ML18150A428
| ML18150A428 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 02/29/1988 |
| From: | Stewart W VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.) |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| 87-707A, NUDOCS 8803080203 | |
| Download: ML18150A428 (41) | |
Text
-'
e l,..~...,_. ~..... ~,
VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261
- w. L. STEWART VXCE PRESIDEN'.r NUCLEAR OPERATIONS February 29, 1988 U. S. Nuclear Regulatory Commission Attention:
Document Control Desk Washington, D. C.
20555 Gentlemen:
VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS I AND 2 RESPONSE TO UNRESOLVED ITEMS IN IEIR 50-281/86-36 Serial No.
NOD/ETS:vlh Docket Nos.
License Nos.
87-707A 50-280 50-281 DPR-32 DPR-37 In Inspection Report 50-281/86-36, unresolved issues were identified associated with our Containment Integrated Leak Rate Testing (CILRT) Program.
These i terns include:
- 1) pl ant operation and containment leak rate testing with the containment liner weld leak-chase channel plugs installed; and, 2) exclusion of certain Type C test results from the overall containment integrated leak rate.
In a previous letter dated February 8, 1988, (Serial No.87-707), we provided an evaluation for plant operation and containment leak rate testing with the containment liner weld leak-chase channel plugs installed.
This letter provides our technical evaluation to justify that specific penetrations are normally filled with water and operating under post-accident condit i ans and therefore are not re qui red to be vented and drained duri n,g Integrated Leakage Rate testing.
A Technical Specification change is being prepared and will be submitted requesting exemption from Type C testing for these specific penetrations.
Based on our analysis, we have concluded that the specific penetrations are
. water filled and normally operating during a design basis accident.
Surry's accident analysis assumes that during a design basis accident the containment wi 11 be returned to a subatmospheri c pressure within the first hour of the accident. Therefore, within an hour, any containment leakage will be into the containment.
,,' 8803080203. 880229.. *.
- DR. ADOCK osoog~zo
e Th~-,-Stat ion Nuclear and Safety and Operation Committee has reviewed this infbrfuation and determined that an unreviewed safety question does not exist if the water-filled normally operating penetrations are excluded from Type C testing or the specific penetrations are not vented and drained for Containment Integrated Leakage Testing.
Very truly yours, Attachment
- 1.
Technical Evaluation for Excluding Specific Containment Penetrations from Type C Testing cc:
U. S. Nuclear Regulatory Commission Region II 101 Marietta Street, N. W.
Suite 2900 Atlanta, Georgia 30323 Mr. W. E. Holland NRC Senior Resident Inspector Surry Power Station Mr. Chandu P. Patel NRC Surry Project Manager Project Directorate II-2 Division of Reactor Projects-I/II
e ATTACHMENT 1 Technical Evaluation for Excluding Specific Containment Penetrations from Type C Testing
e BACJ<GROUM.q During the Nuclear Regulatory Commission (NRC) inspections conducted on November 13 through 20, 1986 and February 9, 1987, an unresolved issue was identified concerning initial conditions for the performance the of Type 'A' Containment Integrated Leakage Rate Test (CILRT).
Type 'A' CILRT performance is required by 10CFR50, Appendix J.
The NRC inspection concerns are specific to the initial conditions for testing where certain pipe penetrations are fi 11 ed with water to simulate system accident conditions and therefore, a Type 'C' leakage penalty is not included in the overall integrated leakage rate for these penetrations.
10CFR50, Appendix J allows for pipe penetrations to be water filled to simu-late design basis accident conditions.
Therefore, in accordance with the NUREG 0800, Standard Review Plan, Section 6.2.6, "Containment Leak Testing,"
the following technical discussion justifies that specific pipe penetrations are normally filled with water and operating under post accident conditions and thus do not require Type 'C' testing or a Type 'C' leakage penalty to be included in the overall integrated leakage rate.
DISCUSSION t*--
SAFETY INJECTION SYSTEM A.
PENETRATIONS The specific penetrations in the safety injection system which are filled with water and/or are operating under design basis accident conditions follows.
15 21 23 46 60 61 62 68,69 113 Valves 1(2)-Sl-150 MOV-1867C&D (MOV-2867C&D) 1(2)-CH-309 MOV-1289A (MOV-2289A)
MOV-1842 (MOV-2842)
MOV-18698 (MOV-28698)
FCV-1160 (FCV-2160)
MOV-1890A (MOV-2890A)
MOV-1890C (MOV-2890C)
MOV-18908 (MOV-28908)
MOV-1860A&B (MOV-2860A&B) 1(2)-Sl-174 MOV-1869A (MOV-2869A)
Function HHSI to Cold Leg Normal Charging HHSI to Cold Leg HHSI to Hot Leg Loop Fi 11 Header LHSI Pump Discharge to Hot Leg LHSI Pump Discharge
- to Cold Leg LHSI Pump Discharge to Hot Leg LHSI Suction From Containment Sump HHSI to Hot Leg A Type 'C' penalty is not required to be applied to the CILRT results for the penetrations listed above because:
Safety injection penetrations Nos. 7,21,23,60,61,62 and 113 are at a higher pressure than the containment pressure during the first hour of a design basis accident as well as*during accident recovery.
High and low pressure safety injection pumps operate to pressurize discharge piping and associated penetrations.
~-- -- 1
-..--Penetration Nos. 15 and 46 are pressurized prior to and during a design basis accident because the charging headers are water-filled and pres-surized.
Piping inside containment remains filled with water due to system pipe configurations (eg. a water-filled loop seal).
During a design basis accident when the containment sumps fill, Penetration Nos. 68 and 69 are sealed with water.
B.
DESIGN BASES The design bases for the safety injection system are:
I.
To protect the unit and the public by maintaining clad integrity and thus minimizing the release of fission products from the fuel during the unlikely event of a LOCA.
- 2.
To protect the core for a range of possible mishaps (evaluated as more probable than a LOCA), thereby minimizing financial loss and loss of power generation capability.
The specific technical objectives of the safety injection system are:
- 1.
For the assumed LOCA (double-ended rupture of a reactor coolant pipe), or the LOCA associated with a control rod assembly ejection, or the rupture of a steam-generator tube
- a.
To automatically deliver borated cooling water to the reactor core in large enough volume and soon enough after the accident so that I)
The c 1 adding temperature is 1 ess than the melting temperature of Zircaloy-4, and is less than the temperature at which gross core geometry distortion or clad fragmentation may be expected.
- 2)
The total core metal-water reaction is limited to less than 1%.
- b.
