ML18043A412
| ML18043A412 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 01/09/1979 |
| From: | Ziemann D Office of Nuclear Reactor Regulation |
| To: | Bixel D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| References | |
| TASK-02-02.C, TASK-05-10.A, TASK-05-10.B, TASK-05-11.A, TASK-05-11.B, TASK-07-03, TASK-08-03.A, TASK-09-03, TASK-10, TASK-2-2.C, TASK-5-10.A, TASK-5-10.B, TASK-5-11.A, TASK-5-11.B, TASK-7-3, TASK-8-3.A, TASK-9-3, TASK-RR NUDOCS 7901180126 | |
| Download: ML18043A412 (84) | |
Text
II\\**
JAN 0 9 i979 Docket No. 50-255 Mr. David Bixel Nuclear Licensing Administrator.
Con,sumers Po'\\'1er Company_
212 !:!est Michigan /1.venue Jackson, Michigan* 49201
Dear Mr. Bixel:
Enclosed are copies of our draft evciluations uf nine Palisades Systematic Evaluation Program topics.
You are rt.?!quested to examine the facts upon which the staff has based its evaluation and respond either by confirming that* the *facts are correct, or by identifying any error~ If in errors rlease supply corrected information for the docket.
tfo encourage you to SIJpply for the docket any other material related to these topics,that might
- affect the staff's evaluation.*
It would be mbst help1ul if your comments were received within 30 days o~ the date you receive this 1 etter.
Enclosures:
Topics II-2"C V-10.1'\\
V-10.B V-11.J\\
V-11. B VI I-3
. VII I-3.A IX-3 x
cc w/enc1osures:
- See next page Si nee rely, Orj_ginal r:-~ r_ ::.-
,-, G
.Dennis L. Z:J.emarm Dennis L. Ziemann. Chief Operating Reactors Branch #2 Di~ision of Operating Reactors
~RIBDll~
Local PDR DDavis ORB#2 ROG MRR ROG.
DLZi emann HSmith RSilver OELD OI&E(3)
DEi senhu.t TERA JRBuchanan
\\
\\
OFFICEl~.
°"<<i:~***....,.0.0.R.=.O.RB.R................................................ **t-*********... ::.............................,
~;~j~~ :.>ah... *--~-JJ{~~nn..................................................... -~*****.......................................,
n *
- O O O O O O 0 0 O O O O O 0 o o o o o o
- *
- o o o o o o o o o o o o o o o o o." 0 o o o o o o o O *
- O O O O' o o o o O o O o o o o' o
' 'o o o o o o o ' o' o o o o o o o o O '
1 '
O O ~' 'o o O O O O o o '0 ' 'O O O O '
O O O
- f Io o o o o o o o o o o o o o o o o o o g IJURNAM!I MU: fORM 318 (9-76) -NB.CM 02.(0
~.s. OOVE!:RNMl::::NT ~RINTING OP'FICE:, 9715 - zen - 7151
Consumers Power Company cc M
- I. M i 11 er, Es qu i re
- Isham, Lincoln & Beale Suite 4200 One First National Plaza Chicago, Illinois 60670 Judd L. Bacon, Esquire Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Paul A. Perry, Secretary Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Myron M. Cherry, Esquire Suite 4501 One IBM Plaza Chicago, Illinois 506H Kalamazoo Public Library 315 South Rose Street Kalamazoo, Michigan 49006 K M C Inc.
ATTN:
Mr. Jack McEwen 1747 Pennsylvania Avenue, N.W.
Suite 1050 Washington, D. C.
20006 2 -
January 9, 1979
SYSTS~ATIC EVALUATION PROGR~~
BATTERY CAPACITY TESTS LACROSSE DOCKET NO: 50-409 Topic VIII-3.A Station Battery Test Requirements The objective of this review is to assure that the onsite Class IE battery capacity to supply all safety related D-C loads is verified by periodic testing.
The testing should be in accordance with IEEE Standard 450-1975, IEEE Standard 308-1974, BTP EICSB 6 and the "Standard Technical Specifications for General Electric Boiling Water Reactors" (NUREG-0123).
The required tests are as follows:
- l. At least once per 18 months, during shutdown, a battery service test should be perfonned to verify that the battery capacity is adequate to supply and maintain in operable status all of the actual emergency loads for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
- 2.
At least once per 60 months, during shutd~wn, a battery di scharae test should be performed to verify that the battery capacity is at least 80%
of the manufacturer's rating.
The technical specifications for the Lacrosse Nuclear Station do not include any requi re:11ents. for station battery tests. Therefore, the Lacrosse ~Juclear Nuclear Station does not cc:rnply with current licensing requirements for station battery tests.
This deviation will be evaluated in the context of the Desiqn Basis Events (DBE) that rely upon these comoonents for mitigating the consequences of the DBE.
If this deviation is determined to be unacceptable, the Technical Soecifications will be appropriately revised.
~eferences
- 1.
- 2.
- 4.
"Lacrosse Technical Specifications", Dairyland Power Cooperative.
Standard Review Plan, Appendix 7-A, BTP EICSB 6, "Capacity Test Requirements of Station Batteries - Technical Specifications", U. S.
Nuclear Regulatory Commission.
"IEEE Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations", Std. No. 308-1974, The Institute of Electrical and Electronics Engineers, Inc.
"IEEE Recanmended Practice for Maintenance, Testing and Repl acernent of Large Lead Storage Batteries for Std. No. 450-1975, The Institute of Electrical and Electronics En.gi neers, Inc.
"Standard Technical Specifications for General Electric Boiling Water Reactors", NUREG-0123, U.S. Nuclear Regulatory Ccmmission.
Palisades Nuclear Plant Topic II-2.C At~spheric Transport and Diffusion Characteristic5 The objective of this review is to determine the appropriate on-site and near-site atmospheric transport and diffusion characteristics necessary to establish conformance with the 10 CFR Part iOo* guidelines.
In particular, the short-term relative ground-level air ccncentratio~s (X/Q) are used to estimate offsite exposurEs resulting from postulate~
accidents.
Estimates of effluent plume dispersion and transport beyond the site boundary are complicated by the rough and irregular terrain. Several onsite meteorological towers have been used to collect data since 1952, bi.:t the locations of these towers have been such that the measure~:r:ts represent extremely localized conditions. The concern about how representative these measurements were was first identified in 1969, and has been the subject of a continuing staff review.
The most recent staff evaluation of short-term X/Q values at the Palisades site was performed in November 1977.
At that time, one year (September 1973 - August 1974) of onsite meteorological data was considered to be the best available data for the calculation of short-term X/Q values.
Wind speed and wind direction were measured at.the 16.8m (55-ft) level by a low-threshold sensor. Atmospheric stability was defined by the ~luctuations of horizontal wind directi0n (siama-t~~t2 when wind speeds were greater th~n 0.9m (2 mph) and by the vertic::l
c 2
temperatu~e difference betwe~n the 3.0m (10-ft) and 16.Sm levels v:hen the wind sp~ed was less than 0.9 m/s.
Data recovery for this one-year period of record was only 67%.
Because of the inadequacies of the available meteorological data in te~~:
of representativeness of tower loc~tion,*data acquisition procedures, and data recovery, the direction-independent atmospheric dispersion rod*2l C:escribed in Regulatory Guide 1.4 1*1ith the procedures describe:
in Section 2.3.4 of the Standard Review Plan was used to determine short-term X/Q values.
The following X/Q values for an assumed ground-level release with a building wake factor, cA, of 1100m2 have been determined:
Time Period Distance X/Q sec/m3
-4 0-2 hours EAB (700m) 3.4 x 10 0-8 hot.:rs LPZ (5000m) 2.0 x 10-5 8-24 hours LPZ (5000m) 1.3 x io-5 1-4 days LPZ (5000m) 6.0 x 10-6 4-30 days LPZ (5000m)
- l. 9 x 10-6 These X/Q values are reasonably conservative for the Palisades site and are similar to values calculated using meteorological data from the Donald C. Cook site, located about 48 km (30 miles) south of the
.*Palisaces site in similar topography.
The X/Q value for the 0-2 hour time period is about 30% higher than the value presented in the 1 -
~ t E 1 or191n~
~are y va ua~1on ~epor~.
.. The li~ensee has installed an improved meteorological rneesure~ents program, (Topic II-2.B) and one full year of de.ta from this p:ogra;n should be available in mid-1979.
The licensee intends to sut~it one year of additional meteorological data, with greater than 90:
recovery, from the upgraded measurements program as soon as these data are available.
These data will be used to confirm the conservatism of the X/Q values presented herein.
We conclude that the X/Q values presented above are adequ2te for providing preliminary estimates of offsite exposures resui~ir.g :ror:i postulated accidents.
SYSTEMATIC EVALUATION PROGRA~
?LANT SYSTE~S/MATERIALS PALISADES Topic V-10.A Residual Heat Removal System Heat Exchanger Tube Failures Ths safety objective of this jeview is to assure that impurities fro~
the cooling water system are not introduced into the primary coolant in the event of shutdovm cooling system heat exchanger tub~ failure.
T~1is was expanded to assure that adequate monitoring exists to assure no leakag~ of radioactive material in the other direction - into the service water and thus to the environment.
Information for this assessment was gathered from plant personnel during the safe shutdown review site visit and from related telephone conversa-tions.
Information was also taken from Palisades system drawings anj the Palisades Technical Specifications.
The bases for the review of these cooling systems on tcday 1s plants include: (l) the NRC's Standard Review Plan (SRP) 9.2.l, which requires that the service water system include the capability for detection and control of radioactive leakage into and out of the system and prevention of accidental releases to the environment; (2) SRP 9.2.2, which requires that auxiliary cooling water systems (such as the* shutdown cooling system) include provisions for detection, collection and control of system leakage and means to detect leakage of activity from one system to another
~ - -
and preclude its release to the environment; and (3) SRP 5.2.3, which
Plant Sys~e~s/~aterials - Palisades discusses compatibility of materials with reactor coolant and requires monitoring and sampling of the primary coolant system.
These Standard Review Plans were used only in the comparison of the Palisades plant against today's criteria and were not used as licensing requirem~nts which must be met, especially if the plant incorporates other equally viable means of accomplishing the stated goals.
The Palisades Shutdovm Cooling System (SCS) heat exchangers (2) operate at pressures between 110 and 160 psig, although during shutdo~n of this system, pressures substantially lower will be experienced for a few minutes.
The Closed Cooling Water (CCW) system at this heat exchanger operates at a pressure between 70 and 110 psig.
It can thus b~ readily seen that during operation of the SCS little thance exists for leakage from CCW into the SCS.
There are four other factors which make undetected leakage either into or out of the reactor coolant system through the SCS a very low proba~ility event.
These are:
(l) Technical Specification 4.5.3 requires testing of the SCS system outside containment at intervals not to exceed 12 months.
This testing is required either by use during normal operation or at a hydrostatic test pressure of 255 psig. Although the staff would prefer specific hydrostatic testing of the SCS heat exchanger tubes, we will be satisfied with the above requirement until the implementation of
~1a~t 5ys:e~s/~aterials
?al isa.=es the requirements of 10 CFR 50.55a(g) governing inservice inspection.
Such requirements will include the hydrostatic testing of the SCS heat exchanger tubes.
(2)
Technical Specifications 3. 1.6 and 4.2 require sa~~ling the primary coolant for chloride and.
flouride ions during power o~eration at a fre~uency of 3 times/7 days with a mximum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> bet\\'1een samples.
\\.le would recoiT!iilend adding the requirement to sample the SCS while it is being shutdown or prior to its being
~sed ag.ain, especially since, as discussed belo*..:,
there could be an opportunity for inleakage into cc~ from the service water system.
(3)
The CCW system surge tank includes high and low level alarms to alert the plant operators to leakage into or out of the system from or to any of the CCW-cooled components.
(4)
The CCW system includes a radiation monitor and alarm to warn the operators of radioactive leak-age into the CCW system.
~As briefly mentioned above, the possibility, albeit remote, exists fo~
lea~age from the service water system into the CCW system.
