cooling flow requirement during full-power operation is normally met by operation of two component cooling pumps; the third pump provides standby capacity. During plant cooldown all three pumps are operated and each pump circulates one-third of the total component cooling flow. 9.2.2.4.3 Component Cooling Surge Tank The surge tank, in addition to the piping connections, has a flanged opening at the top for additions of chemical corrosion inhibitor to the Component Cooling System. For the purpose of homogenizing this chemical with the rest of the system, a recirculation line from the pump discharge is provided. Normally the tank is open to the atmosphere, but if high radiation is detected in the Recirculating System the vent line is 9.2-16 SGS-UFSAR Revision 6 February 15, 1987 automatically closed. The tank is connected to the system by two lines, both equipped with locked-open valves. The tank has an internal baffle divider to provide two separate surge volumes. This arrangement provides redundancy for a passive failure during recirculation following a LOCA. 9.2.2.4.4 Valves Since the component cooling water is not normally radioactive, special features to prevent leakage from the valves to the atmosphere are not provided. Self-actuated spring loaded relief valves are provided for lines and components that could be pressurized to their design pressure by improper operation or malfunction. 9.2.2.4.5 Piping All Component Cooling System piping is carbon steel or substitutable chrome alloy material with welded joints and connections except at components which might require removal for maintenance. The piping is of carbon steel since the coolant contains a corrosion inhibitor. 9.2.2.5 Design Evaluation 9.2.2.5.1 Availability and Reliability Inside the containment, most of the piping, valves, and instrumentation are located outside the crane wall at an elevation above the water level in the bottom of the containment at post-accident conditions. In this location the portions of the system within the containment are protected against credible missiles and from flooding during post-accident operations. This location also provides radiation shielding which permits maintenance and inspection to be performed during power operation. (The exceptions are the cooling lines for the reactor coolant pumps which are isolated following a postulated LOCA.) 9.2-17 SGS-UFSAR Revision 14 December 29, 1995 The component cooling pumps, heat exchangers, and associated valves, piping and instrumentation are located outside of the containment and are therefore available for maintenance and inspection during power operation. Replacement of a pump or heat exchanger is practicable while the other components are in service. Sufficient cooling capacity is provided to fulfill all system requirements under normal and accident conditions. Adequate safety margins are included in the size and number of components to preclude the possibility of a component malfunction adversely affecting operation of safeguards equipment. Power is supplied to each of the component cooling pumps from separate 4160 V buses. These buses are normally supplied from separate diesel generators in the event of loss of offsite power. Upon power failure coincident with a LOCA, the component cooling pumps are manually loaded on the vital buses. During a LOCA not coincident with loss of offsite power, the diesels will start but will not be loaded and power to the component cooling water pumps is not interrupted. 9.2.2.6 Leakage Provisions To minimize the possibility of leakage from piping, valves, and equipment, welded construction is used wherever possible. The component cooling water could become contaminated with radioactive water due to one of the following conditions: 1. A leak in any heat exchanger tube in the CVCS, Sampling System, RHR System, or Spent Fuel Pool Cooling system or a cooling coil for the thermal barrier cooler on a reactor coolant pump. 2. SGS-UFSAR A leak in the residual heat exchangers following an accident. (Tube or coil leaks in components being cooled are detected by radiation monitors located on the component cooling heat exchanger outlet headers.) 