ML20235P283

Rept on Pilgrim Station Safety Enhancements

ML20235P283
Person / Time
Site:	Pilgrim
Issue date:	07/01/1987
From:	BOSTON EDISON CO.
To:
Shared Package
ML20235P281	List: ML20235P279 ML20235P283
References
NUDOCS 8707200429
Download: ML20235P283 (114)

Text

.-_ . _ _

i 1

l l

l 1

REPORT ON PILGRIM STATION SAFETY ENHANCEMENTS 1

1 I

l i i

i i

i I

l 1

l July 1, 1987 ffg7200429s7o7og p ADOCK 050002'/3 PDR i

--" - - - - - - _ . - _ _ _ _ . _ _ , _ _ _ , _ _ _ _ _ _ _ _ .]

l.0 INTRODUCTION i 1.1 Purpose of Report 1.2 Scope of Report 1.3 Safety Enhancement Program Goals 1.4 Safety Enhancement Program Plant and Operational Changes '

i 2.0 OVERVIEH OF SAFETY ENHANCEMENT PROGRAM 2.1 Background q 2.2 Safety Enhancements

3.0 DESCRIPTION

OF SPECIFIC PLANT SAFETY ENHANCEMENTS l

3.1 General Considerations 3.2 Installation of a Direct Torus Vent System (DTVS) 3.3 Containment Spray Header Nozzles 3.4 Additional Sources of Hater for RPV Injection and Containment Spray 3.5 Diesel Fire Pump for RPV Injection and Containment Spray l 3.6. Diesel Pump Fire Pump Fuel Oil Transfer System 3.7 Backup Nitrogen Supply System 3.B Blackout Diesel Generator Including Protected Installation ,

Facilities i 1

3.9 Automatic Depressurization System Logic Modifications 3.10 Addition of Enriched Boron to Standby Liquid Control System j 3.11 ATHS Feedwater Pump Trip 3.12 Modifications to Reactor Core Isolation Cooling System Turbine Exhaust Trip Setpoint 3.13 Additional ATHS Recirculation Pump Trip

4.0 DESCRIPTION

OF OPERATIONAL PLANT SAFETY ENHANCEMENTS

5.0 CONCLUSION

S

1 i

1.0 INTRODUCTIQM l 1.1 PURPOSE OF REPORT The purpose of this report is to describe the improvements Boston Edison Company (BECo) has voluntarily elected to implement under its Safety Enhancement Program (SEP). This report concentrates on the hardware change elements of the SEP. The procedural and personnel training elements of the SEP will be described in a 3 subsequent revision of the report.

i I

i l

l l

I l

l l

i I

l.2 SCOPE OF REPORT I The report describes the bases for and elements of the SEP and examines each of the plant design and operational changes.

Section 1 provides a summary of the SEP goals and a list of the physical and operational plant changes.

Section 2 provides a brief overview of the Safety Enhancement Program including its underlying philosophy.

Section 3 gives an in-depth review of the physical plant design changes improvements in the program, including:

1. The objective or reason for the change.

2. A description of the change.

3. An evaluation of each change relative to current plant configuration and safety commitments.

Section 4 will be provided in a subsequent revision to this report. It will describe in detail the plant operational enhancements.

Section 5 is a summary of the report conclusions.

o i

4

> . l e

l.3 SAFETY ENHANCEMENT PROGRAM GOALS The specific goals of the program are:

NEAR TERM G0ALS o Identify and implement plant improvements responsive to NRC Draft BWR Containment Policy; o Revise Emergency Operating Procedures and train personnel to improve operational readiness; and o Ensure effective use of plant capabilities in the event of an accident.

LONG TERM GOALS o Perform a comprehensive safety assessment supported by deterministic and probabilistic analyses of severe accidents.

to ensure that:

The Pilgrim plant specific response to severe accidents is well understood; These insights are effectively used within the Boston Edison Company to reduce the probability and consequences of a core damage accident; and These insights are available in support of Emergency Preparedness planning.

The program employs the following elements:  ;

o A team of expert contractors was used to provide. technical issue support and recommendations as to which improvements would be most effective, o Consideration of both core damage prevention and citigation was used in the selection of safety enhancements.

o The new design features were developed and applied without impacting existing safety functions.

o The program integrated both the design changes and the operational improvements. The resultant changes are comprised of hardware, procedures and training improvements.

o The program also encourages and maintains interaction with related activities of IDCOR and the BWR Owners' Group. 1 I

I l

i

l 1.4 SAFETY ENHANCEMENT PROGRAM PLANT ANQ_0PERATIONAL CHANGES The plant and operational enhancements are:

1 Physical Plant Chanaes

1. Direct Torus Venting System

2. Containment Spray Header Nozzles

3. Additional Sources of Hater for RPV Injection and Containment .,'

Spray

4. Diesel Fire Pump for RPV Injection and Containment Spray

5. Diesel Fire Pump Fuel Oil Transfer System

6. Backup Nitrogen Supply System

7. Blackout Diesel Generator including Protected Installation Facilities-

8. Automatic Depressurization System Logic Modifications

9. Addition of Enriched Boron to Standby Liquid Control System

10. ATHS Feedwater Pump Trip

11. Modifications to Reactor Core Isolation Cooling System Turbine Exhaust Trip Setpoint-

12. Additional ATHS Recirculation Pump Trips Operational Plant Chanaes This information will be provided in a subsequent revision to this report.

/

l i

2.0 DVERVIEW OF SAFETY' ENHANCEMENT PROGRAM

2.1 BACKGROUND

The capability of nuclear power plants to withstand severe accidents has been under study for more than two decades. The consensus of analysts who have studied these issues is that the design features of US commercial light water reactor power plants, including Boiling Water Reactors (BHR's) with Mark I type containments such as Pilgrim Station, provide adequate protection of the health and safety of the public. The conclusion of these efforts is best summarized in the Nuclear Regulatory Commission's Severe Accident Policy which found that existing plants pose no undue risk to public health and safety.

Recer.tly, tnere have been some new concerns raised about the consequence mitigation capability of Mark I containments following the extremely unlikely occurrence of a severe accident. This is mainly concerned with the timing of accident sequences and the.

recovery actions. The Boston Edison Company, because of the importance of these questions, its strong commitment to protect the public health and safety, and its desire to enhance public and regulatory confidence, has, at its own initiative, undertaken a Safety Enhancement Program (SEP) to examine these and other concerns. One of the important goals of the SEP is to evaluate plant specific conditions or functions that are important to minimizing public risk, and then implement improvements in plant design, operating procedures, and operator training that will:

1. Reduce the probability of core damage events, and/or

2. Improve the capability of containment to mitigate offsite consequences should a core damage event occur.

In addition, Boston Edison has been performing a longer term safety re-assessment of the Pilgrim Station. This re-assessment, or Individual Plant Evaluation (IPE), examines how accidents leading to core damage might possibly occur at the plant, and the capability of the plant design and the effectiveness of the emergency operating procedures to prevent these accidents. I The Pilgrim IPE will be performed using the IPE Accident Sequence Methodology developed by the Industry Degraded Core Rulemaking Program (IDCOR). This methodology has been reviewed by the NRC, and in BECo's view, provides a sound basis for performing evaluations of plant specific vulnerabilities to severe accidents.

The IPE will utilize the tools of Probabilistic Risk Assessment to structure a systematic evaluation of the plant's systems, operating procedures and maintenance practices. The important results of the Pilgrim IPE will include:

1 o Identification and understanding of the accident sequences J that could lead to core damage; 1

I

o Identification of any unique vulnerabilities to core damage that may trarrant further corrective action; l o Identification of opportunities for improving safety or j operation of the plant; and o Estimation of the likelthood of a core. damage event at the Pilgrim Station.  !

The SEP modifications currently planned were selected based upon extensive although still preliminary analyses and qualitative engineering judgments. Final quantitative analysis must, in accordance with the stated long term goal of the SEP, await final i identification of modifications and completion of the IPE. BECo-understands that the NRC intends to issue later this year a generic letter requiring all plants to perform an IPE as part of the closure of the Commission's Severe Accident Policy Statement. When that requirement is issued, BECo expects to complete the IPE and promptly make the results available in accordance with the review process prescribed by the generic letter. s 1

l l

I 1

i l

2.2 SAFETY ENHANCEMENTS The safety enhancement measures that are currently identified for implementation fall within the categories of: (1) emergency power; (2) core and containment decay heat removal; (3) containment 1 hydrogen control; (4) containment sprays; (5) containment wetwell I venting;. (6) procedural changes; and (7) personnel training. These measures are discussed below.

Emergency Power.

1 In addition to offsite sources of AC power from our grid system, 1 Pilgrim currently has two highly reliable standby emergency diesel generators on site. Either of these diesel generators is adequate to supply emergency AC power for those safety systems (including.

core cooling and containment heat removal) required for licensing basis accidents.

However, Boston Edison will. install a third onsite emergency diesel generator to further improve the reliability of AC power supplies.

for plant safety systems, thus further reducing the probability of a station blackout event. .This will reduce the potential for' severe accidents which involve both core damage and loss of contair. ment heat removal capability due' to the loss of current normal and emergency power sources.

Core and Containment Decay Heat Removal New core and containment decay heat removal capability will be realized through the incorporation of: 4 (a) Redundant diesel engine driven fire water pumps that supply fire water to the core sufficient for decay heat removal using the safety relief valves to discharge steam to the suppression pool at low reactor pressure conditions, and (b) Capability to vent steam from the suppression pool to the i atmosphere via the main stack sufficient to remove containment ,

decay heat and maintain primary containment below its design pressure.

The new decay heat removal capability provides the plant operators with increased flexibility and time to avoid any core damage events and to recover successfully from a wide variety of potential plant damage state conditions including major and multiple equipment- ,

failures.

Containment Hydroaen Control If a severe accident involving core damage by overheating were to-occur, hydrogen would be generated as a consequence of an oxidation reaction between high temperature steam and the metal cladding containing the reactor fuel. If sufficient oxygen is present and certain thermodynamic conditions were satisfied, hydrogen i

)

1

i combustion could occur resulting in increased temperature and {

pressure in containment. The objective of hydrogen control i measures is to minimize the possibility that combustion could occur by reducing the availability of oxygen in the containment.

Currently the Pilgrim containment is normally nitrogen inerted when the plant is at power. Hence, in the event of a severe accident, oxygen would not be present in the containment. However, the Technical Specifications do allow operation for a limited period with the containment deinerted, typically 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after startup 1 and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before shutdown. Boston Edison will implement administrative controls to further limit the time the containment will be deinerted during shutdown. j To further ensure a reliable supply of nitrogen to maintain the containment in an inerted condition throughout potential plant transients, Boston Edison has committed to augment the present plant nitrogen supply with two backup sources: (1) 20 nitrogen i bottles that will supply nitrogen upon detection of low instrument supply pressure, and (2) a 6000 gallon liquid nitrogen tank with vaporizers that can be manually aligned to supply nitrogen for both containment inertion and instrument control.

Another relevant consideration, the control of oxygen ingress into containment, will be addressed by modifying the instrument nitrogen supply for drywell instrumentation. Currently, the backup I pneumatic supply to these instruments is compressed air. Hence this represents a potential for introducing oxygen into the containment should a supply line in containment leak or fail. With the addition of the two additional nitrogen supplies, the instrument air backup to all drywell instruments will no longer be required, and will be isolated from containment by locked closed  !

manual isolation valves. '

Containment Soravs ,

Containment sprays can be used for containment temperature and pressure control for a wide spectrum of postulated accidents including design basis accidents. Under severe accident conditions, the containment spray system also has several important functions. These include:

o Reducing the pressures and temperatures of the containment atmosphere by condensing steam and cooling non-condensible gases.

o Removing fission product aerosols that are suspended in the containment atmosphere.

o Quenching overheated core debris and removing the decay heat from material that may be present on the floor of the containment in the unlikely event of reactor vessel failure.

i New containment spray capability will be provided with redundant I

diesel engine driven' fire water pumps that supply fire water to the i containment spray header to ensure the capability for primary I

containment temperature and pressure control, drywell fission product scrubbing and core debris cooling.

The containment spray flow rate has been redesigned to optimize its use under severe accident conditions and to provide the operator with significantly greater operational capability than is permitted by the current Emergency Operating Procedures.

The design optimization and new improved reliability of the containment spray function using the new system provides the plant operators with increased flexibility to mitigate the consequences of a wide variety of potential core damage scenarios.

Containment Hetwell Ventina Torus or wetwell venting represents an important means of minimizing risk to the public for event sequences involving a loss of containment heat removal capability (including loss of RHRS and SB0 events). The vent can be used to control. containment pressure (prevent containment overpressure) and remove decay heat in the unlikely event that neither of the two redundant containment heat removal systems are available. This would result in the prevention of core damage for a number of important event sequences.

This vent will be an eight inch pipe that will direct gas from the wetwell gas space to the exhaust stack bypassing the Standby Gas Treatment System. Key-locked switches will be used to control operation of the valves in the torus vent pathway. This will prevent inadvertent opening, or unauthorized use of the vent pathway during normal operation or accident events.

It is important to note that these enhancements were preceded by torus improvements implemented during previous refueling outages. ]

The earlier improvements to the Pilgrim torus were undertaken to 1 increase .its strength and to provide additional design margins for loss of coalant type accidents.

Procedural Chances This information will be provided in a subsequent revision to this report.

]

j

-l l

i

___._-__-_ _____ - - - - _ A

l

\

l Trainina  !

This information will be provided in a subsequent revision to this report.

i t

l 1

)

i l

1 i

_ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - __ _ _. . _ _ i

3.0 DESCRIPTION

OF SPECIFIC PHYSICAL PLANT SAFETV ENHANCEMENTS 3.1 GENERAL CONSIDERATIONS The major safety enhancement program plant and operational changes listed in Section 1.4 includes twelve physical plant changes which will be described in detail in this section. The operational plant safety enhancements will be described in detail in Section 4.0.

{

The physical plant changes enhance the plant's ability to orevent or mitigate severe accident scenarios including: Anticipated  ;

Transients Withnet Scram (ATHS); Loss of all Decay Heat Removal  ;

Capacity (.DHR); Loss of all AC Power - Station Blackout (SBO)). j None of the physical plant ci.anges increases the probability or consequences of a design basii accident. To the contrary, all of the changes will result in a reduction in the frequency of core melt scenarios or an improvement in the performance of the containment response.

The succeeding discussion will address each of the following factors for each major design change.

1. Objective

2. Description

3. Evaluation (a) Systems / Components Affected (b) Safety Functions of Affected Systems / Components (c) The Potential Effects on Safety functions (d) Analysis of the Potential Effects on Safety Functions (e) Summary Statement of the Evaluation Conclusions l

l 1

i

i 3.2 LNjTALLATION OF A DIRECT TORUS _yENT SYSTEM (DTVQ l 3.2.1 Obiective of Desian Change .

This design change provides the ability to address one of the severe accident concerns by direct venting of the torus to prevent primary containment over-pressurization during an extended station blackout. Containment venting is one core damage prevention strategy utilized in the BWR Owners Group Emergency Procedure Guidelines (EPGs) as i previously approved by the NRC and is considered  !

important for plant-specific Emergency Operating l Procedure (EOPs). The torus vent-line connecting the torus to the main stack will provide a flow path for relieving excessive pressure generated during a s'evere accident. For 56 psi saturated steam conditions in the torus, approximately 1% decay heat can be vented.

3.2.2 Desian Chance Description This design change (Figure 3.2-1) provides a direct vent path from the torus to the main stack bypassing the Standby Gas Treatment System (SBGTS) equipment on the torus purge exhaust line. The bypass is an 8" line whose upstream end is connected to the pipe between primary containment isolation valves A0-5042 A & B. The downstream end of the bypass is connected to the 20" main .

stack line downstream of SBGTS valves A0N-108 and J A0N-112. An 8" butterfly valve (AO-5025), which can be  ?

remotely operated from the main. control room, is added downstream of 8" valve A0-5042B. This valve acts as the primary containment outboard isolation valve for the direct torus vent line. The new pipe is ASME III Class 2 up to and inclusive of valve A0-5025. Test connections are provided upstream and downstream of A0-5025.

The proposed change replaces the existing AC solenoid valve for A0-5042B with a DC solenoid valve (powered from essential 125 volt DC) to ensure operability during a station blackout. The new isolation valve, A0-5025, is also provided with a DC solenoid powered from the q redundant 125 volt DC source. Both of tnese valves fail  ;

closed. One inch nitrogen lines are added_to provide backup nitrogen to valves A0-5042B and A0-5025. The present logic of A0-50428 is being modified to override containment isolation signals by keylock remote manual action. New valve A0-5025 closes on containment isolation signals but is provided with the same isolation override control logic as A0-5042B. When 5025 and 50428 i are in the containment isolation bypass mode, a separate '

logic has been added to re-isolate both valves if there is a high radiation level in the torus l

vapor space. This high radiation isolation can also be overridden by the operation of a remote manual action keylock switch. Controls are arranged so that the valves j will not automatically reopen when isolation signals '

reset without operator action. Cable and conduit for j redundant valves are separated to prevent single failure from affecting both valves.

l A 20" pipe will replace the existing 20" diameter duct between SBGTS valves A0N-108, A0N-112 and the existing 20" pipe to the main stack. The existing 20" diameter duct downstream of A0-5042A is shortened to allow fitup of the new vent line branch connection.

A rupture disk will be included in the 8" piping downstream of valve A0-5025. The rupture disk will provide a second leakage barrier. The rupture disk is designed to open below containment design pressure, but  ;

will remain intact during design basis conditions. ]

The purpose of the vent is to relieve excess containment pressure, remove decay heat and prevent premature containment failure. Use of the vent will be under management control and would require that the keylock switches for operation of the A0-50428 and A0-5025 valves

)

be placed in the Emergency Open Position to override the ,

containment isolation signal which would be present if the containment was at high pressure. Prior to opening the vent valves the SBGT system would have to be shutdown and valves A0N-108 and A0N-112 (the outlet of SBGT) placed in a closed position. If there ir high radiation l in the torus vapor space A0-5042B and A0-$')25 will reisolate. This isolation signal can be overridden by the second set of manual keylock actuated switches if venting is to continue.

New 8" vent pipe (8"-HBB-44), including the butterfly valve, is safety related. Vent piping downstream of the valve, including SBGTS discharge piping to main stack, is also safety related. All safety related piping will be supported as Class I. Nitrogen piping is non-safety related and will be supported as Class II/I.

The interpretation of the Class II/I designation through this report is given below:

All Class II items which have the potential to degrade the integrity of a Class I are Q-safety related and are analyzed for seismic forces of the safe shutdown earthquake (SSE). Such Class II items do not require dependable mechanical or electrical functionality during SSE, only that all of the following conditions prevail:

1. The Class II items creates no missiles which impact unprotected Class I items safety functions.

2. The Class II item does not deform in a way which would degrade a Class I item.

.3. Any' credit: for armoring of Class I items. is defended for the full impact of all missiles generated by the assumed failure of Class II items.

All electrical portions of this design are safety related 4 except for the indicating lights on the MIMIC panel C904, the tie-ins to'the annunciator, and the interface with the plant computer.

3.2.3 Desian Chance Evaluation 3.2.3.1 Systems /Comoonents Affected i Containment Atmospheric Control System (CACS)

The torus purge exhaust line inboard isolation valve A0-5042B and the associated 8" pipe are the components of the CACS affected by this  !

proposed modification. With incorporation of the subject modification, the CACS will depend on both essential AC (for valve A0-5042A) and essential DC (for A0-50428) to perform its purging function.

