ML20059A670
| ML20059A670 | |
| Person / Time | |
|---|---|
| Site: | 05200001 |
| Issue date: | 10/22/1993 |
| From: | GENERAL ELECTRIC CO. |
| To: | |
| Shared Package | |
| ML20059A669 | List: |
| References | |
| NUDOCS 9310270045 | |
| Download: ML20059A670 (25) | |
Text
r 1 i L
]
, ECCS-Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 ECCS-Operating LC0 3.5.1 Each ECCS subsystem and the Automatic Depressurization System (ADS) function of eight safety / relief valves shall be '
OPERABLE. ,
APPLICABILITY: MODE 1, MODES 2 and 3, except ADS valves and RCIC are not required tobeOPERAplEwithreactorsteamdomepressure s 3.5 Kg/cm g for ADS and s 10.5 Kg/cm2g for RCIC.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or two ECCS A.1 Restore ECCS 14 days subsystems inoperable subsystem (s) to ,
provided RCIC is OPERABLE status.
B. RCIC inoperable. B.l.1 Verify the CTG is 7 days ,
functional by 0B verifying the CTG' starts and achieves ,
RCIC and any one other steady state voltage ECCS subsystem and frequency within .;
inoperable. 10 minutes.
~
AND B.I.2 Verify the CTG 7 days circuit breakers are capable of being AND aligned to each of ;
the ESF buses. once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter ER B.2 Verify the ACIWA 7 days mode of RHR(C) subsystem is ,
functional.
(continued)
ABWR TS 3.5-1 10/21/93 -
9310270045 931022 [Og
{DR ADOCK 05200001 PDR
E l-ECCS-Operating
' 3.5.1 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) AND B.3 Restore ECCS 14 days subsystem (s) to OPERABLE status.
C. RCIC and any other two C.1.1 Verify the CTG is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ECCS subsystems functional by inoperable provided at verifying the CTG least one HPCF starts and achieves subsystem is OPERABLE. steady state voltage and frequency within 10 minutes.
AND C.1.2 Verify the CTG 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> .
circuit breakers are '
capable of being AND aligned to each of the ESF buses. Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter DB ,
C.2 Verify the ACIWA 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> i mode of RilR(C) subsystem is functional.
AND I C.3 Restore one ECCS 7 days I subsystem to 1 OPERABLE _ status. j D. Any three ECCS D.1 Restore.one ECCS_ 3 days subsystems inoperable subsystem to i provided RCIC is OPERABLE status. 1 OPERABLE. j (continued) _;
ABWR TS 3.5-2 10/21/93
'- i
, ECCS-Operating 3.5.1 ACTIONS (continued)
CONDITION' REQUIRED ACTION COMPLETION TIME E. Three high pressure E.1 Restore one high 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> .
ECCS subsystems pressure ECCS inoperable. subsystem to OPERABLE status.
F. Required Action and F.1 Be in MODE 3. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> associated Completion t
Time of Condition A, AND 1 B, C, D or E not met. I F.2 Be in MODE 4. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> DB i Any four ECCS subsystems inoperable.
G. NOTE G.1 Restore ADS valves 14 days This Condition may to OPERABLE status.
exist concurrently with Conditions A through E.
One or two ADS valves inoperable.
(
H. NOTE H.1 Restore one ADS - 7 days This Condition may valve to OPERABLE exist concurrently status. '
with Conditions A
- through E.
Three ADS valves inoperable.
(continued)
)
ABWR TS 3.5-3 10/21/93 a
l
.- ~ _
ECCS-Operating 3.5.1 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME I. Four or more ADS I.1 Be in MODE 3. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> valves inoperable.
OR AND Required. Action and I.2 Reduce reactor steam 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> associated Completion domepressugeto Time of Condition G or s 3.5 Kg/cm g.
H not met.
SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify, for each ECCS subsystem, the piping 31 days is filled with water from the pump discharge valve to the injection valve.
SR 3.5.1.2 NOTE Low pressure core flooder (LPFL) subsystems may be considered OPERABLE during alignment and operation for decay heat removal with reactorsgeamdomepressurelessthan 9.5 Kg/cm g in MODE 3, if capable of being manually realigned and not otherwise inoperable.
