ML18348A772

Transmittal of Proposed Technical Specification Changes

ML18348A772
Person / Time
Site:	Palisades
Issue date:	09/19/1977
From:	Hoffman D Consumers Power Co
To:	Schwencer A Office of Nuclear Reactor Regulation
References
Download: ML18348A772 (14)

Text

.,.

consumers Power company REGULATOJY DOCJ{fT FUE COPY General Offices: 212 West Michigan Avenue, Jackson, !Jiic_l')_lga!" _49201 * ~r_ea Cocle 517 ?88-0550 September 19, 1977

• Director of Nuclear Reactor Regulation Att:

Mr Albert Schwencer, Chief Operating Reactor Branch No l US Nuclear Regiilatory Commission Washington, DC 20555 DOC:KET 50-255 "."" LICENSE DPR-20 PALISADES PLANT - PROPOSED TECHNICAL SPECIFICATIONS CHANGES The attached proposed T_echnical Specifications change *will clarify a. large "grey" area of potential.equipment failures and/or* out?-ges which could presently lead to llll.warranted plant outages.

David P Hoffman Assistant Nuclear Licensing Administrator CC:

JGKeppler, USNRC

CONSUMERS POWER COMPANY Docket 50-255 Request for Change to the Technical Specifications License DPR-20 For the reasons hereinafter set forth, it is requested that the Technical Specifications contained in Provisional Operating License DPR-20, Docket 50-255, issued to Consumers Power Company on October 16, 1972, be changed as described in Section I~ below:

I.

Changes After the first sentences of Sections 3. 3. 2. f,,3. 4. 5, and 3. 5.1. c, add the following sentence:

11As an alternative, the affected component may be placed in the fail-safe condition required during an accident, or suitable backup means may be provided to insure the components' accident funetion is-met.

In either case, appropriate controls shall be provided until component repairs are made and the condition reported immediately to the NRC."

II.

Discussion The present wording of Sections 3.3.2.f, 3.4.5 and 3.5.1 encompasses a large "grey" area of potential problems which could force an unwarranted shutdown of the plant.

When backup means are available to provide the intended function of the components covered by the reference sections, plant shutdown should not be required.

An example of both aspects of this clause would be the failure of a high-pressure safety injection valve to open on an SIS test. If the valve could be manually operated, it could then be opened and caution tagged until repair of the automatic circuitry.

If the valve was not operable by any means, then the fully redundant HPSI header could be valved into service as a "suitable backup means."

III.

Conclusions Based on the foregoing; the Palisades Plant Review Committee has concluded that this change does not involve an unreviewed safety question and the Safety and Audit Review Board has reviewed this from a safety standpoint and finds this change to be acceptable.

CONSUMERS POWER COMPANY By Sworn and subscribed me this 19th day of September 1977.

Thayer, Jackson County, Michigan My commission expires July 9, 1979.

2

3.3 EMERGENCY CORE COOLING SYSTEM (Contd)

The other low-pressure safety injection pump shall be tested to demonstrate operability prior to initiating repair of the inoperable pump.

c.

One high-pressure safety injection pump may be inoperable provided the pump is restored to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The other high-pressure safety injection pump shall be tested to demonstrate operability prior to initiating repair of the inoperable pump.

d.

One shutdown heat exchanger and one component cooling water heat exchanger may be inoperable for a period of no more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

e.

Any valves, interlocks or piping directly associated with one of the above components and required to function during accident conditions shall be deemed to be part of that component and shall meet the same requirements as listed for that component.

f.

Any valve, interlock or pipe associated with the safety injection and shutdown cooling system and which is not covered under 3.3.2.e above but, which is required to function during accident conditions, may be inoperable for a period of no more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

As an al-ternative, the affected component may be placed in the fail-safe condition required during An accident, or suitable backup means may be provided to insure the components' accident function is me~. In either cas.e, appropriate controls shall be provided until component repairs are made and the condition reported immediately to the NRC.

Prior to initiating repairs, all valves and interlocks in the system that provide the duplicate function. shall be tested to demonstrate operability.

Basis The normal procedure for starting the reactor is, first, to heat the primary coolant to near operating temperature by.running the primary coolant pumps.

The reactor is then made critical by withdrawing con~

trol rods and diluting boron in the primary coolant. (l) With this mode of start-up, the energy stored in the primary coolant during the ap-proach to criticality is substantially equal to that during power opera-tion and, therefore, all engineered safety features and auxiliary cooling systems are required to be fully operable.

During low-temperature physics tests, there is a negligible amount of stored energy in the pri-mary coolant; therefore, an accident comparable in severity to the design 3-30

• I 3.3 EMERGENCY CORE COOLING SYSTEM (Contd) basis accident is not possible and the engineered safeguards' systems are not required.