This is b2cause the lbwest CCW system pressure, 70 psig (with a range of 7~-110 psig), is lower than the highest service water pressure of
Pla~: Systems/~aterials Pa~isades 75 psig.
However, in addition to the CCW surge tank high level alarm, plant procedures require a weekly sample of the CCW system.
This sample inc1udes pH, conductivity, chromate ion (a compound of which is used in the CCW system for corrosion inhibition),
sodium ion, and activity. This samp1e is sufficient to detect leakage not only from the service water system to the CCW system, but also serves as a means to discover leakage from SCS (or any*other CC~-
coole~ co~~onent) to the CCW system.
As a final defense against 1eakage to the environment, the Palisades service t*,'ater system includes a radiation monitor to alert plant opera':ors ( l) to the unlikely failure of tubes in any combinaticn of the tv10 scs and the two ccw heat exchangers or ( 2) failure of any c~her CCW-cooled component and failure of tubing in either (or beth) cc~ heat exchanger.
~e cJnclude that the likelihood of contaminant leakage into the primary system from either (or both) the SCS or CCW heat exchangers is small, given the relatively small amount of time that primary pressure is low enough that inleakage could occur.
The suggested expanded scope of the technical. specifications will provide additional assurance.
We will review this recommendation further during the integrated assessment at the completion of Design Basis Event review.
~o actior. on the part of the licensee is necessary at this time.
~2 also conclude that the systems adequately protect the environLJien~.
SEP REVIEW OF SAFE SHUTDOWN SYSTEMS FOR THE PALISADES NUCLEAR PLANT
TABLE OF CONTENTS Paoe
- 1. 0 INTRODUCTION...........................................
1
- 2. 0 DISCUSSION.............................................
6
- 2. 1 Normal Plant Shutdown and Cooldown................
6 2.2 Shutdown and Cooldown with Loss of Offsite Power..
9 3.0 CONFORMANCE WITH BRANCH TECHNICAL POSITION 5-1 FUNCTIONAL REQUIREMENTS..............................
11
- 3. 1 Background........................................
12 3.2 Functional Requirements...........................
17 3.3 Electrical Instrumentation and Power Systems......
35
48
- 4. 1 4.2 4.3 4.4 4 -
.. :i 4.6 RHR System Isolation Requirements.................
Pressure Relief Requirements......................
,Pump Protection Requirements... ~..................
Test Requirements..............................,..
Operational Procedures............................
Auxiliary Feedwater Supply........................
48 52 58 59 60 61 5.0 RESOLUTION OF SEP TOPICS...............................
63 5.1 Topic V-10.8 RHR System Reliability...............
63 5.2 Topic V-11.A Requirements for Isolation of High and Low Pressure Systems...................... ~.
64 5.3 Topic V-11.B RHR Interlock Requirements...........
64 5.4 Topic VII-3 Systems Required for Safe Shutdown....
65 5.5 Topic X Auxiliary Feed System.....................
67
6.0 REFERENCES
71
1.0 INTRODUCTION
The Systematic Evaluation Program (SEP) review of the 11 safe shutdown" subject encompassed all or parts of the following SEP topics, which are among those identified in the November 25, 1977 NRC Office of Nuclear Reactor Regulation document entitled 11Report on the System-atic Evaluation of Operating Facilities":
- 1.
Residual Heat Removal System Reliability (Topic V-10.B)
- 2.
Requirements for Isolation of High and Low Pressure Systems (Topic V-11.A)
- 3.
RHR Interlock Requirements (Topic V-11.B)
- 4.
Systems Required for Safe Shutdown (Topic VII-3)
- 5.
Station Service and Cooling Water Systems (Topic IX-3)
- 6.
Auxiliary Feedwater System (Topic X)
The review was primarily performed during an onsite.visit by a team of SEP personnel.
This onsite effort, which was performed during the period July 26-28, 1978, afforded the team the opportunity to obtain current information and to examine the applicable equipment and propedures.
The review included specific system, equipment and procedural requirements for remaining in a hot shutdown condition (reactor shutdown in accordance with technical specifications, tempe~atJre above 525°F) and for proceeding to a cold shutdown condition (temper-atuie less than 210°F).
The review for transition from operating to hot shutdown considered the requirement that the capability exists to perform this operation from outside the control room.
The review was *augmented as necessary to assure resolution of t:-ie applicable topics, except as noted below:
Topic V-11.A (Requirements for Isolation of High and Low Pressuie Systems) was examined only for application to the Residual Heat Removal (RHR) system.
Other high pressure/low pressure interfaces were not investigated.
Topic IX-3 (Station Service and Cooling Water Systems) was only reviewed to consider redundancy and seismic and quality classif~-
cation of cooling water systems that are vital to the performance of safe shutdown system components.
The criteria against which the safe shutdown systems and components were compared in this review are taken from the:
Standard Review Plan (SRP) 5.4. 7, 11 Residual Heat Removal (RHR) System 11 ; Branch Technical Position RSB 5-l, 11Design Requirements of the Residual Heat Removal System 11 ;,and Regulatory Guide 1. 139, 11Guidance for Residual Heat Removal.
11 These documents represent current staff criteria for the review of applications for operating licenses.
~~ i' =,.
~ S*~ i' i:.,.
~
- -~*'1 ~
I; *;".,.,,.,
- .:.:* *: -:.. ~ This comparison of the existing systems against the curren: 1i:e~sing criteria led naturally to at least a partial comparison of desig~
criteria, which will be input to SEP Topic III-1, 11 Classificat~on of Structures, Components and Systems (Seismic and Quality).
11 As noted above; the six topics were considered while negle~ting possible interactions with other topics and other systems and components not directly related to safe shutdown.
For exa~ple, Topics II-3.B (Flooding Potential and Protection Requi~eme~ts),
II-3C (Safety-Related Water Supply), III-4.C (Internally Gener:ted Missiles), III-5.A (Effects of Pipe Break on. Structures, Syste~s, and Components Inside ~ontainment), III-6 (Seismic Design :ons'dera-tions), III-10.A (Thermal-Overload Protection for Motors o~ Motor-Operated Valves), III-11 (Component Integrity), III-12 (Enviro~mental Qualification of Safety-Related Equipment) and V-1 (Co~pliance with Codes and Standards) are among several topics which could :e a7fected by the results of the safe shutdown review or could have a safety impact upon the systems which were reviewed.
These effects will be determined by later review.
This review did not cover, in any significant detail, the reactor protect~on system nor the electfical power distribution system both of which will be reviewed later in the SEP.
Tooic The major factor in assessing the safety margin of any of the SE?
facilities depends upon the ability to provide adequate protection for postulated Design Basis.Events (DBEs).
The SEP topics provide a major input to the DBE review, both from the standpoint of assess-ing the probability of certain events and that of determining the consequences of events.
As examples, the safe shutdown topics pertain to the listed DBEs (the extent of applicability will be determined during the DBE review for Palisades):
DSE Grouo*
Impact Upon Probabi Or Conseauences of ity
- l:::
V-10.S VII (Spectrum of Loss of Coolant Consequences Accidents)
V-11. A VII (Defined above)
Prob ab i 1 ity V-11. B VII (Defined above)
Probability VII-3
~,.
,...., I (Defined as a generic tcpic)"
Consequences IX-3 III (Steam Line Break Inside Consequences Containment)
(Steam Line Break Outside Containment)
IV (Loss of AC Power to Station Consequences Auxiliaries)
(Loss of all AC Power)
V (Loss of.Forced Coolant Flow)
'(Primary Pump Rotor Seizure)
Probability (Primary Pump Shaft Break)
- .
- ror a 11st1ng of DBE groups and generic topics, see Reference 8.
Impact Upon Prcba i l i :y Tooic DBE Grouo Or Consequences o C3E VII (Defined above)
Consequences x
II (Loss of External. Load)
Consequences (Turbine Trip)
(Steam Pressure Regulator Failure
[closed])
(Loss -0f Feedwater Flow)
(Feedwater System Pipe Break)
I II (Defined above}*
Consequence*s IV (Defined above)
Consequences v (Defined above)
Consequences VI I (Defined at;iove)
Consequences The completion of the safe shutdown topic review (limi~ed in scJpe as noted above) provides significant input in assessing the existing safety margins for the Palisades Plant.
n R
~,_..,...,.
~.., h
~<I ~*
~-' n.*
'\\ *. ~ *.,, t 1
. 2. o c:scussroN
- 2. l Normal Plant Shutdown and Cooldown All Eguioment The plant conducts an orderly shutdown using the turbine central system, reducing load gradually.
The plant uses procedure A.5.8, P1ant Shutdown From Full-Power Ooeration, for this purpose.
Tavg' pressurizer level and pressure, and steam generator levels may be controlled automatically or manually.
Control rods are inserted and boron concentration increased as needed to match the load decrease.
A feedwater train is secured at about 40% power.
Auxiliary loads are transferred from station transformer to startup transformers when power reaches 15%.
Steam pressure is controlled at 900 psi with turbine bypass valves and at about 4% power the turbine is tripped.
T.
is maintained at 532°F by reducing power avg and bypassing steam to the condenser as needed.
Also, at this power the remaining feedwater train is tripped off and the electric motor driven auxiliary feedwater pump is placed in service taking suction from the condensate storage tank.
The main steam isolation valves (MSIV) afe closed and the manual bypass valves around the MSIV 1s are opened to retain the decay heat removal path to the main condenser.
Tavg is maintained at 532°F with the reactor at low r
pcwer to remain at hot standby.
Operating reactor coolant pumps may now be tripped to control the heating rate and boron concentra-tion is adjusted to keep the necessary control rod groups above their pre-power dependent insertion limits.
To achieve hot shutdown all control rods are inserted fully and boron concentration is increased to at least the minimum allowed hot shutdown value.
Shutdown rods are kept out until boration is complete.
The plant is shut down from hot standby to the cold shutdown condi-tion using plant procedure A.5.9, Plant Cooldown from Hot Standbv.
Letdown and charging flow is lined up and the reactor coolant system is berated from the concentrated boric acid storage tanks with this system to the cold shutdowR concentration.
Two of the reactor coolant pumps are stopped (pumps 18 or 2A is left on to provide 6P for pressurizer spray) and part length rods are inserted.
Pressurizer level control is placed in 11manual 11 and the heaters are turned off.
Condenser vacuum is retained and steam from the generators is still being dumped to the main condenser via turbine bypass valves.
(Steam could be dumped to the atmosphere via the atmospheric steam dump valves or aligned to discharge via the hogger:
the hogger path is the preferred alternate because it is quieter.)
Steam generators continue to be fed by the auxiliary feedwater system with condensate storage as the water source.
Pressurizer spray is periodically operated to maintain pressurizer boron concentration the same as the rest of the reactor ccola~t system.
Cooldown is limited to 60°F/hr. and a pressurizer-coclant loop ~T of 350°F.
Letdown flow is secured and charging flow is controlled manually to offset shrinkage from coolant contraction.
Pressurizer hiaters are turned off and safety injection signal is blocked at 1690 psig.
High pressure safety injection pum~ fuses are pulled at 1400 psi (to preclude reactor coolant system (RCS) overpressurization from these pumps).
After reaching 400 Jsi ~nd 300°F, power operated relief valves are reset to their low va1ue to protect against RCS overpressurization at low temperature.
Tre pressurizer is allowed to fill and the charging pump is turnec off when the desired RCS temperature is reached.
After reaching 270 psia or less, shutdown cooling is placed ir, operation.
When condenser vacuum can no longer be maintai~ed :he bypass valves are closed and the hogging air ejector steam du~~ to atmosphere is valved in to dissipate decay heat.
To place the shutdown cooling system (SCS) into service requires realigning the low pressure safety injection (LPSI) system to the shutdown cooling mode (ihe LPSI pumps are also used for dec~y heat removal).
Prior to placing the SCS in service, safety injection water is circulated through the refueling water storage tank until SCS boron co~ce~tration is equal to or greater than RCS concentration.
Component coo!~ng
F:~ "'*rr*
~ ~~i !\\~
- .., is established in each of the shutdown coolers.