To shut the reactor down and maintain it a 1% shutdown with all but one control rod assembly inserted (after long-term core operation at 2546 MWt>*
Per the UFSAR, "These criteria ensure that the core remains in place and substantially intact to such an extent that effective cooling of the core is not impaired."
- 2.
For the steam-line break or uncontrolled cooldown
- a.
To maintain the core in place and essentially intact so as not to impair effective cooling of the core, with the most reactive control rod assembly withdrawn, no* offsite power, and a single failure in the engineered safeguards systems.
'b.
To limit clad damage to an insignificant amount for the worst steam-1 ine break, with no stuck control rod assembly, with offsite power available, and with engineered safeguards.
- c.
To prevent DNB after shutdown and during cooldown due to any single active failure, for example, the opening of a steamline relief valve.
The safety injection system meets the intent of General Design Criteria 37 though 48, as discussed in UFSAR Section 1.4, because
- 1.
The safety injection system objectives are met even though a loss of normal station power has occurred coincident with the accident.
- 2.
Any single active failure during injection does not prevent the accomplishment of safety injection system objectives.
One active or passive failure in the systems required for long-term safety injection system operation does not prevent the accomplishment of safety injection system objectives, nor cause the total offsite dose to exceed 10 CFR 100 guidelines, assuming credit is taken for detection and operator action.
- 3.
Critical parts of the safety injection system and of the reactor coolant system are periodically inspected.
- 4.
Active components of the safety injection system are tested periodically to ensure that each component is operable.
- 5.
An integrated safety injection system test of active components is performed periodically dur1ng shutdown without introducing flow into the reactor coolant*system.
- 6.
Maintenance outages of active components are permitted only for limited periods of time.
- 7.
It is assumed that the highest worth control rod assembly remains stuck out of the core on reactor trip.
- 8.
Components exposed to the accident environment are designed to operate in that environment for the length of time required.
- - - -- 3----- - --
C.,. SYSTEM DESCRIPTION Adequate emergency core cooling following a LOCA is provided by the safety injection system show in Figures 1, 2 and 7.
The system com-ponents operate in the following possible modes:
- 1.
Injection of borated water by the passive accumulators.
- 2.
Injection of borated water initially from the refueling water storage tank with the safety injection charging pumps, and injection by the low-head safety injection pumps drawing borated water from the refueling water storage tank.
- 3.
Recirculation of spilled coolant and injection water back to the reactor from the containment sump using the low-head safety injection pumps and by the safety injection charging pumps, if required by the situation.
The initiation signal for core cooling by the safety injection charging pumps and the low-head safety injection pumps is the safety injection signal that is actuated by any of the followin9:
- 1.
Low-low pressurizer pressure.
- 2.
High containment pressure (three out of four).
- 3.
Steam-1 ine differential pressure (two out of three between each steam line and main steam header).
- 4.
High steam flow in any two of three steam lines (one out of two per line) coincident with low steam-line pressure (two out of three in steam-generator header), or low Tavg*
- 5.
Manual actuation.
Injection Phase The principal components of the safety injection system that provide emergency core cooling immediately following a loss of coolant are the three accumulators (one for each loop), two of the three safety injection charging pumps (which perform the charging functions during normal operation), and the two low-head safety injection pumps.
The safety injection charging pumps are located in the auxiliary building.
The low-head safety injection pumps are located in the safeguards area alongside the containment building with the pump impeller actually located within an extension of the containment boundary.
- ----4
1 Theisafety injection signai opens the safety injection system isolation valves and starts the safety injection pumps.
The accumulator isolation valves also receive the safety injection signal.
The valves of the high-head safety injection system open or close in approximately 10 sec (in contrast to accumulator check valves, which open almost instantaneously).
The safety injection charging pumps deliver borated water to the cold legs of the reactor coolant loops via separate discharge headers.
These pumps provide for the makeup of coolant and add negative reactivity following a small break that does not immediately depressurize the reactor coolant system to the accumulator discharge pressure.
For large breaks, they start delivery after the accumulators start their discharge.
The suction of the safety injection charging pumps is diverted from the normal suction at the volume control tank to the refueling water storage tank by the safety injection signal.
The pumps feed two injection headers.
The normal injection header contains redundant para 11 el isolation valves which open on receipt of a safety injection signal.
For large breaks, the reactor coolant system is depressurized and emptied of coolant rapidly (about 10 sec for the largest break) and a high flow rate is required to quickly recover the exposed fuel rods and limit possible core damage.
To achieve this objective, three accumulators are provided.
Two pumps each delivering to a separate header are available to provide for an active component failure.
Delivery from one low-head pump is required to supplement the accumulator discharge.
For large-area ruptures, the flow from the low-head portion of the system completes and maintains the core reflooding started by the accumulators.
The accumulator injection starts core reflooding, as well as the termination of the clad temperature rise.
The pumping systems ensure that the core is refl ooded and that the reactor vessel is flooded at least to the nozzle.
The core decay heat is removed by boil off of the injected water, and ultimately the core is subcooled.
The low-head pumps will recirculate the sump water, either directly to the reactor coolant loops for large breaks, or to the suction of the high-head pumps for small breaks, to ensure continued long-term cooling of the core.
Hot-leg connections for the low-head systems were selected to provide the optimum performance for the above °functions and achieve a diversity of injection locations and flexibility to meet long term cooling require-ments. --- -
- The.Jco 1 d-1 eg break is the most 1 i mit i ng, s i nee the fl ow from one of the three accumulators is lost through the break, the steam-binding problem is more severe, and the clad temperatures at the end of blowdown are higher than for a comparable hot-1 eg break.
The two unbroken col d-1 eg lines will deliver 340 gpm from the high-head pump, with allowance for part of the flow to spill through the break in the cold leg.
The low-head pumps p~ovide the means to recirculate the sump water cool~d by the spray heat exchanger and continue cooling the core through several alternate flow paths. The flow provided is in excess of that required to replace boiloff with allowance for spilling injection flow where app 1 i cab 1 e.
If the 1 ass of coo 1 ant occurred on the co 1 d 1 eg of one of the loops, the injected water would pass through the core to the break and ultimately subcool the core in the forced-circulation mode.
Motor-operated va 1 ves of the safety injection system that are under manual control, that is, valves that normally are in their ready position and do not receive a safety injection signal~ have their positions indicated on a common portion of the control board.
At any time during operation, if one of these va 1 ves is not in the ready pas it ion for injection, it is shown visually on the board.
In addition, an audible alarm alerts the operator to the condition.
Changeover from Injection to Recirculation The transfer of* the safety injection suction 1 ineup from the refueling*
water storage tank to the containment sump takes place automatically.
The valve alignment sequence begins with MOV-863A and B opening while MOV-885A, B, C, and D close.