Verify each ECCS subsystem manual, power 31 days operated, and automatic valve in the flow path, that is not locked, sealed, or otherwise secured in position, is in the correct position.
i (continued) l I
ABWR TS 3.5-4 10/21/93 i
. ECCS-Operating
>.. 3.5.1 .
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.5.1.3 Verify ADS nitrogen supply pressure is 31 days-2 11.3 Kg/cm29 ,
SR 3.5.1.4 Verify each motor driven ECCS pump develops 92 days -
the specified flow rate against a system head corresponding to the specified reactor >
pressure.
SYSTEM HEAD CORRESPONDING TO A REACTOR :
SYSTEM FLOW RATE PRESSURE OF LPFL 2 954 m3/h 2 2.8 Kg/cm2g HPCF 2 181.7 m3/h 2 82.8 Kg/cm2g <
~
NOTE Not required to be performed until 12 i hours after reactor steam dome pressure is 2 56.4 Kg/cm29 Verify, with RCIC steam supply pressure 92 days-5 73.5 Kg/cm2g and 2 66.4 Kg/cmZg, the RCIC pump can develop a flow 2181.7 m3/h against a system head corresponding to reactor pressure.
(continued) 1 ABWR TS 3.5-5 10/21/93
~ '
. ECCS-Operating 3.5.1 SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.5.1.6 NOTE Not required to be performed until 12 -
hours after reactor steam dome pressure is >
2 10.6 Kg/cm29 Verify, with RCIC steam supply pressure 18 months s 11.6 Kg/cm2g, the RCIC pump can develop a flow rate 2181.7 m3/h against a system head corresponding to reactor pressure.
SR 3.5.1.7 NOTE Vessel injection may be excluded. ,
Verify each ECCS subsystem actuates on an 18 months actual or simulated automatic initiation signal.
SR 3.5.1.8 NOTE Valve actuation may be excluded.
Verify the ADS actuates on an actual or 18 months simulated automatic initiation signal.
J SR 3.5.1.9 NOTE Not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reactor steam dome pressure is 2 66.8 Kg/cm29 Verify each ADS valve opens when manually 18 months on a actuated. STAGGERED TEST BASIS'for each valve solenoid ABWR TS 3.5-6 10/21/93
. . - _ - . . . = . -
' ~
ECCS-Operating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.1 ECCS - Operating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS directs water to both inside and outside the core shroud to cool the core during a LOCA. The ECCS network is composed of the High Pressure Core Flooder (HPCF) System, the Reactor Core Isolation Cooling (RCIC)
System, and the low pressure core flooder (LPFL) mode of the Residual Heat Removal (RHR) System. The ECCS also consists of the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for both the RCIC System and the two HPCF subsystems.
On receipt of an initiation signal, ECCS pumps automatically start; simultaneously the system aligns, and the pumps inject water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps.
Although the system is initiated, ADS action is delayed, to allow time for confirmation of the initiating signal. The discharge pressure of the HPCF pumps exceeds that of the RCS, and the pumps inject coolant into the flooding sparger above the core. Once the steam driven RCIC turbine has accelerated, the RCIC pump discharge pressure exceeds that >
of the RCS and injects coolant into the reactor pressure vessel (RPV) via one of the feedwater lines. If the break is small, RCIC or either of the HPCF pumps will maintain coolant inventory, as well as vessel level, while the RCS is ;
still pressurized. If the RCIC and HPCFs fail, they are !
backed up by ADS in combination with the LPFL. In this i event, the ADS timed sequence would Le allowed to time out '
and open the selected safety / relief valves (S/RVs),
depressurizing the RCS and allowing the LPFL to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure drops rapidly, and the HPCF and LPFL i subsystems cool the core. !
l (continued)
- I ABWR TS B 3.5-1 10/21/93
a ECCS-Operating
~-
B 3.5.1 BASES BACKGROUND Water from the break returns to the suppression pool where
( Continued ) it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the Reactor Building Cooling Water (RCW) System. The ECCS network is effective in cooling the core regardless of the size or
?ocation of the piping break.
Apart from its ECCS function the RCIC System is also designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater >
system to provide adequate core cooling and control of RPV water level. Under these conditions, the HPCF and RCIC systems perform similar functions. The RCIC System design x requirements ensure that the criteria of Reference 11 are satisfied.