The component cooling system is in turn cooled by service water from Lake Michigan.
RCS flow to the shutdown coolers is adjusted as needed to control the cooldown rate and hold the RCS temperature to the desired 1eve1.
2.2 Shutdown and Cooldown with Loss of Offsite Power On loss of offsite power, the reactor, reactor coolant pumps, and turbine trip, the main condenser becomes unavailable as a heat sink and the steam driven main feedwater pumps trip because of loss of
- ondensate flow.
The turbine trip signal starts the diesel generators, the load shed relays strip the 2400 V buses, 2400 V buses lC and 10 re-energize and essential loads are sequenced back on these buses.
These loads include service water pumps and charging pumps.
The auxiliary feedwater steam driven pump is aligned and started from the control room to feed the steam generators.
Steam is dumped to the condenser via bypass valves to automatically limit steam pressure to 885 psig.
When condenser vacuum is lost, the bypass valves close.
Steam pressure is* then controlled with the atmospheric dump valves.
St~am generator and pressurizer levels ~re restored and pressurizer pressure is maintained by use, of the heaters.
Cc::-:;onent cooling.*water, instrument air, and other equipment is restarted as needed.
The core is cooled by natural circulation of reactor coolant through the core and steam generators (this procedure was satisfactorily demonstrated in the startup test program).
The steam generators are fed by the steam-driven auxiliary feed pu~p using the condensate storage tank as its source.
Heat is removed fr~G the steam generators through the atmospheric steam du~p valves.
The shutdown on loss of AC is conducted in accordance with provisions of plant procedure D.4.3, Loss of AC.
Cooldown, if required, is per~ormed as above using plant procedure A.5.9, Plant Coolaown From He: Sta~~bv. With the main condenser unavailable, however, steam is dumped to atmosphere using either the atmospheric steam dump or the hogger.
3.0 CONFORMANCE WITH BRANCH TECHNICAL POSITION 5-1 FUNCTIONAL REQUIREMENTS The current NRC criteria used in the evaluation of the design of the systems required to achieve cold shutdown for a new facility are listed in Standard Review Plan (SRP) 5.4.7 and Branch Technical Position RSB 5-1.
The following paragraphs give a point by point comparison of Branch Technical Position RSB 5-1 functional require-ments to the shutdown systems at the Palisades Plant.
The remaining BTP provisions will be addressed in Section 4.
Branch Technical Position 11 A.
Functional Reauirements 11The system(s) wich can _be used to take the reactor from normal operating conditions to cold shutdown shall satisfy the functional requirements listed below.
- 1.
The design shall be such that the reactor can be taken from normal operating conditions to cold shutdown using only safety-grade systems.
These systems shall satisfy General Design Criteria 1 through 5.
- 2.
The system(s) shall have suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite ~lectrical power system operation (assuming onsite power is not available) the system function can be accomplished assuming a single failure.
- 3.
The system(s) 'Shall be capable of being operated from the control room with either only onsite or only offsite power available with an assumed single failure.
In demonstrating that the system can perform its function assuming a single failure, limited operator action outside of the control room would be *considered acceptable if suitably justified.
g'jf1 p* IT
. ::; \\. \\,..
~ '. *.1
-\\ ~
. -*. *~ :j... 4.
The system(s) shall be capable of bringing the reactor to a cold shutdown condition, with only offsite or onsite power available, within a reasonable period of time following shutdown, assuming the most limiting single failure.
11 The capability of the safe shutdown systems for the Palisades Plant to meet these criteria is discussed below.
- 3. 1 Backaround A
11 safety grade 11 system is defined, in the NUREG 0138 (Reference 1) discussion of issue.#1, as one which is designed to seismic category I (Regulatory Guide 1.29), quality group C or better (Regulatory Guide 1.26), and is operated by electrical instruments and controls that meet Institute of Electrical and Electronics Engineers Criteria for Nuclear Power Plant Protection Systems (IEEE 279).
The Palisades Plant received its Operating License on March 24, 1971 prior to the issuance of Regulatory Guides 1.26 and 1.29 (as Safety Guides 26 and 29 on 3/23/72 and 6/7/72 respectively).
Also, proposed IEEE 279, dated August 30, 1968, was used in the design of only certain instrumentation and control systems at Palisades.
Therefore, for this ev_a.luation, systems which should be 11 s~_fety grade 11 are the systems identified in Table 3. 1 and in the following minimum list of safe shutdown systems.
General Design Criterion (GDC) l requires that systems important to safety be designed, fabricated, erected, and tested to quality standards, that a Quality Assurance (QA) program be implemented to assure these systems perform their safety functions, and that appropriate records of design, fabric~tion, erection, and testing are kept.
Regulatory Guide (RG) 1.26 provides the current NRC criteria for quality group classification of safety-related systems.
Table 3. 1 provides a comparison of the Palisades safety grade shutdown systems with RG 1.26.
Although RG 1.26 was not in effect when Palisades was constructed, the licensee has since classified the systems in accordance with this guide.
Even though the safety-related systems at Palisades were not designed, fabricated, erected, and tested using RG 1.26, the maintenance and repair of the classified systems is currently conducted in accordance with this guide.
In Reference 3, the licensee classified structures, systems and equipment whose failura could cause uncontrolled release of radioac-tivity or which were essential for immediate and long term operation following a loss-of-coolant accident (LOCA) as Class l. Class 2 structures, systems, and equipment are those whose limited damage would not prevent safe shutdown following the initiation of a
- reactor trip or normal shutdown, and whose failure would not cause unccntro11ed release of radioactivity.
Those structures, systems, and equipment whose failure would not result in the release of radioactivity and would not prevent reactor shutdown but may interrupt power generation were classified as Class 3.
This classification system is reflected in Table 3. 1.
At the time the.Palisades Plant was licensed, the NRC (then AE:)
criteria for QA were being developed.
However, the QA program for construction of Palisades was reviewed by the staff (Amendment 14 to Reference 3), and the QA program for operation has been reviewed by the staff and found to be in conformance with 10 CFR 50, Appendix B (Reference 6).
Appropriate records concerning design, fabrication, erection and testing of equipment important to safety are maintained by the licensee in accordance with the QA program and the plan:
Technical Specifications.
GOC 2 states that structures and equipment important to safety shall be designed to withstand the effects of natural phenomena without loss of capability to perform their safety function.
Natural phenomena considered are:
hurricanes, tornadoes, floods, tsunamll seiches and earthquakes.
Measures were taken in the design of the Palisades Plant to prctect against high winds, tornadoes, seiches, floods, earthquakes anc ice
. I. and snow loading." *During the Provisional Operating License review, the staff concluded that the potential effects of tornadoes, floods, seiches, and earthquakes on structures and equipment important to safety were acceptable.
The effects of tornadoes will be reevaluated during the course of the SEP in Topics II-2.A "Severe Weather Phenomena, 11 III-2 "Wind and Tornado-Loadings," and III-4.A "Tornado Missiles.
11 The effects of flood on the Palisades Plant will be reassessed in the SEP review under Topics II-3.B "Flooding Potential and Protection Requirements" and III-3 11Hydrodynamic Loads.
11 And within the SEP revie~. the potential for and consequences of a seismic event at the Palisades site will be reassessed under several review topics.
GDC 3 requires structures, syst~ms, and components important to safety to be designed and located to minimize the effects of fires and exp 1 os ions.
Following a fire at the Brown's Ferry Nuclear Station in March 1975, the NRC reevaluated the Palisades fire protection program and issued the evaluation with License Amendment No. 24 dated September 1, 1978.
The results of this reevaluation will be inteqrated into the SEP assessment of Palisades Plant.
GOC 4 requires that equipment important to safety be desig~ed :o withstand the effects of environmental conditions for normal o~era-tion, maintenance, testing, and postulated accidents.
Also the equipment should be protected against dynamic effects including internal and external missiles pipe whip, and fluid impingemen:.
GDC 4 was considered in the POl review of Palisades, and the facil-ity was found to meet this criterion.
Additionally, the S~P w~ll consider the various aspects of this criterion when reviewing topics III-12 11 Environmental Qualification of Safety-Related Equip-ment,11 III-5.A "Effects of Pipe Breaks Inside Containment, 11 II:-5.8 11 P~pe Breaks Outside Containment, 11 and III-4 11Missiie Generaticn and Protection.
11 GDC 5 is not applicable for the Palisades Plant because it does not share any equipment with other facilities.
The BTP 5-1 functional requirements focus on the safety grade systems that can be used to take the reactor from operating conditions to cold shutdown.
The staff and licensee developed a "minimum 1 i st 11 of systems necessary to perform this task.
These systems are:
- l.
Reactor Protection and Control Systems
- 2.
Auxiliary Feedwater System
- 3.
Main Steam System (Main Steam Isolation Valves, Safety Valves, and Atmospheric Relief Valves)
- 4.
Service Water System
- 5.
Chemical and Volume Control System
- 6.
Pressurizer Heaters (for ~aintenance of hot shutdown)
- 7.
Component Cooling Water System
- 8.
Shutdown Cooling System
- 9.
InstrumentatioD for the above systems and equipment
- 10.
Emergency Power (AC and DC) for the above systems and equipment In addition to these systems, other safety grade and nonsafety grade systems may function as backup for the above systems and components.
The following section will discuss both the safety-grade systems and the nonsafety-grade systems which may function as backup.
3.2 Functional Reguirement Five basic functions, or tasks, are required to proceed from plant operation to hot shutdown and to cold shutdown.
These functions are* identified in Table 3.2.
A discussion of each function and associated alternate methods is provided below.
Control of React6r Power Power generation in the reactor core is terminated by either chemical addition (boration) or insertion of control rods.
During a planned shutdown, power would be reduced in an orderly manner by boration followed by control rod insertion.
For rapid reactor shutdown, the control rods can be manually or automatically tripped.
Boration is accomplished with the Chemical and Volume Control System (CVCS) which is discussed under Primary System Control below..
The control rods are controlled by the Reactor Protection System.
The Reactor Protection System (RPS) is designed on a channelized basis to provide physical and electrical isolation between redundant reactor trip channels.
Each channel is functionally independent of every other channel.
The power source for the RPS are the preferred AC buses which can receive power from either onsite or offsite sources.
The RPS fails safe (tripped) on loss of power.
The system can be manually tripped both from the control room and from other locations outside the control room.
The rod control system for Palisades consists of 45 separate rack and pinion type control rod drives and associated switches, inter-locks, rod position relays, and indicating lights.
Upon receipt of a reactor trip signal, breakers in the DC power supplies to the control rods open to release electromagnetic clutches on each rod
- drive and the rods fall into the core by gravity.
The control rod drive mechanism clutches for the shutdown and regulating reds are arranged on two DC buses with half the rods supplied from each bus.
Two DC power supplies provide power to each bus.
The DC power supplies are connected through independent reactor trip circuits to AC sources.
The four partial-length rods cannot be scrammed.
The dual bus design assures in that a single failure cannot prevent more than half of the rods from being tripped.
The RPS and Reactor Control System were evaluated by the AEC staff using Proposed AEC General Design Criteria, published July 10, 1967, and Proposed IEEE-279-1968 and were found to be acceptable.
The design of the RPS and Reactor Control System as well as other safe shutdown related electrical control and power systems will be reevaluated later in the SEP.
Core Heat Removal In hot.shutdown, and during cooldown prior to Shutdown Cooling System operation, core decay heat is transferred to the steam generator by forced convection flow of reactor coolant using the rea:tor coolant pumps.
If offsite power is unavailable, core decay 5.4 TcJic VI!-3 Svstems Required For Safe Shutdown The Safety objectives of this topic are:
- 1.
To assure the design adequacy of the safe shutdown system to (a) initiate automatically the operation of appropriate systems, including the reactivity control systems, such that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences or postulated acciden:s, and (b) initiate the operation of systems and components required to br1ng the plant to a safe shutdown.
- 2.
To assure that the required systems and equipment, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown are located at appropriate locations outside the control room and have a potential capa-bility for subsequent cold shutdown of the reactor through the use of suitable procedures.