The new 8" torus vent line will be connected to existing 8" CACS piping between valves A0-5042B and A0-5042A. {

Standbv Gas Treatment System (SBGTS)

The SBGTS fan outlet valves (A0N-108 and i A0N-112), ductwork from these valves to the 20" l i

line leading to the main stack, and the 20" )

line leading to main stack are the components )

of this system affected by the proposed change.

l Valve A0N-108 is normally closed, fail-open.

l Valve A0N-112 will be revised to be normally closed, fail-closed, and these valves will be provided with essential DC power and local safety related air supplies.

Primary Containment Isolation System (PCIS)

This system is affected by the modification to containment isolation valve A0-5042B logic.

The addition of containment outboard isolation valve (AO-5025) and associated controls will 1 also affect the PCIS. i

\

3.2.3.2 Safety Functions of Affected Systems /Comoonents i Containment AtmMylu'ric Control System i This system has the safety function of reducing the possibility of an' energy release within the primary containment from a Hydrogen-Oxygen reaction following a postulated LOCA combined ,

with degraded Core Standby Cooling System.

i I

Standbv Gas TreatmentJvstem This system filters exhaust air from the reactor building and discharges the processed air to the main stack. The system filters particulate and iodines from the exhaust stream in order to reduce the level of airborne contamination released to the environs via the main stack. The SBGTS can also filter exhaust air from the drywell and the suppression pool.

Primary Containment Isolation System This system provides timely protection against the onset and consequences of accidents )

involving the gross release of radioactive -l materials from the primary containment by. I initiating automatic isolation of appropriate 1 pipelines which penetrate the primary '

containment whenever monitored variables exceed pre-selected operational limits. j

(

Primary Containment System l

The primary containment system, in conjunction with other safeguard features, limits the I release of fission products in the event of a postulated design basis accident so that offsite doses do not exceed the guideline ,

values of 10 CFR 100. l 3.2.3.3 Potential Effects on Safety Functions Containment Atmospheric Control System. Standby Gas Treatment System. and Primary Containment Isolation System The improvements change the solenoid A0-5042B control from AC to DC enabling it to open (from its normally closed position) when required even during extended station blackout.

Ductwork at the outlet of the SBGTS is replaced with pipe and the new vent line _is connected to the 20" line at the outlet of the SBGTS.

Addition of a new 8" vent line with containment isolation valve A0-5025 off the torus purge and vent line could have the potential of introducing a flow path that could vent the containment directly to the stack bypassing the SBGTS.

4 I

New logic is being added that allows override j of the containment isolation signal on existing  ;

valve A0-5042B and provides the same logic for valve A0-5025. This could have the potential of allowing venting of the containment directly to the stack. This could allow bypassing of the SBGTS. It potentially could also subject the SBGTS to high containment pressure if venting was directly through it.

3.2.3.4 Analysis of Effects on Safety Functions.

]

An analysis of the effects on the safety  !

functions of CACS. SBGTS, and PCIS for the i installation of the direct torus vent is described as follows:

The change from AC to DC control on A0-5042B-does not adversely affect the ability to open l A0-50428 when the containment is being purged, or to isolate under accident conditions'

! The modifications to the ductwork and 20" line 1aading to the main stack do not affect the safety function of any of the safety related systems.

During norw.1 plant. operation, the CACS and the SBGTS do not use the torus 20" purge and vent line to perform their safety functions. The containment isolation valves are in their normally closed position, satisfying the safety function of the PCIS.

There are no adverse affects on the primary containment system by the addition of the ,

DTVS. The effects on the torus of the new 8" l l

piping have been evaluated for Mark I program  ;

loadings, using ASME BPVC Section III l criteria. The remaining piping was evaluated using ANSI B31.1.

During plant startup and shutdown (non-emergency condition) when the purge and ,

vent line is in use, the logic does not allow  !

A0-5025 to open unless A0-5042B is closed.. In I addition, a rupture disc downstream of valve .

A0-5025 will provide a second positive means.of preventing leakage and prevent direct release.

up the stack in the event of a single failure 3 of A0-5025 during containment purge and vent at l plant startup or shutdown. l 1

During containment high pressure conditions, the CACS does not use the torus main exhaust line to communicate to the SBGTS for performing its safety function. The existing CACS logic cannot override.the containment isolation signal to open valve A0-5042A. A single failure of A0-5042B logic would still protect the SBGTS from high pressure because A0-5042A, and A0-5025 would still be closed. . Valve A0-5025 and the rupture disk downstream would-also prevent any inadvertent discharge up the stack.

3.2.3.5 Design Chanae Evaluation Summary Conclusions DTVS installation does not adversely affect the safety functions of the CACS, SBGTS, PCIS, or any other safety related systems.

l 1

j i i

_ _ _ _ _ _ __._ _ _____ _.__._ _ _ ____ __ _ _ ______ _ ____.___.___._ ____.________._-________ __________m____ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ . _ __ _ _ . . _ _ _ _ _ _ _ _ _ _ _

l .I .

r MoGW 7 _

E

^

2C N C M

U v//g R

/

' y,

,0 2

' A /j

/

~ , <

~ '<

Il '

3 I d '

/

j E

/ P

, / I

/ 2 P 1

,OF O 1 O C A I A F T 0 C

, 1 U D

M

" G E E 8 T N P T

[/,

I G

I

, T P S ,

B SW Y S I

X E S E N

/

T 1

, /

N 2 , / _

E . /

V 3 , O A

O A

S E I

U R T_-

R U , C _

O G U

, D .

T I

,5 A _

i2 2 O T F 4 _

^ 0 A C ,5 -

'5 0 EP I

r g r E E E

, j ' d '

8 R DD AI ' D - I 2 P_- _ -

I R RW ES 8" O IRW I ' iI g O A

4 0

D I V *lESV 5

HO O -

0

\ -

L L

2 E

^

mW _

J. T L E W

L Y L _

R E m .  !

DW

, 8I

(

x ..

l l; '1lfl1L

3.3 CONTAINMENT SPRAY HEADER N0ZZLES 3.3.1 Obiective of Desian Chanae The new containment spray header nozzles are designed to optimize the use of containment drywell spray under severe accident conditions and to provide the operator with significantly greater operational capability than is permitted by previous Emergency Operating Procedures.

The design change for replacement of the containment spray header caps / nozzles is related to the following SEP plant changes:

1. 3.4 Additional Sources of Water for RPV Injection and Containment Spray

2. 3.5 Diesel Fire Pump for RPV Injection and Containment Spray

3. 3.6 Diesel Fire Pump Fuel Oil Transfer System 3.3.2 Desian Chance Description This design change (Figure 3.3-1) replaces the 104 upper and 104 lower containment spray header nozzles inside the drywell. The torus spray header will remain as is.

The replacement nozzles are identical to the existing nozzles except that the replacement 1-1/2"-7G-25 Fogjet nozzles have one open spray cap and six blanked off spray caps, whereas the existing 1-1/2"-7G-25 Fogjet nozzles have all seven caps open. The new nozzles have the same classification as the existing nozzles; no system boundaries are revised.

Replacing the nozzles will reduce the capacity of the drywell spray system for all containment spray modes during a design basis loss of coolant accident (LOCA) and a design basis small steam line break. The reduced drywell spray capacity will provide increased operational flexibility and permit containment spray operation over a w!'er range of containment temperature pressure conditions.

Calculations were performed to determine flows through the replacement nozzles for various severe accident and LOCA operating modes. For a LOCA, the calculations considered one RHR pump supplying water to the upper I containment spray header nozzles. The results of the calculations were used as input to an analysis of the RHR containment spray flow which concluded that the calculated spray flow of 543 gpm would maintain the drywell structural and atmospheric temperatures below the design limits of 2810F and 3400F, respectively.

i

These two analyses confirm that replacing the drywell spray header nozzles will not prevent the containment spray. system from maintaining the design temperatures in the drywell during a LOCA and, therefore, maintaining the design basis of this mode of the RHR system.

This change also has an effect on the small steam line break accident. The operator can use the containment spray to mitigate this accident as described in the FSAR. The reduced flow will again minimize the possibility of damaging the containment structure by 4 sudden decompression following the' initiation of containment spray. For this design basis accident the RHR heat exchangers must maintain design flow to assure adequate heat removai from the suppression pool. To accomplish this, the torus spray bypass line must be throttled to maintain design flow through the RHR Heat Exchangers.

The reduced spray flow also reduces the risk of containment structural damage from an inadvertent' spray initiation into a hot dry atmosphere.

This improvement poses no new loads on the piping system and, therefore, need only comply with the existing seismic design, including support design.

3.3.3 Desian Chance Evaluation-3.3.3.1 Systems. Subsystems. Comoonents Affected The system that is directly affected by the change is the Residual Heat Removal System (RHRS).

The subsystems that are directly affected by the change are the drywell spray, the torus spray and the RHR suppression pool return valve. The torus spray flow will be affected j only slightly, and the suppression pool return 1 valve needs to be open during containment spray {

so that rated flow through the RHR heat '

exchanger will be maintained.

The components that are directly affected by the change are the RHR Drywell Spray Header caps. Six of the seven spray nozzles are blanked off.

The systems that are indirectly affected by the change are the torus-to-containment vacuum breaker system and the reactor-building-to-torus vacuum breaker system. The response time of the vacuum breakers is affected by the reduced drywell spray flow.

{

l

_A - _-----_--- - - - - - - _ - _ _ - - - - - - - - _ _ - - - - _ - , - . -

3.3.3.2 Safety Functions of Affected Systems /Comoonenti Residual Heat Removal System The RHR cools the suppression pool water and provides for containment spray cooling. It is used for a wide range of postulated LOCAs as well as MSIV closure, struck open relief valve, and alternate shutdown events. Impact on previous safety analyses is limited to those events that utilized the containment spray mode of the RHR operation (FSAR Figures 5.2-2 to 5.2-7).

Drvwell Sorav and Torus Sorav Subsystem The Drywell Spray Cooling subsystem provides water.to spray header systems located in the drywell and suppression chamber. Under post-accident conditions water pumped from the suppression pool through the heat exchanger may be sprayed into the drywell and the suppression chamber to remove the energy associated with the steam in these regions. The containment

' spray is used for a wide range of LOCAs.

Impact on previous safety analyses is limited to those events that utilized the containment spray mode of the RHR operation (FSAR Figures 5.2-2 to 5.2-7).

Containment Vacuum Breaker Systems The safety function of the vacuum breakers is to equalize the pressure among the drywell, suppression chamber and reactor building so q that the structural integrity of the containment is maintained (FSAR Section 5.2-3.6). For accidents such as those {

presented in FSAR Figures 5.2-2 through 5.2-7, a reduced drywell spray will mean a lower rate l of drywell depressurization, resulting in l delayed opening of the vacuum breakers. This {

delay is included in the analyses described  !

below and has no deleterious consequences.  ;

3.3.3.3 Potential Effects on Safety Functions Drvwell Response l

The effectiveness of the reduced drywell spray in controlling drywell temperature for small break LOCAs needs to be evaluated. l RHR Heat Exchanaer Efficiency Because of the reduced drywell spray flow, the heat removal capacity of the RHR heat exchanger when operating the RHR system in the containment spray mode needs to be evaluated.

3.3.3.4 Analysis of Effects on Safety Functions Effect on Drvwell Resoonse TheFSARcontainmentresponsewasre-analyzeg for break sizes ranging from 0.02 to 0.5 ft.

assuming the reduced containment' spray was initiated 30 minutes after containment pressure reaches 10 psig. It was determined that a containment spray flow rate of 300 gpm is sufficient to reduce the airspace temperature to below 281*F for all break sizes analyzed.

Holding airspace temperature below 281*F eliminates the driving force for the wall temperature to exceed 281*F, the design temperature of the containment liner.  !

The containment spray flow with the proposed design, with one header operating, has'been calculated to be 543 gpm when the suppression pool bypass valve (1001-36A, B) is open with total RHR flow limited to 5000 gpm and 1150 gpm when the valve is closed. The containment spray from one header will deliver sufficient I flow to maintain the design temperatures in the drywell during a LOCA.

Effect on RHR Heat Exchanaer EfficQnty When operating the containment spray, the operator will be instructed to open the RHR suppression pool bypass valve (1001-36A, B) so that rated flow through the RHR Heat exchanger will be maintained. This ensures that the heat-removal capability throurq the heat exchanger will not be rdduced.

• l

.i I

i s

l 4

3.3.3.5 Delipn Change Evaluation Conclusiqai

'There are two potential safety issues arising from replacement of drywell. spray header caps:

(1) effect on drywell responses and (2) effect on RHR heat exchanger efficiency. These safety issues were addressed by (1) performing analyses to show that the reduced drywell spray flow will- still maintain drywell atmospheric and structural temperature belcw their -

respective design limits and (2) requiring an-operator action which will be incorporated.into 1 the revised operating procedure to keep the. '

suppression pool bypass valve open while operating in containment spray mode in order to maintain rated RHR flow through the heat exchanger.

l 3

I

. =

CONTAINMENT SPRAY a HEADER NOZZLES -

r clGURE 3.3-1 "

eM/##

THE SIX OUTER C APS ON THE SPRAY  ! [1 1

NOZZLES ARE PEPLACED WITH SIX I dl BLANK CAPS ,

= I -

, Z a#- ## 9,s l If N.R 7(F~), yot*' ,a 3

l \'- yAAf i f Ipipe mountes on

=

i d 5 --.s 4 I I t t ' 17 '

W . _ _

3' s a

~ ,-ld V/

L4 lA;---

-J h

}

r%'Kr ,

j 'j blan)drd cu.us v \ D Cy8# pe tt le-H,.gr l ,) (0 4'ar j h -7G ZS ft3;7.!CT EE't.E

};~CM OC/~A/t S oAJ /f -7G ZS R>G.!CT Ezt.A 3CK INDUSTRIAL CATALOG ~

or.SCRIPTION OPRAYING SYSTEMS C0.

'/?t - 7G ES

/ cG /CT*VOZZ4f QM&

wonTw Avrwut AT ocwedALE noAm wwzAtom. ILL.

ost. sY 4. M. DWG. NO.

DAtt 2 72 _

o

-24A-

3.4 ADDITIONAL SOURCES OF HATER FOR RPV IN;!ECTION AND CONTAINMENT SPRAY 3.4.1 Obiettive of Desian Chance The purpose of this design change is to provide redundant  !

and diverse water sources that are not dependent on AC power for containment spray or vessel injection for extended station blackout and severe accident scenarios beyond design basis. In addition, this change provides additional redundant sources of water for pumping to the

. containment drywell spray. header, torus spray header and/or for RPV injection. Those new water sources available for pumping are the fire water storage tanks via diesel fire pump P-140 or driven fire pump P-135 and )

city water via the new SEP diesel fire pump P-179. The  !

original design basis torus water is also available via RHRS pumps P-203A, B, C and D .

The design change for the piping to connect'P-140, P-135  !

and the new diesel fire pump to the RHR containment spray i header and torus spray header is directly related to the following SEP plant changes:

1. 3.3 Containment Spray Header Nozzles ,

2. 3.5 Diesel Fire Pump for RPV Injection and l Containment Spray

3. 3.6 Diesel Fire Pump Fuel Oil Transfer System 3.4.2 Desian Change Description This design change (Figure 3.4-1) will include the installation of a piping crosstie between the Fire Protection System (FPS) and the Residual Heat Removal System (RHRS). The crosstie will allow water from fire pumps P-135 and P-140 and the new diesel fire, pump P-179 to flow to the RHR. The crosstie connects the 8" FPS header at floor elevation 23'-0" with the 12" RHR Salt Service Hater injection line at floor elevation 3'-0", in the Reactor Auxiliary Bay. The crosstie consists of approximately 90 feet of 8"-KB pipe and associated fittings, pipe supports, one locked closed gate valve, removable section of pipe and approximately 4 feet of 8"-GBB pipe and associated fittings, pipe supports, one gate valve and one check valve. The gate valve in the KB' piping is for FPS isolation; the gate valve and check valve in the GBB piping are for RHR isolation.

The removable pipe section is 16" in length with an internal strainer-and is located between the FPS and RHR isolation valves. It is installed and removed with quick disconnect Victualic couplings. The removable pipe section will be stored nearby in a locked cabinet when not in use. Also, the isolation valves will be locked

__ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ U

closed. When the removable pipe section is not in use.

the connecting piping ends will be capped to prevent foreign material from entering. The caps will be Victaulic caps and will be held in place by the quick-disconnect couplings used to connect the removable pipe section.

The FPS isolation gate valve will have a 3" bypass line around it. The bypass line consists of approximately 9 .

feet of 3" pipe, fittings, pipe supports, a globe. valve, j and an in-line flow meter with a local indicator. The bypass will be used when the water quantity required to remove decay heat has decreased to approximately 300 gpm. All keys for the locked closed valves and the removable pipe section cabinet will be under the control ,

of the watch engineer. A 3/4" vent line with a globe valve will be placed at a piping high point on the KB piping. A 1" drain line with a gate valve will be placed at a piping low point on the KB piping.

A 1" drain line with two gate valves will be placed at a low point on the GBB piping. The drain piping will be ,

routed to a clean radwaste drain in the reactor auxiliary l bay which leads to the reactor building equipment drain sump in the HPCI room. This will allow any leakage of RHR water past the RHR isolation gate valve to be recycled by the Radwaste System.

An emergency lighting unit will be installed to provide sufficient light for the operator to install the l removable pipe section and to monitor the flow meter. #

The firewater and RHR crosstie will only be used for extended station blackouts or other potential severe 1 accidents scenarios that show a benefit from this l additional source of makeup water. ]

The crosstie will have approximately 4 feet of ASME Section III, Class II piping with an ASME Section, Class I gate valve and check valve. The remainder of the i crosstie is designed to ANSI and NFPA standards and is designated Quality Class FPQ (Fire Protection).

i All ASME Section III, Class II piping and valves will be  !

seismically designed and supported. For the ASME l interface with the ANSI /NFPA piping, the ANSI /NFPA piping  ;

will be seismically designed and supported to a seismic boundary anchor. The remainder of the ANSI /NFPA piping will be analyzed II/I.

In addition, this design change calls for the use of the 4" RPV Head Spray line as a flow path for direct RPV injection. The original design for PNPS included a RPV heat spray line originating from 18"-GB-10 on the "A"'RHR loop and terminating in a spray nozzle in the top of the RPV. The head spray line consisted of piping, supports a flow element, a flon control valve, a check valve', two containment isolation' valves, a test connection, electrical power and control logic. Due to water hammer experienced during operation of the head spray line, it was disconnected from the RHR header and the RPV and.

capped. All valves and wiring were left intact and power isolated.

To reduce the potential for water hammer, the new 4"-GBB-10 piping which reconnects the existing piping has been rerouted (approximately 150 ft. of new piping). -In addition, control valve FV-1001-58, flow element FE-1001-85 and transmitter FT-1001-86 are relocated as close as possible to the 18"-GB-10 line. Also, a 1"-GBB-10 bypass line with restriction orifices-is added around FV-1001-58. This will allow a maximum of-75 gpm through the head spray line until it.is pressurized.

During normal plant operation, RHR head spray isolation valves M0-1001-60 and MO-1001-63 remain in the closed position and if opened, will close' automatically'when PCIS signals are present.

During a station blackout or severe accident beyond the plant design basis, the head spray isolation valves must be opened in order to pump water to the reactor vessel.

To accommodate this change, bypass switches are added for each valve to override the PCIS signals. To preclude the possibility of overpressurizing the RHR head. spray piping, the existing logic is modified such that the high reactor pressure PCIS signal will override the bypass circuitry if the reactor pressure is above the setpoint.