The SIRW tank* contains a minimum of 250,000 gallons of water containing 1720 ppm boron.

This is sufficient boron concentration to provide a 5%

shutdown margin with all control rods withdrawn and a new core at a tem-perature of 6o°F.

Heating steam is provided to maintain the tank above 4o°F to prevent freezing.

The 1% boron (1720 ppm) solution will not precipitate out above 32°F.

The source of steam during normal plant operation is ex-traction steam line in the turbine cycle.

The limits for the safety injection tank pressure and volume assure the required amount of water injection during an accident and are based on values used for the accident analyses.

The minimum 186-inch level cor-responds to a volume of 1103 ~ 3 and the maximum 198-inch level corres-ponds to a volume of 1166 ft 3.

Prior to the time the reactor is brought critical, the valving of the safety injection system must be checked for correct alignment and appro-priate valves locked.

Since the system is used for shutdown cooling, the* valving will be changed and must be properly aligned prior to start-up of the reactor.

The operable status of the various systems and components is to be demon-strated by periodic tests.

A large fraction of these tests will be per-formed while the reactor is operating in the power range.

If a component is found to be inoperable, it will be possible in most cases to effect repairs and restore the system to full operability within a relatively short time.. For a single component to be inoperable does not negate the*

ability of the system to perform its function but it reduces the redundancy provided in the reactor design and thereby limits the ability to tolerate additional equipment faillires.

To provide maximum assurance that the re-dundant component(s) will operate if required to do so, the redundant component(s) is to be tested prior to initiating repair of the inoperable component.

If it develops that (a) the inoperable component is not re-paired within the specified allowable time period or, (b) a second com-ponent in the same or related system is found to be inoperable, the reactor will, initially be put in the hot shutdown condition to provide 3-31

3.3 EMERGENCY CORE COOLING SYSTEM (Contd) for reduction of the decay heat from the fuel and consequent reduction of cooling requirements after a postulated loss-of-coolant accident.

This will also permit improved access for repairs in some cases.

After a limited time in hot shutdown, if the malfunction(s) is not corrected, the reactor will be placed in the cold shutdown condition utilizing normal shutdown and cooldown procedures.

In the cold shutdown condition, release of fission products or damage of the fuel elements is not considered pos-sible.

The plant operating procedures will require immediate action to effect repairs of an inoperable component and, therefore, in most cases, repairs will be completed in less than the specified allowable repair times.

The limiting times to repair are intended to:

(1) Assure that operability of the component will be restored promptly and yet, (2) allow sufficient time to effect repairs using safe and proper procedures.

The requirement for core cooling in case of a postulated loss-of-coolant accident while in the hot shutdown condition is significantly reduced below the requirements for a postulated loss-of-coolant accident during power operation.

Putting the reactor in the hot shutdown condition re-duces the consequences of a loss-of-coolant accident and also allows more free access to some of the engineered safeguards components in order to effect repairs.*

Failure to complete repairs within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of going to the hot shutdown condition is considered indicative of a requirement for major maintenance and, therefore, in such a case, the reactor is to be put into the cold shutdown condition.

With respect to the core cooling function, there is functional redundancy over most of the range of break sizes. (2 )

Adequate core cooling for the break spectrum up to and including the 42-inch double-ended break is assured with the minimum safety injection which is defined as follows:

For the system of four passive safety in-jection tanks, the entire contents of one tank are assumed to be unavail-able for emergency core cooling.

In addition, of the three high-pressure safety injection pumps and the two low-pressure safety injection pumps, only one of each type is assumed to operate; and, also that 25% of their combined discharge rate is lost from the primary coolant system out the break.

The transient hot spot fuel clad temperatures for the qreak sizes 3-32

3.3 EMERGENCY CORE COOLING SYSTEM (Contd) considered are shown on FSAR Figures 14.17.9 to 14.17.13.

These demon-strate that the maximum fuel clad temperatures that could occur over the break size spectrum are well below the melting temperature of zir-conium ( 3300°F).

Malfunction of the Low-Pressure Safety Injection Flow control valve could defeat the Low-Pressure Injection feature of the ECCS; therefore, it is disabled in the "open" mode (by isolating the air supply) during plant operation.

This action assures that it.will not block flow during Safety Injection.

The inadvertent closing of any one of the Safety Injection bottle isola.:...

tion valves in conjunction with a LOCA has not been analyzed.

To provide a$surance that this will not occur, these valves are electrically locked open by a key switch in the control room.

In addition, prior to critical the valves are checked open and then the 480 volt breakers at MCC 9 are opened.

Thus, a failure of a breaker and a switch are required for any of the valves to close.

References (l)FSAR, Section 9.10.3.

( 2 )FSAR, Section 6.1.