- 3.
To assure that only safety grade equipment is required for a PWR plant to bring the reactor coolan~_system from a high pressure condition to a low pressure cooling condition.
Safety objective 1(a) will be resolved in the SEP Design Basis Event reviews.
These reviews will determine the acceptability of "the plant response, including automatic initiation of safe shutdown related systems, to various Design Basis Events, i.e., accidents and transients (Reference 8).
Objective l(b) relates to availability in the control room of the control and instrumentation systems needed to initiate the opera-tion of the safe shutdown systems and assures that the control and instrumentation systems in the control room are capable of fol1ow-ing the plant shutdown from its initiation to its conclusion at cold shutdown conditions.
The ability of the Palisades Plant to
. fulfill objective l(b) is discussed in the preceding sections of this report.
Based on these discussions, we conclude that safety objectives l(b) is met by the safe shutdown system at Palisades subject to the findings of related SEP Electrical, Instrumentation, and Control topic reviews.
Safety objective 2 requires the capability to shutdown to both hot shutdown and cold shutdown conditions using systems instrumentation, and controls located outside the control room.
The Palisades Plant procedure 04.21, 11Control Room Fire, 11 provides the necessary steps to take the plant to the hot shutdown condition a~d to proceed from there to the cold shutdown condition.
The procedure, which is also heat can be adeqU:ately removed by natural circulation flow.
(See Section 4.4 for a discussion of natural circulation.)
In the final stages of plant cooldown and for long term cooling, decay heat is removed with the Shutdown Cooling System (SCS).
Heat from the SCS is transferred to the ultimate heat sink (Lake Michigan) via the Component Cooling Water System and the Service Water System.
The Shutdown Cooling System (SCS) is a subsystem of the Low Pressure Safety Injection (LPSI) system.
The system consists of a single drop line from the PCS (loop 2) through two redundant LPSI pumps and the SCS heat exchangers back to the RCS through the LPSI lines.
The LPSI pumps discharge into a common header which supplies flow to the four LPSI injection lines via two SCS heat exchangers in parallel.
For shutdown cooling, one LPSI pump and two heat exchang-ers are used; however, a reduced rate of cooldown can be achieved with only one heat exchanger.
The three Containment Spray System pumps serve as backup for the LPSI pumps for shutdown cooling.
Two spray pumps are required to provide the same flow as.one LPSI pump.
Each LPSI pump is powered from a separate.redundant 2.4 kV engineered safeguards bus.
The system pumps, isolation valves, and flow control valves are normally controlled from the control room; hcwever, the initial valve lineup and warmup of the system requires manual operation of valves outside the control room.
ihe single shutdown cooling suction line from the PCS and the single discharge line from the SCS heat exchangers to the LPSI injection lines renders th_e SCS susceptible to single passive pipe failures, the failure of the heat exchanger supply or discharge valves, or the failure of the suction isolation valves (M0-3015 and M0-3016) in th~ shut position.
(A failure in the header from the pump discharge to the heat exchangers can be bypassed by use of the Co~tainment Spray pumps for shutdown cooling.) Although the above failures would terminate shutdown cooling, the effect would be identical to a loss of CCW to the SCS heat exchangers, and the alternate means of decay heat removal which are discussed in the CCW section below are still available.
Le:k detection for the SCS is provided by drain sump high level alarms and drain pump start indications for the Engineered Safe-guards Room sumps.
Certain of the remotely operated valves in the SCS are air-operated.
The air system used to actuate these valves is the High Pressure Air system as opposed to the Service and Instrument Air system which supplied valves in the SWS and CCW system.
The High Pressure Air system compressors are powered from the engineered safeguards buses.
The air supply headers from the air receivers to the SCS valves are seismic Class 1.
- e A backup safety-grade means of core cooling may be established by opening either of the two pressurizer_power operated relief valves or the four 2-inch PCS drain lines to remove water from the PCS.
This water would be collected in the containment sump from where it would be available for recycling to the PCS via the high or low pressure safety injection systems.
The Component Cooling Water (CCW) system consists of three pumps, two CCW heat exchangers, a surge tank, various cooling loads, and connecting piping and valves.
During normal full power operation, one pump and two CCW heat exchangers accommodate the heat removal 1 oads.
Two pumps and two heat e_xchangers are required for the post-accident recirculation heat removal mode of the Containment Spray System or for the plant cooldown mode, both of which use the Shutdown Cooling System (SCS) heat exchangers.
For shutdown cooling, one CCW heat exchanger is capable of PCS cooldown at a redwced rate. During post-accident recirculation, if one CCW heat exchanger failed, the lower heat removal capacity of the CCW system could be made up by the containment air coolers as described in the follow-ing discussion of CCW passive failures.
n~ !'i~
.~ Ir 1J p,.
,,._.,. **. *J
'1 i.-1... tj ~.~
!t Four main CCW supply lines are provtded to the following:
- 1.
SCS heat exchangers (used for normal cooldown and for post-accident recirculation cooling)
- 2.
Engineered Safeguards pumps
- 3.
Spent fueJ pool heat exchangers and radwaste equipment
- 4.
Services inside containment Supply valves in these lines are operable from the control room.
Although the pumps and heat exchangers are redundant, they are connected by single pipe headers whose Jailure could disable t~e system and render the long-term cooling mode of the inoperable.
This was considered in the POL review of Palisades, and the staff concluded that in a post-LOCA scenario, the Safety Injection (SI) pumps could continue to recirculate spilled reactor coolant with decay heat being removed by the containment air coolers (Reference 2).
If the CCW Failure occurred during a cooldown of the plant, with the reactor vessel head installed, -the plant would return to hot shutdown and decay heat could be removed via the steam generators as described in the following discussions of the Main Steam and AFS hot shutdown and cooldown methods.
The pla~t could remain in hot shutdown while CCW repairs were made.
'* For decay heat re*mova 1 when the reactor vessel head is removed, adequate cooling can be provided by keeping the core flooded using various systems such as L~SI and CVCS while repairs are made to the CCW piping.
Therefore, although the CCW system does not meet the guidelines of BTP RSB 5-1 or SRP 9.2.2 for assumed passive failures, the Palisades plant has acceptable alternate means to remove core decay heat for both normal shutdown and post-LOCA long-term cooling.
The remotely operated valves in the CCW system are ~ir-operated.
Upon a postulated failure of the air supply, the valves fail in the appropriate positions to supply CCW flow to all loads except the sp~nt fuel cooling system and the radwaste evaporators to which flow is secured.
cc~ system leakage detection is provided by a low surge tank level alarm and the high level alarm for the auxiliary building drain sump.
The CCW system pumps receive power from the redundant 2.4 kV engi-neered safeguards buses which can be powered from onsite or offsite sources:
The system is normally operated from the control room.
The Service Water System (SWS) circulates cooling water.from Lake Michigan to various critical and noncritical heat loads throughout the plant.
The system has three half-capacity pumps, two of which are powered by 2.4 kV bus 10.
The remaining pump is powered from 2.4 kV bus lC.
Under normal, shutdown, and post-accident condi-
- tfons, two S'n'S pumps are required to be operating.
The SWS piping' is split into two headers (A and B) which supply redundant essential (critical) load trains.
Header A supplies train A loads; header 8, train B loads.
However, header A alone supplies The Component Cooling Water (CCW) heat exchangers, and header 8 alone supplies the Containment air coolers.
Even though the headers are joined in the auxiliary building by a double-valved crosstie and header isolation valves which permit the isolation of either header upstream of the crosstie, a passive failure of a header downstream of the crosstie would eliminate SWS flow to either the CCW heat exchangers or the containment air coolers, depending upon which header failed.
This system design is accept-able because (1) the containment air coolers are backed up in the post-accident scenario by the fully redundant Containment Spray System, and (2) the CCW heat exchangers can be lost during all plant operating conditions without significant consequences as describ~d in the CCW section of this report:
..Leak detection for_the SWS is provided by header pressure switches, which start the standby SWS pump on low pressure, and by drain sump
~~~lrT
~ *, ' \\ :., " ~
._....... -. removed in the turbine and main condenser.
After the turbine is tripped, the turbine bypass system provides a controlled steam release of up to 5% of full power steam flow to the condenser.
The ultimate heat sink for the condenser is the Circulating Water System (Lake Michigan).
When the main condenser is not available, steam is released directly to the atmosphere through the atmospheric relief valves, safety valves, or the steam hogging air ejector (hogger).
The turbine driven auxiliary feed pump also provides a path for approximately 2% of full power steam flow from the steam generators to the atmosphere.
As steam or liquid is lost from the steam generators, a continuing source of feedwater is required.
The safety-grade safe shutdown components associated with the Main Steam System are-the main steam isolation valves (MSIV), the steam safety valves, and the steam atmospheric relief valves.
Each of the two Palisades steam generators is equipped with an air-operated, solenoid controlled MSIV, 12 code safety valves and two air-operated atmospheric dump valves.
For core decay heat removal in hot shutdown with natural circulation of the reactor coolant, only one steam generator and two of its 12 safety valves are sufficient to remove decay heat a few seconds after reactor trip.
One atmospheric dump valve, which is set up for automatic operation and for remote manual control from the control room, has t:::
t:::
j.:
,.,.,~.. ~
, ' ] " ~
- ~
~ :*
t\\ F!a *
- 1
'~..
.. \\., ~ ;
28 -
sufficient relief capacity for maintaining hot shutdown or for cooldown of the primary coolant system (PCS).
Since the plant compressed air s~stems are not safety-grade, manual opening of the safety valves with installed manual operators would be required to limit the cooldown to the use of safety grade equipment alone.
The atmospheric dump valves have no manual operators.
Since there is no need to proceed immediately to cold shutdown from hot shutdown,
~n op~rator is not required to manually open a steam safety or dump valve to commence cooldown for several hours after reactor trip.
Backup safety-grade paths for steam removal are the auxiliary feed pump turbine steam.line and 2" diameter manual steam generator vent lines (one per each steam generator).
The steam removal c~pac~ty for these paths is approximately 2% and 3% respectively.
The turbine-driven auxiliary feed pump is discussed under Feedwater below.
The nonsafety-grade paths for steam removal are the hogger and the turbine bypass valves which rely on seismic Class 2 steam system piping.
The hogger which must be manually operated from outside the control room and the bypass valves which depend on the nonsafety-grade p.lant air system and the main condens_er are the normally used steam removal paths for plant shutdown.
Each of these paths can remove up to 5% of normal full power steam flow which is equivalent to core decay heat a few minutes after reactor shutdown.
- =ee:*,...ater Under normal operating conditions above 40% reactor power, steam generator feedwater is pumped from the main condenser by the condensate pumps and turbine-driven main feedwater pumps.
When this source of feed is not available, during operation at low reactor power levels, or during plant startup and shutdown, the Auxiliary Feedwater System is used to supply the steam generators.
The Auxiliary Feedwater System (AFS) consists of a motor-driven pump and a turbine~driven pump each capable of supplying greater than 100% flow requirements for decay heat removal.
Although, the two pumps are identical, the turbine-driven pump is classified seismic Class 2 (see Table 3. 1).
In applying the safety-grade provision of BTP RSB 5-1 to the AFS, only a single safety-grade p~~p - the motor-driven - is available with the turbine-driven pump available as a backup.
The pumps discharge to a common AFS header which branches and connects to the main feed headers to each steam generator.
The normal source of water to the AFS pumps is the Class 1 Condensate Storage Tank (CST) with the Class 2 fire system providi~g a manually initiated backup supply.
The AFS flow control and bypass valves in the branch lines to each steam generator are air-operated and fail in the open position on loss of instrument air press~re. The valves in the header from the CST to the AFS pump suctions are. locked:*open manual valves, and the CST supply line and the fire system backup supply line connect to a common pump suction pipe.
There is no leak detection system provided for the AFS pump room to provide timely warning to the operators that a severe AFS leak or flooding condition exist in the room.
The motor-driven AFS pump can be powered from either offsite or onsite electrical power sources.