3.4.3 D.psian Change Evaluation 3.4.3.1 Systems /Comoonents Affected This design change affects the following systems and structures in the manner cited.

Residual Heat Removal System'(RHRS)

The 12" salt service water line to RHR is affected by this change as the 8" crosstie line with a manual gate valve and check valve is connected to it.

Main Control Room i

The main control room may be affected by the  !

addition of new controls and instruments used i in the operation of the design changes.  !

Primary Containment Isolation System (PCIS)  !

The control of PCIS valving may be affected by the design change.

i

Reactor Buildina - Area 1 Civil structure of the Reactor Building Area 1 is affected by this change due to the installation of the new 4"-GBB-10 pipes including supports, valves fittings, tubing conduit, and associated small piping connecting the 18"-GB-10 header to the RPV.

Reactor Buildina - Auxiliary Bay - Area 2 Civil structure of the Reactor Building Area 2 is affected by this change due to the installation of the new 8" pipe including supports, valves and fittings, connecting the Fire Protection System and the Salt Service Water System.

i Fire Protection System The 8" fire protection line in the Reactor Auxiliary Bay is affected by this change. The 8" crosstie with a manual gate valve and a 3" bypass line with a globe valve is connected to the fire protection line.

3.4.3.2 Safetv Functions of Affected Systems /Comoonents Residual Heat Removal System (RHRS)

The safety function of the Residual Heat Removal System is to provide core cooling in conjunction with other Core Standby Cooling Systems, and to provide containment cooling as required during abnormal operating transients and postulated accidents (Reference FSAR Section 4.8.1).

Primary Containment Isolation System (PCIS)

This system has the safety function of providing timely protection against the onset and consequences of accidents involving the gross release of radioactive materials from the primary containment by initiating automatic isolation of appropriate pipelines which penetrate the primary containment whenever monitored variables exceed pre-selected operational limits.

Main Control Room The safety function of the control room is to provide an area where the operators can control the plant during normal and abnormal conditions. The control room is designed to withstand a seismic event and limit radiological exposure to the operators during 3 an accident. {

Reactor Buildino Area 1 The safety function of the Reactor Building is to limit the release to the environs of radioactive materials so that offsite doses-from a postulated DBA will be below the guideline' values of 10 CFR 100. In addition, the Reactor Building is designed to provide protection for the engineered safeguards and nuclear safety' systems located in the building l from all postulated environmental events including tornadoes (Reference FSAR Sections 5.1.3, 5.3.1).

Reactor Buildino Auxiliary Bay Area 2 This structure has a safety function of protecting the integrity of safety related components and equipment housed in it (Reference FSAR Section 12.2.1.1).

Fire Protection System The Fire Protection System does not perform any safety related function. The Fire Protection System is important to safety because it mitigates the occurrence of equipment damage ,

from a fire that could damage or significantly degrades the capability to safely shutdown the plant.

l 3.4.3.3 Potential Effects on Safety Functions Residual Heat Removal System (RHRS)

The new 8" crosstie line, the normally closed l gate and globe valves, the check valve and the .j associated drain line form a part of the i Residual Heat Removal System pressure boundary l and are required to maintain its design basis  !

integrity.

l The new 1" and 4"-GBB-10 head spray line and normally closed valves form a part of the l Residual Heat Removal System pressure boundary  !

and are required to maintain their design basis  ;

integrity. '

i 1

i l

I

___.____.____.______.__m_____ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ ___ ____ ____._.________.m

Primary Containment Isolation System (PCIS)

The Primary Containment Isolation signals for High Drywell Pressure and Low Reactor Hater Level for containment isolation valves M0-1001-60 and M0-1001-63 might be bypassed through the use of the bypass switches located in the control room.

The replacement of the motor and actuator accessories and drywell cabling for MOV-1001-63 and the rerouting of power and control cables for MO-1001-60 potentially effect the safety function of the PCIS.

Main Control Room The main control room panel 903 is affected by

, the addition of bypass switches for containment i

isolation valves M0-1001-60 and MO-1001-63.

1 i

Reactor Building Area 1 The pipe support installation could have the potential for affecting secondary containment integrity due to the drilling of concrete for pipe support anchor bolts and due to piping loads transmitted to the concrete.

Reactor Buildino Auxiliarv Area 2 Installation of non-safety related components (connecting the Fire Protection System to the Residual Heat Removal System) and the associated pipe supports could have the potential for affecting the integrity of the safety related system housed in this area. The safety related systems could be affected by the non-safety related components during a seismic event if the non-safety related components suffer a structural failure.

Fire Protection System The Fire Protection System does not perform any safety related function. However, the new 8" crosstie line, the normally closed gate and globe valves and the associated vent and drain lines form a part of the Fire Protection System pressure boundary and are required to maintain that boundary as any other Fire Protection System component. The crosstie between the Residual Heat Removal System and the Fire Protection System creates the potential of contaminating the Fire Protection System with radioactive water.

3.4.3.4 Analysis of Effects on Safety E2nctions Residual Heat Removal System'(RHRS)

The new 8" crosstie line, the normally closed manual gate valve and the check valve and the drain valves are designed to ASME Section III, Class II. They are seismically designed and supported. .They are subject to Class 2 ISI.

The design ensures that the modifications meet the design basis criteria of the system.

Hence, the modifications maintain the integrity of the RHR pressure boundaries.

The new 4"-GBB-10 head spray piping and the reused normally closed isolation and control valves (1001-60, 1001-63, and FV-1001-58) are quality category "0". They are seismically designed and supported. The design ensures l

that the changes meet the design basis criteria l of the system. Hence, the modifications maintain the integrity of RHRS pressure boundary and the safety function of the RHRS is not affected by this modification. Fire water will only be used to cool the RPV during a station blackout or other potential severe accident scenarios that show a benefit for this additional source of makeup water.

The rerouting of the head spray piping and the relocation of the FCV and associated bypass line alleviate the previous waterhammer problem and thus, ensure that the pressure boundary of i

the piping and its safety functions remain I

intact.

Primary Containment Isolation System (PCIS)

The addition of keylock bypass switches does >

not affect the safety function of the Primary Containment Isolation System. Under normal operation valve MO-1001-60 and MD-1001-63 will isolate on a group 3 isolation signal. In order to bypass the isolation signal the.

operator will be required to place the bypass switch into the bypass position.

The replacement of the motor, actuator accessories and drywell cabling for MOV-1001-63 with qualified components improves the PCIS.

l The rerouting of power and control cables for )

l MD-1001-60 improves the PCIS by complying with l PNPS Appendix R high-low pressure interface commitments. This prevents the simultaneous opening of both inboard and outboard containment isolation valves from a common area fire. .

i

_ - - - _ _ _ _ -_--___-___--_A

j l- Main Control Roqm The addition of bypass switches to panel 903 does not affect the safety function of the Control Room.

Reactor Buildina Area 1 j i

Concrete drilling for pipe support anchor bolts i will be in accordance with the applicable specifications and PNPS procedures for drilling into safety related walls. This ensures that )

the integrity of the structure is not degraded. Hence, this modification does not ,

affect the safety function of the Reactor i Building.

Reactor Buildina Auxiliary Bay Area _2 The non-safety related components which have the potential for degrading the integrity of J the safety related systems houses in this area-are adequately supported by pipe supports which are analyzed for seismic forces of the safe-shutdown earthquake. These pipe supports are quality "Q". Hence, this modification does not degrade the integrity of any safety related system in the Reactor Building Auxiliary Bay Area 2.

Fire ProtectioD_ System In order to ensure the Fire Protection System pressure boundary on the new 8" crosstie line, the normally closed gate and globe valves and the associated vent and drain line are designated Q (fire protection).

In order to ensure the Fire Protection System l 1s not contaminated with radioactive water during normal operation, a removable spool  !

piece is located in the 8" crosstie. This j spool piece is removed during normal  ;

operation. It will only be placed in the 8" crosstie line when the fire water system is being used as a water source during extended station blackouts or severe accident scenarios i l beyond design basis.

i I

3.4.3.5 Design Chance Evaluation Conclusions This improvement does not call for-the safety equipment of the system to operate at higher pressures, temperature and more severe-conditions _than the existing levels; hence, the modification does not increase the probability-of malfunction of the equipment important to safety.

This improvement is also designed such that the failure of any non-safety related equipment will not degrade the capability of safety related equipment to perform its function.

1 k

Y R R

D D a' \

N wr A [ Q l3 *,

N O

I T s2' 4

_ C wr S LE U

E ER R I J ' ' ' O S E

F N T D N I

I i.' gl2wr'

.* I E h W WV V

_ I W ER ND

_ P 2 "6 f f, r 1

RY .

1' I r A .

.. 3j R

O R' 1 E I F SP  % I

, M

- " T- ,

1 S 8 NO E IN R 4 6S 01 I A R O A E T .

"8 O

R R FIR M RB DIC T N3 AE HP RO [

1 C S TP NH R

E T

m" 1

WME OO', P OGE E G f-4 fk lJ NR TL M U T DMIN M N I

FI U 4 P NLPBIUMI P W L W O TI AG R A AR xQU H P DRES E O T L T F ORE 7 "8 R O SNF OO C E A L HV # R EO TL m" m'/ I P C TL W A E E C C , '

O "3 V "3 TG R a L L O AA U z i l '

WR O P

m" m" ET O

S g

- "O S

)

IRS F

s " -

L y yg 7 *  :

A J /

_ ~

~  :

N N

/L I

O I

E V

T D RI P I DM E U D T A R L

E P

D t E

' O R TE SE B

A T E L CRS L O TE A ER I I I

A VEP A TDO P L DF S RTM U S NS E R E '

O E AU AE G '

TSWP M LA V NTL OV

" OA 8WHCMV

.y*

3.5 DIESB. FIRE PUMP FOR RPV INJECTION AND CONTAINMENT SPRAY 3.5.1 Obiective of Desian Change The purpose of this design change is to provide a redundant water source to the existing diesel driven fire pump (P140) and to the RHRS for containment spray and RPV Injection during extended station blackout and other potential severe accident scenarios (loss of core cooling and containment spray) beyond the current plant design bases. The equipment installed by this change, with the exception of the snclosure's lighting and space heaters, operates independently from normal plant power, the emergency diesel generators and the blackout diesel generator. Required electrical power is from a battery system provided by the fire pump manufacturer.

This design change is part of a series of related SEP plant changes as follows:

i 1

1. 3.3 Containment Spray Header Nozzles

2. 3.4 Additional Sources of Water for RPV Injection and Containment Spray

3. 3.6 Diesel Fire Pump Fuel Oil Transfer System 3.5.2 Desian Change Description l This design change (Figure 3.5-1) involves the addition l

of a new diesel fire pump (SEP diesel fire pump) and associated components consisting of an electric pump, piping, valves, and an enclosure with foundation and lighting.

, The SEP diesel fire pump and components will be installed l in the same location as that of the abandoned construction water fire pump. The new pump enclosure will be offset approximately 2'-0" north and 2'-0" east l from that of the existing pump enclosure location so as

not to interfere with existing electrical equipment which is mounted on the enclosure's west and south walls. To accomplish this, the west and south walls will be left standing while the rest of the enclosure and foundation, along with the abandoned pump, valves and miscellaneous equipment will be removed. The city water tie-in and l existing electric feeds will remain and shall be utilhed as needed for installation of the new equipment.

The SEP diesel fire pump system consists of a Fairbanks Horse pump rated for 750 gpm at 125 psi and equipped'with a 4 cylinder, 3000 rpm,150 hp engine,165 gallon fuel tank, relief valves, instrumentation, engine cooling system, engine exhaust system, engine starting system, and pump controller. The pump controller meets NFPA

requirements for weekly test and startup on 100 header pressure, however, since the fire pump is connected'to the city water system and is isolated from the Fire Protection System during normal operation, the' fire pump is to be operated manually only during a station blackout, severe accident, periodic test, or for fire protection. To accomplish this, the controller will be ]

modified to permit only manual operation. The pump will 1 take suction from city water through approximately 20 i feet of 6" diameter carbon steel and ductile iron I piping. A gate valve is provided for isolation and a i removable strainer is provided for startup.

l Diesel fire pump accessories include a controller which houses the engine control, monitors and battery chargers. This controller is powered by a power panel which will be fed from the existing construction fire i water pump motor control center, B40.

The discharge of the fire pemp ties into the main Fire Protection System header, 12"-KC-33, between valves 12-0-7 and 12-D-8. Connection piping will be approximately 180 feet of 6" diameter carbon steel and ductile iron piping. The piping will be equipped with a check valve and a manual isolation gate valve at the pump discharge and a manual isolation-gate valve with a post indicator at the connection to the main Fire Protection System yard loop. ,

In order to operate the SEP diesel fire pump for extended {

periods of time (more then eight hours), separate diesel fuel oil storage and transfer capability will be installed. -The fuel oil transfer system will consist of a hydroturbine and a positive displacement (PD) pump.

The hydroturbine is driven by discharge flow from the SEP diesel fire pump and exhausts to fire pump suction using approximately 40 gpm. The pipirag to and from the hydroturbine is 1-1/2" diameter with necessary manual isolation and manual control valves. The hydroturbine is directly connected to the PD pump. The PD pump takes suction from the underground Blackout Diesel fuel oil storage tanks and discharges to the SEP diesel fire pump fuel oil tank (T-162) at approximately 5 gpm. The fire pump fuel oil tank will have an overflow line which returns to the underground tanks.

The piping for the PD pump suction and discharge lines and the return line will be 2", 1-1/2", and 3/4" diameter with necessary manual isolation and manual control valves. The PD pump and hydroturbine will be housed in f the new SEP diesel fire pump enclosure.

The SEP diesel fire pump enclosure will be equipped eith a wet pipe fire protection system with all necessary piping, valves, controls, alarm, and sprinkler heads.

The enclosure is a 20' X 24' prefabricated metal structure and will contain SEP diesel fire pump P-179 and accessories, SEP diesel fire pump fuel oil day tank T-162, diesel fuel oil transfer pump P-180, and all above ground piping. The enclosure will have four temperature controlled space heaters and a natural ventilation system to maintain a temperature range of 60F to 100F. The enclosure will also contain lighting and access doors for maintenance. The electrical power shall be supplied form a local power panel which is fed from MCC B40.

A gate valve will be installed in the public water supply between the suction connection for SEP diesel fire pump P-179 and the administration building / warehouse. This will isolate the SEP diesel fire pump from the public water supply until it is needed for testing or as an emergency makeup / supply.

All equipment installed in this modification will be designed to ANS: and NFPA standards.

3.5.3 Desion Chanae Evaluation 3.5.3.1 Systems /Comoonents Affected Fire Protection System The SEP diesel fire pump discharge line is connected to the Fire Protection System main header, 12"-KC-33, between valves 12-D-7 and 12-D-8.

City Water System The SEP diesel fire pump suction line is connected to the city water system. Capability is provided to isolate the city water from the rest of the plant services so as to provide maximum capability to the fire pump.

Blackout Diesel Generator I

Fuel oil transfer pump suction piping is connected to the blackout diesel generator oil storage tank. The fuel oil driving pump is supplied by the discharge side of the new diesel driven fire pump which takes suction from the city water system. Capability is provided to isolate the city water from the rest of the plant services so as to provide maximum capability to the fire pump.

The SEP diesel fire pump enclosure electrical.

load.will be powered from the Blackout Diesel Generator. in it e event of the failure of normal station power.

Auxiliary Electrical System Electric power to the.new diesel fire pump room lighting and maintenance loads will be provided from HCC B40 (within the blackout diesel generator enclosure), which.is supplied from Bus B-5 during normal operation.

3.5.3.2 Safety Functions of Affected Systems /Comoonents Fire Protection System The Fire Protection System does not perform any safety related function. The Fire Protection System is important to safety and has been placed under the management Quality Control Program because it reduces the probability and consequences of fire damage and the resultant degradation of the plant safe shutdown capability.

City Hater System The city water system performs no safety function. It does, however, act as a backup-water supply for.the. Fire Protection Hater System.

Blackout Diesel Generator The Blackout Diesel Generator will function as a backup to the existing Emergency Diesel Generators. The Blackout ~ Diesel Generator is not required to perform any safety related function.

Auxiliarv Electrical System q The source of power for MCC B40 is LC B-5. Bus j B-5 is supplied from Bus A-4, which is a  ;

non-safety related electrical bus. '

3.5.3.3 Potential Effects on Safety Functions Fire Protection System j

The Fire Protection System does not perform any 1 safety related function. However, the new 6" i i

l l

l

line, the normally closed gate valves, the check valve, the fire pump, and the associated vent and drain lines form a part of the Fire Protection System pressure boundary and are necessary to maintain that boundary. The fire pump pressure rating is compatible with the Fire Protection System piping design pressure of 200 psig, the maximum discharge pressure.

City Water System

The City Water System has no safety function to l perform.

i l Blackout Diesel Generator The Blackout Diesel Generator is not required to perform any safety related function.

Auxiliary Electrical System The affected portions of the Auxiliary Electrical System perform no safety related functions.

3.5.3.4 Analysis of Effects on Safety Functions Fire Protection System In order to ensure the Fire Protection System pressure boundary is maintained, the 6" line, the normally closed gate valves, the check valve, the fire pump and controllers, and the associated vent and drain lines are designated 0 (Fire Protection).

3.5.3.5 Desian Change Evaluation Conclusions No safety related system is affected by this design change. System connection to existing equipment will not negate any previous FSAR analysis.

AK E M "2 IR F i Y

A R

X P P S pM R U P

OT E F EN - R I

F PM r MN 1

UI W A1 O PT- L L F EN RO 5 $ ER S

E E L ,6 L x I V F C3 I

u 0 J g E S DO E S^' N l

L D E 3

, DI E NR [ C S AU - A E NI G V H

I m' -

R  :

D OFI E

F  ::

>T S C

E M

E N N A

R

=

=

pg T T c J .

S 3j

- L N . Y S LN ]!'g e l J

E S

I EE V

P R

R E)

L K E IN T R cI l SV EI R DD

/.

ill l

- 0 ~"_

L

_ E I

D T

U RA  ; O PL K S( I 0 C D

T m7 7 I/

l 2

l A

L B

$/ f /

"6 ." (4,$'

E CR - M R TIL E

• O Yg e, LJ Rg I L SB T J OUA W L FC, T P ig'

3.6 DIESEL FIRE PUMP FUEL OIL TRANSFER SYSTEM 3.6.1 Objective of Desion Chanae The purpose of this design change is to provide a redundant (non-electric power dependent) diesel fuel oil transfer pump for the diesel fire pump P-140. This redundant pump will allow extended operation of the diesel fire pump as a water source for the RHR system during extended station blackout and other potential severe accident scenarios beyond design basis.

l Pilgrim Nuclear Power Station is providing several new additional sources of water to supply the containment spray header, the torus spray header, and/or for use in  !

RPV injection. The additional sources of water. chosen to '

be made available for these uses are the fire water storage tanks and city water. The torus water is also available. All of these sources are described in Section 3.4. This change adds a hydroturbine driven (AC power independent) fuel oil transfer pump to keep the fire pump .

day tank (T-123) filled such that during a station blackout the diesel fire pump (P-140) is available on a-continuous basis, thus permitting utilization of the additional sources of water to the RHR system.

3.6.2 Desian Change Description i

This design change (Figure 3.6-1) covers the installation of a diesel fire pump fuel oil transfer and hydroturbine driver (P-181) pump in the intake. structure. Both the units will be mounted on a common bastplate. The hydroturbine will be connected to the discharge and suction piping of existing diesel fire pump P-140, while the fuel oil transfer pump will be connected to the fuel oil transfer piping between fuel' transfer pump P-141A and the fire pump day tank T-123. This modification does not involve installation of underground piping. .The design temperature (winter) is 60*F (FSAR, Table 10.9-1) for both the diesel generator building and the intake structure.