The maximum closing time for these valves is 2 min.
MOV-836A and B supply suction to the high-head safety injection pumps from the discharge of the 1 ow-head safety injection pumps.
MOV-885A and D and MOV-885B and C are series va 1 ves isolating each of the two low-head safety injection pump recirculation lines to the refueling water storage tanks.
Two minutes after the start of the valve positioning sequence, MOV-860A and B start to open, while MOV-862A and B and LCV-115B and D start to close.
The maximum closing time for these valves is 2 min.
MOV-860A and B supply suction to the low-head safety injection pumps from the containment sump.
- MoV-862A and B isolate suction to the low-head safety injection pumps from the refueling water storage tank.
LCV-115B and D isolate the high-head safety injection charging pump suction from the tank.
Existing check valves in these 1 ines prevent cross connecting the containment sump with the refue 1 i ng water storage tank.
The entire sequence of the automatic transfer takes 4 min.
(Note:
Preface each MOV number with a I or 2 depending upon the unit, i.e., MOV-1885A Unit 1, MOV-2885A Unit 2.)
-- ---- --------------------- --- ---- ----*---------- ------- ______ s ___ --------- ----- -------- ------- ------ --- ------------------- ------ ----
, Recirculation Phase The coolant and refueling water spilled from the break and the water from the containment depressurization system collects in the containment sump, and part is returned to the reactor coolant system by the low-head safety injection pumps.
The balance flows to the recirculation spray subsystem.
Because the injection phase of the accident is terminated before the refueling water storage tank is completely emptied, pipes are kept filled with water before recirculation is initiated.
If the break is large, the depressurization of the reactor coolant system occurs rapidly, due to the large rate of mass and energy loss through the break to the containment.
For small breaks, the depressurization of the reactor coolant system by the safety injection system and by the rupture during the injection phase can be augmented by secondary steam dump and auxiliary feedwater addition.
Operator action to steam augments depressurization, but credit is not taken for this in the LOCA design analysis in UFSAR Section 14.5.
When the necessary depressurization has been accomplished, the low-head safety injection pumps take suction from the containment sump and return the coo 1 ant to the reactor.
If the depressurization of the reactor coolant system proceeds slowly, the recirculation of spilled coolant can be accomplished by aligning the discharge of the low-head safety injection pumps with the suction of the safety injection charging pumps.
The redundant features of the recirculation loop include one pump in each of two separate trains, with crossover capability at the discharge of each pump.
Each pump takes suet ion through separate 1 i nes from the containment sump.
After one day, the spray water collected is cold enough to reduce the temperature of the combined mass sufficiently for recirculation without flashing.
Heat remova 1. is through the reci rcul at ion spray subsystem.
There are no heat exchangers in the safety injection system.
Those portions of the safety injection system 1 ocated outside of the containment that are designed to circulate, under postaccident conditions, radioactively contaminated water collected in the containment, meet the following requirements:
- 1.
Shielding to maintain radiation levels within the guidelines set forth in 10 CFR 100.
- 2.
Collection of discharges from pressure-relieving devices into closed systems.
- 3.
Means to detect and control radioactivity leakage into the environment.
Steam Line Break Protection A large break of a main steam system pipe causes an uncontrolled removal of heat that rapidly cools the reactor coolant, causing the insertion of positive reactivity into the core.
Compensation is provided by the injection of 2000 ppm borated water from the RWST.
The isolation valves in the lines injecting into the reactor coolant system hot legs remain closed, ensuring that the safety injection flow is directed into the cold legs of the reactor coolant system.
D.
SINGLE-FAILURE ANALYSIS A single-active-failure analysis is presented* in Table 1.
Credible active system failures are considered.
The analysis of the LOCA presented in our UFSAR is consistent with the single-failure analysis.
The analysis is based on the worst single failure ( genera 11 y a pump failure) in the safety injection system.
The analysis shows that the failure of any single active component does not prevent ful fi 11 i ng the *
- design function; al so, operator action is not required to correct the malfunction.
In addition to the single-active-failure capability, an alternative flow path is available to maintain core cooling if any part of the recirculation flow path becomes unavailable.
The procedure followed to establish the alternate flow path also isolates the spilling line.
E.
TESTS AND INSPECTIONS Preoperational Component Testing Preoperat i ona l performance tests of safety injection system components were performed in the manufacturer's shops.
The pressure-containing parts of the pumps were hydrostatically tested in accordance with paragraph UG-99 of Section VIII of the ASME Code.
Each pump was given a complete shop performance test in accordance* with Hydraulic Institute standards.
The pumps were run at design flow and head, shutoff head, and at additional points to verify performance characteristics. Net positive suction head was established at design flow by means of adjusting suction pressure for a representative pump.
This test was witnessed by qualified Westinghouse and Virginia Power personnel.
The remote-operated valves in the safety injection system are motor or air operated.
Shop tests for each valve included a hydrostatic pressure
- test, leakage tests, a check of opening and closing time, and verification of torque switch and limit switch settings.
The ability of the operator to move the valve with the design differential pressure across the gate was demonstrated by opening the valve with an appropriate hydrostatic pressure on one side of the valve.
8
e Th~*recirculation p1p1ng and accumulators were initially hydrostatically tested at 150% of design pressure.
The service water and component cooling water pumps were tested before initial operation.
Preoperational System Testing After hot functional testing and before initial fuel loading, the safety injection system was operationally tested.
These tests included individual pump full-flow tests, accumulator operation, and complete system operational flow tests, with the reactor head removed.
The purpose of this test was to demonstrate the proper functioning of the instrumentation and actuation circuits and to evaluate the dynamics of placing the system in operation.
Water was supplied from the refueling water storage tank for this series of tests.
The actuation of the pressurizer low level and pressure signals initiates the automatic startup of the safety injection system.
The operability of the accumulators was checked by closing the stop valve, raising the pressure in the accumulator, and then opening the stop valve and observing the accumulator level change to provide an indication of system delivery.
An additional check on system delivery can be made by observing the pressurizer level rise.
Refueling Tests Testing can be conducted to demonstrate proper automatic operation of the safety injection system.
The safety injection charging pumps can be tested using the minimum flow recirculation flow lines that return to the volume control tank, and they can also be tested at any time during plant operation because of their dual charging and safety injection system functions.
A test of the low-head safety injection pumps can use the rec i rcul at ion lines that return to the refueling water storage tank, using the same procedure as for the safety injection charging pumps.
A test signal is applied to initiate safety injection, and verification is made that each pump attains the required discharge head.
The tests are considered satisfactory if control board indication and visual observations indicate that components have operated and sequenced properly.
The automatic actuation circuitry, valves, and pump circuit breakers are also checked during these test.
