ML20076A977
| ML20076A977 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 03/23/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20076A975 | List: |
| References | |
| SER-790323-1, NUDOCS 7905070347 | |
| Download: ML20076A977 (17) | |
Text
_ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ - _ _. _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _
/
UNITEO STATES
['
't NUCLEAR REGULATORY COMMISSION j - ). D ), jj WASHINGTON, D. C. 20566
, c
% *'.w... y SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SUPPORTING AMENDMENT NO.50 TO FACILITY OPERATING LICENSE NO. OPR-65 NORTHEAST NUCLEAR ENERGY COMPANY, ET AL MILLSTONE NUCLEAR POWER STATION, UNIT NO. 2 DOCKET N0. 50-336 i
1.0 Introduction By application dated December 8,1977, and supplemental information dated December 3, 1976, March 8 and 22 and June 9, 1977, Northeast O'
Nuclear Energy Company, et al, (NNECO or the licensee). requested changes to the Technical Specifications (TS) for the Millstone Nuclear Power Station, Unit No. 2.
l The proposed changes to the TS consist of adding low temperature
'i overpressure protection system (OPS) requirements.
i
2.0 Background
l The history of the generic low temperature overpressure protection issue is described in NUREG-0138 (Reference 1). Briefly, a series of over 30 incidents had occurred in pressurized water reactors (PWRs) since 1972 in which the Appendix G pressure-temperature limits had been exceeded at temperatures ls than normal operating temperature.
These incidents consisted of two varieties of pressure transients:
a mass input type from charging pumps, safety injection pumps, or O
safety injection accumulators, and an energy input type caused by thermal feedback when a reactor coolant pump (RCP) sweeps cooler primary system water through a steam generator with a hot secondary side. These incidents usually occurred in a water solid system during startup or shutdown operations.
Pressure transients which could occur at normal operating temperature.
approximately 570 F, are mitigated in most plants by ~1arge. code l'
safety valves located on the pressurizer. These are mechanical valves which open against a spring pressure of about 2400 psia. The code safety valves are quite sir:ple, having no electrical components, and as such are considered passive, failure free components. These code safety valves are tested in accorcance with ASME Code,Section XI requirements.
(
79050703T7
. Prior to the introduction of an OPS, pressure transients initiated while operating at lower temperatures were not protected against and there were no pressure relief devices in the reactor coolant system to prevent these transients from exceeding the Appendix G pressure-temperature limits.
Nuclear reactors such as Millstone 2, which have a pressure limit in excess of 2500 psia at 570 F, have only a 700 psia limit at 200 F.
The code safety valves with settings in the 2400 psia range would not be able to relieve a pressure transient at low RCS temperature without the Appendix G limits being violated by a large amount.
The Appendix G pressure limit drops off rapidly at lower temperatures because the reactor vessel material and welds have significantly less toughness at lower tenceratures and are therefore more susceptible to flaw induced f ailure.
In addition, factors such as copper content in welds and neutron fluence levels affect the material toughness and contribute to the reduction in safety margin to vessel failure at low temperature conditions. The Millstone 2 overpressure protection analysis v/
was performed utilizing the Appendix G curves for 2 to 10 years of full power operation as the basis for maximun allowable pressure.
As a solution to the low temperature overpressurization problem, the licensee identified a set of power operated relief valves (PORV's) located on the pressurizer which are normally availab.le for overpressure protection during normal plant operations. These usually have a single pressure setpoint just below the opening pressure of the mechanical code safety valves and are designed to relieve small pressure transients with-sut requiring the code safety valves to lift. The licensee proposed to
- rovide the PORV's with a. low pressure setpoint to which they could be switched as the plant cooled down. If a pressure transient would occur at these lower temperatures and the lower setpoint had been selected, there would then be a pathway to relieve system pressure.
The PORV's are significantly more complicated than the code safety valves d
since the PORV's require electrical circuitry to sense pressure, transmit a signal to the valve, and actuate the solenoid to open the valve. Thus 4
3 it is desirable to insure redundancy and separability in the circuitry to preclude a single f ailure from disabling the entire OPS system.