The fuel oil storage and transfer system (hydroturbine and fuel oil transfer pump) for the existing diesel. fire pump is sized to provide enough fuel oil supply to operate the diesel fire pump engine at 1001 load for a minimum of seven days without refueling during a station blackout. (It currently has an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> supply.)

1 l

- ___- __- _ - Q

The hydroturbine will be a modified Horthington Model No.

D-814 and rated for a normal flow of 50 gpct of dater.

The pressure drop through the hydroturbine will be approximately 45 psi. The hydroturbine will have cast iron casing and be bronze fitted. The suction and discharge lines to the hydroturbine will be 1-1/2 inches in diameter and will be connected to the discharge and suction piping of the existing diesel fire pump. The suction and the discharge piping of the hydroturbine will be supplied with globe valves to adjust the water pressure and, thereby, the turbine speed. The gate valve located at the suction line of hydroturbine will be used as an equipment cutoff valve. Also, vent piping and vent valves will be provided. The suction piping is provided with a test connection to install a pressure gauge and measure the water pressure at the inlet of the hydroturbine.

The fuel oil transfer pump will be a rotary-type, Horthington Model No 2GAUH and rated for a normal fuel oil delivery of 5 gpm and total design head of 10 psi.

The pump will have a cast iron casing and be steel fitted. The suction and discharge piping will be 1-1/2 and 1 inches in diameter, respective, and be connected to diesel oil transfer pfping (1-1/2"-HG-38) upstream of the fire pump day tank. The suction and discharge of the fuel oil transfer pump will each have a plug valve, and a globe valve will also be installed in the discharge. The pump will be located south of the day tank in the intake structure.

The fuel oil transfer pump will use the existing suction  !

and discharge lines of pump P-141A. However, a 1-1/2" bypass line will be added around fuel oil transfer pump P-141A to reduce the suction pressure drop and increase NPSH availability for the fuel oil transfer pump. Since the bypass will begin upstream of the suction of the pump P-141A and the piping is Class 1, a "Q" valve (glove, normally locked closed) will be added to act as a seismic boundary. This bypass will be located in the diesel generator building.

During a station blackout, the inlet and outlet plug l valves (No. 120 and 122) of the fuel oil transfer pump j will be opened, and the plug valve (No. 123) installed in the line (1-1/2"-HG-38) ahead of the tank T-123 will be closed. Also, the globe valve (No. 118 and normally locked closed) installed in the bypass line (diesel generator building) will be opened and the existing valve 104A (suction of Pump P-141A) will be closed. 'The diesel fire pump P-140 will be started, and the gate valve (1 i 1/2"-P-130) installed in the lines to the hydroturbine will be opened. Also, the 1 1/2" diameter lines to the

hydriturbine will be vented through vent valves I

'3/4"-VT-117 and 118. The fuel oil transfer pump will run until the tank T-123 is full. If the tank is overfilled, the diesel fuel oil will return to the emergency diesel generator oil storage tank T-126A via an existing 2 inch ,

diameter overflow line (2"-HG-38). Periodically, the 1 level gauge of the tank will be checked for proper level. The hydroturbine and the fuel oil transfer pump supply and discharge valves will be reversed back to their position as shown on Drawing M-218, Sheet 2 of 4 and M-223, once the day tank is full or the blackout is over. It should be noted that all valves are manually operated.

The one inch valve (No. 118) and piping connected to existing diesel fuel line 2-1/2"-HG-38 located at the suction of pump P-141A are safety related. The globe valve will be normally locked closed. The piping up to the anchor and including the valve will be seismically analyzed and supported.

The remainder of the piping installed by this PDC will be J designed to ANSI and NFPA standards. Also, the hydroturbine and the lines connected to it are quality class FPQ.

3.6.3.1 Systems /Comoonents Affected Diesel Oil Storace and Transfer System The 2 1/2-HG-38 suction pipe of diesel 011' transfer pump P-141A is affected by this change. 1"-HG-38 line bypassing pump P-141A is connected to the 2 1/2"-HG-38 line.

The 1 1/2"-HG-3B discharge pipe of the diesel oil transfer pump P-141A is affected by this change. A 1 1/2"-HG-38 line bypassing pump i P-141A is connected to the 1 1/2"-HG-38 line. '

The 1 1/2" inlet pipe to fire pump day tank is affected by this change. The suction and  !

discharge lines of the backup diesel oil transfer pump are connected to'this pipe.

Fire Protection System l

The 12"-KB-33 suction and discharge lines of  !

diesel fire pump P-140 are affected by this 4 change. The 1 1/2"-KB-33 (the hydroturbine inlet and outlet) lines are connected to these pipes.  ;-

l i

Intake StruAture The civil structure of the diesel fire pump (P-140) and the diesel day tank (T-123) rooms of this building are affected by this design change due to the installation of component supports and equipment foundations.

3.6.3.2 Safetv Functions of Affected System /Comoonents Diesel Oil Storaae and Transfer System The safety function of this system is to provide diesel fuel oil to the emergency diesel

l. generators which provide a single failure proof source of onsite AC power adequate for safe.

shutdown on the reactor following abnormal operational transients and postulated accidents (FSAR Section 8.5).

Fire Protection System The Fire Protection System does not perform any l

safety related function, but it is important to l l safety because it reduces the probability and consequences of fire damage and the resultant degradation of plant safe shutdown capability.

Intake Structure The intake structure has the safety function of protecting the Class I Salt Service Hater System from natural phenomena (FSAR Section 12.2). J l

3.6.3.3 Potential Effects on Safety Functions i Diesel Oil Storaae and Transfer System l

Operation of the new pump P-181 requires that j the existing diesel oil transfer pump P-141A be  ;

secured. I Degradation of any new oil piping may impact  :

the capability of the existing diesel oil '

transfer pump to supply oil to the emergency diesel generators.

Fire Protection System i The structural degradation of the hydroturbine inlet or outlet may limit the capability of the diesel driven fire pump.to perform its function.

Intake Structure i

The structural integrity of the intake structure is not degraded by the addition of a pump foundation or holes for anchor bolts.

3.6.3.4 Analysis of Effects on Safety Functions Diesel Oil Storage and Transfer System While the new fuel oil transfer pump P-181 is '

in operation, transfer pump P-141A will be I inoperable since its suction valve (104A) will be closed. Transfer pump P-141B can be manually aligned and manually controlled to fill. day tank T0124A (Reference FSAR Section 8.5.2.7). However, pump P-181 will only be used during station' blackout, therefore, pump P-141A will not have power to start when its suction valve is isolated. Prior to testing pump P-181, day tank T-124A should be filled to ensure that pump P-141A does not automatically start while its suction isolation valve (104A) is closed.

The following design features of this design change mitigate the effect of the structural failure of new components on the safety function of Diesel Oil Storage and Transfer J

. System.

(a) The design change has Class I piping-up to and inciasive of the globe (normally i locked closed) valve which forms the ,

boundary for the seismic portion of the '

Diesel Oil Storage and Transfer System.

(b) All non-saf?ty related items which have the potentiel for degrading the integrity of Class I items are analyzed for seismic i forces of a safe shutdown earthquake (SSE) and are analyred and installed as Q.

r1re Protection System The hydroturbine's suction and discharge lines l were designed to mininize the possibility of structural failure degrading the capability of the diesel driven fire pump to perform its function. In addition,.the inlet and outlet  ;

lines will include two normally closed '

l- isolation valves to isolate the hydroturbine from the Fire Protection System during normal i operation. These manual valves will only be l

l opened during extended station blackouts, when .

the hydroturbine is needed to transfer diesel  !

oil from the emergency diesel oil storage tank to the diesel driven fire pump's day tank.

l The hydroturbine will increase the availability of the diesel driven fire pump for extended periods of operation. The new fuel oil transfer pump P-181 will function as a backup to the existing pump P-141A for normal operation.

3.6.3.5 Desian Chanae Evaluation Conclusions This change does not call for the safety equipment of the system to operate at higher pressures, temperature or more severe conditions than the existing levels, hence, the modification does not increase the probability of malfunction of equipment important to safety.

This change is designed such that the failure of any non-safety related equipment will not degrade the capability of safety related equipment to perform its function.

This change will increase the margin of safety for diesel driven fire pump availability for extended periods of operation.

l I

I l

_ - _- _____ _____-__ n

M E L

E S T E I

DP S IN A

K TM Y M S A L N N UU S S A

1 E A AI OP T K R

P 4 S T M K R U N E

l P EE C O R T Y I GA R E KL A A 3 DA6 E A F CI T E W GR2 h T A

L S, BN

" AO E F E WV.

E P N O-1 W L LG B

S R N I TS TT WA E RA E R E

WSE O I

N F S I

L IR N T E I T A P O X O I

T EO W F NDS T

- R M ! O P 4 T L M T U

F L P E R U I

V P O E ?

O E

L R v G

N R M  ;

E I

F I

T l

" W 1

S F U -

N I

X O

1 L F 6 E N F E E R P 3 V I

= mF V _J=-

E V

=

M I

O R R =

UE D D W PR U L

- E N

EG L a ( E a RI F E ) S S

I E ( E F I I

D D > y L

E G L W  ;

S N E Y SA E R E

t E

I T ED N T I

I DP A N L D S k GM V

EP I

X yA NU Y T SMK I

T EUN E

I D PAT I

SE C XI R M E I

EF O W RY R EI A F NFD

^

L

,2?

3.7 BACKUP NITROGEN FJJPPLY SY1 TIE 3.7.1 Objective of Design Change l This design change provides additional backup nitrogen (N2 ) supply during a station blackout to the following:

1. Critical valves and instruments.

2. Torus and drywell for containment atmosphere makeup. ]

This change also replaces the existing instrument air supply backup to drywell with N2 , thus eliminating the potential air /02 leakage to containment. Also, valve A04356 is modified to fail open upon loss of AC power or N2 supply to the valve actuator (vs. fail closed). This ,

improves the reliability / operability of the drywell j instrument N2 system.

During a severe accident condition if the existing nitrogen storage facility is rendered inoperable a bank of nitrogen bottles will automatically supply drywell instrumentation. This mode of operation will continue until such time that the new liquid N /2vaporizer trailer is available, i.e., connected to supply N2 for torus /drywell makeup or drywell instruments. The N2 cylinder supply is for a minimum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> which provides sufficient time to align the N2 trailer. The N2 trailer provides an increased onsite supply of nitrogen.

It also allows time for truck delivery of additional N 2-3.7.2 Design Chance Description This design change (Figures 3.7-1 and 3.7-1) includes the addition of a liquid nitrogen / vaporizer trailer (X-168) and associated piping and valves. The mobile vaporizer system will be normally stored outside the north side of the reactor building in the northwest corner of the site used for storage and laydown of miscellaneous equipment.

When needed, the trailer will be noved outside the west gate of the condensate storage tank controlled access area. It will be arranged to deliver at two different pressures to the nitrogen system via two flex hoses normally stored on the trailer. Nitrogen supplied at 120 psig will be available to supply drywell instruments to match the existing drywell N2 supply pressure. -Two inch piping and a globe valve will be added to tie the vaporizer system into the existing piping. A check valve will be added to prevent nitrogen flow into the existing

l nitrogen tank. A pressure control valve will be added to control nitrogen pressure from the existing nitrogen tank I when it is used for drywell makeup during normal operation. Nitrogen at 70 psig from the package trailer unit will supply drywell N2 makeup to match the existing l drywell makeup system pressure by connecting to the I existing fill connection located on the north wall of the reactor building.

Also included are the addition of two banks of ten cylinders each, associated piping and valves. The cylinders will be arranged to automatically take over nitrogen supply to drywell instrumentation from the time the existing nitrogen supply is not available, to the time the new liquid nitrogen / vaporizer trailer is ,

available, i.e., connected to supply N -2 I i

The cylinders, via the new cylinder rack and manifold l (X-169), will deliver nitrogen gas at 110 psig (reduced l by a vendor supplied pressure control valve) through 2 inch piping which will tie into the existing nitrogen i makeup supply to drywell instrument supply piping. The j new piping will contain a check valve, a gate valve and a i relief valve. A differential pressure indication switch  !

with alarm will be connected between the cylinder supply i and the existing supply to provide control room indication of when the complete switchover to the cylinders has occurred. The existing manual gate valve ,

(31-162) will be changed from normally open to normally l locked closed to isolate instrument air supply to drywell instrumentation. The existing nitrogen operated valve (AO-4356) will be modified from fail closed to fail open to provide an open nitrogen path to drywell ,

instrumentation. '

It should be noted that the existing nitrogen supply is set at 120 psig and the bottle supply at 110 psig. This  ;

differer,tial is sufficient enough to avoid spurious i signals (flip-flopping).

The 6000 gallon liquid nitrogen / vaporizer trailer will be sized for a minimum of 20,000 scfh for 7 days and 8000 ,

scfh for an extended time period (approximately 18 days). l The nitrogen cylinders' supply capacity is for a minimum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. This assumes two cycles of the MSIV's, two cycles of the HSRV's, and various other leakage rates.

Valve A0-4356 is modified to fail open which will improve the operability of the drywell instrument

l

.]

nitrogen system. Currently this valve fails closed upon loss of AC power to the solenoid or nitrogen supply to-the actuator. This present failure position-is adverse 1 to maintaining nitrogen supply to the ADS accumulators I and MSIV's, during station blackout conditions or a severe accident. The original design feature of failing  ;

closed was to provide isolation for an instrument line 1 rupture inside containment. Originally, instrument air was provided as the normal source, but later it was modified for use as the backup source. The instrument air supply will now be locked closed. Check valve 31-CK-167 provides containment isolation.

)

Pipe penetrations and attachments to the reactor building walls are safety related. Construction shall take appropriate precautions to block off the penetration )

during construction in accordance with PNPS procedures. j This design change is "Q" due to pipe penetrations, 1 modifications to seismic supports, attachments to "Q" J 1

wa'Is, and II/I criteria for pipe routing.

3.7.3 Desian Chanae Evaluation J 3.7.3.1 Systems. Subsystems. Components Affected i

Inertina and Drywell Testina This design change will involve the following:

The addition of a check valve and a 2 inch tee in the existing cryogenic nitrogen supply-header' common to the drywell instrument supply j and drywell inerting supply. The 2 inch tee connection branch includes a normally closed globe valve and a normally capped pipe end.

The addition of a pressure control valve to the existing pipe which connects the drywell instrument header with the existing drywell inerting piping which is normally isolated by an existing closed valve. The pressure control valve reduces the 125 psig (maximum) supply I from the existing cryogenic storage tank to 70 psig which is the normal drywell inerting system supply pressure. ,

i The addition of a nitrogen cylinder station connected to the existing drywell instrument supply header. The system is initiated when i the normal nitrogen supply line pressure drops- .

below the bottle rtation supply pressure. j 1

1 l

i I

l 1

i The locking of closed valve 31-H0-162'(S-31-1) l

.in the instrument air. supply header to drywell l instrumentation. This decreases the load on- '

the existing-instrument air. system. Drywell instrumentation supply will be.normally taken from the existing nitrogen system and ~

supplemented by the new nitrogen cylinders and liquid nitrogen / vaporizer trailer.

1 The addition of a liquid nitrogen / vaporizer- l trailer onsite which will be connected to the i existing drywell inerting supply piping mounted on the outside of the reactor building wall and to the drywell instrumentation supply header -

via newly installed 2 inch piping when the existing liquid nitrogen storage tank is not available.

Changes _to the air operator on drywell instrument supply isolation valve A0-43565 from fail closed to fail open. This ensures an open path to the drywell'during a station blackout.- 1 i

event. Check valve 31-CK-167 located '

downstream of.this valve performs the containment isolation function.

Reactor Buildina This design change will involve drilling holes in safety related reinforced concrete of the reactor building.

Control Room Annunciator This design change also involves adding an additional alarm input to the existing annunciator to provide control room indication upon switchover to the nitrogen cylinders.

3.7.3.2 Safety Functions of Affected Systems /Comoonents Inerting and Drvwell Testina The Inerting and Drywell Testing System is part of the Containment Atmospheric Control System (CACS), which provides the capability to_ purge containment so that the containment design pressure is not exceeded following a design basis accident.

The Inerting and Drywell Testing System 2 provides the capability to pressurize containment to dilute and maintain the hydrogen concentration below the lower flammability limit following a design basis accident.

l

---

-- - - - - - _ _ - --.--_----------,--,.--___a---,-------:.------.-._..-----__---.. - - - - - - - . - - . - _ - - ,----u----------------a_------------.,m-m-- -a-a-_ - - - - - - - - - -__-

The Inerting and Drywell Testing System provides the capability to close and thereby isolate the torus and drywell purge and makeup penetrations and the drywell compressed air header penetration to satisfy the containment isolation function following a design basis accident.

The modified supports are required to maintain the pressure boundary integrity of the drywell inerting system during normal and accident conditions.

Reactor Buildina The reactor building is part of the secondary containment system. The secondary containment system, in conjunction with other engineered safeguards, limits the release of radioactive

materials to the environs, so that offsite l doses from a postulated design basis accident will be maintained below the values of 10 CFR 100.

Control Room Annunciator l l

The control room annunciator has no safety l function. I 3.7.3.3 Potential Effects on Safety Functions Inertina and Drvwell Testing 1

1 The backup nitrogen supplies provided by this change do not reduce the Inerting and Drywell Testing System's ability to purge containment.

This change does not affect the containment isolation functions of the Inerting and Drywell Testing System.

The modified supports have been re-analyzed and redesigned to accommodate thermal and seismic loads. This change, therefore, enhances the system's ability to perform its safety functions.

Reactor Building The safety functicn of the reactor building is not adversely affected by the additional penetration in the reactor building wall.

1 i

1 Control Room Annunr,iatgr The control room annunciator is not adversely affected by the addition of a new alarm input.

3.7.3.4 Analysis of Effects on Safety Functions ,

Inertina and Drywell Testing This design change does not alter:

o the.Inerting and Drywell Testing System's purging function because the liquid nitrogen / vaporizer trailer is normally )

isolated and is provided to supplement the '

existing nitrogen supply, when needed; o the Inerting and Drywell Testing System's ,

containment oxygen dilution function  !

because the liquid nitrogen / vaporizer trailer is normally isolated and is provided to supplement the' existing nitrogen supply, when needed; and o the Inerting and Drywell Testing System's containment isolation function because the i liquid nitrogen / vaporizer trailer and nitrogen cylinders are connected upstream of the existing containment isolation valves. Containment isolation valve function / operation is not altered by this modification.

Reactor Building i The reactor building penetration added by this modification will be made utilizing existing engineering and construction procedures.

Engineering has evaluated the size and location of the core drill necessary and the penetration seal required to maintain the. structural and ,

pressure boundary integrity of secondary containment. The addition of the 4 inch diameter core drill in the reactor building wall, followed by the postulated failure of the 2 inch nitrogen cylinder station supply line during a seismic event has been reviewed. The additional vent area created has been judged to have a negligible effect on the capability to draw down secondary containment. i i

l

Control Room Annunciator The control room annunciator is not adversely affected by this change. Therefore, no j analysis is needed, q 1

3.7.3.5 Desian Change Evaluation Conclusions i The safety functions of the Inerting and Drywell Testing System are not adversely affected by the additional nitrogen backup l supplies and associated piping, valves and l instruments. j The safety functions of the reactor building are not adversely affected by the addition of the reactor building penetration.