9.2-18 Revision 6 February 15, 1987 The relief valves on the cooling water lines downstream of the sample, letdown, excess letdown, seal water, spent fuel pool and residual heat exchangers are sized to relieve the volumetric expansion occurring if the exchanger shell side is isolated and high temperature coolant flows through the tube. side. The set pressure equals the design pressure of the shell side of the heat exchangers. The relief valve on the component cooling surge tank is sized to relieve the maximum flow rate of water which enters the surge tank following a rupture of a reactor coolant pump thermal barrier cooling coil. The set pressure is equal to the design pressure of the component cooling surge tank. The discharge of this valve is directed to the waste holdup tank. The relief valve on the plant auxiliaries' header is sized to relieve the volumetric expansion from all components on that header should it be isolated from the surge tank. 9.2.2.7 Incident Control The portion of the Component Cooling System located inside the containment can be isolated following a LOCA. The lines to and from the excess letdown heat exchanger are isolated in phase A isolation and the lines to and from the reactor coolant pumps in phase B. The cooling water supply line to the reactor coolant pumps contains a check valve inside and remote operated valves outside the containment wall. Each return line from the pumps has remote operated valves inside and outside the containment wall. The cooling water supply line to the excess letdown heat exchanger contains a check valve inside the containment wall and both supply and return lines have valves outside the containment wall which can close automatically to isolate that portion of the system. Except for the normally closed makeup line and equipment vent and drain lines, there are no direct connections between the cooling water and other systems. The equipment vent and drain lines outside the containment have manual valves which are normally SGS-UFSAR Revision 13 June 12, 1994 closed unless the equipment is being vented or drained for maintenance or repair operations. The Component Cooling System instrumentation provides the required signals for safe, reliable, and efficient operation and control of the system. All alarms are located in the Control Room. 9.2.2.8 Reactor Coolant Pump/Motor Cooling 9.2.2.8.1 Description Component cooling water is provided to the reactor coolant pump thermal barrier heat exchanger, as well as to the upper and lower motor bearing oil coolers. In addition, seal injection flow is supplied to the pumps from the eves. These cooling supplies are discussed in the following paragraphs and are shown schematically on Figure 9.2-5. The thermal barrier is a welded assembly consisting of a flanged cylindrical shell, a series of concentric stainless steel cans, a heat exchanger coil assembly, and three flanged water connections. Component cooling water enters the thermal barrier through a flanged connection on the thermal barrier flange (See Figure 9. 2. 6) . The cooling water flows through the inside of the coiled stainless steel tubing in the heat exchanger and exits through another flanged connection on the thermal barrier flange. During normal operation, the thermal barrier limits the heat transfer from the reactor coolant to the pump internals. If a loss of seal injection flow should occur, the heat exchanger in the thermal barrier assembly cools the reactor coolant before it enters the radial bearing and the shaft seal area. Conversely, if a loss of component cooling water to the thermal barrier heat exchanger should occur, the seal injection flow is sufficient to prevent damage to the seals. SGS-UFSAR Revision 6 February 15, 1987 The upper bearing assembly contains an oil-cooled pivoted-pad radial guide bearing (upper guide bearing), as well as a double acting oil-cooled Kingsbury-type thrust bearing (see Figure 9.2-7). The thrust bearing shoes are positioned above and below a common runner to accommodate thrust in both directions. The shoes are mounted on equalizing pads, which distribute the thrust load equally to all the shoes. The oil is circulated through and cooled by component cooling water in an external oil-to-water shell and tube heat exchanger (oil cooler). The lower guide bearing is a pivoted-pad radial bearing, similar to the upper guide bearing. The entire lower guide bearing assembly is located in the lower oil reservoir, which contains an integral oil-to-water coil type heat exchanger (See Figure 9.2-7). As discussed above, component cooling water is provided to the reactor coolant pump thermal barrier heat exchanger, as well as to the upper and lower motor bearing oil coolers. Should a loss of component cooling water to the reactor coolant pumps occur, the eves continues to provide seal injection flow to the reactor coolant pumps; the seal injection flow is sufficient to prevent damage to the seal with a loss of thermal barrier cooling. However, the loss of component cooling water to the motor bearing oil coolers will result in an increase in oil temperature and a corresponding rise in motor bearing metal temperature. It has been demonstrated by testing (discussed below) that the reactor coolant pumps will incur no damage as a result of a component cooling water flow interruption of 10 