In a series of meetings and through correspondence with PWR vendors and licensees, the staff developed a set of criteria, which if adhered to, I
j would produce an acceptable OPS. These criteria are:
1.
Operator Action:
The licensee could not take credit for operator action for 10 minutes after the operator b0came aware of an ongoing transient.
a 2.
Single Failure: The system had to be designed to relieve overoressure transients assumi(g the worst case single failure in addition to the event which caused the transient.
(}.
~
\\
3.
Testability: The system had to be testable on a periodic basis con-I sistent with the systen's employment.
4.
Seismic and IEEE 279 Desian:
Ideally the system should meet seismic Class 1 and IEEE 279 cesign requirements. The basic obje'ctive is that the system should not be vulnerable to a common failure mode which both initiated a pressure transient and caused a fa.ilure of equipment needed to terminate the transient.
In addition to the four formally stated criteria mentioned above, a number of additional criteria were established in the process of the staff review of generic submittals from the various vendors and in the
{
exchange of information between the staff and the licensees.
Forenost among these was the requirement that the licensees show pro-p tection for the limiting mass addition transient regardless of the admin-
'j istrative procedures proposed to eliminate that potential scenario. Each E
licensee, therefore, was required to analyze the effects of the single pump start which would produce the most limiting mass addition transient and most severely challenge the Appendix G limits. For Millstone 2 a High Pressure Safety Injection (HPSI) pump start produces the most limiting pressure transient.
For the worst case energy addition transient the licensees were allowed to limit the severity of the transient in their analyses by assuming a maximum aT acress the steam generator. By maximum ST we mean the maximum difference in tne temperature between the primary loop coolant and the secondary loop water in the steam generator. For this case and for other scenarios the licensees were required to develop Technical Specifications which delineated the actions required to limit the severity of these scenarios and also provide justification for their action.
l 1
.4 9
Another criterion for the design of the OPS was that t the operator to 1) properly enable the low temperature OPS at the proper temperature during cooldown, and 2) indicate if a pressure transient was Additionally the electrical system had to provide positive 3
assurance that the isolation valve upstream of each PORY was open when occurring.
The enable alarm would not be permitted to clear until selector switch for each PORY system was placed in the low pressure setpoint position and the isolation valve was opened.
NNECO submitted a geperic overpressurization protection report preparedTh i.
by Combustion Engineering (CE) in Reference 2.
The generic report for the CE Owner's Group comprising five utilities.
provided information on RCS response to postulated p O
a general description of design modifications which could be used to prevent overpressurization of CE designed Nuclear Steam Supply Systems The staff, in conjunction with its review of the CE generic report, requested that NNECO commit to a schedule for implementing a (NSSS).
31, 1977, and re.
permanent or interim version of the OPS by December quested additional information related to the application of tne generic aspect of the OPS as pertinent to the Millstone 2 plant (Reference 3).
In References 4 and 5 the licensee submitted addition for implementation of the proposed system.
,e NNEC0 states that the Millstone 2 final OPS was installed during the refueling outage beginning in December 1977. This conforms to the staff's requirement to install an interim or final version of OPS
()
by December 31, 1977.
NNECO submitted the Millstone 2 plant specific report in Reference 7 and additional plant specific data was supplied in Reference 9.
l
3.0 Discussion and Evaluation The system installed by NNECO for Millstone 2 incorporates a defense in depth concept for overpressure orotection, utilizing operator training, administrative procedures, Technical Specifications, and hardware im-provements to meet the, criteria established by the staff. The objective of the OPS is, first, to insure that pressure transients while operating at low RCS temperatures become and remain unlikely events, and second, to mitigate the consecuences of a pressure transient should one occur. The mitigating system includes sensors, actuatino mechanisms, and valves to prevent a RCS pressure transient from exceeding the pressure-temperature linits included in the Hillstone 2 Technical Specifications as required by Appendix G to Chapter 10, Code of Federal Reculations, Part 50 (10 CFR 50). These Appendix G limits are those established by using procedures defined in Appendix G to Section III of the ASME Code.