The turbine-driven pump can receive motive-power steam from either steam generator.
Air-operated isolation and flow control valves supply steam to the AFS turbine.
These valves can bi either locally overridden or bypassed to supply steam to the turbine in the event of an air system failure.
The AFS can be started and controlled from the control room with either only onsite or offsite power available.
In applying the single failure provision of BTP RSB 5-1, four areas of concern are identified.
First, the failure of the CST or the header from the CST to the common AFS pump suction pipe would cause the 1oss of AFS flow.
However, the fire system can be used as a backup AFS supply by opening a manual valve in the fire system - AFS crosstie line and starting a fire pump.
This can be done within five minutes by an operator dispatched from the control room.. The licensee 1s analysis of the loss of feedwater accident (Reference 3) calculates that, assuming a complete loss of f~ed to both steam generators, the water inventory in the steam generators alone would provide boil-off
- cooling for 17 mtnutes.
Also, assuming a reactor trip at full plant load, the steam generator inventory alone would provide decay heat removal for approximately one hour (Reference 4).
Therefore~
sufficient time is available for manual alignment of the fire system backup water supply to the AFS before the steam generators would boil dry; The second concern is that a failure of the CST supply header inside the AFS pump room could cause the room to flood and render both AFS pumps inoperable.
A requirement for a leak detection sys~em in the AFS pump room is not considered to be of such signif-icance that immediate action should be taken to install such a system.
This is because of the seismic classification of this piping, the low pressures at ~hich it operates, and the low li~eli-hood of a failure of sufficient magnitude to overcome the AFS pump rocm drain system.
However, consideration will be given tc re~~iring a leak detection system when the SEP integrated backfit decision is made for Palisades.
The third concern is that a potential *passive failure of either the common.AFS pump discharge pipe or common pump suction pipe would terminate AFS flow under conditions when main feed flow to the steam generators is not available.
In thi3 case, the condensate pumps, which are powered from offsite sources, or the heater drai~
puiiips, 'n'hich can receive onsite or offsite power, may be used tc pump water through the normal feedwater train to the steam generators as a nonsafety-grade backup.
The condensate pumps can supply water to the steam generators if steam pressure and temperature are below approximately 500 psi and 470°F.
This cooldown to 470°F can be achieved by blowing down the steam generator through the atmospheric dump valves or by_other methods discussed in the following paragraph.
To wse the fire pumps to feed the steam generators, steam genera~or pressure must be reduced to below 125 psig.
If a sufficiently low primary temperature cannot be achieved to reduce steam generator pressure, then one steam generator could be blown completely dry and then the fire pump, or condensate pump, would be able to supply water to it at atmospheric pressure.
Because of the severe ther~al shock caused by adding cold water to a dry steam generator, this method should only be used if no other method is available. ihe nuclear steam supply system is designed to take a limited nuriber (8) of these transients (References 3 and 4).
The fourth concern is the lack of AFS pump redundancy because the turbine-driven pump is seismic Class 2.
The staff will consider the need.for upgrading the seismic classification of this pump in the SEP integrated assessment of Palisades.
An immediate resolu-tion of this concern is not required because this pump is identical
.to the motor-driven pump which is seismically qualified.
Primarv Svstem Control
- It is necessary to control pressurizer level and pressure during the plant shutdown and cooldown.
Pressurizer level is controlled with the chemical and volume control system.
Pressure is controlled by the pressurizer heaters (to prevent pressure decrease caused by ambient heat loss if. the plant is to remain in hot shutdown).
The Chemical and Volume Control System (CVCS) provides borated water from the Boric Acid Tanks or the Safety Injection and Refuel-ing 1dater Tank (SIRW'T) through three positive displacement cha!"ging pumps.
The pumps provide flow to the Primary Coolant System (?CS) via, (1) the normal charging line (to either loop lA or 2.~ of :he PCS), (2) the pressurizer auxiliary spray valve, or (3) the al:ernate High Pressure Safety Injection (HPSI) line.
A failure of the nonsafety-grade Control and Instrument Air system would disable the f1ow paths to the pressurizer and from the Boric Acid Tanks via the Boric Acid Pumps.
However, the other charging paths remain avail-able because either the air-operated valves fail open (normal charging line) or the paths contain motor-operated valves (alternate
- HPSI,
~0ric Acid Tank lines bypassing the 89ric Acid PumpsJ and SIRWT).
In addition, the motor-operated valves have manual over-rides which permit local manual control if necessary and p!"ocedures exist to manually open the alternate pressurizer spray valve i~side containment.
The capacity of one charging pump is sufficient to compensate for PCS coolant contraction during. normal cooldown.
Boration is not required for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> because of xenon inventory in the core, so manual actions outside the control room could be taken, if required, to establish a charging path for boration.
Leak detection for the CVCS is provided by drain sump level alarms in the Auxiliary Building.
The charging pumps and eves motor-operated valves can receive po~er from both onsite and offsite sources.
The charging pumps and Serie Acid Pu~ps can be operated locally or from the control room.
Another method, redundant to the eves, for PCS makeup and boration exists via the High Pressure Safety Injection (HPSI) system.
inis method is described in Reference 4.
If the plant is to be maintained in the hot shutdown condition, the Pressurizer Heaters must be operated to maintain PCS pressure. The heaters are not needed during plant cooldown and are deenergized.
One set of heaters is powered by the safety grade engineered safe-guards electrical system (bus 10).
The heaters can be controlled from the control room.
', 3.3 Electrical !nstru~entation and Power Systems Indications are available in the control room for the following safe-shutdown related parameters.
Power for these instruments can be supplied by either onsite or offsite sources.
Auxiliary feed flow CST level Stearn generator level Steam generator pressure
- MSIV position Atmospheric steam dump position PCS temperature Pressurizer pressure Pressurizer level Pressurizer heaters energized Charging fl ow Boric Acid Tank level SIRW tank level CCW surge tank level SCS flow The instrumentation systems are designed using hig_h quality compo-nents; however, the systems are not safety grade (Class 1).
The design of these systems, as well as safe shutdown related e1ec:rica1 control and power systems, will be evaluated later in the SEP.
Offsite power for Palisades is provided through a ~ingle startup transformer and a single overhead power line. Therefore, applying the BTP RSB s-1* assumption of the loss of onsite power with an assumed single failure of the startup transformer or power line results in the total loss of AC power.
The design of the offs~te power supply for Palisades* was reviewed and found acceptab1e dt.:ring the original license review of the plant.
It was concluded that, because of the demonstrated high reliability of the equipment involved and the availability, within four to six hours of an alternate supply via the station power transformer, the system was acceptable (Reference 2).
The design of the offsite power system was found acceptable and does meet the current NRC requirements cf GDC 17, even though it deviates from the guidelines of BTP RSB 5-1.
The design of the engineered safety feature electrical system provides two independent 2400-volt buses which supply power~*-t:o -
--_--c-_
redundant *engineered safety features and to loads required for safe shutdown.
Each 2400-volt bus has its own djesel generator with the
capacity to supply the power required by the bus.
These buses supply power for the 480 volt system through separate stepdown transformers.
The 480 volt buses, in turn, supply power directly to the chargers for the station batteries and to the 120 volt instrument buses through stepdown transformers.
To assure reliability, each diesel generator has two independent start circuits on separate DC sources (station batteries) and two separate air starting motors.
Each diesel has a 600 gallon day tank in its bedplate, and a 2700 gallon auxiliary day tank in the diesel room.
In addition, there is a 30,000 gallon underground storage tank.
The fuel conta.ined in a diesel's day tank and auxiliary day tank will provide for approximately 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br /> of full-power operation.
Two 20 gpm diesel oil transfer pumps are available to transfer fuel oil from the 30,000 gallon storage tank to the day tanks.
This supply would allow one diesel to operate at full power for approximately ten days.
Two separate and independent sources of DC power for instrumenta-tion and controls are provided in the form of station batteries.
Each battery is a nominal 125 volt, 664 ampere-hour unit housed in a separate, ventilated room, and has its own chargir.g equipment.
The.dual DC system is-carried throughout the station.
The control circuits for each diesel generator set and for each engineering safety feature bus switchgear group will be supplied from one cf the 125 volt DC systems.
On loss of normal and standby AC power, the batteries will supply power to the preferred AC (through in-verters) and DC loads, until one of the diesel generators is avail-able.
The batteries can supply these loads for 30 minutes.
The Palisades onsite and offsite electrical power systems will be further evaluated under several SEP topics.
Components/Subsystems Suhsy~.tems Rcq 1 d for Cool down to Wms Cut-in Steam Generator (Pri. & Sec.
Side) l\\tm. Dump Valves CV-0779; CV-0700; CV-0781; CV-0782 Air Supply System Main steam piping up to and including MSIV Main steam lines to Aux.
feed turbine l\\ux. Feed System
- Turbine Driven Aux. Feed Pump, P-00
- L.O. Valve H 6-14-0742 FW L.O. Valve H 6-29-0773 FW
]<J -
r;
~r.*"..,
- ~ il :i t., t;..,:
t r. '1
\\J.
ll\\BIE 3. l Cll\\SSlrICl\\TION or SllllT00\\1N srdTf.IS Pl\\USl\\OES Pll\\NT Qua 1 i ty Group Seismic Reg. G. l. 2°6 Pl ant Rc9. G. l. 29 SHP 3.2. l Plant Design SRP 3.2.2 Design ASME, I II Class l (pri)
Class 2 (sec)
/\\SME, II I Class 2 Quality Group C ASME, III Class 2 ASME III Class 3 ASME, I II Class 3
/\\SME, I I I Class 3
/\\SME, III Seismic Catg.
Class A I
ASA 831. l Seismic Catg.
I Seismic Class l Seismic Class l AS/\\ 831.l Seismic Catg.
Seismic
?
?
I*
Class l Sci smic Catg.
I Seismic Class l Seismic Catg.
Seismic I
Class l Stds. of Seismic Catg.
llyct1*aulic I
Seismic Class 2 Institute
?
Seismic Catg.
I
?
REM/\\nKS Ref. page 4-10 of FS/\\R ~
Ref. page 10-6 of FSAR
- New RHR shutdown design req't per letter from Mattson to Case dated Jan. 19, 1 78 flequire boundary cJa-;s sPpara-l ion l11ro.
See Uwy. No. M-207
~ 40 -
TAOLE 3.1 (Continued)
Components/Subsystems Quality Group Seismic Reg. G. 1. 26 Plant Reg. G. l. 29 SRP 3.2. l P'lant Design SRP 3.2.2 Design
- Motor-Driven Aux. Feed Pump, P-0/\\
ASME, III Class 3
- Piping and valves supplying ASME, III Aux. FW from pumps to FW Class 3 System line connection Condensate Storage Tank, T-2, ASME, III and associated piping Class 3 Isolation valve interfaced with Fire Fighting Sys.
Valve H 4"-29-0774 FW ASME, III Class 3 Main feed piping from steam ASME III generators. to isolation check Class 2 valve Ooration Systems eves
- Boric /\\cid Tanks T-53/\\ &
T-538
- Boric Acid Pumps P-56/\\ &
P-56B
- Boric Acid Gravity Feed Valves M0-2169 & M0-2170 ASME, Sect.
III Class 3
/\\SME, Sect.
III Class 3
/\\SME, Sect.
III Class 3 Stds. of Seismic Catg.
Seismic l~draulic I Class l ASA 031.l Seismic Catg.
Seismic Class l*
?
?
?
I Seismic Catg.
I Seismic Catg.
I Seismic Catg.
I Seismic Class l*
?
?
ASME, Sect.
Seismic Catg.
Seismic III Class 3 I Class l
?
Seismic Catg.
Seismic I
Class l
?
Seismic Calg.
Seismic I
Class 1 RHIAHl 3. 2. 1 SRP 3.2.2
~esiJI!!