minutes. Two reactor coolant pump motors have been tested with interrupted component cooling water. These tests were conducted at the Westinghouse Electro Mechanical Division. In both bases, the reactor coolant pumps were operated to achieve "hot" (2230 psia, 9.2-21 SGS-UFSAR Revision 6 February 15, 1987 5S2*F) equilibrium conditions. After the bearing temperatures stabilized, the cooling water flow to the upper and lower motor bearing oil coolers was terminated and bearing (upper thrust, lower thrust, upper guide and lower guide) temperatures were monitored. A bearing metal temperature of 185°F was established as the maximum test temperature. When that temperature was reached, the cooling water flow was restored. In both teats, the upper thrust bearing exhibited the limiting temperatures. Figure 9.2-8 shows the upper thrust bearing temperature versus time. In both cases, 185°F was reached in approximately 10 minutes. The reactor coolant pump bearing temperature alarm is set at 175 degrees Fahrenheit. The operator will immediately execute the trip procedure upon receipt of this alarm. The maximum teat temperature of 185°F is also the suggested alarm setpoint temperature, and the suggested trip temperature is 195°F. It should be noted that the melting point of the babbitt bearing metal exceeds 400°1". The information presented above constitutes the basis of the RCP qualif1cation for 10-minute operation without component cooling water with no resultant damage. 9.2.2.8.2 operating Procedures Public Service Electric & Gas (PSE&G) operating Procedures for Salem Units 1 and 2 have been revised to address the loss of component cooling water to the reactor coolant pumps in sufficient detail to cover the concerns expressed. Upon a valid low component cooling flow alarm to a single reactor coolant pump, the operator will trip the reactor coolant pump within 5 minutes if flow cannot be restored to the reactor coolant pump. Upon a valid low component cooling flow alarm to more than one reactor coolant pump, the operator will trip the reactor and affected RC pumps within 5 minutes if flow cannot be restored to the RCPs. This action will be performed prior to the motor bearing reaching its design operating temperature. 9.2.2.8.3 Analysis of Simultaneous Multiple Pump Seizure Probability As discussed above, a loss of component cooling water to the motor bearing oil coolers will result in an increase in oil temperature 9.2-22 SGS-UFSAR Revision 16 January 31, 1998 and a corresponding rise in motor bearing temperature. Westinghouse contends that the loss of component cooling water to the reactor coolant pumps will not result in an instantaneous seizure of two pumps simultaneously and is not a credible ultimate consequence. Instead, it is Westinghouse's technical opinion that a more realistic ultimate consequence will be an abbreviated coastdown. If a limiting condition of the babbitt metal is considered, an increasing coefficient of friction as well as an increasing retarding torque is expected. However, in view of the large rotational inertia of the pump/motor assembly, Westinghouse maintains that an instantaneous seizure will not result. Because an initial seizure is not expected, it is not possible to define a precise point in time at which a sequential seizure would be anticipated. Therefore, for the purpose of defining the time expected between sequential seizures, the following discussion is presented in terms of sequential occurrences of reaching a "high" bearing temperature. As discussed above, the upper thrust bearing exhibits the limiting temperature. Therefore, an upper thrust bearing temperature of 240°F has been chosen arbitrarily as the "high" temperature. It should be noted that the use of this value does not imply pump seizure at this temperature. Variables affecting the steady state operating temperature of the bearings include the following: 1. Surface finish of the bearing and runner 2. Bearing (and oil pumping mechanism) clearances 3. Inlet temperature of water to heat exchanger (oil cooler) 4. Condition of oil-to-water heat exchanger (oil cooler), i.e., extent of fouling 9.2-23 SGS-UFSAR Revision 6 February 15, 1987