The safety functions of the primary containment are not adversely affected by the additional ,

nitrogen backup supplies and associated piping, l valves and instruments.  ;

I J

l l

l l

l l

T NY E PL M P UU 2

RS T N

- SR E C P I lNIA O P

_ H l

O Y VS TL

- L

- - O Y A DE F

e' P

- I MS

- DR OOL O

MNC M

E T M O

S RK T Y FN

_ S T N YT EPLG A

I #' p1 LE N

P k "4 LM

_ Y M N U P I

g EU

_ L1 R UT WR Y T T SS P -

P7 S 2X I =

R NS N NE = DI U

_ . I S3

, y y V '

K A

NE j E ER R GU N B MO L .

A T M S OG /

N U V D

RI F /

PS E U EE T DI M C OVS

_ NS A TLA O A E V I I N T V YV CL L L F N

_ P X N O/ A E C'

L I Dell OPA U

TW K , ' WNY MOQ

' EER C

MVD A

B h p

?

_ f f $

_ +

S E

L T

_ T O

B0 2 2 N-

j

(

N O _

S I L T T LN 'K A -

L Y EE CC O G AK N GN P

L P WM P YU E L H = )TOA I SOT U

E U RR C E I K

V Xp2 S DT S L A [E9N A M

2O N NTI L

J

%V --

d p , _

3 , .

M

_ E T -

V

_L m" S A .' .

Y V K

S -

C =

_ Y

- H E

p L 2 C u P - hT E v 2 7 V .M E P 7 S S

.V x

A U A=

C & V S 3 O u L S E e 7 v V M u N E R r S

~ n E R G U a, E f u V O

T O G

= '

V L  :

- .k A V v w V . M R F I

m r .V T ' WV EC

?

I N

[L r/NP rg y 2 m

i r S

.M

. V X =

P U

3j 4 A -

K rg 7 -

C 3j 3 , _

A t B mT  %

4 ) e, g>3 TP EY E 7 ST rg

(

l

=

N: - _

\ ,j  : _

d 5o'u,a -

o g" l i

g I

1 NO ba l

O o O -

,@ 8 8 2 .- m~

_s8 E2 -. $g4 * -

4' I

' +

)]

iST _

3.8 EACK0UT DXESEL GENERATOR INCLUDING PRQIETED INSTALLATION FACILXTfE.S 3.8.1 Obiettive of Desian Chance A new onsite, independent backup power source will be installed in a protective structure. This new diesel generator (blackout diesel generator) will provide a backup source of power to selective safety related bus A5 and A6 loads. This backup power is being installed to reduce the probability of a prolonged station blackout which could lead to core damage and/or containment failure. The blackout diesel generator set will be capable of producing 2000 kW continuous (2200 kN standby), 3 phase, 60HZ and 4160V electrical power to safety bus A5 and/or A6. This electrical power will be utilized to operate loads required for reactor shutdown / scram without a LOCA (See FSAR Table 8.5-1).

This diesel generator unit is fully self-contained, not l dependent on any permanent plant systems (except a 480 Vac feed from the plant for diesel generator maintenance l loads when the unit is not running) and has the fuel l capacity to provide rated power continuously for a minimum of one' week without refueling. The unit is skid mounted and housed in a pre-engineered enclosure to protect it and the associated electrical and mechanical support systems from the environment.

3.8.2 Desian Chance Description This design change (Figure 3.8-1) installs a blackout diesel generator set as a non-safety related source of 2000 kW continuous (2200 kW standby), 3-phase, 60HZ, l 4160V electrical power for a minimum of one week without

refueling. Electrical power from this blackout unit will be utilized to operate loads from one safety train required for a reactor scram without a LOCA, as defined in the FSAR, Table 8.5-1. The unit is mounted on a skid and housed in a pre-engineered enclosure to protect it and the associated electrical and mechanical support I systems from the environment. The unit will be located l south of the plant adjacent to the switchyard relay house.

The blackout diesel generator and the existing 5 HVA shutdown transformer can be connected to the existing essential service 4.16kV buses AS, A6 through a new two-breaker 4.16kV bus AB. The blackout diesel. generator I will be connected to i

I i

l a

l

i one of the 4.16kV breakers of the new switchgear A8 and {

the shutdown transformer will be connected to the second i breaker. The outgoing feed from the switchgear A8 will l be connected to the existing 4.16kV breaker A600 which is j in turn connected to breakers A501 and A601 of the '

essential buses A5 and A6.

Breaker A802 which is connected to the shutdown ,

transformer will be kept closed during normal operation l to supply power through breaker A600 (normally closed) to breakers A501 and A601 (normally open). This alignment of breakers is consistent with the present arrangement .

which maintains shutdown transformer power available for i automatic connection to the emergency buses (via automatic closing of A501 and A601) upon a unit trip, loss of the startup transformer and failure of the emergency diesel generator. The blackout diesel generator output breaker A801 will be maintained open during normal operation and will be closed to the safety ,

related buses only during station blackout or test. )

Provisions are made so that the blackout diesei generator can be load tested b/ synchronizing to the shutdown transformer during normal plant operation. During this time breakers A802, A600, A501 and A601 are maintained in j their normal lineup. When the control switch is selected j l

to the test position and buses are synchronized, the j shutdown transformer and blackout diesel generator are  ;

both available to supply power to the A5/A6 buses. l A synchro-check relay, a synchronizing switch and diesel l test switch located at the A8 switchgear/ diesel generator enclosure are provided for load testing. Load testing can only be accomplished from the diesel enclosure /switchgear A8. Interlocks are provided so that i if the diesel generator breaker is closed to a dead bus l (i.e., the shutdown transformer is de-energized) the l l shutdown transformer breaker A802 will be prevented from closing until the diesel generator breaker A801 is tripped.

The blackout diesel generator and the two new 4.16kV breakers will be operated manually (except for automatic protective actions) from the main control room or locally i

from the diesel generator. When the diesel generator is used during blackout conditions, load will be controlled by manual operation by disabling of breakers on buses A5 and A6. In general either A501 or A601 and the ECCS pump breakers on the bus being energized must be opened and prevented from closing.

Control switches and indicating lights are installed on l

main control room panel C3 to allow start /stop of the diesel generator and trip /close of the AB bus breakers.

Engine speed control and generator voltage control is not presently provided in the control room. These controls l

located at.switchgear A8 must be set / adjust'ed during unit test. Once. set they will operate automatically when the unit is started. The diesel generator breaker can be closed from the main antrol room only when the shutdown transformer breaker is_open.. During.a blackout the operator must trip the shutdown transformer breaker before closing the diesel generator breaker. Relaying on the blackout diesel generator and an engine speed interlock provide permissives to close the diesel generator breaker to bus AB. The shutdown transformer breaker can be tripped and closed.from the control room.

The diesel generator is fully self-contained and is.not dependent on any permanent plant systems, except for a  ;

480 volt AC feed from existing non-safety related load center B4 of PNPS. This feed will be connected to a motor control center for supplying power to the maintenance loads (engine water heating, lube oil system, heating / ventilation, lighting, etc.) of the diesel generator when it is not running. If the diesel generator is not operating, loss of power to the maintenance MCC will be alarmed (diesel generator j trouble) in the main control room. If the diesel is l operating, an automatic transfer switch is provided to i supply power to this motor control center from the  !

blackout diesel generator upon loss of the station supply. l l

The blackout diesel generator and the new two breaker 4.16kV bus will be' supplied 125V DC power from a new independent battery system (battery and charger) dedicated for this purpose. The DC power supply installed in the AB.switchgear is not connected to the existing plant DC power system.

Annunciation will be provided in the main control room for blackout diesel generator trouble, diesel generator ,

breaker (A801) trip / inoperative and shutdown transformer  !

breaker (A802) trip / inoperative. Annunciator window 25  !

on panel C3 presently monitors breakers A501 and A601.

Breakers A600 and A802 will be combined with these breakers to annunciate on an automatic trip of the breakers or on an inoperative breaker signal from any of these four breakers. The blackout diesel generator l trouble and breaker A801 will be annunciated on window 69 i of panel C3. The window 69.at present annunciated Unit 1 emergency shutdown transformer under voltage relay or breaker A600 open. This undervoltage-signal will be .

combined with signals connected to annunciator window 47,

" emergency shutdown transformer miscellaneous alarm".

After these modifications, window 25 will annunciate .

" Shutdown Transformer Breaker Trip or Inop". This will  ;

indicate the power supply from shutdown transformer to

the emergency service buses A5 or A6 is affected. Hindow 47 will annunciate " emergency shutdown transformer miscellaneous alarm". This will indicate trouble with the shutdown transformer and under voltage on breaker A600. Hindow 69 will annunciate " Blackout Diesel Generator Trouble". This will indicate trouble on the blackout diesel generator and breaker A801.

Protective relaying is provided to prevent damage to the diesel generator and the shutdown transformer. Voltage regulation and engine governor control are provided to maintain acceptable engine speed and generator voltage and frequency during diesel generator operation. Over voltage, underfrequency and overfrequency relaying are provided to prevent the diesel generator from supplying unacceptable power to the 24kV electrical system or the emergency service buses.

A two element differential current relay used to protect the shutdown transformer up to breaker A600 will be replaced by a 3 element relay. The relay mounted in control room panel C5 will allow the addition of the.

blackout diesel generator to the existing differential protection scheme.

In addition, installation of foundations and underground structures / components is necessary to complete the construction of the new standby diesel generator facility. The new facility will primarily consist of the diesel generator, two (2) double wall. underground fuel storage tanks complete with annulus monitoring / leak detection system, a radiator, an electrical switchgear arrangement and miscellaneous underground piping and electrical conduit / duct bank.

3.8.3 Desian Chance Evaluation l 3.8.3.1 Systems /Comoonents Affected This design change involves the addition of non-safety related components. The following systems are affected by the addition of the blackout diesel generator set.

1. The secondary offsite AC power source (shutdown transformer).

2. Emergency service buses A5 and A6.

3. Main control room panels C3 and C5.

4. 480V load center B4.

L______________-_____-__

Secondarv AC Power Scurce (Shutdown Transformer)

The secondary'AC power source (shutdown transformer) is discussed in Section 8.3 of FSAR.

The secondary AC power source (shutdown transformer) is a non-safety related system and provides a source of power to the emergency services buses A5 and A6 of the Auxiliary Power Distribution System. The new blackout diesel generator will be connected between the secondary side of the shutdown transformer and emergency buses A5 and A6. A new two breaker 4.16kV bus will be installed to which the new diesel Generator. the shutdown transformer and the existing 4.16kV breaker A600 will be connected. The differential current relay installed to protect the shutdown transformer will be modified from a 2 element unit to a 3-element unit to allow the addition of the diesel generator in the differential protection scheme.

Emergency Service Buses A5 and A6 The 4.16kV emergency service buses are described in Section 8.4, Auxiliary Power Distribution System of the FSAR.

The emergency buses A5 and A6 will be supplied power from the new diesel Generator under station blackout conditions. There are no physical changes to the emergency buses except that existing contacts from the differential relay discussed above in the control schemes of circuit breakers A501, A600 and A601 will now include input from the blackout diesel generator circuit. The differential relay is non-safety related and will operate for faults when power is supplied to the emergency _ buses from the shutdown transformer of the blackout diesel generator which are both non-safety related power sourcas. This relaying will not change the reliability of the emergency service buses A5 and A6 when the unit, preferred or 1 emergency onsite sources are supplying-power.

Main Control Room Panels (C3 and C5)

I The main control room panel (C3) annunciator. j will be modified to provide annunciation for

' blackout diesel generator trouble and new switchgear breaker trouble. The existing control switch for the 24kV line circuit switcher will be moved to a new location on the same panel. Control switches and indicating lights for the blackout diesel generator and the two new 4.16kV circuit breakers will be installed on panel C3. Additional changes are being made to the C5 differential relaying function.

l 480V Load Center B4 The 480V. distribution system is described in Section 8.4, Auxiliary Power Distribution System, of the FSAR.

The 480V AC power feed to the blackout diesel Generator maintenance loads from the PNPS auxiliary distribution system will be tapped from existing load center 84. Load center bus B4 is a normal service bus and is not safety related.

3.8.3.2 Safety Functions of Affected Systems /Comoonent's Secondarv AC Power Source (Shutdown Transformer)

The secondary AC power source provides a non-safety related source of power to the emergency service portion of the auxiliary power distribution system. When the unit is tripped (i.e., unit AC power is not available),

the preferred offsite AC power (startup transformer) is not available.and the emergency diesel generators do not start, the secondary AC power supply provides power to the emergency service buses.

Emeraency Service Buses A5 and A6 The emergency service portion of the auxiliary power distribution system under design basis conditions, distributes AC power required to safely shutdown the reactor, maintain the shutdown condition, and operate all auxiliaries necessary for station safety.

i The control of the 4.16kV circuit breakers i A501, A600, and A601, which control the power ]

from the shutdown transformer, are not safety  !

related. However, the controls for these i breakers are interlocked to prevent interconnection with either the unit AC power  ;

source, the preferred offsite AC power source l

l l l

or the emergency diesel generators. These interlocks backed by procedural restrictions protect against failures associated with paralleling non-synchronized sources. The existing controls of these circuit breakers are not changed except for the modification to the shutdown transformer differential relaying which trips these breakers upon initiation.

Control Room Panels C3 and CS Control room panels C3 and C5 will interface with various safety related functions of the electrical distribution system. However, the design changes do not interface with these safety related functions.

480V Load Center B4 480V bus B4 has no safety function.

3.8.3.3 Eqtprjtial Effects _p] Safety Functions Secondarv (Offsite) AC Power Source l

l The new blackout diesel generator is a backup I to the secondary offsite power source and is manually started. The diesel generator breaker A801 is normally open, the new breaker in the secondary of the shutdown transformer (A802) is normally closed and the present alignment of breakers A600, A501, and A601 are not modified by this change. The shutdown transformer's ability to supply emergency buses A5 and A6 under design basis conditions, therefore, will not be affected during normal operation.

During load testing of the blackout diesel generator it will operate in parallel with the shutdown transformer. Lineup of the switchgear to supply power from the shutdown transformer ]

to the 4.16kV emergency service buses will remain the same during load testing of the blackout diesel generator as during normal operation. Therefore, power from the shutdown transformer (or the blackout diesel Generator) is available to the emergency service buses A5 )

and A6, if required.

The 4.16kV breakers A501 and A601 interface the  !

shutdown transformer and the blackout diesel l Generator to buses A5 and A6. These breakers will remain open at all times when buses A5/A6 are supplied power from the unit auxiliary '

l 1

_______ _____ _ _ _ __A

transformer, the startup transformer or the emergency diesel generator, thus isolating the blackout diesel generator from the emergency buses. The blackout diesel; generator will supply power to the emergency essential 4.16kV buses A5 and A6 only when all other sources of AC power are lost (i.e., under station blackout conditions). l The single failure analysis for the secondary AC power source discussed in Section 8.3.3.2 of the FSAR is not affected by this. change since l the blackout diesel generator is wired via existing shutdown transformer cabling from the

~

i

turbine building south wall into the safety related switchgear and sufficient separation is maintained between the shutdown

' transformer / blackout diesel generator controls and the emergency diesel generator controls.

Emeroency Service Buses A5 and A6 The failure of an emergency diesel generator to restore voltage on' emergency service buses A5 or A6 after a loss of power would result in automatically connecting the affected bus to the secondary offsite AC power source after a time delay of approximately 12 seconds from loss of power. The secondary' power source may also be manually connected to the emergency service 4.16kV buses to reduce the duration of emergency diesel generator operation whenever both unit power source and the preferred power source are unavailable. The operation of the emergency buses is not affected by the addition of the blackout diesel generator except for the modifications to the shutdown transformer differential relay. I The existing shutdown transformer differential relay (187-5) is non-safety related and supervises the 2one from the primary of the-shutdown transformer to the emergency service bus breakers A501 and A601. The existing two element differential relay will be replaced by j a three element differential relay to include ' -

protection of the blackout diesel generator set. Controls of the 4.16kV circuit breakers-A501, A600, and A601 are not safety related.

The existing relay and new relay'are both-non-safety related. A failure of the relay will not cause a malfunction of the system l t___________________.__...._______._.______._______ . _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _J

(such as breaker closing when not required) nor trip any of the safety related breakers of the emergency service buses controlling the power from the unit AC, preferred offsite AC and emergency diesel generators.

Control Room Panels C3 and C5 Although the changes made to Q panels C3 and C5 by this improvement are non-safety related, all work to the panels is performe.d utilizing Q-materials seismically installed to procedures qualified for safety related work. Therefore, there will be no impact on safety related functions of the panels.

DC System The controls of the blackout diesel generator and the new 4.16kV breakers will be supplied l 125V DC power from a new independent battery system dedicated for this purpose. This 125V l DC control power supply is not connected into I

the existing DC system. Therefore, the existing station DC system is not affected by this modification.

Evel Oil The fuel oil for this diesel generator set is obtained from dedicated tanks and, therefore,

, will not impact the emergency diesel generator I

fuel supplies.

Seoaration Criteria Although this design change is non-safety related, separation criteria have been maintained between the blackout diesel generator and all other sources of AC power except the shutdown transformer. The cabling j for the blackout diesel generator controls is i routed separately from the controls for all other power sources. The blackout diesel generator control switches on the main control room panelboard C3 are mounted on the vertical board section of the panel (with the shutdown transformer controls) and controls for all other AC power supplies are on the benchboard section of the panel.

4 1

Power cabling from the blackout diesel generator (switchgear AB) is routed to the emergency switchgear via the routing established for the shutdown transformer as discussed in the FSAR, Section 8.3. Therefore, independence is maintained between the blackout diesel generator ano the emergency diesels just as it is between the shutdown transformer and the emergency diesel generators.

Seismic II/I Interfaces All conduit and cable installed by this design change is non-safety related, however, all conduit located within safety related area will be supported in accordance with seismic II/I criteria. In addition, all drilling of seismic I structures is performed as Q activities. '

3.8.3.4 Analysis of Effects on Scfety Functions Seconicry AC Power Source The secondary AC power system, the shutdown transformer and the controls of 4.16kV circuit breaker A600 are not safety related. The new blackout diesel generator and associated 4.16kV switchgear are also not safety related. The l new 4.16kV bus enables either the diesel generator or the shutdown transformer to supply power to the emergency service 4.16kV buses as required. By this modification, an additional 4.16kV circuit breaker is introduced into the 4.16kV power supply circuit between the secondary of the shutdown transformer and 4.16kV breaker A600. This circuit breaker l controls the power from the shutdown transformer to the new 4.16kV bus. The addition of a new 4.16kV (A802) breaker in the secondary supply of the shutdown transformer does not adversely affect the availability of the secondary AC power except under conditions i of malfunction (tripping) of the breaker and l shutdown transformer overcurrent relay. In such an event, the blackout diesel generator will be available to supply power to breaker A600 through breaker A801. This new 4.16kV eetal clad switchgear will be designed, built, rated and tested in accordance with recognized industry codes and ANSI standards. Thus, the overall availability of the secondary power system is not reduced by this design change.