- Pip i ll!J, l ~ ldown l i ne vi a He~Jenera t. i ve llXs to and including air-operated valves CV-2003, -2004, &
-2005 (inside containment)
ASME. I II Class l
- Piping downstream of ASME, III CV-2003, -2004, & -2005 via Class 2 letdown llX to outside con-tainment barrier
- Piping outside containment ASME, III via CV-2009 thru remote Class 2 manual valve, 2"-NX19M3-2010
- Piping downstream of above ASME, III valve via CV-2012 and Class 2 CV-2023
- Piping downstream of ASME, III CV-2023 via~Ion Exchanges Class 3 of bypass path towards Volume Control Tank
- Piping from Doric Acid ASME, III tanks and pumps, and down-Class 3 stream to Charging Pump Section
- Piping from Volume Control ASME, Ill Tank to Charning Pumps Class 2 (Safety Seismic Catg.
Class l)
I (Safety Seismic Catg.
Class N)
I (Safety Seismic Class 2)
I (Safety Seismic Catg.
Class N)
I (Saft?ty Non-Seismic Class N)
Catg. I (Safety Seismic Catg.
Class 2)
I (Safely Seismic Catg.
Class 2)*
I Plant nes.:!JI!!
Seismic Class l Non-Se i smi c Non-Seismic Non-Seismic Seismic Class l Seismic Class l
. Ref. Owg. No.11-202
- From Val v<~ m- ?0fl1 "'*'fl',' 1*~**"il of VCT.
Co111ponents/S11hsystems
- Piping from Ch3rging Pumps via Heyen. llX to valves CV-2113, CV-2115, CV-2117
- Regenerative II)(, E-56
- Letdown ti)(
Tube Side (letdown)
Shell Side (component cooling water Ion Exchangers, T-51A, T-51B, T-51C
- Purification Filters, F54A and F55B
- Boric Acid Batching Tank, T-77
- Boric Acid filter, F-9 T/\\BLE 3. 1 (Continued)
- -~ *---*** -*****-*. *-*-**** **- ***-
Qua l i Ly Group '
Sci !.im i c Re!J.
G:---,-~26--'--r1-a11c---1~e~
1
. G. 1 *~?'J SRP 3.2.2 llesiun Sl~P 3.2. l ASME, I II Class 2 ASME, III Class 2 ASME, I II Class 2 ASME, III Class 3 ASME, III Class 3 ASME, I II Class 2 Quality Group 0 (ASME Sect. VIII)
ASME, I II
- Class 3
. (Safety Seismic Catg.
Class 2)
I ASME, III Seismic Catg.
Class {\\
I ASME, III Seismic Catg.
Class C I
ASME, III Non-Seismic Class C Catg. I ASME~ III Seismic Catg.
Class C I
ASME, VIII Non-Seismic Categ. I ASME, III Seismic Catg.
Class C I
Plant Design Seismic Class l Seismic Class l
?
?
?
Less than Seismic Class l Seismic Class 1 lff ill\\ H I< S Ref. pages 9-65 through a for component classification Note, per Dwg. M-202. tube side of HX is Safety Class 4.
and shell side is Safety Class 3.
Per Owg. No. M-202 note that Piping about these tanks is Safety Cl ass H e
1] -
l/\\111 L :I. I (Co11l.in11ed)
- .-, ! *', * ; \\,
. "\\
r.
1 1
- , ;., *~..
l:
I I
I~ 1'. '. !
... ",.: J \\ 'I '
Compom~n b/S11h~;ys tems Qua l i l.y c;roup Se i ~*111 i c ney:-G.-T:~c,-*.. -** **- Viill1T***. *-- *--Hi~J'~--t:i:--*r:-2~i*-* **-pr;i-iiT-SHP 3._~:.. ?._. _
!lt~s ~U'.~
SHI' :L?. l l~~s i_gf!
- Chemical /\\ddition Tank, T-56 ASME, Sc!ct. Vlll
/\\SME, Vlll Mon-St!ismic Catg. I
- Piping upstream of T-56 to 031. l valve CV-2165, located*in discharging to Blender M-51
- Chaq1ing Pumps P-55A; P-55B; ASME, Sect.
P-55C Class 2
- Volume Control Tank T-54 ASME, Sect.
III Class 2
- Valve M0-2140 (opens on SIS)
ASME, III Class* 2 Safety Injection and Refueling ASME, Sect.
Tunk, T-50 III Class 2 lligh Pressure Safety Injection ASME, Sect.
Pumps:
P-66/\\; P-660; P-66C III Class 2 Component Cooling System Con~onent C~oling Sys located out.side of containment ASME Sect.
. Class 3
?
?
- ASME, Sect. II I Class c
?
ASA B96. l
?
/\\SI\\ nJ'l. I Non-Seismic Catg. I Seismic Cal!J*
I Seismic Catg.
I Seismic Ca tu.
I Seismic Ca lg.
I Seismic Catn.
I
~*(! i Siii i C C:,1 l!J.
I Less than Seismic Class I
?
Seismic Class I Non-Seismic?
Seismic Class l Seismic Class l Seismic Class l Seismic Cl ass 1
- Part of this line should 9 Safety Class.2 No code provided Note, piping ilhout this tank is Safety Class N.
See Owg. No. M-202 Ref. page 6-4 of FSAR Hote:
Per pi!lJr~ 6-6 of f 5..
pumps were tested to stds. of the l~draulic Institute and ASME Power lest Code, PTC-11.2.
Ref., fli.l!fl! I\\-/ of rS/\\I~
Components/Subsystems
- Piping and Valves (in
~Jenera l)
- Valves for supply of cooling water to LPSl/RUR pumps:
CV-0913; CV-0947; CV-0948; CV-0950
- Component Cooling Pumps
- Component Cooling llXs
- Shutdown Cooling MX Service Water System
- Service water backup to Engineered Safeguards Pump Seals
- Water supply to Component Cooling llXs
- Service Water Pumps Servic~ Water to Containm~nt Air Coolers 114 -
11\\DLE 3.1 (Continuecl)
Qua l i ty Group Seismic Hey. G. l..29 SRP 3.2. l fieg. G. l.2G Plant SRP 3.2.2 Design ASME, Sect.
III Class 3 ASME, Sect.
III Class 3 ASME, II I Class 3 ASA B3l.l Seismic Catg.
I AS/\\ B31.l Seismic Calg.
I NEMA, ASA Seismic Catg.
ASlM I
Plant Design Seismic Class l Seismic Class l Seismic Class l ASME III Class 3 ASME, Sect.
Seismic Catg.
Seismic ASME. I II Class 3 ASME, II I Class 3 ASME, III Class 3 ASME, II I Class 3 II Class C I
Class l ASA 831. l ASA 831. l NEMA ASA
/\\STM
/\\SI\\ 031. l Seismic Catg.
I Seismic Catg.
I Seismic Catg.
I Seismic Catg.
I Seismic Class l Seismic Class l Seismic Class l Seismic Class 1 Seismic Class 1 REMAP.KS Ref., page 9-2?. of fS/\\R Loss of instrument ai~ to9 valves leaves system ln a fail-safe mode.
See below (Rim system).
Per Sect. 9. l of FS/\\R, Se~ie water sys. for plant criti systems is Seismic Class l Ref. page 9-7 of FS/\\R for Quality Class Design Ref., page 9-G of FSA~
Ref., page 9-2 of FS/\\R
Components/Subsystems RI IR Shutdown Cool i ng Line
- LPSI/rum Pumps
- Second Isol. Valve, M0-3016
- Valve Upstream of RHR HX, and its air supply:
CV-3055
- Valve downstream of RHR HX, and its air supply CV-3025 CV-3006 air operated bypass valve about mm ll)(s 8
11-line connection to spent fuel pool, downstream of RllR llXs, including valve
//U"-Nl3UMJ02-3214
.. 45 -
TAOLE 3.l (Continued)
Quality Group Reg. G. l. 26 SRP 3.2.2 Plant Design Seismic Reg. G. l. 29 SRP 3.2. l Plant Design ASME, III
?
Seismic Catg.
Seismic Class 2 I
Seismic Catg..
Seismic Class 2 (tube Class C I
Class 1 side)
Class 3 (shell side)
ASME, III
?
Seismic Catg.
Seismic Class l I
Class l*
ASME, III Class 2 ASME, III Class 2 ASME I III Class 2 ASME, III Class 2 ASA 831. l? Seismic Catg.
I ASA 831. l? Seismic Catg.
?
?
I Seismic Catg.
I Seismic Catg.
l Seismic Class l Sci smic Class l
?
?
r. ! ',l r. 1; **;:ir*
Ii I' )
- \\,o., :
I:': *\\,... ;j' ':
.,,,.. *~,,, ""..
RHIARl<S Ref., Sect. 6.1 of FSAR and Dwg. No. M-20'1 Ref. page 6-16 of FSAR Ref., Dwg. No. M-204
- Based on dwg legend 1.
Note:
per page A-3 of FSAR air systems are seismic Class Ref. Owg. No. H-201 I
Components/Subsystems Fire Protection System
/\\ux. Feedwilter Pump Suction Interface Compressed Air System Piping and Valves
- *1h -
r ;., f1 *: *
- I " i I.1 '.
- I I I *'"'.
I /\\ll l i: ). I ( Co11 Li mu*d)
~-----
Qua I i ty li roup Reg. G. l.iG--
Plilnt SRP 3.2.2 pesi~n~
/\\SME, I II Class 3
?
Seismic l~eg. G. l. l.9 SHP 3. 2. I Seismic Catg.
I?
Quality Group O*
/\\SA B3l. l Non-Seismic Catg. I"'
Plant Desi fn!
Seismic Class 2 Seismic Class 2 HGl/\\Hl<S.
Ref., page*/\\-3 of fS/\\R No Quality Code info prov.*d.
See pages 9-3/ and 9-30 o SJ\\!
Ref., page 9-33 of FSAR,
~nd page -3 of FSAIL
- Note:
Generally, compressed*
air system is Quality Group U.
llowever, air systems req'd to per-form safety function
{e.g., accumulators am piping) should be Seismic Cal!)* I and Qua 1 i Ly Group C.
Function
- 1.
Control ot*neactor Power
- 2.
Core lleat Removal
- 3.
Steam Generator Heat Removal
- 4.
- 5.
Primary System Control
- Sa fety-gracle 47 -
I
': '\\ 11' 1':
. '. I r. *1 I
..,* "(/. 1,., ;* i
~j ~ 'c.il ~ !.
Table 3.2 Functions for Shu ldown and Cool clown Method
- a.
- b.
- a.
- b.
- c.
- d.
- e.
- a.
- b.
- c.
- d.
- e.
- a.
- b.
- c.
- a.
b.'
Dorat ion
- l.
CVCS*
- 2.
High Pressure Safety Injection*
- l.
Controlled Rod Injection
- 2.
Reactor Trip Forced Circulation (reactor coolant pumps)
Natural Circulation* (using steam generators)
Shutdown Cooling System*
PCS drains and Safety Injection*
Pressurizer Reliefs and Safety Injection*
Main Condenser (circulating water system)
Atmospheric Dumps Safety Valves*
Auxiliary Feed System Turbine*
Steam Generator Vents*
Main Feedwater Pumps Steam and Motor Driven Auxiliary Feedwater Pumps*
Condensate pumps (steam gen. pressure less than 500 psi-CVCS*
Pressurizer lleaters
- 4. 1 118.
RHR Svstem Isolation Requirements The RHR system shall satisfy the isolation requirements listed below.
- 1.
The following shall be provided in the suction side cf the RHR system to isolate* it from the RCS.
(a) Isolation shall be provided by at least two power-operated valves in series.
The valve positions shall be indicated in the control rooG.
(b) The valves shall have independent diverse. interlocks to prevent the valves from being opened unless :he RCS pressure is below the RHR system design pressure.
Failure of a power supply shall not cause any valve to change position.
(c) The valves shall have independent diverse interlocks to protect against oAe or both valves being open during an RCS increas~ above the design pressure of the RHR system.
- 2.
One of the following shall be provided on the di~charge side of the RHR system to isolate it from the RCS:
(a) The valves, position indicators, and interlocks described in item(a)-(c),
(b)
One or more check valves in series with a normally closed power-operated valve.
The power-operated valve position shall be indicated in the control room.