Normal Operation Each active component of the safety injection system may be individually actuated on the normal power source at any time during the operation of the unit to demonstrate operability.
9
. TheJ chemical and volume control system charging pumps serve as the high-head safety injection pumps.
As such, the operability of a least one pump is demonstrated by continuous charging operation while the unit is at power.
Demonstration tests can be performed at other times on the other two pumps while charging with the third by employing the minimum flow recirculation line that returns to the volume control tank.
The test of the low-head safety injection pumps employs the minimum flow recirculation test line that returns to the refueling water storage tank.
Remote-operated valves and actuation circuits are also periodically tested.
The accumulator pressure and level is continuously monitored during station operation, and flow from the tanks can be checked at any time using test lines.
The accumulators and the injection piping up to the final isolation valve are maintained full of borated water while the station is in operation.
The accumulators are refilled with borated water as required by using the positive-displacement hydrotest pump.
The boron concentration in the accumulators is sampled periodically.
The operation of the remote stop valves in the accumulator discharge line is tested by opening the remote test valves in the test line between the remote stop valves and check valves.
Fl ow through the test line is measured, and the opening and closing of the discharge line stop valves is verified by the flow instrumentation.
The test line can also be used to check leakage through the check valves and to ascertain that these valves seat whenever the reactor system pressure is raised.
ASME Code,Section XI, Inservice Inspection of Nuclear Reactor Coolant System, requires that portions of the emergency core cooling system that penetrate the containment be subject to the requirements of Section XI from the reactor coolant piping to the first isolation valve outside the containment capable of external actuation.
The portion of the low-head safety injection system p1p1ng located in the containment valve pit is not subject to the requirements of Section XI because it is located outside the first containment isolation valve capable of external actuation.
The length of pipe between the valve pit and the pump suet ion for the safety injection system is 3 ft.
This run of pipe is embedded in concrete.
The pipe employed is 12-in., Schedule 40S, fabricated of ASTM A358, Type 304 material, in accordance with Code for Pressure Piping USAS-B31.l.O, 1955 edition, plus Code Cases N-1 and N-7.
Under normal plant operating conditions, the low-head safety injection piping in the valve pit will be dry and subjected to no pressure.
Heavy wall piping has been used, and all welds have been radiographed during construction.
10
Thfu* methods of leak detection proposed for the p1 p1 ng are as fo 11 ows:
Large leaks in the suction piping, which is located in the valve pit, will be detected by liquid measuring devices.
The valve pit is provided with a baffle dividing the pit into two sections. Thus, the leakage from one set of safety injection lines will be detected by the increased liquid level on the affected side of the baffle.
On detection, the operator in the control room has the capability to remote manually isolation the leaking subsystems, leaving one safety injection loop operable if required.
The volume of water required in the valve pit to actuate an alarm in the control room is 200 gal. A small leak rate, which may be defined as 10%
of the total flow in the piping, will cause the alarm to sound in less than 45 sec, since the total flow in the piping is 3000 to 3500 gal/min.
In the case of small leaks, specific detection of a leak is not possible; however, when the operation of these systems is initiated, the same signal diverts the. ventilation air from the structure enclosing the piping outside the containment through charcoal filters. Thus, no escape of unfiltered gases or liquid to the outside environment can occur.
Inspections Components of the safety injection system are inspected periodically to demonstrate system readiness.
The pressure-containing components are inspected for leaks from pump seals, valve packing, flanged joints, and safety valves during system testing.
The inspection for extern a 1 1 eaks are performed on a month 1 y basis in accordance with the monthly performance test of the system.
A daily walkdown is also performed on the charging system for evidence of leaks.
11
TAfilE I SINGIE-ACI'IVE-~ ANAINSIS OF SAFElY INnCI'ION SYSTEM Component A.
Accumulator (injection phase)
B.
Pl.mp (injection phase)
- 1. Safety injection charging
- 2.
I.ow-head safety injection
- c. Automatically operated valves (open on safety injection signal)
( injection phase)
- 1. Isolation valves at discharge of high-head safety injection purrps (cold-leg injection)
- 2.
I.ow-head safety injection pump discharge isolation valves (cold-leg injection)
- 3. Accumulator stop valves Malfunction Deliveries to broken loop
/
Fails to start Fails to start Fails to open Fails to open Fails to open 12 eonunents
(
Totally passive system with one accumulator per loop. Evaluation based on two accumulators delivering to the core and one spilling from ruptured loop.
Three provided. Evaluation based on operation of one.
'ThTo provided. Evaluation based on operation of one.
One of two parallel valves is required to open.
e One line from each pump leading to e
common discharge header. Isolation valve in this line locked open.
One valve per accumulator, noD11ally open, or opened if initially closed.
Analysis assumes the three accumulator stop valves are open.
'mBIE I SlNGIE-ACI'IVE-EAIIIJRE ANAINSIS OF SAFEI'Y ~00 SYS.11EM Component
- c. Automatically operated valves (open on safety injection signal)
(injection phase) (continued)
- 4. Refueling water storage tank to charging pump.
return valves D.
Valves automatically closed on safety injection signal
- 1. Chal:ging line injection
- 2. Voltnne control tank discharge E. Valves operated for recirculation
- 1. Containment sump
- 2. Safety injection charging pump suction valve from low-head safety injection pump discharge Malfunction Fails to open Fails to close*
Fails to close Fails to open Fails to open 13 Connnents
(
Two in parallel; one out of two is as-sumed to open.
e Two valves in series are provided wher-ever closure is required.
Two valves in series are provided wher-ever closure is required.
Two lines in parallel; one valve in either line is required to open.
One recirculation line from each low-e head pump.
One motor-operated valve in each line, one of which must open.
TABIE I SINGIB-ACI'IVE-F7u!IJRE ANAINSIS OF SAFEl'Y ~00" SYSTEM Component E.
Valves operated for recirculation
( continued)
- 3. Isolation valve at suction header of low-head safety injection pump from refueling water storage tank
- 4. Isolation valves suction to high-head safety injection ptnnpS
- 5. Isolated valves on the low-head safety injection system miniinum flow or a test line retunri.ng to the re-fueling water storage tank
- 6. suction and discharge valve on safety injection charging pump Malfunction Fails to close Fails to close Fails to close Fails to close 14 Cormnents
(
Motor valve and check valve in series.
Motor valve required to close backed up by check valve.
e Two motor valves in parallel, backed up by check valve and administratively con-trolled, nonnally open manual gate valve.
Two motor-operated valves in each minimum flow line in series with a check valve in each line.
'Ihese valves are nonnally open.
Failure of one to close does not prevent separate and redundant recirculation paths.
e
SPRAY S'Y-oTEM A.