All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS subsystems.
The ECCS injection systems are arranged in three separate divisions each comprised of a high pressure and low pressure subsystem. ECCS Division I consists of the RCIC system and LPFL-A. ECCS Division 2 consists of HPCF-B and LPFL-B.
ECCS Division 3 consists of HPCF-C and LPFL-C.
LPFL is an independent operating mode of the RHR System.
There are three LPFL subsystems. Each LPFL subsystem (Ref. 2) consists of a motor driven pump, a heat exchanger, piping, and valves to transfer water from the suppression pool to the RPV. Each LPFL subsystem has its own suction and discharge piping. Each LPFL subsystem takes suction from the suppression pool. LPFL subsystems B and C have dedicated discharge nozzles to the RPV that connect to flooding spargers in the vessel annulus area outside the core shroud. LPFL subsystem A discharges to one of the main feedwater injection lines and thus also supplies coolant to the vessel annulus area outside the core shroud via the feedwater sparger. The LPFL subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, each LPFL pump is automatically started approximately 10 seconds after electrical power is available. When the RPV pressure drops sufficiently, LPFL flow to the RPV begins. RHR System valves in the LPFL flow (continued)
ABWR TS B 3.5-2 10/21/93
ECCS-Operating B 3.5.1 BASES BACKGROUND path are automatically positioned to ensure the proper flow
( Continued ) path for water from the suppression pool to inject into the RPV. A discharge test line is provided to route water from and to the suppression pool to allow testing of each LPFL pump uithout injecting water into the RPV.
The HPCF System is comprised of two separate subsystems.
Each HPCF subsystem (Ref. 1) consists of a single motor driven pump, a flooder sparger above the core, and piping and valves to transfer water from the suction source to the sparger. Suction piping is provided from the CST and the suppression pool. Pump suction is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCF System. The HPCF System is designed to provide core cooling over a wide range of RPV pressures, (0 to 82.75 Kg/cm d), vessel to the air space of the compartment containing the water source for the pump suction. Upon receipt of an initiation signal, the HPCF pumps automatically start (when electrical power is available) and valves in the flow path begin to open. Since the HPCF System is designed to operate over the full range of RPV pressures, HPCF flow begins as soon as the necessary valves are open. A full flow test line is provided to route water from and to the CST to allow testing of the HPCF System during normal operation without injecting water into the RPV.
The RCIC System (Ref.1) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line B, upstream of the inboard main steam line isolation valve.
I (continued)
ABWR TS B 3.5-3 10/21/93 I
1
ECCS-Operating !
B 3.5.1 BASES BACKGROUND TheRCICSystemisdesignedtoprovidecorepoolingfora
( Continued ) wide pange of reactor pressures,10.55 Kg/cm g to 81.2 Kg/cmg. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the suppression pool to allow testing of the RCIC System during normal operation without injecting water into the RPV. For the station black out scenario, where all AC power from the offsite AC circuits and from the standby diesel generators are assumed to be lost, RCIC is designed to provide makeup water to the RPV. Diverse alternatives to RCIC are provided by the Combustion Turbine Generator (CTG) and the AC-Independent Water Addition (ACIWA) mode of RHR(C)
(References 13 and 14). If RCIC is inoperable, water can be injected into the RPV either by powering other ECCS subsystems from the CTG or by the Fire Protection System (FPS) using the ACIWA mode of RHR(C).
The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPFL pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line " keep fill" systems are designed to maintain all pump discharge lines filled with water.
The ADS (Ref.1) consists of 8 of the 18 S/RVs. It is designed to provide depressurization of the primary system during a small break LOCA if RCIC and HPCF fail or are unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPFL),
so that these subsystems can provide core cooling. Each ADS valve is supplied with pneumatic power from either its own ,
dedicated accumulator located in the drywell, or from the atmospheric control system (ACS) directly when pneumatic power from the accumulators is not needed. The ACS also supplies the nitrogen (at pressure) necessary to assure the ADS accumulators remain charged for use in emergency j actuation.