3-33

3.4 CONTAINMENT COOLING Applicability 3.4.1 3.4.2 Applies to the operating status of the containment cooling systems.

Objective To assure operability of equipment required to remove heat from the containment in normal operating and emergency situations.

Specifications Containment Cooling Systems The reactor shall not be made critical, ext:ept for low-temperature physics tests, unless all the following conditions are met:

a.

The following equipment associated with diesel generator 1-2 is operable:

Containment Air Cooler VlA Containment Air Cooler V2A Containment Air Cooler V3A Service Water Pump P7A Service Water Pump P7C Containment Spray Pump P54A Component Cooling Water Pump P52B

b.

The following equipment associated with diesel generator 1-1 is operable:

Containment Air Cooler V4A Service Water Pump P7B Containment Spray Pump P54B Containment Spray Pump P54C Component Cooling Water Pump P52A Component Cooling Water Pump P52C

c. All heat exchangers, valves, 'piping and interlocks associated with the above.components and required to function during ac-cident conditions are operable.

During power operation, one of the components listed in Specifica-tion 3.4.1 above may be inoperable provided that the corresponding redundant components shall be tested to demonstrate operability.

If the inoperable component is not restored to operability within 7 days, the reactor shall be placed in a hot shutdown condition 3-34

3.4 CONTAINMENT COOLING (Contd) 3.4.3 3.4.4 3.4.5 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

If the inoperable component is not restored to operability within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed in a cold shut-down condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

During power operation, the requirements of Specification 3.4.1 may be modified to allow a total of two of the components listed in Section 3.4.1.a or b to be inoperable at any one time provided the emergency diesel con-nected to the opposite engineered safeguards bus is started to demonstrate operability.

The redundant component or system on the other bus shall be tested before initiating maintenance on the inoperable components. If the operability of at least one of the two inoperable components is not re-stored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the reactor shall be.placed in a hot shutdown con-dition within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

If the operability of at least one of the two inoperable components is not restored within an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the reactor shall be placed in a cold shutdown condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Continued power operation with one component out of service shall be as specified in Section 3.4.2, with the permissible period in inoperability starting at the time that the first of the two components became inop-erable.

Any valves, interlocks and piping directly associated with one of the above components and required to function during accident conditions shall be deemed to be part of that component and shall meet the same requirements as listed for that component.

Any valve, interlock or piping associated with the containment cooling system which is not covered under Specification 3.4.4 above and which is required to function during accident conditions may be inoperable for a period of no more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided that prior to initiating repairs, all valves and interlocks in the system that provide the duplicate func-tion shall be tested to demonstrate operability.

As an alternative, the affected component may be placed in the fail-safe condition required during an accident, or suitable backup means may be provided to insure the components' accident function is met.

In either case, appropriate controls shall be provided until component repairs are made and the con-

~

dition reported immediately to the NRC.

Basis A full-capacity emergency diesel generator is connected to each of the two engineered safeguards 2400-volt buses.

At least one pump of each 3-~5

. 3.4 CONTAINMENT COOLING (Contd) type is connected to each of the two buses to assure that equipment is available under all conditions for minimum safety injection.

It a pump is removed from one of the two buses for emergency repair, the power supply for minimum engineered safety feature equipment is available.

It is in-tended that all equipment be returned to service promptly after emergency repairs are completed.

One shutdown heat exchanger is sufficient to cool down the reactor following a shutdown.

One heat exchanger is required to remove the heat from the containment after a loss-of-coolant accident. If a heat exchanger is not available, the containment air-cooling system is available as a fully redundant system.

The containment spray system is redundant with the containment air circu-lation and cooling system. (l) It is sized such that two of the three pumps will limit containment pressure to less than design pressure follow-ing a DBA without taking credit for ~he s~fety injection tanks. (2 )

Three of the four air coolers have the capability of limiting the containment pressure under the same conditions as the two pumps.

The redundant equipment provided to limit the containment pressure follow-ing a DBA is divided into two groups., each of which has the capacity (with ample reserve) to limit the containment pressure and is connected to a separate engineered safeguards bus.

The division of equipment is such that the two spray pumps and one service water pump having full capacity are on one bus and three air coolers and two service water pumps also having full capacity are on the second engineered safeguards bus.

In addition, the spare units of these redundant systems are connected to opposite buses to provide excess capacity for pressure reduction on each bus.

Therefore, any one unit removed from a given bus for repair does not restrict that group of equipment from completing its design function.

The removal of two units from a given bus could limit the capability of that group; there-fore, to insure the availability of the power supply to the redundant group in case of outside power failure, the emergency diesel connected to the other bus is started to demonstrate operability.