Emergency Service Buses A5 and~A6 The emergen y service buses A5 and A6 will be affected by this design change as these buses can be. supplied power from the new blackout j diesel generator. -The addition of.the blackout ~

diesel generator to the existing scheme will-not impact the ability of the shutdown I transformer to supply power to the emergency buses during normal operation - since the.

blackout diesel generator will not normally be operating. The blackout diesel generator will be added to the shutdown transformer- J 3

differential current relay scheme. The new {

differential relay scheme provides trip signals 1 to 4.16kV breakers A600, A501, A601, A801, A802 and 24kV line circuit switcher.  ;

The new differential relay scheme provides the same level of protection.for buses A5 and A6 for faults.in the secondary AC.,ower n system. l The controls for all of these breakers are i I

non-safety related. There are no changes to the safety related portions of the emergency service buses. The ratings of the safety related breakers are adequate after the- l addition of the blackout diesel generator set. 1 The safety functions of these buses are not l affected by this change. i Control Room Panels C3 and C5 The main control room panels C3 and C5 are safety related panels. However,-the control switches and indicating lights for the blackout diesel generator and associated 4.16kV switchgear installed on panel C3 are not safety related. The differential relay mounted.on panel C5, is also not safety related. Even though these changes are not' safety related, all modifications to panels C3 and C5 will- be implemented to Q criteria to prevent II/I failures. i 480V Load Center B4 This system does not perform a safety-function. The maintenance loads of the new- j l diesel generator will be supplied power from '

this load center when the diesel generator is j not operating. The additional loading on the l buses is within the capacity of the load center. l 1

3.8.3.5 Desian Chanae Evaluation Conclusions Based on the preceding evaluation, the addition of the "olackout diesel generator does not increase the probability of occurrence or consequences of an accident or malfunction of equipment important to safety as previously evaluated in the FSAR. This modification does not create the possibility for accident or malfunction of a different type than any evaluated previously in the FSAR, nor does it reduce the margin of safety.

I I

i i

FIGURE-3.8-1 BLACK 0UT DIESEL GENERATOR 24KV -

!s r c(>xn Any)

[] AAC LJ EDG O

/4.16K V fPREFERRED)+~

[] []

L 345/4.16 KV '

4.16 K V -$M -

EDG1 EDG 2 O .

/

O 1

[] [] [] [] [] [] [] []

A5 A3 A4 A6 4.16 K V 4.16 K V 4.16 K V 4.16 K V '

(SAFETY) (N ON-S A FETY) (NON.S A FETY) (SAFETY) 1 4.16 K V/480V 4.16KV/480V

[: []

B1 B2 480V 480V

• ADDITION ALTERNATE AC (AAC)

EMERGENCY DIESEL GENERATOR (EDG)

CONFIGURATION

-63A-

3.9 AUTOMATIC DEPRESSJRIZATION SYSTEM LOGIC MODIFICATIONS -

3.9.1 Objective of Desian Chance Operating experience. indicates that increased attention should be focused on reducing the need for operator action. The Automatic Depressurization System (ADS) was-originally designed as a backup to the HPCI system for small and intermediate sized line breaks inside the drywell. Automatic initiation of the system requires concurrent signals of low reactor vessel water. level and high drywell pressure. The existing system.will not turn on automatically in the event of breaks outside the drywell or breaks inside the drywell'that do not result  !

in high drywell pressure. NUREG-0737, Item 11.K.3.18 I requires that "The Automatic Depressurization System (ADS) actuation logic should be modified to eliminate the need for manual actuation to assure adequate core cooling." A BHROG feasibility and risk assessment study was required to determine: the optimum approach and was submitted to the NRC. BECo evaluated all the approaches.

approved by the NRC and has chosen the one described below for implementation.

3.9.2 Desian Chance Description The design change (Figure 3.9-1) provides a timed bypass of the high drywell pressure initiation signal and a i manual inhibit of existing ADS actuation logic. This j timed bypass and manual inhibit responds to the BWROG evaluation for Item 11.K.3.18 of NUREG-0737, and will provide backup to operator action for those loss of coolant accidents or other postulated events which do not I result in a high drywell pressure trip. Presently, such i events require manual initiation of ADS.

Item II.K.3.18 of NUREG-0737 directs that the ADS actuation logic be modified to " eliminate the need for manual actuation to assure adequate core cooling". The BWROG Evaluation of NUREG-0737 Item II.K.3.18 identified either addition of a bypass to the high drywell pressure  ;

trip plus a manual inhibit, or elimination of the high  !

drywell pressure trip plus a manual inhibit, as preferred i alternatives for achieving conformance with the NRC l NUREG-0737 position. The NRC has accepted these options in their Safety Evaluation Report on II.K.3.18.

]

The existing Automatic Depressurization System' design, requires a LOCA signal consisting of concurrent high drywell pressure and low reactor water. level

l signals. When both high drywell pressure and low water q signals have been received, a 120 second delay timer j starts. The timer is automatically reset '

if the low low water level trip clears before the timer trips. It can also be manually reset. The timer allows the operator time to bypass the automatic blowdown by l resetting the logic if the conditions have corrected themselves or if the signals are spurious. To complete 3 the sequence, the low pressure ECCS pumps are 1 automatically checked to ensure that makeup water will be delivered to the vessel once it is depressurized.

Events such as a break external to the drywell or a stuck q open safety / relief valve (SRV) do not necessarily cause a high drywell pressure signal. The ADS valves may be individually opened, if required, for such events. (

Following the Three Mile Island accident, increased emphasis has been placed on eliminating. manual actions which are needed to assure adequate core cooling.

Eliminating manual actions to activate ADS during events which do not cause a high drywell pressure signal is consistent with this emphasis.

During development of the ADS logic, consideration has been given to events where automatic depressurization is not desired. These include spurious activation and ATHS events. For the situation where the reactor protection system has failed to function, the Emergency Procedure Guidelines (EPGs) direct the operator to prevent the ADS action. This may be accomplished by repeatedly resetting the 120 second timer or by locking out all low pressure i -ECCS pumps. Neither of these options is desirable I

considering the activity required of the operators during .

such events and the need to maintain suppression pool cooling.

The proposed modification will provide both a bypass of the drywell pressure signal after a set time delay and a manual inhibit function. The low RPV-pressure permissive of the RHR and Core Spray pump start logic will also be bypassed after the same time delay. This will further automate the ADS system by providing automatic ADS initiation, if required, for events such as a break external to the drywell or a stuck open SRV. .The modification also provides the capability to more easily inhibit ADS operation.

The bypass is accomplished by incorporating into the logic system design a second " bypass" timer actuated on l the same RPV low-low level trip point, as in the current l design. The trip picks up a new KX relay, which -

i satisfies the RPV low-low level portion of the logic, and 1

)

l l

l

starts the new nominal 11 minute time delay relay. This  :

also activates an alarm that indicates the bypass logic has been activated. After the set time delay, the time delay relay contacts located in the drywell signal bypass circuit (and the RHR and LPCS pump start logic low RPV pressure permissive bypass circuit) are closed, affecting j the bypass. The existing 120 second timer is then i started and the ADS solenoid energized, after the timer runout, provided that at least one low pressure pump in that division is running. The logic will also result in continuation of a vessel blowdown once it has automatically started even if the low pressure pump running signal is interrupted. When the low water level signal has cleared, or the reset pushbutton is pressed, all the timers are automatically reset.

A manual inhibit switch is also included in this modification. The manual inhibit switch allows the  ;

operator to inhibit ADS operation without repeatedly pressing the reset pushbutton. One manual inhibit switch  :

will be provided for each division. The switch will be a standard two position maintained contact type switch.

Each switch will activate a white indicating light and an annunciator to alert the operator of the inhibit action.

The pressure relief function and individual SRV control wi'll not be affected by operation of the manual inhibit switch.

In addition to NUREG-0737 modification requirements, this design change includes a recommended modification of the ADS logic to permit the continuation of vessel depressurization once it has started even if the low pressure ECCS pump running permissive is lost.

3.9.3 Desian Chance Evaluation 3.9.3.1 Systems /Comoonents Affected Changes to ADS (a) Automatic start of vessel depressurization on low-low reactor vessel water even if high drywell pressure is not high.

(b) If automatic depressurization has started, loss of low pressure pump running signal will not terminate vessel depressurization. (Using the reset pushbuttons will interrupt the depressurization and restart the timers.

However, if the low pressure pump running signal was lost after pushing the reset pushbuttons, ADS will not reactivate automatically.)

1 l

(c) Resetting the timers will deley ADS by 13 minutes if the sequence was activated by only low RPV water level. If high drywell pressure started the sequence, reset action will delay ADS by 120 seconds.

(d) The use of " ADS Inhibit" switches will disable auto initiation logic, but use of  !

the " ADS Inhibit" switches will not terminate a valid initiation of ADS once the actual blowdown has begun.

Chances to RHR and Core Sorav (a) The low RPV pressure permissive (400 psig) i to start the RHR and Core Spray pump will be bypassed after 11 minutes of sustained low water level. The same timer whose contacts bypass the high drywell signal in I the ADS logic will also close contacts in y l the'RHR and core spray pump logic.

l 3.9.3.2 Safety Functions of the Affected Systems l

ADS (FSAR Section 6.4.2)

Safety Function: In case the capability of the i

Feedwater System, Reactor Core Isolation Cooling (RCIC) System, and HPCI System is not sufficient to maintain the reactor water level, the Automatic Depressurization System functions to reduce the reactor pressure so that flow from LPCI and the Core Spray System enters the reactor in time to cool the core and limit fuel clad temperature.

Core Sorav System (FSAR Section 6.4.3) j Safety Function: In case of low water level in the reactor vessel, or high pressure in the drywell, when reactor vessel pressure is low 4 enough, the Core Spray system sprays water onto the top of the fuel in time and at a sufficient rate to cool the core and limit fuel clad temperature. j l RHRS (LPCI Mode) (FSAR Section 6.4.4) i Safety Function: In case of low low water  ;

level in the reactor vessel, or high pressure . '

in the drywell, when reactor vessel pressure is l low enough, the LPCI mode of RHR pumps water into the reactor vessel in time to flood the core to limit fuel clad temperature.

i

__-__-.-- - _____ - _ - _ D

i 3.9.3.3 Potential Effects on Safety Functions.

Effect of the ADS Loaic Chanaes  !

)

Addition of the bypass timer around the high drywell pressure signal will allow ADS to depressurize the reactor vessel for those events which have previously required manual operation. The existing logic is designed for protection against excessive fuel cladding heatup upon loss of coolant, over a range of steam or liquid line breaks inside the drywell. The addition of the bypass timer 1 would not change the system's response to {

, breaks inside the drywell, but will broaden the I spectrum of events to which ADS will automatically respond.

Manual depressurization has been required for events such as: RPV isolations (including I breaks outside the drywell) with a loss of high pressure makeup systems, and a stuck open relief valve. This change will provide additional assurance of adequate core cooling for these events which do not directly produce i a high drywell signal, by eliminating the need for manual actuation to assure adequate core cooling during these events.

Addition of a blowdown seal in relay may allow the ADS blowdown to continue, even if all low pressure CSCS pumps are lost, and the low pressure pump running permissive in the ADS logic is lost. This change may cause the blowdown to continue without low pressure makeup. This change will not change the number er type of events to which ADS is capable of q responding. The change may allow the blowdown 1 to continue once it has begun.

Addition of the " ADS Inhibit" switches could allow the operator to disable the automatic actuation of ADS. The operator has the ability to delay the initiation of ADS indefinitely ender the existing logic, by pushing both timer reset pushbuttons every 120 seconds. This change will offer the operator the existing ability to inhibit ADS actuation without resetting the time every 120 seconds. It will reduce the possibility of inadvertent initiations of ADS by reducing the number of operator actions required to keep ADS inhibited.

1

_ _ _ _ _ _ _ __ ___ -_. __ ._ ._ _ __ . _ _ _ ---_ A

Effffft of the Core Sorav and RHR Chanaes 1

These changes will not reduce the number or types of events to which Core Spray and RHR presently respond. The addition of the bypass L timer, contact around the low reactor pressure signal will allow the low pressure ECCS pumps to respond, in concert with ADS, to those additional events discussed'above.

3.9.3.4 Analysis of Effects on Safety Functions Analysis of the Effect of the ADS Changes l (a) Addition of hiah drvwell oressure bvoass i timer: NUREG-0737 Item II.K.3.18 requires that the ADS actuation logic be modified to eliminate the need for manual actuation to assure adequate core cooling. The BHROG responded to_this requirement with NEDE-30045.

NEDE-30045 states that transients and accidents which do not directly produce a high drywell. pressure signal, and which  !

are degraded by a loss of all high pressure injection systems, require manual 1 depressurization of the RPV followed by I injection to assure adequate core cooling. NEDE-30045 groups these events into two classes: (1) RPV isolations (including breaks outside the drywell) with loss of high pressure makeup systems, and (2) RPV isolations with a loss of high pressure makeup systems, further degraded by a stuck open relief. valve.

NEDE-30045 then refers to NED0-24708A <

" Additional Information Required for NRC l Staff Generic Report on Boiling Water-Reactors", Section 3.5.2.1, and says that the operator has at least 30 to 40 minutes-to initiate ADS and prevent excessive fuel cladding heatup for both the classes of events listed above. This 30 to 40 minutes was based on starting from full power with equilibrium core exposure and complete failure of all the high pressure i makeup systems.  !

The addition of the high drywell pressure bypass timer is one of the two changes ,

proposed by NEDE-30045 that I

l L_______._________ ___ _._ _ _ _ _ _ _ _ _ _ _ _ . _ .__ ____1

the NRC accepted. An analysis of the effect of adding the high drywell pressure bypass timer was conducted.

In this analysis the class of transients and events that do not pressurize the containment, but eventually require ADS to depressurize the reactor vessel, were investigated. The limiting case for this

, class of events is a Reactor Hater Cleanup line break outside primary containment.

This event also assumed a loss of all high pressure makeuo systems. The analysis evaluated bypass timer settings of 16,17, 18,19 and 21 minutes for their effect on peak clad temperature (PCT) during the event.

The analysis also concluded that a bypass timer setting of 16 minutes will not exceed the conservative limit of 15000F.

Another analysis on the minimum allowable time delay for ADS initiation for ATHS events recommended that the minimum time delay between the ADS low level setpoint signal and actual depressurization is 6 minutes.

The actual time delay setting of 11t2 minutes was chosen as providing equal margin from both the maximum and minimum recommended bypass timer settings.

Electrical separation and the single failure criterion of the original design of ADS, RHR and Core Spray Systems was satisfied by conformance to IEEE 279 (1968).

This change provides further improvement in electrical separation for RHR and Core Spray Systems. The added events of the above systems that are powered by bus "B" will be routed in flex conduits in panel 932.

The circuits added to the existing ADS logic that is powered by bus "B" are not required to be routed in flex conduits, since the entire ADS is a " Division I" system.

Moreover, the bus "B" is protected from l faults which may occur in the " Division I" panel 932 by fuses in the individual circuits, and by circuits. overload protection in the power distribution panel.

The electrical equipment to be installed has been seismically qualified per IEEE 344. The equipment to be installed are relays (Agastat Type TR and GP), switches (GE type CR2940), and-indicating' lights (GE type and ET-16).- The switches and indicating lights will be installed in .

panel C903 and the relays will be  !

installed in panel C932.

Analysis has been performed to show that the devices installed in the subject panels (C932 and C903) of this modification are appropriate for the j seismic environment. j Calculations were performed to develop l in-structure response spectra (IRS) for l panels C903 and C932 and to compare the manufacturer's test response spectra (TRS) for the relays.to the TRS curves for panel C932. Likewise, another calculation was-developed to compare the manufacturer's TRS for.the switches and lights mounted in panel C903.

(b) Addition of the blowdown seal-in relay:

Analysis for this logic modification is summarized as follows:

It can be assumed that vessel depressurization started because all the necessary conditions' to initiate ADS have been satisfied, i.e., high drywell pressure low low RPV water. level, and 120 second timer runout with a. low pressure pump running (such as'for a LOCA inside  ;

the drywell); or new bypass timer-runout,  !

low RPV water level and 120. seconds timer  !

runout with a low pressure pump running ,

(such as for a LOCA outside the-  !

containment) and no operator action to  !

inhibit ADS blowdown. If all these.  !

conditions are satisfied vessel  :

depressurization should not be interrupted. ,

l l

i l .

a l

N ___

Analytical results for the limiting LOCA-used to establish the bypass timer setting -

show that 60-90 seconds after all the ADS SRV's have opened the vessel water level will have decreased to a point where it l would collapse to approximately two thirds core height if the depressurization was halted. Revision 4 of the Emergency l Procedure Guidelines Contingency 3 J instructs the operator to depressurize the vessel by manually opening SRV's if water 3 level is this low so that he can provide effective steam cooling of the core while trying to get any available makeup system into operation. Thus the operator would have instructions to blowdown the RPV even if no ECCS pumps were available.

One of the objectives of NUREG-0737 is to reduce operator decisions during a postulated accident scenario. It'does not appear that maintaining the logic sequence that Pilgrim currently has in place, which l will terminate ADS. is the preferred j alternative. The design change .j recommended adds to the spirit of the  !

requirements addressed by NUREG-0737 and allows for continuation of an already started vessel depressurization sequence.

Addition of the " ADS Inhibit" Switches As part of the BHROG response to NUREG-0737 Item II.K.3.18. NEDE-30045 also considered Anticipated Transients Without Scram (ATHS) ,

events in the development of the proposed change to the ADS logic. The addition of a manual ADS inhibit switch was part of both of the approved, logic change options.

The keylocked " ADS Inhibit" switches provide capability to conveniently disable the automatic logic for starting vessel depressurization. The E0P's provide instructions to deliberately disable the ADS

-logic for the following two conditions only:

i j

1 i

)

i

i (1) There has been a failure to scram, water  !

level is dropping or being reduced and Standby Liquid Control System has been activated:to inject boron. For a failure to scram event, E0P's provide a specific ,

method for vessel blowdown, if required, i to avoid uncontrolled low pressure cold i water injection and concomitant potential j reactivity excursion. In this scenario, i the ADS Inhibit switches aid the operator by permitting him to concentrate on'other variables instead of having to remember to )

repeatedly use the reset pushbuttons. ]

(2) A liquid line break has occurred, core i uncovery is a concern and it is desirable I to conserve remaining liquid inventory. l The operator, who has more information available than the automatic system logic, has entered the E0P's under Contingency 1

1. He uses the inhibit' switches to. avoid ADS actuation while increasing coolant injection into the vessel. The operator-will manually initiate vessel blowdown, when it is required, in this scenario.

Analysis of the Effect of the RHR and Cora_

l Sorav Chances Implementation of the ADS logic modification described above requires that the pump start logic to RHR and Core Spray be changed. 'This aspect of the ADS logic system change was analyzed by General Electric for the BWROG.

This analysis states that neither low RPV j pressure nor high drywell pressure would be expected on a timely basis for the events that the ADS change is intended to cover. Thus, the >

timely' start of the low pressure pumps could i not be assumed without operator action.  !

Furthermore, since automatic initiation of ADS i requires confirmation that at least one low pressure pump is running, timely ADS actuation could not be assured without operator action.

Addition of the time delay relay contacts around the low pressure permissive allow for i

the actuation of ADS as described above. The proposed logic change retains all of the i 4

)

i existing design features of the pump start logic, and also allows the loc pressure pumps to start and respond to the additional events outlined in the analysis of the ADS modification.

3.9.3.5 Desian Chance Evaluation Conclusions In conclusion, the addition of the Automatic Depressurization System (ADS) modifications to the existing logic meets the requirements of NUREG-0737.

These changes do not increase the probability of occurrence or consequences of an accident or i malfunction of equipment important to safety previously evaluated in the FSAR. These changes retain all of the existing logic, and do not modify the response of the systems to the accidents previously analyzed.

These changes do not create the possibility for accident or malfunction of a different type than any evaluated previously in the FSAR. The additional bypass timer relays and bypass timer contacts have been integrated into the existing logic channels, maintaining the redundancy and diversity which protects these systems from I single failures.