(continued)
ABWR TS B 3.5-4 10/21/93 l
- - - . . - . =. . - --
ECCS-Operating '
B 3.5.1
~ BASES BACKGROUND TheRCICSystemisdesignedtoprovidecorepoolingfora
( Continued ) wide pange of reactor pressures,10.55 Kg/cm g to 81.2 Kg/cmg. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the suppression pool to allow testing of the RCIC System during normal operation without injecting water into the RPV. For the station black out scenario, where all AC power from the offsite AC circuits and from the standby diesel generators are assumed to be lost, RCIC is designed to provide makeup water to the RPV. Diverse alternatives to RCIC are provided by the Combustion Turbine Generator (CTG) and the AC-Independent Water Addition (ACIWA) mode of RHR(C)
(References 13 and 14). If RCIC is inoperable, makeup water to the RPV can be supplied either by powering other ECCS subsystems from the CTG or by the fire Protection System (FPS) using the ACIWA mode of RHR(C).
The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPFL pump discharge pressures following system initiation. To ensure rapid !
delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line " keep fill" systems are designed to maintain all pump discharge lines filled with water.
The ADS (Ref.1) consists of 8 of the 18 S/RVs. It is designed to provide depressurization of the primary system i during a small break LOCA if RCIC and HPCF fail or are unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating ;
pressure range of the low pressure ECCS subsystems (LPFL), l so that these subsystems can provide core cooling. Each ADS j valve is supplied with pneumatic power from either its own dedicated accumulator located in the drywell, or from the atmospheric control system (ACS) directly when pneumatic power from the accumulators is not needed. The ACS also supplies the nitrogen (at pressure) necessary to assure the ADS accumulators remain charged for use in emergency actuation. ,
(continued)
ABWR TS B 3.5-4 10/21/93
- . I i
ECCS-Operating l B 3.5.1 '
BASES i
APPLICABLE The ECCS performance is evaluated for the entire spectrum SAFETY ANALYSES of break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 2, 3, and 4. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 5), and the results of these analyses are described in Reference 6.
This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 7),
will be met following a LOCA assuming the worst case single active component failure in the ECCS:
P
- a. Maximum fuel element cladding temperature is s 1204*C; Maximum cladding oxidation is s 0.17 times the total b.
cladding thickness before oxidation;
- c. Maximum hydrogen generation from zirconium water reaction is s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; ,
- d. The core is maintained in a coolable geometry; and
- e. Adequate long term cooling capability is maintained.
The limiting single failures are discussed in Reference 6.
For any LOCA, failure of ECCS subsystems in Division 2 '
(HPCF-B and LPFL-B) or Division 3 (HPCF-C and LPFL-C) due to failure of its associated diesel generator is the most severe failure. One ADS valve failure is analyzed as a limiting single failure for events requiring ADS operation, however, the above single failure of a diesel generator, and associated motor driven ECCS injection subsystems in the division, is a more limiting failure. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damago.
Additional functions of the RCIC System are to respond to transient events by providing makeup coolant to the nuclear vessel and to be an independent AC source during station blackout.
In order to provide increased margin to ECCS acceptance criteria (i.e., 10 CFR 50.46), the ECCS was designed to the (continued) -
l l
ABWR TS B 3.5-5 10/21/93
ECCS.- Operating !
, B 3.5.1 BASES APPLICABLE more stringent goal of no core uncovery for any postulated SAFETY ANALYSES DBA or transient event, even given the most limiting single (continued) failure. This design philosophy resulted in substantially improved ECCS performance such that, when analyzed consistent with typical licensing basis methodologies, (i.e., assuming only the traditional limiting single failure), there was considerable margin relative to existing regulatory requirements. The magnitude of such margin suggested that the ECCS would still be able to perform its intended safety function, even under situations with some equipment initially out of service or unavailable due to multiple postulated failures. Therefore, further ECCS analyses were performed (see Reference 8) in an attempt to identify the minimum amount of ECCS equipment that must operate such that the plant could still meet the 10 CFR 50.46 acceptance criteria listed above.