- 5. Condition of oil 6. Amount of oil in oil pot 7. Oil temperature These variables would be expected to interact concurrently in a manner which individualizes the performance of the bearings during actual steady state plant operation. In order to quantify the resultant variation in performance, Westinghouse has collected data from an operating four-loop plant. This data demonstrates that the upper thrust bearings operate at different steady state temperatures (i.e., 128°F, 132°F, 135°F, and 145°F). Using these actual steady state operating values (A=128°F, B=l32°F, C=135°F, D=l45°F) and assuming a conservative 5°F/minute linear heatup rate after a loss of component cooling water sequential occurrences of reaching the "high" bearing temperature could be expected at the time intervals tabulated below: (See Figures 9.2-9 and 9.2-10) Time Sequential Operating Interval Motors Temperature (OF) (minutes) A and B 4 0.85 B and c 3 0.65 c and D 10 2.875 A and c 7 1.5 B and D 13 2.525 A and D 17 3.375 To summarize, two bearings sequentially reaching a temperature of 240°F could be expected at a minimum time interval of 0.65 minute and at a maximum time interval of 3.375 minutes. Westinghouse has obtained motor bearing heatup data, as discussed previously. SGS-UFSAR These test data show actual values of bearing 9.2-24 Revision 6 February 15, 1987 temperatures following a loss of component cooling water. The test data presented on Figure 9.2-8 will be examined relative to the above discussion. The test runs, which were performed at different times using different motors, demonstrate similar heatup rates. This fact supports the assumption of identical linear heatup rates made in the previous discussion. In addition, the average heatup rates evidenced in the test data are less than 3.3°F per minute, which substantiates the use of 5°F per minute as a conservative value. The actual test data, although limited, is supportive of the assumptions posed in defining the time intervals tabulated above. In conclusion, Westinghouse contends that a single or multiple pump seizure as the result of a loss of component cooling water to the reactor coolant pumps is not a credible event. However, in our judgment and based on the above discussion, two reactor coolant pump motor upper thrust bearings could sequentially reach a "high" bearing temperature of 240°F at a minimum time interval of 0.65 minute (or approximately 40 seconds). 9.2.2.8.4 Definition of Core Damage and Pressure Transients as a Result of Two Sequential Locked Rotors Section 15 presents the analysis of a single reactor coolant pump locked rotor. It should be pointed out that the analysis assumes an instantaneous seizure of a reactor coolant pump rotor on a non-mechanistic basis. As discussed above, Westinghouse contends that a postulated mechanistic instantaneous seizure of a pump rotor due to loss of component cooling water to the reactor coolant pump will not occur and is not a credible event. However, in response to the Nuclear Regulatory Commission's request, the results of a second non-mechanistic instantaneous seizure occurring at 40 seconds (defined previously) after a first non-mechanistic SGS-UFSAR instantaneous seizure have been evaluated. 9.2-25 Revision 6 February 15, 1987 Although a Final Safety Analysis Report approach was utilized to evaluate this situation, Westinghouse does not recognize a postulated mechanistic instantaneous locked rotor as a credible consequence of the loss of component cooling water to the reactor coolant pumps. Assuming that a second pump seizure occurs 40 seconds after a first pump seizure, no noticeable change is seen in the RCS pressure and the clad temperature transients. Furthermore, even if the time interval between the sequential seizures is reduced to 10 seconds, no noticeable change is seen in the RCS pressure and the clad temperature transients. The hypothetical seizure of one reactor coolant pump results in a low flow reactor trip approximately 1 second after the initial of the event. As a result of the fast reactor trip and the consequential decrease in core heat flux, the reactor coolant system pressure and the clad temperature reach the peak values at about 2.5 seconds and then start to decrease. Because the core has been shut down, at 40 seconds, or even 10 seconds, after a pump seizure, the RCS pressure and the clad temperature transients have decreased to a point at which a second pump seizure results in no noticeable change in the transients. 9. 2. 2. 8. 5 Single Failure Criteria Related to Electrical Power Requirements An audit of the electrical design involved in the redundant supplies of cooling water to the reactor coolant pump seals has been performed to verify the ability of control and motive power sources to meet the single failure criterion. The result of this audit shows that there are no credible single electrical failures capable of causing a total loss of cooling water to any reactor coolant pump. The equipment and controls 9.2-26 SGS-UFSAR Revision 6 February 15, 1987 analyzed are the following (Unit 1 numbers are used. identical). Unit 2 analysis is eves Isolation valves ICV116 and ICV284 RCP Seal Leakoff valves CV104 (11-14) Cooling water supply valves ICC117 and IC118 water return valves ICC136 and ICC187 Thermal barrier water return valves ICC131 