PENETRATIONS The specific penetrations in the spray system which operate under accident conditions filled with water follows:
Penetrations 63 64 66,67 Valves 1(2)-CS-24 MOV-CS-lOlC;D (MOV-CS-201C;D) 1(2)-CS-13 MOV-CS-lOlA;B (MOV-CS-201A;B)
MOV-RS-155A;B (MOV-RS-255A;B)
Function CONTAINMENT SPRAY DISCHARGE CONTAINMENT SPRAY DISCHARGE CONTAINMENT SPRAY DISCHARGE CONTAINMENT SPRAY DISCHARGE CONTAINMENT SPRAY DISCHARGE CONTAINMENT SPRAY DISCHARGE OUTSIDE RECIRC SPRAY SUCTION OUTSIDE RECIRC SPRAY SUCTION A Type 'C' penalty is not required to be applied to the results of the CILRT for the penetrations listed above because:
Penetration Nos. 66 and 67 for outside recirculation spray (RS) pump suet ion penetrations are sealed with water inside the containment upon accident initiation when water fills the containment sumps.
Containment spray (CS) pumps' discharge penetration Nos. 63 and 64 are pressurized during the design basis accident because the CS pumps' suctions are continuously exposed to the water column head of the RWST which flows through each CS pump to the discharge valves located in the valve pit.
When CS pumps start, discharge valves open and the penetrations are pressurized.
Inside containment CS piping configuration provides a water filled loop seal.
15
e B.~
DEs.IGN BASES The spray system consists of the containment spray subsystem and the recirculation spray subsystems, (See Figure 3 and 4) which are designed to provide the necessary cooling and depressurization of the containment after any LOCA.
Components, piping, valves, and supports in the spray system are Seismic Category I.
The subsystems, operating together, cool and depressurize the containment to subatmospheri c pressure in less than sixty mi nut es fo 11 owing the design-basis accident.
The recirculation subsystems are, in addition, capable of maintaining the subatmospheric pressure in the containment for an extended period following the design-basis accident.
The removal of radioactive iodine from the containment atmosphere after a design-basis accident is accomplished through the addition of sodium hydroxide solution to the containment spray (Section 14.5.6).
The spray system is designed to depressurize the containment to subatmospheric pressure with any one of the two containment spray pumps operating and only two of the four recirculation spray pumps operating.
The spray system :is designed,
- fabricated,. inspected, and i nsta 11 ed to meet the requirements of the General Design Criteria.
The spray subsystems and their components are considered to be essential to accident prevention and/or the mitigation of accident consequences that could affect the public health and safety.
The spray system pumps and valves are fabricated, welded, and inspected according to the requirements of the applicable portions of the ASME Code, Sections III, VIII and IX.
Materials of construction are stainless steel or equivalent corrosion-resistant materials.
Valve packing and pump seals are selected to minimize or eliminate leakage where necessary.
Motor-operated va 1 ve operators are selected because their proven superior reliability in past applications ensures reliable valve operation under accident conditions.
The Teflon sleeve and packing of the outside recirculation spray system suet ion valves have been changed to XOMOX 7.
This change reflects the review performed in accordance with NUREG-0578, Section 2.1.6.b.
In this review it was found that the valves would be located in a high-radiation area a~ a result of a LOCA.
The Teflon material is satisfactory to onl~
1 x 10 rads, whereas the XOMOX 7 material is satisfactory to 8 x 10 rads.
The expected 40-year normal plus postaccident integ6ated radiation dose in this area is conservatively estimated to be 7 x 10 rads.
16
L Th~*containment spray system p1p1ng and equipment are fabricated of ASTM A358, Type 304 stainless steel, or equivalent, which has a corrosion rase of less than O. 0001 in./yr. at the system operating conditions of 45 F temperature and 9 to 10.4 PH.
This system contains the sodium hydroxide solution only while operating during an incident, which is a period of approximately thirty minutes.
The recirculation spray system piping and equipment are also fabricated of ASTM A358, Type 0304 stainless steel, or equivalent.
System operating conditions are 200 F temperature and 7.6 to 8.2PH during the long-term postaccident period.
Piping fabrication, installation, and testing are in accordance with the Specification for Power Plant Piping, ANSI B31.l, with supplemental requirements and inspections as necessary for use in nuclear applications. Pipe routing and supports are such that missiles generated from postulated events or the effects of LOCAs do not impair the operation of spray systems.
C.
SYSTEM DESCRIPTION The spray system consists of two separate but parallel containment spray
- headers, each of 100% capacity, and four separate but parallel recirculation spray headers, each of 50% capacity.
An addi ti ona 1 ring header common to both containment spray trains is installed at elevation 95 ft. 6 in. outside the crane wall.
Check valves are i nsta 11 ed in each branch connection from the riser to the common header to limit fill time, should one containment spray pump train fail to start.
Each of the containment spray headers draws water independently from the refueling water storage tank.
The sodium hydroxide solution used for iodine removal from the containment atmosphere is added to thi containment spray water by a ba 1 anced gravity feed from the chemi ca 1 addition tank.
The containment spray pumps are capable of supplying approximately 3200 gpm of borated water to two separate circular containment spray ring headers located approximately 96 ft. above the operating floor in the dome of the containment structure and the common crane wall header at elevation 95 ft. 6 in.
Each pump is driven by an electric motor drive.
The containment spray pumps are located adjacent to the containment structure and the refueling water storage tank.
Each containment spray supply line to the containment contains a weight-loaded chec*k valve.
Should any water enter the manifolds during periodic testing, 0.5-in.
drain lines located after the check valves inside the containment drain the containment spray manifolds.
The size of the drain line does not decrease the capacity of containment spray during operation. A stainless steel filter is provided in the suet ion of each containment spray pump.
17
Earj:i of the four recirculation spray headers consists of a recirculation
- spray pump, a recirculation spray cooler, and a 180-degree spray ring header.
The spray ring is located approximately 47 ft above the operating floor of the containment structure..
The four recirculation spray pumps take suction from a common containment sump.
Two of the recirculation spray pumps and motors are located inside the cont a foment structure, and two pumps and motors are 1 ocated outside the containment.
The four pumps are of the vertical deep-well type, and are of essentially the same design; however, the outside recirculation spray pumps have shaft extensions to permit locating the pump suctions at the level of the common containment sump, with the motors at an elevation slightly below ground grade.
In Unit 1, to ensure that adequate NPSH for the outside recirculation spray pumps exists at their operating point during design-basis accident, the sump water at the pump suction inlet has added provisions for subcoo 1 i ng.