Analyses were performed for a set of identified limiting scenarios, assuming the unavailability (or failure) of multiple ECCS subsystems, and using the same calculational methods as were used for the traditional design basis analyses. The results of these analyses demonstrated that
" success" (i.e., no violation of the above stated 50.46 limits) was achieved under various postulated accident scenarios provided at least one motor driven ECCS injection subsystem was capable of successfully injecting water into the RPV. For any such scenarios also requiring depressurization, " success" was achieved with the actuation of at least five SR/Vs in the ADS mode (in conjunction with successful vessel injection from the one required ECCS subsystem). Thus, it was confirmed that the ABWR ECCS is able to perform its intended safety function (in accordance with the applicable regulatory requirements), even for postulated events involving limiting single failures that might occur with less than the full complement of ECCS subsystems initially available.
The ECCS satisfy Criterion 3 of the NRC Policy Statement.
LC0 Each ECCS subsystem and eight ADS valves are required to be OPERABLE. The ECCS subsystems are defined as the three LPFL subsystems, the two HPCF subsystems, and the RCIC System.
The high pressure ECCS subsystems are defined as the two HPCF subsystems and the RCIC System.
(continued)
eL2 ..m -'
__m .__._ _w ECCS - Operating ;
8 3.5.1 l BASES LCO With less than the required number of ECCS subsystems (continued) OPERABLE during a limiting design basis LOCA concurrent with the worst case single failure, the margins to the limits specified in 10 CFR 50.46 (Ref. 7) would be reduced.
Furthermore, all ECCS subsystems are assumed to be initially available in the comprehensive set of analyses performed to satisfy the single failure criterion required by 10 CFR 50.46 (Ref. 7). Thus all ECCS subsystems must be OPERABLE.
The ECCS is supported by other systems that provide automatic ECCS initiation signals (LC0 3.3.1.1, "SSLC Sensor Instrumentation" and LC0 3.3.1.4, "ESF Actuation Instrumentation"), cooling and service water to cool rooms containing ECCS equipment (LC0 3.7.1, " Reactor Building Cooling Water (RCW) System, Reactor Service Water (RSW)
System and Ultimate Heat Sink (VHS)-Operating", LC0 3.7.2, "RCW/RSW and UHS-Shutdown" and LC0 3.7.3 "RCW/RSW and UHS-Refueling"), electrical power (LC0 3.8.1, "AC Sources-Operating," and LC0 3.8.4, "DC Sources-0perating").
A LPFL subsystem may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPFL mode and not otherwise inoperable. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems can provide the required core cooling, thereby allowing operation of an RHR shutdown cooling loop when necessary.
APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3 when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. InMODES2and3,theRCICSystemifnotrequired to be OPERABLE when pressure is s 10.5 Kg/cm g (150 psig) since other ECCS subsystems can provide sufficient flow to the vessel. InMODES2and3,theADpfunctionisnot ,
required when pressure is s 3.5 Kg/cm g (50 psig) because !
the low pressure ECCS subsystems (LPFL) are capable of providing flow into the RPV below this pressure. ECCS requirements for MODES 4 and 5 are specified in LC0 3.5.2, "ECCS - Shutdown. "
(continued)
ABWR TS B 3.5-7 10/21/93
~
ECCS-Operating B 3.5.1 BASES ACTIONS A.l. B.1,1. 8.1.2. B.2, and B.3 With one or two ECCS subsystem (s) inoperable provided RCIC is OPERABLE (Condition A), the inoperable subsystem (s) must be restored to OPERABLE status within 14 days. If RCIC is inoperable or RCIC in combination with any one other ECCS subsystem is iroperable (Condition B), the inoperable subsystem (s) can be restored to OPERABLE status within 14 days provided the Combustion Turbine Generator (CTG) is verified, initially within 7 days and once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter, to be functional and capable of being aligned to each of the ESF buses or the AC-Independent Water Addition (ACIWA) mode of RHR(C) is verified to be functional within 7 days. In these Conditions, the remaining OPERABLE subsystems provide more than adequate core cooling during a LOCA. However, overall ECCS reliability is reduced; and a single failure impacting one or more of the remaining OPERABLE subsystems concurrent with a LOCA would result in degraded ECCS performance and reduced margins to 10 CFR 50.46 acceptance criteria. Nevertheless, even given the worse case single failure concurrent with a LOCA initiated from this Condition, there will always be at least one ECCS subsystem available to inject water into the RPV. (For the special case of an LPFL-A line break and failure of a diesel generator, the CTG would be available to provide emergency electrical power to the ECCS pumps.) Additional analyses of limiting design basis scenarios demonstrate that in such cases 10 CFR 50.46 acceptance criteria will still be met.