and ICC190 All the valves identified except the CV104 valves are 230 V ac valves. The CV104 valves are 125 V de solenoid-operated valves. The CV104 valves have been designed to fail into the open position upon loss of control power or air. Each valve control circuit has been assigned to a control grouping which insures physical of all involved control devices. All credible failures result in an open valve. An individual valve "hot-short" could cause a loss of seal water flow to only one pump. Such a failure could not cause the coincident loss of component flow. The motor-operated valves perform the safety function of containment isolation, and are separated among the three vital 230 V ac buses. All of these valves are normally open and remain open unless signaled to close by containment isolation logic. One-half of the component valves would close upon of a containment isolation The other half would close upon the same be closed upon of containment isolation B) from from Train B. A) Train A. The eves would from their trains. There are no credible failures of causing both of SGS-UFSAR 9.2-27 Revision 25 October 26, 2010 these events to coincide. A design basis LOCA would result in closure of all valves to comply with containment isolation criteria. All motive power and control circuits have been analyzed for potential failures. The results of this analysis indicate that no credible failure mechanism can cause loss of all cooling flow to the reactor coolant pumps. 9.2.2.9 Malfunction Analysis The malfunction analysis of pumps, heat exchangers, and valves is presented in Table 9.2-5. 9.2.2.10 Tests and Inspections Active components of the Component Cooling System are either in continuous or intermittent use during normal plant operation. Surveillance requirements for inservice inspection and testing of components are in accordance with the Technical Specifications. 9.2.3 Demineralized Water Makeup System Makeup water required for the high purity water systems in the station can be produced from demineralizers. Water from wells on the station property is used as makeup to the Demineralizer System. Two 500,000-gallon outdoor demineralized water storage tanks are provided. The demineralized water storage tanks are shown on Plant Drawings 205213 and 205246. 9.2-28 SGS-UFSAR Revision 28 May 22, 2015
- *
- 9.2.4 Potable Water .Systems The Potable Water Systems use a combination of deep groundwater (subsurface) wells as the supply source in sufficient capacity for all of the requirements which include potable, process makeup, fire protection, and sanitary uses. Three fresh water wells, located in the Mt. Laurel-Wenonah formation (approximately 300 feet deep) and one fresh water well, located in the upper Raritan formation {approximately 800 feet deep) supply through well pumps a total of 1000 gpm of fresh water to two 350, 000 of water which are reserved for fire protection use, or the Auxiliary Feedwater System and the upper 50,000 gallons referred to as 11plant" water) are used for potable 1 sanitary, and process makeup purposes. The station water is pumped from the storage tanks to the station's process water equipment through an 8-inch main, and to all sanitary and potable water equipment through a 4-inch main by a constant pressure pumping system consisting of three automatically-operated pumps and one standby pump which maintain a constant 70 discharge pressure. If1 for some reason, affect any safety-related systems the Fresh Water Systems fail to operate, it will not equipment on a short-term basis as each of the store sufficient quantities of water to enable that system to perform its functions. The following design criteria prevent any radioactivity source in the plant from contaminating the Potable Water System: 1. Each fresh water supply well is approximately 300 feet deep (or more) and has two impervious clay formations between the ground surface and the source of water supply. Also, the wells are double-cased and cement-grouted from the bottom of the gravel pack to grade which prevents seepage of surface waters. The 9.2-29 SGS-UFSAR Revision 23 October 17, 2007 source of water is thereby protected from any outside contamination. 2. The Fresh Water System does not enter any radioactive area nor does it supply any radioactive equipment, directly or indirectly. 3. The water supplies to potentially radioactive areas, such as the "hot" machine shop and the monitoring area, and the demineralizers, are protected from contamination by the use of backflow preventers, of the type approved by the New Jersey Department of Health, on all such pipelines. 4. The water storage tanks are enclosed and are 250 feet from any potential radioactive building. 9.2-30 SGS-UFSAR Revision 6 February 15, 1987