1 l

l

G N

I D D T E E S D I

ST X D DA EA I ATI

-- N I

_A _

M p E .l,[

9 T T S ].l SIB D!

Y AH -

I

- S N C S ,I* . LIei' R

N S N Y

AN j OP R M T

R O O I

M H U A I

2 R P T TI m S AT 1

Y

- .. T H N Z C I

A 9 . SEC A RI . EM 3 . R'S U F I S D E S

E O R U R R M G R

O O I

P C F E I

_! , 'l'l.l IL .'"'r

&r D G O

- ~

x- ~

CL .

l ' I_

~

I T _AND

. h7 EA Y N~

L I~

A

- M E M ' r .

m-I M~

1 T D 1~ m{-

[l

- .],1s(

O # %]

T U

- A /s

- S

- S E

R G L S I

- P V S

- L H L S P L G W E

- I R O 0

- E H T 0 W L Y W x 4

R x

- D R L $,

l1

3.10 ADDITION OF ENRICHED BORON TO STANDBY LIOUID CONTROL SYSTEM 3.10.1 Obiettive of Desian Chance The use of enriched sodium pentaborate to the SLCS allows Pilgrim to meet the requirements.the NRC's Anticipated.

Transient Without Scram (ATHS) Rule (10 CFR 50.62) with one pump operable thereby retaining the redundancy of the SLCS design. While redundancy is not required by the Rule, it improves SLCS reliability. The reduction in maximum allowable solution concentration from 16 to 9.22 weight percent reduces the maximum solution saturation temperature from 70*F to 38 F. This extends the range of SLCS operability under degraded plant conditions. The additional system changes are being performed to simplify testing and minimize enriched sodium pentaborate loss.

3.10.2 Design Chance Description This change (Figure 3.10-1) replaces the Standby Liquid ControlSystem's(SLCS)existingsodiumpentaborgge solution (natural boron.with 19.8 atom percent B' ) of 9.4 to 16 weight percent concentration with an enriched sodium pentaborate.

54.5atompercentBgglution(boronenrichedgreaterthan u) of 8.42 to 9.22 weight percent concentration. In addition, this change recalibrates and revises the setpoints of the level and temperature sensing instruments, relocates the SLC pump 207B test i button near the test button for pump 207A and locates a new pressure gauge near the test buttons. The recalibration and revision of level and temperature I sensing instrumentation is required, due to the solution.

concentration change.

The SLC's Technical Specification change. includes the solution concentration requirements, surveillance j

requirements, and bases for the new enriched sodium pentaborate solution.

Analysis indicates that the use of an 8.42 or greater percent concentration of enriched sodium pentaborate (enrichment exceeding 54.5 atom percent boron BIO) wjit meet or exceed the NRC ATHS rule 10 CFR 50.62 equivalency.

requirements of the Standby Liquid Control System (SLCS) -1 at Pilgrim Nuclear Power Station.- This analysis is based ,

on an injection rate of 39 gallons per minute. The 1 required quantity of enriched sodium pentaborate is less 4 than 2500 gallons. l Each pump of the SLC System has a minimum discharge capacity of 39 gallons per minute and the enriched sodium.

pentaborate solution tank has a low level volume (net) of 3960 gallons. The design is, therefore, adequate to  ;

satisfy the NRC ATHS rule requirements. The solution u

temperature will be maintained above 48'F at all times.

An annunciator in the main control room will alarm if the temperature in the Standby Liquid Control tank or pump suction piping falls below 48*F.

3.10.3 Desian Chance Evaluation 3.10.3.1 Systems /Comoonents Affected S_tandby Liouid Control System The performance of the system is improved by this change. The modified system performs at increased reactivity control capacity to meet the NRC ATHS rules equivalency requirements of 86 GPM/13 weight percent of normal sodium pentaborate solution.

If the enrichment option was not used, two pumps would be required to meet the NRC's ATHS rule. With the enrichment option, the reliability of the system is maintained, since only one pump is required to satisfy the NRC's ATHS rule. The system retains one redundant pump.

The low crystallization temperature (38'F corresponding to a 9.22 weight percent concentration) of the enriched sodium pentaborate solution will further improve the system reliability. This reduces the possibility of reactor shutc'own because of solution temperature requirements.

Theresponsetimeofthesystemisimprovggby this modification due to higher rate of Bi injection into the reactor.

The relocation of the test button for SLC pump 207B and the addition of the pressure gauge will facilitate the system testing and does not affect the safety performance of the system.

3.10.3.2 Safety Function of Affected Systems / Components The safety function of the SLC system is to provide a backup method, which is independent of the control rods, to maintain the reactor subcritical as the nuclear system cools, in the event that not enough of the control rods can be inserted to counteract the positive reactivity effects of a colder moderator (FSAR Section 3.8.1). This change has an impact on the safety analysis.

3.10.3.3 Eotential Effects on Safety Function The enriched sodium pentaborate change to the SLC will upgrade the system to the reactivity control capacity requirements of the NRC's ATHS rule (10 CFR 50.62) and still provide the equivalent of 700 ppm of natural boron to maintain the original system shutdown requirement.

The low crystallization temperature (38 F corresponding to a 9.22 weight percent concentration) of the enriched sodium

!- pentaborate solution allows .the reduction of the tank heater and heat tracing setpoint to 53*F. This temperature is 5 F above the low temperature alarm setpoint of 48 F. The low solution crystallization temperature and the new tank heater and heat' tracing setpoint will reduce the possibility of reactor. shutdown because of solution temperature requirements.  ;

The addition of the pressure gauge and the relocation of the safety related test button for SLC pump 2078 will not have any adverse affects on the safety functions of the SLC system. Materials for these changes will be procured, installed and tested in accordance with safety related requirements.

3.10.3.4 Analysis of Effects on Safety Functions Analysis shows the use of an 8.42 or greater percent concentration of enriched sodium g

pentabora{u)(willmeetorexceedtheNRCATHS-enriched percent B to gre rule 10 CFR 50.62 requirements of the SLCS at Pilgrim Nuclear Power Station. This analysis is based on an injection rate of-39 gallons per minute. As each pump of the system has &

minimum discharge capacity of 39 gallons per minute, the design is adequate to satisfy the NRC ATHS rule requirements. The minigm concentration of 8.42 percent and a Biu enrichment greater than 54.5 percent provides a total margin of 136 percent beyond the amount needed to shutdown the reactor.

1 w_ __ _ _ _

The upper limit, 9.22 weight percent, concentration of enriched sodium pentaborate has a saturation temperature of 38'F. To preclude precipitation, the minimum solution temperature will be maintained above 48 F, which is 10*F above the saturation temperature of the maximum concentration. In order to ensure a solution temperature greater than l 48*F, the solution temperature will be determined daily. This frequency is considered adequate because the room minimum design temperature is 60 F, and any temperature change would be gradual. In addition, the daily monitoring will be backed up by the tank heater, heat tracing, and low temperature alarms. If the solution temperature in either the tank or pump suction lines reaches 53*F, the tank heater or heat tracing will commence l operation. If the solution temperature in either the tank or suction lines continues to drop to 48'F, the. operator will receive an alarm in the control room. The reactor will be placed in a cold shutdown condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the solution ~ temperature is less than 48*F.

In order to comply with the ATHS rule (10 CFR 50.62), the boron in the sodium pentaborate i solution must be pnriched to grgater than 54.5 l atom percent of B'0 If the B W enrichment is )

found to be less than or equal to 54.5 atom i percent, the operator will determine if the original shutdown criteria (equivalent of 700 ppm of natural boron) can be met. If the original shutdown criteria cannot be met, the reactor will be placed into a cold shutdown condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If the' original shutdown criteria can be met, there is a seven day period in which to return the B10 enrichment to greater than 54.5 atom percent i If at the end of this seven ys withinsevenpven.

day period, B richment is still less than i or equal to 54.5 atom percent, the operator i will notify the NRC in writing of. plans to  !

bring the enrlthment into compliance. In order  ;

to ensure a B u enrichment greater than 54.5 j i

l l

l i

n

!) .A percent. B10 enrichment will'be determined prior to restart from a refu? ling outage or any time boron is added to the storage. tank. his frequency'isconsideredadequatebecauseB{0is a stable isotope and enrichment changes can only occur.when additional boron is added. In addition, to ensure that the toron.added is enriched properly, station procedures' will require that Bi0 enrichment be determined as part of the receipt inspection before release of the material for use and the results of the test known within 30 days of samplifg the-material in the Standby Liquid Cortf ol Storage tank. The 30 day time period allus sufficient time to perform the enrichment test and receive the test results.. It is considered adequate from a safety poi 6t, due to the station procedure requirenients to determine enrichment as part of the receipt. inspection before release of the material for Use. The requirement to determine enriGw.nt after the addition of boron to the storage tank functions as a backup check to the station procedures.

The storage tank high and low level alarms are being maintained at their original. volume setpoints. The high level alarm alerts the tank overflow.. The original vo'uas concentration requirements were such that,

, should evaporation occur, a low level alarm would annunciate before the temperature-concentration requirements were exceeded. For the original solution, the maximum possible attainable concentration at the low level alarm was 14: weight percent.

This corresponded to/a saturation temperature of 60 F which is less than the original 65 F setpoint of the heat-tracing. This ensured the operator was given an alarm before crystallization could occur from'high solution concentration. The requirement for a low level I alarm to annunciate before temperature-concentration requirements are exceeded is not needed because of the'new lower solution concentration requirements (8.42 to l 9.22 weight percent). .Since the maximum j concentration of the.new solution is 9.22  ;

weight percent, the maximum possible solution j concentration obtainable from evaporation j without a high or low level alarm is .i approximately 10.3 weight percent *. . This l corresponds to approximately a 44.F solution temperature (low solution temperature alarm-  !

setpoints is 48.F). 'Due to the 54.F setpoint

! of the tank heater and heat tracing and the design room temperature of 60.F to l'00.F solution concentration' changes due to evaporation would be slow. The operator would be alerted to a solution concentration change from evaporation by either the low level alarm or the monthly surveillance test results before the cryst.111zation point is reached.

• Hiah Level Alarm (4410)

' Low Level Alarm (9.22) - (3960) (9.22) - 10.3 weight percent l

l 3.10.3.5 Design Chance Evaluation Conclusions The addition of enriched boron to the SLCS increases the system's control capacity to satisfy NRC ATHS rule requirements. The modified system is more effective than the existing system-in bringing the reactor to the cold shutdown condition from rated power.

Hence, the change does not increase the consequences of an' accident.

, This change does not call for the safety l' equipment of the system to work at higher pressures, temperatures and more severe conditions than the existing levels. The change maintains the current SLCS pump's redundancy, and it does not change the logic of the system. Hence, the change does not increase the probability of the malfunction of the equipment important to safety.

This change increases the margin of safety for system availability by reducing the. possibility of system unavailability from solution temperature requirements.

This change increases the margin of safety for

, flow rate requirements (required 39 GPM:

l available 78 GPM) and'for minimum volume of l

solution requirements (required 2068 gallons at a mid-range concentration of 8.82 percent; available 3960 gallons).

t D n I e w c 0 U r e

Q lo n P ..

0 f

r o 0 I

e r o e G 5

L v m O _

l Bpto nto 9 6

t Y

B k mot u s m eA 4 0 0

. n I h5 5

a D -

) m c i4 4 N T ee in0 rn 5 A mn u o i1 MBE > 0 T

S m lo Z . .

0 0

iu Ve r n 4 O d it o ot n i T Sg h t

E a 0 i

iu( mt r N me n u n .. 0 O uW o it imc e 5 3

R im e a

- O inta f

ot r in n one 0 n

)

s n n M CL i

B Mr o c e f b c

. . 0 lo D oa n 0

3 G la

%Co t

E en (

H in e e C LP 0 m

/

0 I ..

u R 5 loV 2

N M E E 8 k T \ 6I 0 n 0 a F S 0 _ . 0 T O Y 2 2 t S

o N

N O L 0 0 -

I O . .

5 V T R 1 I T D N 0 D O 0 A C . .

0 1

1

- 2 2 2 0 2 8 4 0 0 . .

1 9 8 8 5 3

. ~ - -

E . " ~

-~ - " 0 R 9 5 U

G "59 8 8 5 7

7 5 6

6 I

F t e

a r y o b b

a n t

n o e it t1 P a r

g t

n ie

_ m iu c e W d n o o S C 4j'

3.11 AIHS FEEDHATER PUMP TRIP 3.11.1 Objective of Design Chance During an anticipated transient without scram (ATHS) initiated by MSIV closure, reactor power is controlled by controlling. reactor coolant flow and reactor water level. This proposed change will provide automatic trip to all feedwater pumps at 1400 psig reactor vessel pressure. The 1400 psig setpoint is selected so that feedwater pump trip occurs only when an ATHS event occurs following closure of Main Steam Isolation Valves. The 1400 psig setpoint is higher than any pressures obtained during any design basis transient or accident.

Therefore, this trip point does not affect the normal plant design basis current evaluations. . Stopping the feedwater flow into the vessel will automatically reduce reactor water level and reactor power.

3.11.2 Desian Chance Description The proposed design change (Figure 3.11-1) package provides an ATHS trip of the feedwater pumps. The current ATHS design consists of trips of the recirculation pumps and initiation of the Automatic Rod Insertion (ARI) system on low low water level or high reactor pressure. The feedwater pumps will be tripped on high reactor pressure (1400 psig) only for the ATHS event.

The existing reactor feedwater pump trip logic will be modified to accept an additional trip signal from ATHS.

This is accomplished by installing a new trip coil (in addition to the existing trip coil) within the breaker associated with each reactor feed pump. Control power for the new trip coils is Division "B" from switchgear A205 for pumps P103A and P103C while Division "A" control power from switchgear A101 is utilized for pump P103B.

Four new slave trip units will be installed in the ATHS panels C2277 and C2278 (two in each) to provide the tripping signal from reactor vessel pressure transmitters 263-122A, 263-122B, 263-122C and 263-122D.

New cables will be installed between the ATHS panels C2277 and C2278 and the switchgear cubicles A101, A102 and A205.

This design change shall resist failures that could prevent any safety-related equipment from performing its nuclear safety function. All essential equipment (slave i trip units, indicating lights, switchgear trip coils, l fuseblocks, fuses, cable and panel wire) shall be i purchased Q. All cable is to be installed seismic Category I with electrical separation for fire, missile and pipe break maintained consistent with FSAR Section 1 8.9. Electrical channel separation shall be maintained i in accordance with Regulatory Guide 1.75 except for the internal wiring to the 4 kV switchgear. Flexible metal conduit will be utilized to separate the redundant wiring within the switchgear cubicles.

3.11.3 Desian Change Evaluation 3.11.3.1 Systems /Comoonents Affected The ATHS system and the feedwater systems are directly affected by this modification. The ATHS system is affected due to the additional trip cards being used, which result in additional load on the power supply (E/S 2600A, B) and additional heat loads in cabinets C2277 l and C2278.

l l

J

- - I

l l

Feedeater System The feedwater system is affected in that a second trip coil will be added-to the reactor feed pump breakers (A101, A205, and A102) and two additional breaker trips will be added (one to each breaker coll). The modification will not degrade the normal operation of feedwater system because the logic will require 2 high pressure signals to trip the breakers.

l Therefore, one failure will have no effect on the system.

Power Sunolies Safety related AC and,DC power supplies are indirectly affected by this modification.

Table 1 lists the affected power supplies, breaker providing isolation, and associated load.

Table 1 ATHS' Power Sunolies i Panel Breaker Lqad Y3 8 C2277 Y4 8 C2278 036 2 C2277 D37 2 C2278 04 5 Al Control Power DS 5 A2 Control Power The breakers listed in Table 1 provide the isolation between the safety related power supplies and the non-safety related ATHS system. In addition, the relays in C2277 and C2278 provide coil to contact separation of the Rosemount trip cards and the remainder of the  ;

circuit, including cables and trip coils. 1 ATHS panels C2277 and C2278 will have.two new slave trip units added to each cabinet. One of-I the existing master trip units on each cabinet will be moved 1 card file position so_as to allow the slave units to be located next to the master units. uAn evaluation of the additional heat load due to the additional trip cards has' l

le i

.m.___m_ am__...______2 ____ - _ - - __ -

been performed. This evaluation ensures that the temperature in the cabinets is acceptable.

The additional load on the power supplies has ,

been evaluated and ensures that the capacity of 1 the power supply is not exceeded.

The feed pump breakers (A101, A205, and A102) will have a second trip coil added. Each trip coil (the existing coil and the new coil) will receive a signal from the ATHS system. One f q

coil will receive a Division I signal and the- >

i other coil will receive a Division II signal.

The wires within the switchgear will be separated from each other as much as practii.al so as to minimize the potential of the failure of one division affecting the other division.

The normal operation of the non-Q feed pump breakers will not be degraded by the modification for the following reasons: (1) the trip cards being purchased from Rosemount are being purchased as "Q" items and have a proven record of reliability throughout the industry; (2) the logic will be a two-out-of-two logic so that a single failure of a trip card or transmitter will not cause the feed pump breaker to trip; (3) the cables from the ATHS panels to the switchgear will be routed in seismic Class I mounted raceways (separate raceways for each division) to ensure that failure of one division will not affect the other division; (4) the wires within the switchgear will be separated as much as practical; (5) the new trip coils will be purchased via the CQI process to ensure that quality is the best available for commercial parts; and (6) installation will be performed and inspected per "Q" standards. As a result, the reactor feed pump breakers and the feed syttem will not be degraded.

3.11.3.2 Sa'ety Functions of Affected Systems /Comoonents The only portion of the feedwater system that has a safety function is that portion of the feedwater system that is also part of the nuclear system boundary-(FSAR 4.11.2 and Q' List, Page 2-3). The feedwater system does ~i h6ve a Power Generation Design Basis of providing water to the reactor vessel during i power operation (FSAR 4.11.3) and to maintain a pre-determined vessel water level (FSAR 7.10.1). )

1

]

l

_o

The ATHS system (Recirculation Pump Trip and I Alternate Rod Insertion) has a design objective of introducing negative reactivity to the reactor in the unlikely event of a failure to scram (FSAR 3.9-1). The existing Recirculation Pump Trip (RPT) supplements the functional performance of the Reactor Protection System (RPS) and is independent of the RPS (FSAR 3.9.2). The RPT occurs at either high reactor-pressure (1175 psig) or low low reactor water level (-46 inches indicated level) (Technical i Specification pages 44a and 59a).

The function of the ATHS panels (C2277 and j C2278) is to process the signals (proportional l to reactor pressure) from PT263-122A, B, C, and 1 0 and the signals (proportional to reactor level) from LT263-120A, B, C, and D. The panels currently provide a trip signal to the )

Recirculation Pump Motor Generator Field i Breaker at 1175 psig or -46 inches indicated j level. -

3.11.3.3 Potential Effects and Analysis of Effects on Safety Functions This change does not affect the feedwater system piping and, therefore, has no effect on the feedwater system safety function. The change could affect the power generation design basis of the feedwater system due to adding new methods to trip the feedwater pump breakers.

Failures in the circuit that could cause the trip coil to be energized, could cause an inadvertent trip of the feedwater pumps. The potential failure is being minimized by purchasing the trip card, indicating lights, and cable to the same criteria as safety related equipment. The trip coil and fuses will be purchased via the Commercial Quality Item (CQI) process. Fuse blocks will be

! purchased via one of the above methods. 'The installation of all items will be performed and inspected by Quality Control personnel as safety related equipment. The. raceways will be supported per the criteria for seismic Class I l raceways.

The two trip coils (one existing and one new) have to be mounted side by side in the breaker cubicle. Separation of the coils in the non-safety related breaker is not possible.