Furthermore, results of PRA sensitivity studies performed (Ref. 9) for Condition A show that this situation is acceptable from an overall plant risk perspective.
For Condition B, the PRA sensitivity studies performed (Ref.
- 9) showed that, with RCIC inoperable, the change in core damage frequency is relatively large for station blackout events. Therefore, if the CTG is verified to be functional and the circuit breakers are capable of being aligned to each of the ESF buses (LC0 3.8.1), other ECCS subsystems can be powered by the CTG during a station blackout to compensate for RCIC's inoperability. Alternatively, to compensate for RCIC's inoperability, if the ACIWA mode of RHR(C) subsystem is verified to be functional, the Fire Protection System (FPS) can be used to inject water into the RPV during a station blackout with the RPV sufficiently depressurized. The ACIWA is verified to be functional by (continued)
ABWR TS B 3.5-8 10/21/93
. ~ _ _ _ _ - . - .. - .
'l ECCS-Operating :
B 3.5.1 l BASES ACTIONS A.l. B.1.1. B.l.2. B.2. and B.3 (continued)
( Continued )
stroking one complete cycle of each of the two manual valves ,
in the FPS connection to RHR(C) injection line, by starting the FPS diesel-driven fire pump and verifying that the FPS header pressure is maintained, and by stroking one complete '
cycle of the RHR(C) subsystem injection valve using its ,
handwheel.
If the CTG or ACIWA is not available, the Completion Time for Condition B is limited to 7 days based on an overall risk perspective. The 14 day Completion Times for both Conditions A and B are based on a risk perspective and the low probability of a LOCA occurring during this period and the overall redundancy provided oy the ECCS and its continued ability to perform its intended safety function, while assuring a return to full ECCS capability in a reasonable time so as to not significantly impact overall ECCS reliability.
C.l.l. C.1.2. C.2. C.3. D.1 and E.1 With RCIC and any other two ECCS subsystems inoperable, provided at least one HPCF subsystem is OPERABLE, one ECCS subsystem must be restored to OPERABLE status within 7 days.
With any three ECCS subsystems inoperable, provided RCIC is OPERABLE, one ECCS subsystem must be restored to OPERABLE status within 3 days. With all three high pressure ECCS subsystems inoperable, at least one high pressure ECCS subsystem must be restored to OPERABLE status within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. In these Conditions, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA, but the single failure criterion capability for all combinations i of systems out of service is not satisfied. Therefore, the Completion Times are limited to 7 days, 3 days and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, ,
respectively, depending on the combination of ECCS subsystems that are inoperable. Additional analyses of limiting design basis scenarios demonstrate that in such ,
cases 10 CFR 50.46 acceptance criteria will still be met (Ref. 8). Furthermore, results of PRA sensitivity studies performed (see Reference 9) show that this situation is acceptable from an overall plant risk perspective.
Additionally, for Condition C, where RCIC is inoperable, either the CTG must be verified, within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, to be (continued)
ABWR TS B 3.5-9 10/21/93
ECCS-Operating B 3.5.1 BASES ACTION C.I.l. C.I.2. C.2. C.3. D.1 and E.1 (continued)
(continued) functional and the circuit breakers are capable of being aligned to each of the ESF buses, or, alternatively, the ACIWA mode of RHR(C) subsystem must be verified to be functional within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. If the CTG is verified to be functional and capable of being aligned to each of the ESF buses (LC0 3.8.1), other ECCS subsystems can be powered by the CTG during a station blackout to compensate for RCIC's inoperability. If the ACIWA mode of RHR(C) subsystem is verified to be functional, the Fire Protection System (FPS) can be used to inject water into the RPV during a station blackout with the RPV sufficiently depressurized. The ACIWA is verified to be functional by stroking one complete cycle of each of the two manual valves in the FPS connection to RHR(C) injection line, by starting the FPS diesel-driven fire pump and verifying that the FPS header pressure is maintained, and by stroking one complete cycle of the RHR(C) subsystem injection valve using its handwheel. If the CTG or ACIWA is not available, the Completion Time for Condition C is limited to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> based on an overall risk perspective.