The subcoo 1 i ng d s achieved by routing co 1 d refue 1 i ng water storage tank inventory at 45 Finto the containment spray system via two b 1 eedl i nes, one from each containment spray pump discharge 1 i ne inside the containment.
Each bleedline contains a restricting orifice to balance the flow with the remainder of the containment spray system.
A 12-in. 1 i ne provides a cross connection between the two 12-in. 1 i nes from the reactor containment sump to the suction of the low-head safety injection pumps.
Each of the two 12-in. lines from the sump has its suction opening located in one of the equal sections of the sump; these sections are formed by the screen assembly that surrounds the reactor containment sump.
The probability of screen c 1 oggi ng is remote.
- However, if the first-stage or the second-stage screens of one of the suction points did become clogged so that no water could be supplied to a pump suction, the cross-connecting 1 ine would supply water to that pump from the other section of the sump through the other 12-in. suction 1 ine.
Thus, both pumps would remain operational.
Each recirculation spray pump has a capacity of approximately 3000 gpm.
The pump and valve motors inside the containment are selected to ensure operation under design-basis accident conditions.
The two reci rcul at ion spray pumps 1 ocated outside the containment are fitted with a tandem mechanical seal arrangement.
The space between the sea 1 faces is fil 1 ed with demi nera 1 i zed water that is maintained at a pressure slightly greater than the recirculation spray pump discharge pressure, thus preventing leakage of recirculation spray water that might be radioactive.
18
e
~. Tha,recirculation spray water flows through recirculation spray coolers, where it is cooled by service water flowing under gravity at 6000 gpm.
Since the recirculation spray water pressure in the coolers is greater than the service water, only outleakage can occur, and dilution of the borated water by service water in the containment is not possible. This ensures that the necessary cold shutdown margin by boron is maintained.
The service water from each cooler is monitored by means of radiation monitors to enable the defective subsystem to be shut down if outleakage occurs.
The entire spray system is constructed of corrosion-resistant materials, primarily stainless steel.
However, other materials are used where suitable, such as brass for the spray nozzles.
The system design pressure is 150 psig.
The spray system consists of four completely separate 50% capacity recirculation spray trains.
The elimination of interconnecting valving between the spray trains provides redundancy and improves system reliability.
The use of a separate spray header connected to the discharge of each pump results in a fixed fl ow rate, and a 11 ows for optimized selection of spray nozzle sizes.
This arrangement gives the optimum combination of small spray particles for maximum heat transfer and larger parti~les for better coverage toward the center and sides of the containment.
In addition, this arrangement also ensures that a.
failure of a component in any one subsystem does not affect the operational capability of the other subsystems.
Initially, the heat exchangers.of the recirculation spray trains are clean and dry, with maximum heat transfer capability.
For long-term operation, on the order of weeks or months, there may be some fouling of the tubes on the service water side, with resultant loss in heat transfer capability. This loss of heat transfer capability is more than offset by the decrease in heat load resulting from decreasing decay heat production.
One day after a LOCA, the decrease in the residual heat production rate is such that each train
- has sufficient heat removal capacity to hold the containment at subasmospheric pressure.
With a maximum service water temperature of 85 F, the recirculation spray subsystem design is conservative.
There is a minimum 100% reserve capacity in recirculation spray at the onset of an accident. Within one day after the LOCA, the reserve capacity exceeds 400%.
19
Ttto' reci rcul at ion spray heat exchangers are designed to Section II I of the ASME Code, and have welded construction at the points where there could be a potential for leakage of radioactive recirculation spray water into the service water.
The maximum pressure differential that can occur between the service water and the recirculation spray water is 100 psi; under those conditions, leakage flow from the recirculation spray subsystem is into the service water system.
The service water is monitored by radiation monitors to detect leakage from the defective subsystem (Section 11.3.3).
If leakage above an allowable level is detected, the defective subsystem is shut down by manual operation of remote motor-operated valves that isolate the recirculation spray cooler.
As a result of the above pressure difference, inleakage of nonborated water into the containment, causing dilution of the borated water in the containment, is not possible.
Recirculation through the outside recirculation spray pumps presents a possibility of leakage through valve packings and from leaks in the suction and discharge piping of the pump.
Valve designs are selected to reduce this potential leakage to a negligible amount.
Leaks in the suction and discharge piping are controlled as follows:
- 1.
Large leaks in the discharge p1p1ng of the recirculation spray pumps are detected by variations in the recirculation spray pumps discharge pressure readings in the control room.
A decreased pressure reading indicates a pipe break, which causes an alarm to sound, and the operator in the contra l room then remote manua 11 y isolates the pump indicated by the alarm.
- 2.
Large leaks in the suction piping in the valve pit are detected by liquid level measuring devices.
On detection, the operator in the control room remote manually isolates the leaking spray line, leaving one recirculation spray loop operable.
In the case of small leaks, specific detection of a leak is not possible; however, the ventilation air from the structure enclosing the piping outside the containment is discharged to the atmosphere through the ventilation vent, and is automatically diverted through charcoal filters on a high-high containment pressure signal.
The reci rcul at ion spray pumps are capable of meeting NPSH requirements under LOCA conditions.
Analyses have shown that the water on the containment floor is subcooled with respect to containment temperature.
The water in the sumps provides a net static head, after a 11 owance is made for the suction piping losses, of about 3.5 to 7.5 ft.
Sufficient NPSH is available when the minimum containment air partial pressure (9.0 psig) is added to the static head.
The installed deep well pumps, both inside and outside, require between 10.1 and 8.4 ft of net positive suction head.
Since there is approximately 12 ft of net positive suction head available in the design, adequate net position suction head is available to ensure satisfactory operation of the recirculation spray pumps.
Their requirements are listed in Table 6.2-12.
20
~- A'f.}eriodic inspection is made of potential points of leakage.
Leakage of pumped fluid from the recirculation spray pumps cannot occur, due to the manner in which the pump shaft is sealed.
Two mechanical seals are arranged in tandem, with a seal fluid between them.
The seal fluid is supplied from a reservoir arranged in such a manner that the pressure of the seal fluid is slightly (about I psi) above the pumped fluid pressure at the inboard side of the inboard seal. With this arrangement, assuming the inboard seal fails, seal fluid leaks through the failed seal while the other seal remains available to prevent the escape of pumped fluid to the atmosphere. A level alarm on the reservoir provides an indication of a seal failure.
D.
SINGLE FAILURE ANALYSIS A failure mode analysis for the components of the spray system is presented in Table 2.
The analysis of the LOCA is consistent with the failure analysis.
The analysis shows that the failure of any single active component does not prevent fulfilling the design function; al so, operator action is not required to correct the malfunction.
E.