During normal power operation, the four fan coolers are in operation to remove heat lost from equipment and piping within containment. (3)

The component cooling system components are located in the auxiliary building so as to be accessible for repair after a loss-of-coolant accident. C4) 3-36

' 3*. 4 CONTAINMENT COOLING (Contd)

In addition, if during the post-accident phase the component cooling water supply is lost, core and containment cooling could be maintained until repairs are effected.< 5)

References (l)FSAR, Section 14.18.

(2 )FSAR, Section 6.2.3.2.

( 3 )FSAR, Section 6.3.2.2.

(4 )FSAR, Section 9.3.3.2.

( 5 )FSAR, Section 9.3.2.3.

3.,..37

3,5 STEAM AND FEED~WATER SYSTEMS Applicability Applies to the operating status of the steam and feed-water systems.

Objective To define certain conditions of the steam and feed-water system necessary to assure adequate* decay heat removal.

Specifications The primary coolant shall not be heated above 325°F unless the following conditions are met:

a.

Both auxiliary feed-water pumps operable or one auxiliary feed-water pump and one fire pump operable.

b.

A minimum of 100,000 gallons of water in the condensate storage and primary coolant system makeup tanks combined and a backup source of additional water from Lake Michigan by the operability of one-of the fire protection pumps.

c.

All valves, interlocks and piping associated with the above components required to function during accident conditions are operable.

As an alternative, the affected component may be placed in the fail-safe condition required during an acsident or suitable backup means may be provided to insure the components' accident function is met.

In*

either case.; appropriate controls shall be provided until component repairs are made and the condition reported immediately to the NRC.

d.

The main steam stop valves are operable and capable of closing in five seconds or less under no-flow conditions.

Basis A reactor shutdoWri from power required removal.of core decay.heat.

Im-mediate decay. heat removal requirements are normally satisfied by the steam bypass to_ the condenser.

Therefore, core decay heat can be con-tinuously. diss*ipated via the steam bypass to the condenser as long as feedwater to the steam generator is available.

Normally, the capability to supply feedwater to the steam generators is provided by operation of the turbine cycle feed-water system.

In the unlikely event of complete loss of electrical power to the sta-tion, decay heat removal is by steam discharge to the atmosphere via the main steam safety valves or power-operated relief valves. (l, 2 )

Either auxiliary feed-water pump can supply sufficient feedwater for removal of decay heat from the plant.

The minimum a.mount of water in the 3-38

STEAM AND FEED-WATER SYSTEMS (Contd) condensate storage tanks is the amount needed for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of such opera-tion.

If the outage is more than 8.hours, Lake Michigan water can be used.

Two fire pumps are provided, one motor-driven and one diesel-driven, each capable of delivering 1500 gpm at 125 psig.

In the event all feed pumps should become inoperable, the fire pumps could be used to pump lake water to the steam generators once the secondary pressure was reduced sufficiently by means of the steam dump valve.

A closure time of 5 seconds for the main steam stop valves is considered adequate and was selected as being consist-ent with expected response time for instrumentation as detailed in the t

1.

b ak".d*t

1. (3) s earn ine re 1nc1 en ana ysis.

References (l)FSAR, Section 4.3.4. '

(2 )FSAR, Section 14.13.1.

(3)FSAR, S t*

14 14 ec ion 3-39

-e

• ..~f' 3,6 CONTAINMENT SYSTEM Applicability 3.6.1 3.6.2 3.6.3 Applies to the reactor containment building.

Objective To assure the integrity of the reactor containment building.

Specific.ations Containment Integrity

a.

Containment integrity shall not be violated unless the reactor is in the cold shutdown condition.

b.

Containment integrity shall not be violated when the reactor vessel head is removed unless the boron concentration is greater than refueling concentration.

c.

Except for testing one rod at a time, positive re.activity changes shall not be made by control rod motion or boron dilution unless the containment integrity is intact.

The internal pressure shall not exceed 3 psig (except for containment leak rate tests).

Prior to the reactor going critical after a refueling outage, an ad-.

ministrative check will be ma.de to confirm that all "locked-closed" manual containment isolation valves are closed and locked.

Basis The prima.rY coolant system conditions of cold shutdown assure that no steam will be formed and, hence, there would be no pressure buildup in the containment if the primary coolant system ruptures.

The shutdown margins are selected based on the type of activities that are being carried out.

The refueling boron concentration provides shutdown mar-gin which precludes criticality under any circumstances.

Regarding internal pressure limitations, the containment design pres-,

sure of 55 psig would not be exceeded if the internal pressure before a major loss-of-coolant accident were as much as 4 psig. (l)

The containment integrity will be protected if the visual check of-all "locked-closed" manual isolation valves to verify them closed is made prior to plant start-up after an extended outage where one or more valves could inadvertently be left open.

References (1)

FSAR, Section 14.18 3-40