Since the ECCS availability is reduced relative to Conditions A and B, a more restrictive Completion Time is imposed. The 7 and 3 day Completion Times for Required Actions C.3 and 0.1 are based on the low probability of a LOCA occurring during this period and the overall redundancy provided by the ECCS and its continued ability to perform the intended safety function while assurir.g a return towards full ECC3 capability in a reasonable time so as to not significantly impact overall ECCS reliability. The ,
Completion Time for Required Action D.1 is more restrictive than the Completion Time for Required Action C.3 because of ;
the lesser capability of RCIC compared to the other high '
pressure ECCS subsystems (HPCF). i The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time for Required Action E.1 is more !
restrictive because a LOCA may necessitate an unwanted I actuation of the ADS to reach the operating conditions of the low pressure ECCS subsystems. However, any one low
, pressure ECCS subsystem is capable of maintaining core coolant during a LOCA for the spectrum of break sizes.
(continued)
ABWR TS B 3.5-10 10/21/93
ECCS-Operating B 3.5.1 BASES ACTION F.1 and F.2 (continued)
If any Required Action and associated Completion Time of Condition A, 8, C, D, or E are not met, or when any four ECCS subsystems are inoperable, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and to MODE 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
G.1 and H.1 With one or two ADS valves inoperable, the ADS valves must be restored to OPERABLE status within 14 days. With three ADS valves inoperable, one ADS valve must be restored to OPERABLE status within 7 days. The LC0 requires eight ADS valves to be OPERABLE to provide the ADS function.
Reference 6 contains the results of the traditional design basis analysis that evaluated the effect of one ADS valve being out of service. However, the results of this analysis are bound by additional analyses or more limiting single failure scenarios which assume the unavailability of multiple ADS valves (see Reference 8). Per these analyses, operation of only five ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced and there is a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 7 and 14 day Completion Times are based on the low probability of a LOCA occurri.ig during this period and the overall redundancy and capacity of the ADS System and its continued ability to perform its intended safety function, while assuring a return towards full ADS capability in a reasonable time so as to not significnatly impact overall ADS or ECCS reliability. Furthermore, each of these conditions has been modified by a NOTE that allows concurrent existence with Conditions A, B, C, D, or E.
Concurrent existence is justified by the additional ECCS analyses that were performed (Ref. 8) and greatly simplifies the necessary Required Actions.
l (continued)
ABWR TS B 3.5-11 10/21/93
^
ECCS-Operating B 3.5.1 BASES l
ACTION 1.1 and I l i (continued)
If the Required Action and associated Completion Time of Condition G or H is not met or if four or more ADS valves l are inoperable, the plant must be brought to a condition in '
which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reactor steam dome pressure reduced to s 3.5 Kg/cm2g within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the HPCF subsystem, RCIC System, and LPFL subsystems full of water ensures that the systems will perform properly, injecting their full capacity into the RCS upon demand. This will also prevent a water hammer following an ECCS initiation signal. One acceptable method of ensuring the lines are full is to vent at the high points. The 31 day Frequency is based on operating experience, on the procedural controls governing system operation, and on the gradual nature of void buildup in the ECCS piping.
SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otharwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves potentially capable of being mispositioned are (continued)
ABWR TS B 3.5-12 10/21/93
^
ECCS -Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 REQUIREMENTS (continued) in the correct position. This SR does not apply to valves i that cannot be inadvertently misaligned, such as check valves.
The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve alignment would only affect a single subsystem. This frequency has been shown to be acceptable through operating experience.
This SR is modified by a Note that allows a LPFL subsystem to be considered OPERABLE during alignment and operation for decay heat removal with reactor steam dome pressure less than the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPFL mode and not otherwise inoperable. This allows operation in the RHR shutdown cooling mode during MODE 3 if necessary.