TESTS AND INSPECTIONS Containment Spray Subsystem Two types of tests are performed on the containment spray subsystem.
First, during and after installation, it is tested to ensure that design criteria are met.
Second, provisions, have been made for testing the subsystem throughout the life of the unit to ensure that it* is operational.
During the construction period, the containment spray headers were fitted with blind flanges that allowed the connection of temporary drain lines for initial testing of the subsystem. After the subsystem was completely i nsta 11 ed, temporary connections were made to the blind flanges on the spray headers and pipe plugs were placed in the spray nozzle sockets.
The containment spray pumps were started and operated over their entire range of flow, circulating water through the spray header supply lines to the spray headers and out the temporary drain connections. This provided a full-system capability test to ensure that the system met both the flow and starting time requirements.* It also provided for a flush of the system to remove any particulate matter that could plug the spray nozzles at a future ti me.
At the comp 1 et ion of this test, the temporary drain connections were removed, the blind flanges replaced, the pipe plugs
- removed, the nozzle pipe nipple inspected, and the spray nozzles installed. The subsystem was then ready for operation.
21
~-
Wi~.~ a system flush to remove particulate matter before the installation of spray nozzles, and with corrosion-resistant nozzles and piping, it is 1 not considered credible that a significant number of nozzles would plug during the life of the unit to reduce the effectiveness of the subsystem; therefore, no means are provided for intermittent testing of the containment spray header nozzles with water.
Provision was made to perform a initial air flow test on the containment spray subsystem nozzles.
A compressed air source was connected to the spray header piping, and the air flow through each nozzle was individually measured by using a funnel and tubing arrangement to channel the air flow from each nozzle through a flow meter.
Also, during subsequent 5-year intervals the containment spray subsystem nozzles will be subjected to an air test to provide indication that plugging of the nozzles has not occurred.
Means have been provided for intermittent testing of the containment spray pumps.
This testing is performed periodically by opening the normally closed valves on the spray pump recirculation line, thus returning water to the refueling water storage tank.
The operation of the subsystem allows the pumps to operate and recirculate a quantity of water back to the refueling water storage tank.
The discharge into the refueling water storage tank is divided into two fractions, one for the major portion of the recirculation flow and the other to pass a small quantity of water through test nozzles, which are i dent i cal with those used on the containment spray headers.
The purpose of the recirculation through test nozzles is to ensure that there is no particulate material in the refueling water storage tank and the containment spray subsystem that could plug or cause deterioration of the spray nozzles.. The fl ow rate through the test nozzles is monitored and compared to the previously established flow rate obtained with the new nozzles.
The presence of any particulate material that could cause plugging will be apparent through a reduction in fl ow rate through the nozzles.
The weight-loaded check valves inside the containment are tested periodically by pressurizing the pump discharge lines with air and checking for a fl ow from the drain line.
Periodic electrical insulation tests during the life of the electrical equipment detect any deterioration of the i nsul at ion and ensure that motors remain in a reliable operating condition.
Recirculation Spray Subsystem The initial test for the recirculation spray subsystem is identical to that for the containment spray subsystem.
By means of the temporary drain connections and blind flanges fitted to the end of each spray ring
- header, each train
- is given a ful 1 fl ow test, with the water recirculating back through the containment sump.
22
Bevause of the present physical arrangement of the inside recirculation spray pumps, it has been impractical to flow-test them periodically.
We have recently committed to modify the existing piping arrangement during the upcoming refueling outages to permit flow testing of these pumps on a refueling outage basis. The pumps are also capable of being operated dry for a short period of time, and therefore can be tested to determine whether they are capable of being run.
The outside recirculation spray pumps also have the capability of being run dry; however, they are also periodically flow-tested.
The closing of the suction line valve and the isolation valve between the pump discharge and the containment penetration allows the pump casing to be filled with water and the pump to recirculate water through a bypass line from the pump discharge to the pump housing.
Provision has been made to perform air flow tests on the recirculation spray subsystem nozzles, using the same method as the containment spray subsystem.
Periodic electrical insulation tests during the life of the electrical equipment detect any deterioration of the i nsul at ion to ensure that motors remain in a reliable operating condition.
23
Component Motor-operated valves Automatic electric and control in-strumentation trains to actuate consequence-limiting safeguards equipment Spray nozzles Containment spray piping TABIE II Malfunction Loss of power to one valve due to failure of electric bus Failure of one train Spray nozzles plugged Pipe rupture 24 Consequences I..
Redundant valves are provided, electric power to valves is supplied from separate buses.
Redundant train will actuate redundant equipment e
Filters are provided in the suction of the containment spray pumps.
Three layers of screening are provided in the suction of recirculation spray pumps.
The filters and the screen mesh are small enough to prevent any material that could plug the spray nozzles from passing through.
SUf-ficient margin is provided to acconuno-date plugging of 25% of the nozzles.
Piping is designed for 100°F tempera-ture and 275 psig pressure. These A
conditions exceed those that could 9
occur during operation. The piping is fabricated of Type 304 stainless steel; this metal has corrosionjerosion resistance. Piping is designed for Class I and is missile protected. Pipe rupture is not considered credible.
Component Contaimnent spray pumps Contaimnent spray pumps Contaimnent spray pump discharge valve Contaimnent spray pump discharge valve Contaimnent spray pumps
'I'ABI.E II Malfunction Pmnp casing ruptures Pmnp fails to start Valve fails to open Rupture of valve body Weight-loaded in pump discharge line sticks closed 25 Consequences
,r
'Ihe casing is designed for 450°F terrpera-ture; standard test pressure is 250 psig and maximum test pressure is 375 psig.
'Ihese conditions exceed those which could occur during any operating conditions.
'Ihe casings are made from cast iron (AS'Il;a A351-CF8); this metal has corrosionjero-*
sion resistance and produces sound castings. 'Ihe pumps confonn to Class I design.
Pumps are missile protected and may be inspected at any time.
Rupture by missiles is not considered credible.
Rupture of the purrp casing is therefore not considered credible.
'Ihe contairnnent spray system has two parallel 100% capacity pumps.
SUfficient capacity is provided by one purrp in case of failure of the other purrp.
Redundant parallel valves are provided.
Redundant valve carries the flow.
Valve body is designed for 150 lb. 'Ihe e castings are made from stainless steel; this material has corrosion/erosion re-sistance and produces sound castings.
'Ihe valves are designed to be missile protected. Rupture of valve body is not considered credible.
Valve is checked peridically during nonnal operation.
In addition, parallel 100% capacity contaimnent spray sub-system is operable.
Component Recirculation spray pump Recirculation spray cooler outside recirculation spray plilllp Recirculation spray piping TABIE II Malfunction Pl.mq) fails to start
'!'Ube or shell rupture Rupture of pump casing Rupture of piping.