Appendix G to 10 CFR 50 states that these ASME Code limits can be used for startup and shutdown when the reactor is not critical. For criti-cality, Appendix G to 10 CFR 50 requires more stringent rules than s
Appendix G to Section III of the ASME Code.
Suggested TS were submitted by the licensee as part of the OPS plan and are reviewed together with the system hardware in this Safety Evaluation. However, the fonnat and content of the proposed TS needs to be revised to meet our requirements. NNECO has agreed to such modifications of the TS for OPS.
3.1 Technical Specifications and Operatino Procedures One cornerstone of the Millstone 2 OPS is the use of TS and operating procedures to limit the probability of initiating pressure transients at low temperatures (<275 F) and to insure the enabling, disabling, and proper functioning of the OPS.
The TS specify the conditions required for starting a RCP, the PORV OPERABILITY requirements and the PORY surveillance requirements. We conclude that these TS will provide assurance that pressure transients at low temperatures will be unlikely and that the system will function to preve it overpressure transients from exceeding Appendix G limits. We further conclude that the TS meet the criteria established by the staff and are acceptable.
The licensee will make extensive use of operating procedures to provide a large measure of the administrative protection against overpressure transients. Among these operating procedures for low temperature operating conditions are the following:
, When RCS temperature, pressure, and other operating conditions permit, a pressurizer steam volume of 60% of the pressurizer volume will be naintained.
. The TS require the maximum aT across the steam generator to be less than 31 F prior to starting a RCP at low temperature.
This insures that functioning of one of the two PORV's will provide sufficient relief capacity such that Appendix G will not be violated in the event of an inadvertent RCP start.
6-
. Emergency Core Cooling System (ECCS) component testing will be conducted with a steam bubble or with the reactor vessel head removed. Operational testing of the Safety Injection and Chemical and Volume Control System (CVCS) components (i.e., pumps, valves, automatic signals, etc.) will be accomplished with a non-solid RCS.
l We conclude that these operating procedures contribute measurably to plant protection from low temperature overpressure transients.
The steam generator aT of 31 F specified in the TS as the operating 1
limit is a result of determining the minimum AT required to prevent In this an Appendix G violation and then factoring in uncertainties.
particular case the maximum permissable aT, calculated to be 43 F, was l
reduced by uncertainties in instrument accuracy (9 F) and the difference in steam generator bulk fluid and shell side temperature (3 F).
We
- rL conclude that the licensee's nethod of measuring steam' generator aT is s
'(
)
's acceptable.
We conclude that the TS submitted by the licensee will provide assurance that pressure transients at low temperatures will be unlikely and that the system will function to prevent overpressure
{'
transients from exceeding Appendix G limits. We further conclude i
that the TS meet the criteria established by the staff and are, therefore, acceptable.
O l
2
p h.v 6
-7 Hardware 3.2 OPS Functioning h proper func-3. 2.1.
Acceptable performance of the OPS depends on t ef the tw tioning and adequate relief caoacity oThe NSSS vendor and the t lated mass strated that with two PORV's functioning, all pos u on the pressurizer.
d If one PORY and energy addition transients could be n be relied i
upon to limit the severity of the limit nginsure that Appendix G.
)
the energy and mass addition cases to J
~')
limits are not violated.
Energy Addition Transients the maximum 3.2.2.
Administrative procedures, backed by TS require that 43 F to lessen the AT across the steam generator be less than i
i t As pre-consequences,,of the RCP start energy addition trans en viously noted, the uncertainty due to instrumenThis aT will be design base Millstone 2 TS in order to limit the severity of theThe ope the maximum AT to 40 F.
limited to no energy addition transient. call for the AT across the stea i
to relieve more than S F during a cooldown.
assurance that a single PORV will be able to funct onAppe this transient and maintain RCS pressure below PORV relief Numerous assumptions were employed in the modelin i design base energy to insure conservatism in the analysis of th s O
addition transient:
The RCS was assumed to be water solid.
i nt The RCS was also assumed to be rigid during the t (no expansion).
A single PORV was assumed to fail.
RCS letdown flow was assumed isolated.
sidered.
Heat absorption by the RCS netal mass was not con 4
t
. Conservatively high heat transfer coefficients were utilized across the steam generator.