If the RHR system discharge line is used for an ECCS function the power-operated valve is to be opened upon receipt of a safety injection signal once the reactor coolant pressure has decreased below the ECCS design pressure.
(c) Three check valves in series, or (d)
Two check valves in,serie:s, provided that there are design provisions to permit periodic testing of the check valves for leak tightness and the testing is performed at least annually.
11
The Shutdown Cooling System (SCS) suction and discharge valves connecting this system to the PCS are shown on Figures 6-1 and 6-2 of Reference 3.
The PCS suction supply to the LPSI pumps is from the hot leg of loop 2 through motor-operated valves M0-3015 and M0-3016 in series.
The SCS uses the LPSI pumps for coolant circulation.
SCS return flow is via all four SI.lines to the PCS cold legs.
The permissive interlock for the SCS suction valves is described in Reference 5, and it prevents opening M0-3015 and M0-3016 unless PCS pressure is below 255 psig.
The pressure signal is generated by PS~0103 on the pressurizer for input to the interlock on both suction valves.
This is a deviation from the independent diverse interlock provision of BTP RSB 5-1.
There are no interlocks which automatically shut the SCS suction or discharge valves on increasing PCS pressure.
The SCS suction and discharge isolation valves fail 11 as is" on loss of power and have position indication in the control room.
On the discharge side of the SCS, protection from PCS pressure is provided by two check valves and the motor-operated LPSI valve in each of the four SI lines.
The SCS is isolated from SI accumulator pressure (200 psig) by one check valve and the four LPSI motor-operated valves.
The motor-operated valves open upon receipt of an SI signal.
Based on the above description, the SCS d~viates from these BTP provisions:
- 1.
The suction valves do not have independent diverse interlocks to prevent opening the valves until PCS pressure is below SCS design pressure (270 psia).
- 2.
The suction valves have no interlock to close them when PCS pressure increases above the SCS design pressure.
- 3.
The motor-operated valves in the discharge lines are not interiocked to prevent opening on an SI signal until PCS pressure is below SCS design pressure.
The deviation from the BTP for the SCS suction valve diverse inter-locks is acceptable because, in addition to the single interlock pressure *signal, the valve controls are the key-lock type and are under administrative controls to prevent opening prior to the interlock permissive pressure.
By procedure, the valves are not opened unless PCS pressure fs below 270 psia.
The deviation for lack of automatic suction valve closure on increas-in~ PCS pressure is acceptable because, in addition to the administ1*a-tive and procedural controls on these valves, an alarm is provided
- at 375 psig to warn the operator that PCS pressure is increasing towards SCS design pressure whenever the Overpressure Protection System is enabled.
Upon receipt of an alarm, the control room operator would be able to terminate the pressure increase or to perform the required procedural steps to isolate the SCS.
(See the following discussion of BTP provision C.1, "Pressure Relief Requireinents.
11 )
The deviation regarding lack of an interlock on the LPSI motor-operated valves to prevent their opening until PCS pressure drops to SCS design pressure is an acceptable deviation because of the high level of reliability of the two series check valves in each of these lines_ to prevent backflow from the PCS.
The reliability of these valves is assured by (1) the continuous indication in the control room of the SI header pressure between the series check valves which would indicate a leaking or stuck-open PCS-side check valve, (2) periodic operability testing of the PCS-side check valves, and (3) the ability to detect and measure, in the control room, leakage through the PCS-side check valves.
In addition the installation of an interlock to delay opening of the LPSI valves could potentially result in the delay of LPSI coolant injection into the reactor core and have an adverse effect on the emergency core cooling capability of the plant.
P
""'*~~
..; !i J 4~ "':
~
~ : ' "'3 1 4.2 "C.
Pressure Relief Requirements The RHR system shall satisfy the pressure relief requirements listed below.
- 1.
To protect the RHR system against accidental overpressuriza-tion ~hen it is in operation (not isolated from the RCS),
pressure relief in the RHR system shall be provided with relieving capacity in accordance with the ASME Boiler and Pressure Vessel Code.
The most limiting pressure transient during the plant operating condition when the RHR system is not isolated from the RCS shall be considered when selecting the pressure relieving capacity of the RHR system.
For example, during shutdown cooling in a PWR with no steam bubble in the pressurizer, inadvertent operation of an additional charging pump or inadvertent opening of an ECCS accumulator valve should be considered in selection of design bases.
11 The SCS has two main relief valves, RV 3154 with a setpoint of 300 psig and 133 gpm capacity, and RV 3162 with a setpoint of 500 psig and a capacity of 5 gpm.
Three smaller relief valves (0401, 0402, and 0403), which are 3/4 inch valves, are provided to relieve the pressure associated with thermal expansion of the fluid in the SCS heat exchangers and between the SCS letdown isolation valves.
Valve 0401 relieves to the Primary Drain Tank.
Valves 0402 and 0403 relieve to the Equipment Drain Tank.
The design pres.sure and temperature of the SCS are 500 psig and 350°F although procedures limit the operating pressure and temperature to 265 psig and 325°F.
The relief valves for the SCS are sized to account for thermal expansion of water in the system, and RV-3164 would limit system pressure to approximately 300 psig if an inadvertent isolation of the letdown control valve occurred while the SCS was in operation (Reference 5).
Overpressure transients more severe than the isolation of PCS letdown flow have _been analyzed by the licensee in conjunction with the reactor vessel overpressurizati9n protection system (OPS)
(Reference 7).
To successfully mitigate these worst case transients the licensee has modified the pressurizer power operated relief valve (PORV~) to provide a low pressure relief setpoint of 415 psia when PCS temperature is below 300°F.
The staff has evaluated the effects of the worst case mass and heat input events described in References 7 and 11 to establish the capability of the OPS and SCS
. relief valv~s to prevent RHR overpressurization.
(Only SCS relief valves 3162 and 3164 were considered in the licensee 1 s analysis.)
For the mass input case (HPSI pump start) presented in Reference 11, the OPS and SCS reliefs would prevent RHR overpressurization.
The heat input case involves the heat-up and thermal expansion of the PCS coolant in a closed, water-solid system.
For a heat input transient to occur, the heat from steam generators must be rapidly transferred to a cooler PCS.
The means of rapid heat transfer is forced convection caused by a reactor coolant pump start.
The resulting pressure increase is sensitive to the parameters of steam generator-PCS temperature and increases as these two parameters increase in value.
The analyses presented in Reference 11 as~ume an initial PCS temperature of 120°F and a steam generator to PCS tew~erature difference of 70°F.
Achieving these conditions depends on the Palisades operating staff following proposed operating procedures, especially the procedural requirement to keep reactor coolant pumps running until PCS temperature is reduced to 160° to 180°F during plant cooldown.* This prevents the formation of a temperature difference greater than 70°F before the PCS is depressurized at a PCS temperature of l20°F.
The appropriate procedures were proposed by the licensee during the staff revie~ of the OPS.
Based on our evaluation of the OPS, we have concluded that the OPS and SCS relief valves would prevent the overpressuri-zation of the RHR system resulting from a heat input event.
By procedure, SCS is initiated at a PCS temperature and pressure of 32S°F and less than 270 psia.
By procedure, aided by a warning alarm, the OPS is enabled at 300°F.
Therefore, a minor change in operating procedures to require the enabling of the OPS prior to initiation of SCS would make the overpressure protection of the OPS available to the SCS.
Consideration will be given, in the SEP integrated assessment, to requiring by technical specification the enabling of OPS prior to initiating SCS to meet this provision of the BTP.
11 2.
Fluid discharged through the RHR system pressure relief valves must be collected and co~tained such that a stuck open relief valve will not:
.(a)
Result in flooding of any safety-related equipment.
(b)
Reduce the capability of the ECCS below that needed to mitigate the consequences of a postulated LOCA.
(c)
Result in ~ non-isolatable situation in which the water provided to the RCS to maintain the core in a safe condition is discharged outside of the containment.
11 Fluid discharged through the SCS suction relief valve RV-3164 is directed to the quench tank inside the reactor containment.
The quench tank has a rupture disc which is designed to rupture at 100 psig and allow the contents of the tank to overflow to the containment sump where it would be available for recirculation.
Should flow from a stuck SCS relief valve cause the rupture disc to rupture, the consequences to safety-related equipment would be less severe than the consequences of post-LOCA containment flooding which has been previously analyzed and found acceptable (Reference 10).
The discharge from RV-3162 in the LPSI 'discharge line is directed to the containment floor and from there to the containment sump where it would be available for recirculation.
No adverse conse-quences to safety-related equipment would result from this 5 gpm flow.
Each of the SCS heat exchangers also has a relief valve (0402, 0403) with a setpoint of 500 psig and a capacity of 15 gpm.
The discharge of these reliefs is directed to the equipment drain tank
- via the east Engineered Safeguards Room sump pumps.
The control room operator would be alerted to a leaking discharge valve by the sump high level alarm or sump pump running indication.
These reliefs as well as the other SCS reliefs can be manually gagged.
Considering the capability of the system in mitigating the conse-quences of a postulated LOCA if the SCS reliefs were to stick open, the leakage would have a negligible effect on ECCS performance.
This is because during LPSI, the flow rate through RV-3162 (5 gpm) is negligible in comparison to the flow rate of one LPSI pump - greater than 3000 gpm.
Therefore, the consequences of leakage through RV-3162 would not be nearly as severe as the loss of a LPSI pump which has been postulated as a single failure in the ECCS analysis.
Also the LPSI discharge line and the SCS heat exchangers are not used during post-LOCA ECCS recirculation.
Recirculation is normally accomplished by the High Pressure Safety Injection (HPSi) syste~.
But the SCS heat exchangers are used by the Containment Spray System (CSS) pumps during post-LOCA containment cooling.
The 15 gpm leakage rate of a SCS heat exchanger relief valve is insignif-icant when compared to the capacity of one of the two redundant CSS pumps - 1800 gpm.
RV-3164, on the SCS suction line, is isolated from-all post-LOCA flow paths.
- , "'= radio 1 ogi cal consequences~ of SCS heat exchanger relief val v*e leakage was considered during post-LOCA recirculation of CSS flow.
In this case, the operator would be alerted to the leakage by the drain sump high level alarm, and could isolate the leaking heat exchanger using remotely operated valves in the course of conduct-ing the procedure for isolating excessive leakage from the safe-guards systems.
Leakage from valve 0401 would collect in the Primary Coolant Drain Tank.
This tank is located inside containment and is provided with a relief valve which discharges to the containment floor.
Lines
~h~c~ lead from the tank to outside of containment can be isolated by remotely operated valves.
113.
If interlocks are provided to automatically close the isolation valves when the RCS pressure exceeds the RHR sys:em design pressure, adequate relief capacity shall be provided during the time period while the valves are closing.
11 As noted above, these interlocks are not provided.
However, the overpressure protection afforded by the SCS relief valves in con-junctiqn with the ops'would provide adequat~ relief capacity to prevent PCS pressure from exceeding RHR design pressure.
r; :.1 i1 f'"?!
',.. ~.., j" 1
.:.... - ~. 4. 3 11 0.
Pumo Protection Requirements The design and operating procedures of any RHR system shall have provisions to prevent damage to the RHR system pumps due to overheating, cavitation or loss of adequate pump suction fluid.
11 The features of the Palisades Plant SCS designed to prevent damage to the pumps are provision for pump cooling, a flow recirculation line, and design to prevent loss of net positive suction head (NPSH).
Also, indications are available in the control room for SCS flow and valve positions of all remotely operated SCS valves.
No alarms are provided to alert the operator of pump loss of flow or overheating.
The CCW system provides cooling for the SCS (LPSI) pump seals and lubricating oil to help prevent damage from overheating.
The SCS has a crossover line to recycle a portion of pump discharge fluid to the pump suction.
This helps to prevent pump overheating caused by pump operation under no flow conditions.
The licensee has calculated NPSH margin for the SCS pumps.
This margin will be reevaluated during the SEP under Topic VI-7.E, 11 ECCS Sump Design and Test for Recirculation Mode Effectiveness.