26 Consequences I,.
Four 50% capacity recirculation spray pumps are provided altogether.
Four 50% capacity recirculation spray coolers are provided altogether. '!he recirculation spray coolers are de-A signed to the AS.ME Code,Section III w,
c and Class I. Rupture is considered unlikely. Ha...rever, in the event of a rupture, motor-operated valves are pro-vided to isolate the cooler and prevent further leakage. Another 50% capacity recirculation subsystem is used.
'!he casing is fabricated of A.S'IM A542, Type 304 stainless steel; this metal is corrosion-resistant. '!he casings are missile protected and set in con-crete. Rupture of the pump casing is not considered credible.
Piping is fabricated of Type 304 stain-less steel and designed to Class I.
~
Piping is also missile protected.
IIIIIIIJ Rupture of piping is not considered credible. Ha...rever, in case of pipe
- rupture for pipe lines to and from outside recirculation spray pumps, isolation valves are provided.
e SANP!i.,IN& SYSTEM A.
PENETRATIONS The specific penetrations in the sampling system which are operating under design basis accident conditions filled with water follow:
Penetration Valves Functions 568 TV-SS-102A;B Reactor Coolant Cold Leg (TV-SS-202A;B)
Sample 56D TV-SS-106A;B Reactor Coolant Hog Leg (TV-SS-206A;B)
Sample 978 TV-SS-103A;B RHR Sample System (TV-SS-203A;B)
A Type 'C' penalty is not required to be applied to the results of the CILRT for the penetrations listed above because:
Sampling system (SS) penetration Nos. 568, 56D, and 978 are sealed upon containment isolation.
The sampling system is operating prior to a design basis accident and it is available for post accident sampling.
In both cases, the penetrations are water-filled.
Sampling system piping configurations within the containment support maintenance of water-filled loop seals.
B.
DESIGN BASES The sampling system is designed to provide primary and and secondary fluid and gaseous samples for laboratory analysis.
The sampling system also has the capability of obtaining and analyzing postaccident liquid and gaseous samples (See Figure 5 and 6).
Process fluids and gases are representatively sampled for testing to obtain data from which performance of the station, equipment, and systems may be determined.
Routine samples of process fluids and gases associated with both the primary and secondary systems are either taken periodically or are continuously monitored.
27
e e
C *"... SVS,TEM DESCRIPTION High Radiation Sampling System The high radiation sampling system is designed to obtain and analyze representative samp 1 es of reactor coo 1 ant, the containment atmosphere, and the containment sump in a timely fashion after an accident.
Prompt sampling and analysis of reactor coolant and containment atmosphere samples can provide information needed to assess and control the course of an accident.
The system provides the ability to obtain grab samples within one hour after an accident from each reactor coolant hot leg, each reactor coolant cold leg, the residual heat removal system, the chemical and volume control system mixed-bed demineralizer
- effluent, the containment sump, and the containment atmosphere.
The system has the capability to cool and depressurize samples at high temperature and high pressure to allow grab sampling and in-line chemical analysis.
Routine Samples The sample lines coming from within the containment contain high-temperature samp 1 es, with the exception of the pressurizer re 1 i ef tank sample.
Where two or more samples join into a common header (i.e., the primary coolant cold-leg samples), each individual sampling line has a solenoid-operated valve in the line that can be remotely operated from a control board in the auxiliary building sampling room.
The primary coolant hot-leg and cold-leg samples flow through delay coils before penetrating the containment.
These delay coils permit sufficient decay of nitrogen-16 so that these samples can be handled in the sampling room.
Sample lines penetrating the containment have two automatically operated valves in the line, one just inside and one just outside the containment.
These trip valves close on receipt of a safety injection signal.
The high-temperature samples pass through sample coolers located in the auxiliary building sampling room.
These coolers cool the high-temperature samples to a temperature low enough for safe handling.
Sample flows leaving the cooler are manually throttled and can be directed to a purge line.or to the sampling sink.
The pressurizer vapor space samples, in addition, pass through capillary tubes that limit the fl ow of steam.
The air-operated trip valves in the residual heat removal sample lines and the reactor cool ant system hot-1 eg and co 1 d-1 eg samp 1 e 1 i nes have been replaced with direct-acting solenoid valves.
This ensures that the valves can be reopened to draw the sample, under the single-failure criterion after an accident.
28
D.ic.~H&GLE FAILURE ANALYSIS Credible active failures have been considered in the single failure analysis.
The analysis shows that the failure of any single active component does not prevent fulfilling the design function.
Failure analysis for the sampling system is addressed in Section 9.6.3.2 of the UFSAR.
E.
TESTS AND INSPECTIONS Routine Samples Most components are used regularly during power operation, cool down, and/or shutdown, thus providing assurance of the availability and performance of the system.
The continuous monitors are period i ca 11 y tested, calibrated, and checked to ensure proper instrument response and operation of alarm functions.
A test is performed each refueling to inspect the system for leakages to reduce the possibility of contamination resulting from a serious transient or an accident condition.
29
gmCU.JS1,0NS Surry Units 1 & 2 perform the Type 'A' CILRT as required by 10CFR50, Appendix J by implementing Periodic Test No. l/2-PT-16.3.
Types 'B' & 'C' Tests are performed as initial conditions in each case for the Type 'A' CILRT.
Containment pipe penetrations for which Type 'C' Leakage Testing is performed but for which no leakage penalty is required to be app l i ed to the total leakage determined by the Type 'A' CILRT are identified in the preceeding individual system discussions.
The reasons why a Type 'C' Leakage penalty is not required to be applied are:
- 1.
The system penetration has pressurized water flowing through it during the design basis accident.
- 2.
The system penetration is pressurized by system status outside containment, and system pipe configuration inside containment provides a water-filled loop seal.
Surry Unit 1 and Unit 2 are each designed with accident mitigating system which insure the containment will be cooled and depressurized to subatmospheric pressure in less than 60 minutes following the design-basis accident (ref. Surry 1&2 UFSAR 6.3.1.1).
After the first hour of the design basis accident, penetration leakage is only directed into containment as long as recirculation subsystems maintain a
subatmospheric pressure condition.
The combination of the identified water~filled pipe penetrations and the subatmospheric containment design contribute to radiological effluent releases being maintained below 10 CFR 100 release limits for design basis accidents.
Type 'A' CILRT verification should reflect containment status under accident.
Therefore, the water-filled pipe penetrations discussed above which do not contribute to the overall containment leakage rate should not require Type 'C' testing or a leakage penalty to be added to Type 'A' CILRT.
30