RCP start was assumed to be instantaneous.
With a PORY low pressure setpoint of 46E psia the licensee showed that one PORY will provide sufficient relief capacity to give a maximum pressure of s500 psia for an energy addition transient. This peak pressure corresponds to an Appendix G limit that would exist at temperatures well below the refueling temperature (.130 F). This analysis assumed a AT of no more than 43 F across the steam generator.. As previously noted the licensee will monitor the temperature difference to insure a aT of no more than 40 F which in turn insures a aT of no more than 43 F when the 3 F of uncertainties are 9
factored in.
We conclude that the licensee and vendor have demonstrated that the OPS can protect the RCS from exceeding Appendix G limits for an energy addition transient even with the addi.tional single failure of a PORV.
3.2.3, Mass Addition Transients Protection from the effects of the limiting mass addition tran-sient was afforded by the licensee by assuring that components l
of the ECCS system would be disabled by procedure and TS during cooloown. This is accomplished at 250 F by disabling one HpSI pump and by disabling the second HPSI pump at 190 F.
Disabling is accomclisned by racking down the HPSI breakers and closing i
the HPSI discharge or header isolation valves with the breakers
(,_ _,i in the 0FF position. This provides assurance that Appendix G limits will not be violated should a single PORV fail prior to
\\_ /
or during a mass addition transient. Conservatisms included in the limiting mass addition transient model, the inadvertent single HPSI pump start, were as follows:
The RCS was assumed to be water solid.
Letdown flow from the RCS was assumed isolated.
The RCS was considered to be rigid during the transient (no expansion).
l l
l
f
, L 4
k.
Mass addition was assumed to occur with the hiohest fluid density that could occur. PORY relief was assumed to occur with the 1 owe 5t fluid density that could occur.
A single PORV was assumed to f ail.
A conservative Bernoulli equation was utilized to model PORY relief.
The staff guidance to the licensee for analyzing the mass addi-tion transient was to show that Appendix G limits were not violated assuming that the safety in.iection pump which could produce the worst case transient inadvertently started, regarc-less of administrative procedures calling for disabling the punps at various stages.
For the Millstone 2 plant the worst pump start would be a HPSI pump. The licensee demonstrated that a single HPSI pump plus one charging pump mass input tran-9 sient would produce a peak pressure of 465 psia, the PORY opening setpoint. The equilibrium pressure for the HPSI pump and one charging pump output balanced by single PORY relief is 460 psia.
The quick opening time of the valve (s10 nilliseconds) results in the transient inmediately being relieved, producing the equi-librium pressure of 460 psia.
This corresponds to an Aopendix G limit that would exist at temoeratures well below the refueling tenperature (s130 F).
We conclude that the licensee has demonstrated that the OP$ will prevent overpressurization of the RCS due to mass addition tran-sients, assuming the single failure of a PORV.
- 3. 2. 4. Conclusion on OPS Hardware
(N ihe syster., presented by NNECO to provide protecti:n f:r t: 1e
(
/
Mil, stone 2 plant from low temperature overpressure transients provides assurance that these transients will be unlikely events and that, should they occur, the plant will be protected.
We conclude, therefore, that the Millstone 2 OPS meets the criteria established by the statt for overpressure protection and is, therefore, acceptable.
/
1
's r.
y k 3.3 Electrical Instrumentation and Control The NNECO design for the OPS is based on the use of existir.g PORV's located on the pressurizer to provide low temperature pressure relief capability. These valves may be operated manually by closing a switch or may be activated by a preset pressure and temperature signal to provide automatic pressureThe PO relief.
type.
Existing reactor coolant system (RCS) temperature signals are used to per-Each function is implemented in a dual redundant mode forn four functions.
~
utilizing a separate temperature system for each PORV.
The functior.s that the RCS temperature signals provide are: (1) energi-zation and de-engerization of the PCRV solenoids, (2) activation of over-O pressure transient alams, (3) activation of " low pressure setpoint" alarms and (4) activation of "high pressure setpoint" alarms. The RCS pressure signal is not utilizec in the activation of the "high pressure setpoint" a1arn.