SR 3.5.1.3 Verification every 31 days that ADS nitrogen accumulator pressure is 211.3 Kg/cm g assures adequate nitrogen pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The designed pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least one valve actuation can occur with the drywell at design pressure, or five valve actuations can occur with the drywell at atmospheric pressure (Ref. 10). The ECCS safety analysis assumes only one actuation to achieve the depressurizationrequiredforoperationofthelowpressure ECCS. This minimum required pressure of 11.3 Kg/cm g is provided by the High Pressure Nitrogen Gas Supply System (HPIN). The 31 day Frequency takes into consideration administrative control over operation of the HPIN and alarms for low pneumatic pressure (Ref.12).
(continued)
ABWR TS B 3.5-13 10/21/93
ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4. SR 3.5.1.5 and SR 3.5.1.6 REQUIREMENTS (continued) The performance requirements of the ECCS pumps are determined through application of the 10 CFR 50, Appendix K, criteria (Ref. 5). These periodic Surveillances are performed (in accordance with the ASME Code,Section XI, requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 7). The RCIC pump flow rates also ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated.
The pump flow rates are verified against a system head that is equivalent to the RPV pressure expected during a LOCA.
The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing.
The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to ,
provide rated flow is tested both at the higher and lower operating ranges of the system. Since the required reactor steam dome pressure must be available to perform SR 3.5.1.5 and SR 3.5.1.6 sufficient time is allowed after adequate pressure is achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable.
Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the specified reactor steam dome pressure is i reached.
l l
A 92 day Frequency for SR 3.5.1.4 and SR 3.5.1.5 is ;
consistent with the Inservice Testing Program requirements. )
The 18 month Frequency for SR 3.6.1.6 is based on the need to perform this Surveillance under the conditions that apply (continued)
ABWR TS B 3.5-14 10/21/93
ECCS-Operating
~,
B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4. SR 3.5.1.5 and SR 3.5.1.6 (continued)
REQUIREMENTS (continued) during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
SR 3.5.1.7 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCF, RCIC, and LPFL will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCF and RCIC Systems will automatically restart on an RPV low water level (Levels 1.5 and 2, respectively) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. SRs in LC0 3.3.1.1 and LC0 3.3.1.4 overlap this Surveillance to provide complete testing of the assumed safety function.
The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. ;
This SR is modified by a Note that excludes vessel injection l during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation l through the test line, coolant injection into the RPV is not i required during the Surveillance. I (continued) .
ABWR TS B 3.5-15 10/21/93
i ECCS-Operating B 3.5.1 BASES I i
SURVEILLANCE SR 3.5.1.8 REQUIREMENTS (continued) The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.
A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,
solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.9 and SRs in LC0 3.3.1.1 and LC0 3.3.1.4 overlap this Surveillance to provide complete testing of the assumed safety function.
The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
This SR is modified by a Note that excludes valve actuation.
This prevents an RPV pressure blowdown.
SR 3.5.1.9 A manual actuation of each ADS valve is performed to verify that the valve and solenoids are functioning properly and that no blockage exists in the S/RV discharge lines. This is demonstrated by the response of the turbine control or bypass valve, by a change in the measured steam flow, or by any other method suitable to verify steam flow. Adequate reactor steam dome pressure must be available to perform this test to avoid damaging the valve. Sufficient time is therefore allowed, after the required pressure is achieved, to perform this test. Adequateppessureatwhichthistest is to be' performed is [66.8 Kg/cm g](the pressure recommended by the valve manufacturer)]. Reactor startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed
. until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reactor steam dome pressure is ;t [66.8-(continued)
ABWR TS B 3.5-16 10/21/93
~L ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.9 REQUIREMENTS 2
(continued) Kg/cm9]. SR 3.5.1.8 and SRs in LC0 3.3.1.1 and LC0 3.3.1.4 overlap this Surveillance to provide complete testing of the assumed safety function.
The frequency of 18 months on a STAGGERED TEST BASIS ensures that both solenoids for each ADS valve are alternately tested. The Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
REFERENCES 1. ABWR SSAR, Section 6.3.2.
- 7. 10 CFR 50.46.
(continued)
ABWR TS B 3.5-17 10/21/93
.. 'I :
.,= .
.' - ECCS-Operating .!
b B 3.5.1 j l
BASES REFERENCES 14. ABWR SSAR, Section 5.4.7.1.1.10. ,
(continued) o ABWR TS B 3.5-18 10/21/93
- -