11 The above protection features and the available control room indication provide adequate assurance that the operator can prevent pump overheating, cavitation, or loss of suction fluid.
r r:-\\ *
...,.-.r,:a
,. *,....* ~
1*
!*.-:. i t..t ~
i.:*'
i~-1a
~-.. i:.. J ~
- 4. 4 "E.
Test Reauirements The isolation valve operability and interlock circuits must be designed so as to permit on line testing when operating in the RHR mode.
Testability shall meet the requirements of IEEE Standard 338 and Regulatory Guide* 1.22.
The preoperational and initial startup test program shall be in conformance with Regulatory Guide 1.68.
The programs for PWRs shall include tests with supporting analysis to (1) confirm_that adequate mixing of borated water added prior to or during cooldown can be achieved under natural circulation conditions and permit estimation of the times required to achieve such mixing, and (2) confirm that the cooldown under natural circulation conditions can be achieved within the limits specified in the emergency operating procedures.
Comparison with performance of previously tested plants of similar design may be substituted for these tests.
11 The SCS isolation valve operability and interlocks~cannot be tested during the SCS cooling mode of operation.
This test requirement is not applicable to the Palisades faci*lity since the installed inter-locks function only when the SCS isolation valves are shut.
Regulatory Guide 1.68 was not in existence when the Palisades preoperational and initial startup testing was accomplished.
However, a test was performed on April 20, 1972 to gather informa-tion on natural circulation flow rates.
At a sufficient time after reactor coolant pump trip to allow flow conditions to stabilize, the.calculated power to flow ratio remained below 0.45 which indi-cated that sufficient natural circulation existed for adequate core cooling.
..... r:\\ ~.-=~
~-~ ~ 2 ;\\ J
- f
- \\
t I f * *... ]
l No testing has been performed at Palisades to determine the adequacy of boron mixing under natural circulation flow conditions.
- However, the staff believes that, ~ith the boric acid concentrations used for shutdown, adequate boron mixing will occur under natural circu-1 at ion fl ow.
- 4. 5 11 F.
Ooerat i ona l Procedures The operational procedures for bringing the plant from normal operating power to cold shutdown shall be in conformance with Regulatory Guide 1.33.
For pressurized water reactors, the operational procedures shall include specific procedures and information required for cooldown under natural circulation conditions.
11
- The licensee has procedures to perform safe shutdown operations including shutdown to hot standby, operation at hot standby, hot shutdown, operation at hot shutdown and cold shutdown including long-term decay heat removal.
The licensee has also provided the operating staff procedures covering offnormal and emergency tondi-tions for shutting down the reactor and decay heat removal under conditions of loss of system or parts of system functions normally needed for shutdown and cooling the core.
These procedures include steps to cool the reactor with only natural.circulation through the core.
Procedures for systems operation for systems used in safely shutting down the reactor are also included in the plant operating procedures.
These procedures include provisions identified in Regulatory Guide 1.33.
These procedures were reviewed and are in con.formance with Regulatory Guide 1.33.
n '-'\\ ~. -J;;I
=.; *-.~ t;i ~ 1
- \\..,.
~
J r.- - Certain operation~ were identified to the reviewers whic~ consti-tute alternate ways and paths to achjeve cooling water source alignment or heat sink alignment.
Some of ~hese methods are not included in their procedure system.
The extent to which some of these methods should be included in procedures will be determined.
4.6 11G.
Auxiliary Feedwater Supply The seismic Category I water supply for the auxiliary feed-water system for a PWR shall have sufficient inventory to permit operation at hot shutdown for at least four hours, followed by cooldown to the conditions permitting operation of the RHR system.
The inventory needed for cooldown shall be based on the longest cooldown time needed with either only onsita or only offsite power available with an assumed single failure.
11 The seismic Class I water supply for the AFS is the Condensate Storage Tank (CST) with a capacity of 125,000 gallons.
The backup sources of supply are storage tanks T-81, T-90, T-91 and the fire system, none of which are seismic Class I.
The present technical specification requirement for condensate storage is a total of 100,000 gallons in the CST and makeup tanks.
By administrative controls, the licensee maintains at least 60,000 gallons in the CST and T-81 combin~d with 35,000 gallons in the CST and the remainder of the'60,000 gallons in T-81 and with the remainder of the 100,000 gallon limit in T-90 or T-91.
The technical specification quantity of water is sufficient to remove decay heat while the plant is ~
r"""..,:,,
' '.;;,*.I !
t' :*
~ 1 !.*
t.,
~i-H
..._. t.
..... ~aintained in hot* shutdown conditions for eight hours.
To mai~tain hot shutdown for four hours followed by PCS cooldown to 300°F and 270 psia, the inventory needed is 123,000 gallons.
Consideration will be given, in the SEP integrated assessment of Palisades, to requiring an increase in the technical specification inventory requirement for the seis~ic Class I AFS water supply to meet this provision of the STP.
- ' - ~.. ~ --.
'L:
- ,,;j ~ ~ ~" \\
L.
\\ '....
W.;it*~3 5.0 R:SOLUTION Or SEP -TOPICS The SEP topics associated with safe shutdown have been identified in the INTRODUCTION to this assessment.
The following is a discus-sion of how the Palisades Plant meets the safety objectives of these topics..
The Palisades Plant systems have been compared with these criteria, and the results of these comparisons are discussed in Section 4.0 of this assessment.
Based on these discussions, we have concluded that the Palisades systems fulfill the topic safety objective subject to the reso1~-
tion of the following in the SEP integrated assessment:
- 1.
The requirement for including in plant operating procedures some of the alternate methods of achieving the functional requirements for plant shutdown and cooldown.
5.2 7osic V-11.A Reoufrements for Isolation of Hiqh and Low Pressure Svstems The safety objective of this topic is to assure adequate measures are taken to protect how pressure system connected to the primary system from betng subjected to excessive pressure which could cause failures and in some cases potentially cause a LOCA outside of containment.
This topic is assessed with regard to the isolati6n requirements of the RH~ system from the RCS.
As discussed in Section 4.B, subject to the following item which will be considered in the SEP integrated
. assessment, adequate overpressure protection exists for the RHR system:
- 1.
The need for Technical Specifications to require enabling the Overpressure Protection System whenever SCS cooling is in progress.
5.3 Tooic V-11.B RHR Interlock Requirements The safety objective of this topic is identical to that of Topic V-11.A.
The staff conc~us~on regarding the Palisades SCS valve interlocks, as discussed in Section 4.8, is that adequate inter-l OCKS exist.
- outlined in Reference 9, is based on the operation of equip~en:
from local breakers or from the redundant engineered safeguards panel (C-33) in the Auxi11ary_Building.
Based on the information provided in Procedure 04.21 ana Reference 9, we conclude that the Palisades Plant meets safety objective 2 of Topic VII-3.
The adequacy of the safety grade classification of safe shutdo'fm systems at Palisades, to show conformance with safety objective 3, will be complete~ in part under SEP Topic III-1, 11Classification of Structures, Components, and Systems_ (Seismic and Quality),
11 and in
. part under the Design Basis Event reviews.
Table 3.1 of this report will be used as input to Topic III-1.
5.3 Tooic X Auxiliary Feed System (AFS)
The safety objective for this topic is to assure the AFS can provide adequate cooling water for decay heat removal in the event of loss of all main feedwater using the guidelines of SRP 10.4.9 and BT?
ASB 10-1.
!he Palisades AFS is described in Section 4.0.
This system has been compared with SRP 10.4.9 and BTP ASS 10-1 with the followi~g conclusions:
\\
I
- 1.
The Palisades Plant including the AFS will be reevaluated during the SEP with regard to internally and externally gene-rated missiles, pipe_whip and jet impingement, quality and seismic design requirements, earthquakes, tornadoes, floods, and the failure of nonessential systems.
- 2.
The AFS conforms to Genera 1 Design Criteria (GDC) 19, 11Co;,tro 1
- Room, 11 GDC 45, 11 Inspection of Cooling Water Systems, 11 and GOS 46, 11Testing of Cooling Water Systems.
11 GDC 5, 11Sharing of Structures, Systems, and Components," is not applicable.
- 3.
A failure of the common pump suction or discharge headers would prevent the AFS from supplying feedwater to the ste~m generators even without an assumed concurrent single active failure.
Should this pipe failure occur, an alternate method of steam generator feeding, as described in Section 3.2, exists.
Even though this alternate method is available and its existence alleviates the need for any immediate corrective measures, the staff intends to examine the need for a long-term improvement in the redundancy of the AFS at Palisades.
This will be considered in the SEP integrated assessment of the pl ant.
- 4.
Although the AFS does not meet the provision for power diversity, the system design does permit emergency feeding of the steam
n ?"'.!1 ~:"' ::-:=i
~
- .,:.** l ~
\\
- .1' J. **
generators ~ith an assumed loss of all AC ~ower; but manual operation of valves in the steam supply lines to the turbine is required.
In thi~ case, manual valve operation is per:nis-sible because with no feed, the steam generator water inven-tory can remove decay heat for 17 minutes to one hour (References 3 and 4).
- 5.
The staff is continuing to evaluate feed system waterhammer for the Palisades Plant on a generic basis.
SEP Topic V-13, 11Waterharmner, 11 applies.
- 6.
As noted in the Section 3.2 description of the AFS, the s:aff will reassess the need for a leak detection system in the AFS pump room.
- 7.
The Palisades AFS is not automatically initiated and the design does not have capability to automatically terminate feedwater flow to a depressurized steam generator and provide flow to the intact steam generator.
This is accomplished by the control room operator.
The effect of this provision will be.assessed in the main steam line break evaluation for Palisades.
l
~-....':"i
~,
- a
. ;.*.... :1
'. ~ 1.,
I *
- 8.
The AFS control system deviates from the provisions of ~egula-tory Guide l.52 regarding manual actuation at the system level from the control room..
To start the pumps requires two separate manual operations:
one to apply power to the pump (AC electrical or steam power), and one to open the feed flow control valves to the ste~m generators (Palisades procedure 812.4).
This deviation will be reevaluated in the SEP Design Basis Event evaluations of accidents and transients for Palisades.
The electrical design of the AFS controls will be evaluated later in the SEP.
- 9.
A lack cf system redundancy exists because the turbine-driven
_AFS pump is not seismic Class 1.
The staff will consider the need for upgrading the seismic classification of the pump in the SEP integrated assessment of Palisades.
- 10.
As noted in Section 4.6, the staff will assess the need for increasing the technical specification inventory limit for the seismic Class I AFS water supply.
- 11.
Th~ technical specifications for the AFS will be reevaluated against current requirements under SEP Topic XVI, "Technical Specifications.
11
l *'a
- 1.
Staff Discussion of Fifteen Technical Issues Listed in Attach-ment to November 3, 1976 Memorandum from Director, NRR to NRR Staff, NUREG-0138, November 1976.
- 2.
Safety Evaluation by the Directorate of Reactor Licensing of the Palisades Plant Docket No. 50-255, March 6, 1970.
Consumers Power Company Palisades Plant Final Safety Anaysis Report.
. 4.
CPC letter D. Bixel to A. Schwencer dated March 31, 1977 forwarding the Palisades Fire Safety Analysis.
CPC letter 0. Hoffman to A. Schwencer dated March 8, 1977.
- 6.
NRC letter, Quality Assurance Plan Approval, dated November 25, 1975.
- 7.
CPC letter D. Hoffman to A. Schwencer, *dated June 24, 1977 forwarding report entitled:
"Palisades Plant Overpressuriza-t ion Analyses.
11
r
!:'=\\ r: --
..* ~.! ~
~
.**.I
~ -...,
I I *
- 8.
Systematic Evaluation Program, Status Summary Report, NUR:G-0485.
- 9.
Amendment 15 to the Palisades Plant License Application for-warded by CPC letter dated August 28, 1969.
- 10.
NRC letter R. Purple to R. Sewell, forwarding Amendment No. 21 to Palisades license, dated April 29, 1976.
- 11.
CPC letter D. Hoffman to A. Schwencer dated November 28, 1977.