)
Assurance for preventing inadvertent blowdown at RCS temperatures above 275 F is provided by the inclusion of two separate hand switches, one for each A hand switch provides the following functions to its associated FORY PORV.
valve system:
(1) low setpoint pemissive signal, (2) high setpoint per-missive signal, and (3) isolation valve open/close signal. '
In addition, the low pressure setpoint signals also form part of the dual-redundant " reset-to-low" and " reset-to-high" circuitry, that infoms the op-To ensure erator to which position a hand-operated switch should be set.
that the PORY low setpoint is enabled at the required RCS pressure and tem-perature by the operator, operator action and warning alarms have been in-y corporated into the modified PORV circuitry logic.
(O Sy nomal plant cooldown procedures, both the RCS pressure and temperature art decreased uniformly down to 300 F and 400-500 psig. Prior to cooling the RCS below 275 F, nomal operating procedures will require the operator to man-ually enable the PORV " Low" setpoint by resetting the hand switch to the " Low' position.
During plant heatue, nomal operating procedures will maintain the RCS pras-When sure below 400 psig until the RCS tem:erature is greater than 275 F.
tne RCS tem:erature exceeds 275 F, namel operating procedures will recuire l
that the PCRV's are reset to the "Hi" setpoint of 2,355 psig, normal plant I
nettup will continue accordingly.
i
Design Basis Criteria and Staff Positions _
3.3.1 Millstone Unit 2 was evaluated under the guidanc given to various pertinent staff positions resulting from these criter Thus, Sections 3.1.1 through 3.1.4 are concerned concerning staff positions and their impact on the design and Operation Millstone Unit 2.
Operator Action 3.3.1.1 In each design basis transient analyzed, no credit for operator action was i tion until 10 minutes af ter the initiation of the RCS overpressur za transient and after the operator was made aware of assumed sient.
low temperature overpressure transient alam.
3.3.1.2 Single Failure The overpressure protection system is designed to protect the reactor vesse given a single failure in addition to a failure that initiated the over-pressure transient.
Redundant pressure (and are used to satisfy the single failure criterion.
temperature) sensors, bistables, two full capacity PORV's and indeoendent power sources are provided for the long-term overpress,ure mitigating system The long-term mitigating system meets the single failure criterion and is acceptable.
3.3.1.3 Tes tabili ty There are two aspects associated with the testability of the overpressure protecuco system (CPS).
for low pressure protection system operability, and has resulted in a staff g) position th2t"the control circuitry from pressure sensor to valve solenoid 4
Deviations from this criterion V
should be stroked during each refueling.Consecuently, the testability program for should be justified".
will be as follows:
Verification of upstream isolation valves functioning once per cold shut-a.
down.
Perfomance of a Channel Functional test of the control circuitry from b.
the pressure sensor to the valve solenoid to be conducted once per re-fueling outage.
Performance of a Channel Calibration of the pressurizer pressure sensers c.
once,per 18 months.
The second aspect of testability involv4s the plant tests during cold shut-0 wn which could result in RCS overpressuri:ation above the minimum c:erating limit curves.
These tests are:
The integrated emergency core cooling system test, The temperature loco calibrations for the letdown isolati:n detectors, and a.
b.
The periodic surveillance tests of the charging pumps.
TP.e following ::reventive measures have been instituted to prevent inadvertent RCS overpressuri:stion:
j 7
s, d
5,-
y; ss
' [
- f
(-
s Ir.tegrated ECGsystem testing will be perfomed with ei(ner (1) a pres-
~ "
a.
-4urizer steant (uoble, or (2) with tht reactor vessel head removed, b.
3emperature loop calibration will only be perfomed _after the charging pumps are secured, and Surveillance testMg of charging pumps will be conducted during a colb c.
shutdown with non-water solid conditions.
s When the testing of ccmponents is required that mQht cause an RCS pressu're 1
rise above the minimum pressure / temperature limit curves, the OPS will be operational consistent with t,he RCS temperature considerations.
The OPS satisfies'che st\\ff t stability criteria and is acceptable.
3.3.1.4 Scisd Design and JEEE, Standard-279 g
s
, s.
IEEE Std-279 and Seismic Criteria were considered in the design of the over-i pressure protction system. The Millstone, Unit 2, plant satisfies criteria insthe follow'ing manner.
s s
s t
The design criteria for the relief valves (PORV's) and the associated instru-mentatisn and control hardware, which are the long tem mitigating systems for low te%erature RCS overpressurizatf@, are based on the existing applicable plant ' criteria and the following consideratioris: -
a.
The m e.1 gating system'i: designjd against9Wie failure. The systs!!O E
("
not vulnerable tc a Dilure mcde tnat would both initiate a pressure trja-sient and disable th60P5t b.
Whenever protection system instrumentation and control hardware are used as part of the mitigating system, isolation criteria will be in accor'd-ance with the app)fcable plant criteria to which the subject unit has been designed and dicensed.
/
V.
The present POA' s (RC-402 and RC-404) are solenoid operated power relief valves. The subject valves were designed and mangfactured in accordance with the ASME Boiler and Pressure Vessel Code,Section III (1968 Edition) and s
tht appl 1 gable ASME code for Pumps'and Valves (November 1968 Edition). The subject valves are clatsified as sei,smlt.31 ass I valves.
s,-
s
+
The long. term'oerprtNurization mit,igation system also satisfies the intent
^'
of IEEE-279 with r+ gard to the channel sepa~ ration, independence and redundancy of both the ' temperature and pressure sensors talong with their associated c?
eigetronics alarmssand PORV's.
In addition, both channels have separate elec-
~
trically independent power supplies (tne each for oressure circuitry, twn each for temperature), as do the pilot valves,for each PORV.
3.3.1.5 High Pressure Alarm The staff position is that a higfFprt:yure alarm be used during low RCS tem: 9,
,, l perature operations as an effective medr4 to alert the operator that a pres-sure transient is in progress.
A descripkien of the alam systet design is provided belcw:
c The alam annunciates on the main centrol bearc when tne reactor coolant x.J system temperature is less than 2/5Y and the reactor coolant pressure is greater then 400 psig. The annunciator provides botn visable and audio'e I
signals. Operator action is required to actnowledge the alam. Recundant +
i x-
'M A
me g k
a w
i w
\\
I I
s x
.m.
s.h^
sensors are provided by the existing low scale pressurizer channels and the
,6 wide rarge cold leg temperature detectors.
~~
The pressure signals'are powered from a vital power source while the tempera-
, \\
3 s ture signals are powered from a non-vital power source.
NNECO has made modifications so both temperature and pressure signals are powered by redundant vital power sources since both of these signals are used in the RCS high pressure alarm and both PORV channels.
We, find th5 above electrical power sources for the temperature and I
pressure signalsxto be acceptable.
3.3.1.6 ' Isolation Valve Alarm _
The staff position 'is that the position of the upstream isolation valve snould be wired into the overpressure protection alarm so that the alarm will i
Means not clear unless the system is enabled and the isolation valve is open.
should be providet tc insure proper alignment of the isolation valve during 4
overpressure protection system operation. A description of the alarm system is provide <1 below:
The c'estreart PORV isolation valves (2-RC-403 and 2-RC-405) are wired into i
RC3 OPS surf) that the~ hand switch enactment of the protection system will result in the opening of the isolation valves. An open-close 3
indication for eac_n isolation valve is provided on the main control board.
We find this modification to be acceptable.
5.
- 3. 3.1. 7 Enable Alarm The staff requires that an alann be activated as part of the plant cooldown
'j e
process to insure that the PORV " Low" setpoint is activated before the RCS
'.n temoerature is equal to or less than 275 F.
A description of the alarm system L-is provided below:
(4
\\\\'
To insure that the P0hV " Low" setpoint is activated, a PORY " Low" reset alarm N
.D is activated when the RCS temperature is equal to or less than 275 F.
Once the PORV's are reset to the "Lew" relief position, an annunciator window will
'C remain lit to indicate the " Low" PORY mcde of operation. The annunciator will
-C remain in this mode until the PORV's are reset to the "Hi" position. The over-2
%"7,
pressure transient alant. becomes operational only at RCS temperatures below 275 F.
Once the PORV's are reset to provide low temperature relief at 450 psig.
l plant cooldown can be resumed.
We find this modification to be acceptable.
[
3.3.1.8 Disable Alarm
,.q t
F The staff requires tnat an alarm be activated as part of the plant heatup crecess to insure that the PORY s are reset to tne "Hi" set:cint wnen the F
'"~
P"S temperature is greater than 275 F.
A description of the alarm system
(
is provided below, t
s.
wm v
Sring plant heatus, nor,al 'c;erating procedures will.aintain tne RCS pres-i
. sure below 400 psig until the RCS temperature exceeds 275 F.
When the RCS temperature exceeds 275 F, normal operating procedures require that the PORV's are reset to the "Hi" setooint relief of 2.385 psfg. At the same time, the overpressure transient alarm will be de-energized when the RCS tem-In order to assure that the PORV's are reset to perature exceeds 275 F.
the "Hi" setpoint, an alam will be activated when the RCS pressure exceeds 425 psig. Af ter the PORV's are reset to the "Hi" setpoint of 2.385 psig, I
normal plant heatup will continue accordingly.
We find this modification to be acceptable.
3.3.1.9 PORV Open Alarm 1
The staff requires that an alarm be activated to alert the operator that a PORY is in the open position. Millstone Unit 2 does not presently have this alam. The licensee will be required to install a PORV Open Alam in both OPS i
cnannels.
3.3.1.10 Pressure Transient Reporting and Recording Requirements The staff position is that pressure transients which cause the overpressure i
protection system to function, thereby indicating the occurrence of a serious pressure transient, constitute a 30-day reportable event.
In addition, pressure and temperature recording instrumentation are required to provide a permanent record of the pressure transient. The response time of the P/T recorders shall be compatible with the transient rates of 100 psig per second.
Appropriate instrumentation and recording equipment exists at Millstone Unit No. 2 which will provide a continuous and permanent record over the full range of primary system pressure and temperature.
The sensing and recording equip-ment will be in service during startup and shutdown operations as well as during long periods of cold shutdown operations.
We find this implementation to be acceptable.
V 3.3.1.11 Disabling of Non-Essential Components During Cold Shutdown The staff position requires the de-energizing of SIS pumps and closure of SI header / discharge valves during cold shutdcwn operations.
A description of the disabling of non-essential components during cold shut-down follows:
3.3.1.11.1 Inadvertent SIS Activation The plant cooldown procedure requires that the high pressure safety in-jection pumps be de-erergi:ed with the breakers in the rack down position price to decreasing the reactor coolant system temperature below 190 F.
In addition, it is required that the cump discharge valves cr tne header isolation valves be closed with the breakers in the OFF cosition. The surveillance procedures which specify the integrated emergency core cool-ing system tests will require that the reactor vessel head be removed or a bubble be formed in the pressurizer prior to Phasing in the HPSI pumps.
The safety injection tank isolation valves are closed wnen the RCS pres-
. sure decreases below 1750 psig.
f The only circumstance for which the HPSI pumps and the discharge valves will not be isolated and de-energized will occur during the planned in-However, the potential for tegrated emergency core cooling system test.RCS overpressurization since either (1) a pressurizer bubble will be required, or (2) the re-actor vessel head will be removed prior to phasing in the SIS equipment.
The HPSI pump breakers are located in the 4160 volt switchgear rooms.
The flow control valve breakers are located on the upper three eleva-tions of the auxiliary building. All pump and breaker controis are 10-cated on the main control boards in the control rocm.
We find this systern to be acceptable.
3 3.3.1.11.2 Inadvertent SDC Isolation In tne shutdown cooling system, reactor coolant is circulated using the low-pressure safety injection pumps. The flow path from the pump dis-charge runs through the shutdown cooling normally locked closed valves51-452 and SI-453, through the shutdown cooling heat exchangers, and through normally closed valve SI-657 to the low-pressure safety injec-tion headers. The circulating fluid flows through the core and is re-turned from the reactor coolant system through the shutdown cooling naz-zie in the loop No. 2 reactor vessel outlet pipe. The coolant is return-ed to the suction of the low pressure safety injection pumps through valves SI-651 and 51-652. These valves are interlocked to prevent open-i ing when the reactor coolant system pressure exceeds the design pressure of the shutdown cooling system. Each valve is independently controlled by separate instrumentation channels.
In the case of the subject unit, the shutdown cooling isolation valves (SI-651 and SI-652) are activated when the RCS pressure exceeds 300 psig. The isolation valves are motor-operated valves. The shutdown cooling system contains two relief valves in the suction loop to the low-pressure safety injection pumps. Relief n
valves SI-469 and 51-468 have relief capacities of 5 gpm and 155 gpm re-
{/
spectively. The setpoint pressure for SI 468 is 300 psig.
We find this system to be acceptable.
3.3.2 Conclusion on Electrical Instrumentation and Control The design of the Millstone Unit 2 low temperature OPS in the areas of electrical, instrumentation and control (EI&C) is in accordance with those des 1gn criteria originally prescribed by the staff ano later expanded during subsequent discussions with the exceptions noted pre-viously.
We find the EI&C aspects of the modifications acceptable on the basis that:
(1) the overpressure protection system complies with IEEE Std 279-1971, and seismic criteria as identified in Section 2.0; (2) the system is redundant and satisfies the single failure criterion; (3) the system is tese-able on a periodic basis, and (4) the recommended TS reduce the probability of overpressurization events to an acceptable level. The licensee has installed a PORV Open Alarm (Section 4.4) in each channnel and pro-vided redundant Class IE vital power sources for the pressure and temperature signals (Section 4.5) since both of thes'e two signals are used in the RCS high pressure alarm and both PORY channels.
)
16-3.4 System Testing The Millstone 2 OPS is designed to be capable of being tested to ensure that the input sional to the control systen is correctly transmitted to the valve-operating solenoid. A channel functional test of the instrumentation and control hardware will be conducted once.during each refueling. Chan7el calibration of the pressurizer sensors will be performed once per 18 months. The valve will be tested in accordance with ASME code,Section XI, Subsection IWY.
3.5 Environmental Consideration We have determined that the am'endment does not authorize a change in effluent types or total amounts nor an increase in power level and will not result in any significant environmental impact. Having made this detennination, we have further concluded that the amendment involves an action which is insignificant from the standpoint of envi-ronmental impact and pursuant to 10 CFR 551.5(d)(4) that an environ-mental impact statement or negative declaration and environmental impact appraisal need not be prepared in connection with the issuance of this aniendment.
3.6 Conclusion We have concluded, based on the considerations discussed above, that:
(1) because the amendment does not involve a significant increase in the probability or consequences of accidents previously considered and does not involve a significant decrease in a safety margin, the amendment does not involve a significant hazards consideration, (2) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed. manner, and (3) such activities will be conducted in comoliance with the Cornission's regulations and the issuance of this amendment will not be inimical to the comon defense and. security or to the health and safety of the (q
public.
'j Date: March 23, 1979
1 17 REFERENCES j
l.
U. S. Nuclear Regulatory Comission, Office of Nuclear Reactor Regulation, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff", NUREG-0138, November 1976.
2.
NNECO submittal of " Generic Report Overpressure Protection for Operating CE NSSS", D. Switzer to G. Lear, December 3,1976.
3.
Nku Staff Position on Overpressure Protection, G. Lear to D. Switzer, January 12, 1977.
4.
NRC Request for Additional Information, G. Lear to D. Switzer",
February 2,1977.
5.
NNEC0 Response to Staff Request, D. Switzer to G. Lear,. March 8,1977.
6.
NNECO Response to Staff Request, D. Switzer to G. Lear, March 22, 1977.
7.
NNECO submittal of Specific Plant Report, D. Switzer to G. Lear, June 9, 1977.
8.
NRC Detennined Deficiencies, G. Lear to D. Switzer, July 11, 1977.
9.
NNECO Application for Overpressure Protection and Response to Staff Request, D. Switzer to G. Lear, December 8, 1977.
O-v i
l l
.