1 1 l I

The wires eithin the switchgear will be separated as much as practical in an effort to prevent failure in one circuit from affecting the other circuit. Switchgear Al and Al do not have existing seismic qualification data available and, therefore, mounting of the additional trip coil and fuse blocks cannot be analyzed for their effect on the breaker and the switchgear. The equipment will be mounted as rigidly as possible.

ATHS panels C2277 and C2278 seismic qualification data has been reviewed to verify that the additional trip cards and lights do not invalidate the panel qualification and, therefore, will not affect the design function of the ATHS system.

The safety function of the vital AC (Y3 and Y4) and DC (D4, 05, D36 and D37) power panels will not be affected by the modification because the isolation breakers, as listed in Table 1, are not being modified and the additional loads on Y3, Y4, D36 and D37 are approximately 225mA per trip card (Rosemount Product Data Sheet 2471),

which is insignificant to the power panels.

During normal operation there is no additional load on D4 and D5.

Fuses are being placed in the trip circuitry (located in both the switchgear and ATHS panels) for ease of maintenance, not for separation of safety and non-safety equipment.

Failures in the trip coil circuitry cannot affect the remainder of the ATHS system because of the contact to coil separation provided by the relays in the ATHS panels.

The cables from the pressure transmitters to the ATHS panels, that transmit the analog signal, have circuitry such that a single failure of the cable could not disable / energize two trip cards. Therefore, a failure of the cable from the transmitter to the ATHS panel cannot cause a feedwater pump trip.

The circuitry inside the ATHS panels could cause all three breakers to trip if the panels were severely damaged and' specific wires shorted conductor to conductor. A single missile could damage the ATHS rack, panel, or conduit such that the feed pump breakers would trip. However, the above components are

i located in an area where failure due to missiles is not a credible failure.

The cables from the ATHS panels to the switchp ar are routed in separate raceways.

The circuit is an energize to trip circuit so that failure of a cable will not cause more than one feed pump to trip. The'only failure that could cause one breaker to trip would be a conductor to conductor short of the cable routed from C2277 (C2278) to A101 (A205).

A conductor to conductor short will cause the  :

existing trip coil of one feed pump to I energize. It would not affect the other two feed pumps. There is no single failure that can trip all three feed pumps. Therefore, this change does not increase the probability of a j total loss of feedwater.  ;

The equipment is not required for safe shutdown following a fire. However, the logic circuitry will be installed in C2277 and C2278 which are located in separate fire zones, separated by a l water curtain. Therefore, a fire in the J reactor building on the 51 feet elevation will not disable both trip systems.

The raceways from C2277 to Al/A2 and C2278 to-Al/A2 will be separated as much as possible so as to reduce the possibility of a. fire ,

affecting both trip circuits and preventing the (

ATHS system from performing its design function, j This change will have no effect on ATHS l Instrument Racks C2275 and C2276.

The trip card setpoint will be adjusted to 1400 )

psig which is high enough to prevent i inadvertent actuation during normal plant I operation.

3.11.3.4 Design Chanae Evaluation Conclusions The above analysis demonstrates that the modifications of the Feedwater Pump Trip Breakers do not degrade the existing feedwater I system, ATHS system, or safety related power  ;

supplies. It does not increase the probability.

of occurrence or consequences of an accident or malfunction of equipment'important to safety previously evaluated in the FSAR. .It does not create the possibility for an accident or i malfunction of a different type than any  !

evaluated in the FSAR. It does not reduce the margin of safety.

i i

l

______.__.n____ _

[

1 ql l  ! I j6 l l l g

- _ 7 2

y W

D C g l i J

_ 2 S 2 l 2 S C NI D - 5 P

_ 1 E O R A R f 0M 3 R t

1 i P L 2 U 6 P _

i T C t I

RO I

A P 2 C P I TC R

_ x E I N T R P

_ L R E T ER TE

- O 2_ _ F 2

AK

- I v_

O WA

- T i b

d _DE A D_

T U

P L ER

_EB I

- ' I C B _ C WO2 l RO

- I

_ 2 S I TC F 2 S

_ N D U _Fx I

1 E

O R

- - _ R A D l_R t

I 3 R I

T C ~

_ O _ 6 P _ _ C P l g l l l

- 2 x E I M _

PT R _ _

E L R T

_ _ _ j P l l l I

- 2 I

pl l I L p 0 P R 1MU l

II I I

- f 1

- i

- T 1

- t PL I I A_ P 1

i RO

- P TC R M3 f

i _ _ER TE

l I l AK l l UE I l 1 PR i t

_WA DE P L D U , t I

R OI

_ER I

T C _EB

- E G I f

I

_Fx E F , I iI I I J , l I I I I

_R 5

- F _ 7 _ p l l 1 L 2

R C 2 _ C

• g

- _ 2 C D O

. I 2 S _ N R

_ S O T

1

- - E _ _ t R A I gl l J

_ 3 R C l C

- 1

- T l A 6 P C P  !

IO P 2 _ ._

_ x E I 1 P IL M R

E T P R _ _

L 2

I RO A U

_ E T r P

R

- I 1 F TC

_ _ 0 R

- i v_ -

ER S D_ _ _ 7 0 TE

- 0 AK W _

A 2

_ _ C

• 2 WA P _

_DE

. I

- S N D l T 2 _. _ _ER l

- _ 1 S O R r IRO A EB

- 1

- E _ R A TC

- _ 3 R . _

r 1

T C i f

_F 6 P i

x

_ 2 _ _ C P

_R x E T

P R _ _ L RI I  ; l l L

- E T

- cI l I I I L pg g ; I I l f

I

- ,0?

3.12 M9 DEIFICATIONS TO REACTOR CORE ISOLATION GQ9 LING SYSTEM Ty_RBINE EXHAUST TRIP SETPOINT 3.12.1 Obiettive of Desian Change During Station Blackout (SBO) events, AC power is not available to operate motor driven ECCS pumps. The Reactor Core Isolation Cooling (RCIC) system pump is driven by a turbine operated by reactor-steam. Control and motor operated valve power for operation of the system are from the station batteries; therefore, the system would be available to maintain reactor water level during such an event. The RCIC Turbine Exhaust Pressure Switch causes the RCIC turbine to trip on high suppression pool pressure signal. Increasing the pressure setpoint will allow the RCIC system to be available until suppression pool pressure reaches the

! increased setpoint during an SB0 event when elevated l

suppression pool pressures are expected to cccur.

3.12.2 Desian Change Description This change (Figure 3.12-1) is proposed to enhance the ability of Pilgrim Station to respond to an SB0 event and is an instrumentation setpoint change. The design change increases the setpoint of the RCIC turbine exhaust line high pressure switches, PS 1360-26A/B, so that RCIC can i

be available at higher suppression pool pressures.

Pressure switches (PS-1360-26A, B) are located in.the turbine exhaust piping to detect high exhaust pressure, indicative of restricted or blocked exhaust piping.

These switches act to trip the turbine when their setpoint is reached. Present setpoint of 25 psig was selected to be as low as possible to detect blockage of the exhaust line without causing spurious trips on turbine starts and is consistent with the maximum discharge capability of the gland seal condenser vacuum pump. In an operating situation, the RCIC exhaust pressure is less than 10 psi greater than torus pressure. Exhaust line and turbine casing are protected against overpressure by a rupture disk set at 153 psi.

Assuming turbine exhaust pressure trip setpoint remains set at 25 psig, the trip point will be reached at about 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the SB0 event. Raising the trip point to 46 psig allows RCIC operation until about 15 1/2 hours into the event.

1 3.12.3 Desian Chanae Evaluation 3.12.3.1 Systems /Comoonents Affected l

RCIC Components directly affected are pressure switches PS-1360-26 A and B. These will be  !

re-calibrated to actuate at 46 psig. This l value is well within their adjustable range of 5-150 psig.

l The instrument effects of increasing the I pressure switch setpoint have been evaluated I and it has concluded that the new setpoint falls below the analysis limit (and the process safety limit) for exhaust pressure even when instrument inaccuracies are taken into account.  !

Components Indirectly Affected The high RCIC exhaust line pressure trip will be set at the increased pressure for all events l l which will require RCIC response. As discussed below, no adverse effects result from RCIC operation with a 46 psig backpressure either during non-accident conditions or during accident or SBO.

Turbine Casing l

The design pressure of the turbine casing is 165 psig. This is more than adequate for a backpressure of 46 psig. l Pinina Piping specification for the turbine exhaust line gives a design pressure of 100 psig and a design temperature of 325'F; therefore, there is no concern with the exhaust line piping 1 design if the turbine exhaust pressure is I

changed from 25 to 46 psig. These design values are used in allowable stress analysis and nozzle loads.

Gland Seal Condenser Subsystem l

The gland seal condenser vacuum pump will not be functional if the turbine exhaust pressure l is near 50 psig, as the vacuum pump maximum discharge pressure is 25 psig. The total gland steam leakage of approximately 220 lb./hr. for 50 psig will still be condensed in the l

l _-_ _______-_ _ __ - - -

barometric condenser (part of the gland seal condenser subsystem) provided the condensate storage-tank is used as a suction source for RCIC. The barometric condenser, if cooled by  ;

CST water, is capable of condensing the entire i amount of gland steam leakage; however, for conservatism when calculating room  !

temperatures, 70 lb./hr. of steam was assumed  ;

to escape to the room environment. This is based on the expected gland steam leakage with the seals degraded to about 101. beyond the recommended replacement clearance. The non-condensible leakage from the vacuum tank relief valve is expected to be linear with backpressure.

Turbine Control Valve /Pumo-Turbine Performance An increase in turbine exhaust pressure up to i 46 psig is expected to cause the turbine i control valve to open further to provide for a given power demand. Also, the turbine will deliver less power at very low inlet steam pressures when the exhaust pressure is higher.

The pump / turbine performance curves published by the turbine vendor already consider an exhaust line pressure of 50 psig. Therefore, RCIC system capacity and flow rate are adequate during those accidents or transients in which RCIC response is part of the current Pilgrim Nuclear Power Station licensing basis.

Nozzle Loads External forces and moments distort the turbine exhaust nozzle; pressure alone does not. An i increase in allowable turbine exhaust pressure j could be accompanied by a corresponding I increase in nozzle loads transmitted into the  !

turbine exhaust nozzle by the piping system.

The piping design already considers nozzle ,

loads at the piping design. pressure of 100 '

psig; therefore, the limits provided on the turbine outline drawing are still met.

Environmental Conditions The operation of RCIC with an increased exhaust pressure does not result in RCIC equipment room temperatures and/or humidity in excess of the 1 environmental service conditions in which RCIC is qualified to operate for a period of approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />, at which time room temperatures are approximately 140*F. This is based on a conservative estimate of.70 lb./hr.

steam leakage, i 1

These RCIC room temperatures were reviewed-as part of.the SB0 analysis based on gland seal steam leakage into the RCIC room at 10 and 70 lb./hr...which bounds the expected leakage at 46 psig. During an SB0 event, the RCIC pump suction is maintained on the condensate storage tank. Cold CST water will be effective in condensing gland leakage at exhaust pressures of 46 psig in the barometric condenser. As a result, this leakage will not, in itself, cause a harsh environment.

During a small break LOCA, when containment.and torus pressures are high, RCIC is not credited in the Pilgrim licensing analyses (FSAR Appendix G, event 39); therefore, RCIC qualification is 'not required.for a LOCA environment. Qualification of the RCIC isolation valves is not affected since the l maximum mission time for EQ purposes has not I

been increased.

During normal RCIC operation, increased turbine exhaust pressure is not expected to occur, therefore, environmental profiles are not affected.

Mark I Containment Analysis The potential for significant containment dynamic loads associated with steam condensation at the RCIC turbine exhaust discharge line has been evaluated for SB0 and small break LOCA conditions and it has been concluded that the increased pressure has'an negligible effect.

Containment response as given by the limiting steam line break is also unaffected by the increased operating time of the RCIC system since the total steam discharged to the torus during depressurization will remain essentially the same.

3.12.3.2 Safety Functions of Affeqeed Systems /Comoonents The FSAR, Section 4.7, states the safety function of RCIC is:

"The Reactor Core Isolation Cooling. System (RCICS) provides makeup water to the reactor vessel following reactor /essel isolation in order to prevent the release of radioactive materials to the environs as a result of inadequate core cooling."

3.12.3.3 Potential Effects and Analysis of Effects on Safety Functions RCIC operation is unaffected for'FSAR Appendix G events as follows:

1. Event #39 results in increased containment pressure; however, for this event RCIC operation is not credited. Extended RCIC operation for small break LOCA is evaluated in Section "C".

2. Events #27, #28 and #38 require RCIC operation, but do not involve increased containment pressure.

3.12.3.4 Desian Change Evaluation Conclusions This change involves re-calibration of pressure switch setpoints only. This change described allows enhanced operation beyond the original design considerations for RCIC.

1 i

l

i i

.i 0 C l 6 6 .1 m o i N N /

u . I m C C e - -

l C - * - > O es ne 4

-l EE & = **

~*  %% Cp : z E se w & UJ

• • l - == - G C as C ce -

Q ee ' oc m en C & & C CP 6 == > - > se H mi && n- -

e$ e e o e as - m n, c Z-

. a:I

.j g 1 .

n. OO O an c a O CL o - > > I 3

'=* - <c w r~ ~ cc o+ oo mo m. U i O 6 e e I O - O m .o M&

m m mm

1. cL >- -=a =J J - +1 em rw g

1. i H

W E

D, > a u- 6 C C W m - - ,

m 6- N pt pi et N e

pf m

C A a  :- e tw - N N N rw rv g el ei +1 +.

M C.

W -

C 4 v . C - -

so & & O e &

j-- De =$ == -N - C1 ==

m n en e e + C C e 3 g Z & C1  % O == = ==. ' CL

-- C- O

<t .

G. C c > O  % m m- e e I N cre - CL (l >o O O = - - t X . C. C r

~

N OO - -< tw N rw W T mt  % Cm

• rw - I  % * * -

Cr. ; Z m% C) l 4 % O Z O O O Wy[O W W z s se  !

• =* CD .". .

,j CO 4 4 .C .C 4 .C > 'C l

& 6-= u u u u ao .u y .u n.,* e.* e e.* ** O e H E

- - - - .c ,C -

.C 3 3 3 80 3 3 - W u' 3 1 <C u; y m m m m e es ** m I U m C- +* e *m CF == ==

w sol == ao no et C er en 3 3 3 G m

U E 3 6 6 n. es 6 6 6 m b

• i

% D Da e 3 O 3 6 3 3 en

• = 3 en b en en en ei se b - -

}

a. **l , 3 e en en b en en ** es so en z en* O so G G b er ea C > > en C, 6 6 6 == h- b as as as b v

==e l 6 . CL CL CL O CL n U J J CL ed M 6 Ga i ..

M

&# D 6 '

t 6 en 3 l

',. I s an .C *.* e a N en so & 3 C se g ** t == Q ee ce

r. as C. ne .C - 'E 6 l' e.* ed C 6 66 C L i M as 64 te f & CL 3 C1 == - -

C' & = as D & == Q an as as er y Q) 6 C es e 6 m == .C = - 6 em C em ** CP so

.C o6 .C

=e

= .= .C

=

.o a, - e, e, .

ma - -

o, o, e,a, a C-o .c

.D vt y 4 .* =ne te e oE C *. C o > >. 6, > > bw O en 3 CD se =- C Si C' u te es - 6, al

[-

1 ,_, - o o ao es 6 a> *o 6 - ao - as C

6- 6, 6- >-

6l T- en 6 C C C 6 3 6 O C Q 6-b == 4 ta E os E - -- 6 -- *.e 6 *c a,

• C.' n . .C - C L,,) l C1 D C en m% 9 .O U to .O u c. E2 l

- EJ E =J 6 CS 6 *o se ew me 6 m-6 m *e - >

UI C% C% O== 3 ='= = ** - *e 3 c, 80 3 Ge en 6 .

M ,

.J i

-92A-

3.13 @D1HONAL ATHS RECIRCULATE 0N PUMP TRIP 3.13.1 Objective of Desian Chance I Recirculation Pump Trip (RPT) is an important BHR plant i feature for mitigation of ATHS events. For plants such as Pilgrim which have Motor / Generator (H/G) sets for recirculation flow control, the trip of recirculation pump may be done at either the field breaker trip of the M/G set, or the drive motor of the M/G set. Pilgrim has, the capability of tripping the. recirculation pumps by opening the field breakers. In addition to this trip and in our effort to increase pump trip reliability, it has been decided to trip the drive motor of the M/G set.

Analyses using the drive motor trip (field breaker trip failure) have been accomplished and found acceptable for the MSIV closure event. This event is the most limiting ATHS event for peak vessel pressure.

3.13.2 Desian Chance Description This description defines the proposed design changes ]

package (Figure 3.13-1) to provide an ATHS trip of the I' M/G drive motor breaker. The current design trips the recirculation M/G field breaker after receipt of high reactor pressure or low reactor water level. The drive '

motor trip will use the existing initiating signals for the field breaker trip without the current time delay (10 seconds) before initiation of the pump trip on low reactor water level.

The existing reactor recirculation pump logic will be  ;

modified to accept an additional trip signal from ATHS.

This is accomplished by installing a new trip coil (in addition to the existing trip coll) within the breaker associated with each recirculation pump. Control power for the new trip coil in breaker compartment A301 is division "B", while control power for the new trip coil in breaker compartment A401 is division "A".

This design change will add an ATHS initiated trip to the 1 4160 volt drive motor breakers of the Reactor l Recirculation Pump Motor Generator Sets A and B. This design change will provide an automatic trip of the drive motor breakers at either high reactor pressure (1175 i psig) or low reactor water level.(-46 inches indicated' level).

The trip signal will be initiated from level transmitters I LT263-120A, B, C, and D and/or pressure transmitters PT263-122A, B, C, and D. These level and pressure' r transmitters will operate trip units 263-121A. B, C, and D on low level and trip units- 263-123A, B, C, and D on reactor high pressure. The above transmitters and trip units are in place at present and currently trip the field breakers of the Reactor Recirculation Pump Motor Generator sets. Eight spare relays, four each in Panels C2277 and C2278 will be rewired to operate in parallel with a trip output relay on trip units 263-121A, B, C, and D and trip units 263-123A, B, C, and D.

The ATHS system for the existing field breaker trip and for this change which will trip the 4160V breakers of the Reactor Recirculation Motor Generator sets consists of the following; reactor vessel water level and pressure sensors, solid state analog trip units. Trip relays, power supplies and redundant trip coils for each drive motor breaker have been added for this change.

The system is separated into two divisions with two separate trip channels (sensors and trip logic) in each division organized into a "two-out-of-two" for water level initiation and a "two-out-of-two" for reactor pressure initiation, A trip signal from either division can initiate a system trip. The system will be an energize to trip system. One trip coil on each breaker shall be actuated by Division I RPT-ATHS logic while the second trip coil is actuated by Division II RPT-ATHS logic.

Cables (routed in Seismic Class I mounted raceway) will go from C2277 and C2278 located on reactor building 51 feet elevation to the switchgear rooms located in the turbine building 23 feet and 37 feet elevations. A second trip coil will be added to each of the 4160V drive motor breakers (A301 and A401) so that each breaker will receive a trip signal from both divisions.

The addition of the motor breaker trips makes the recirculation pump trip reliability acceptable and higher than the industry wide recirculation pump trip reliability initiated by the tripping of the field breakers alone.

3.13.3 Desian Chanae Evaluation 3.13.3.1 Systems /Comoonents Affected The ATHS system and the recirculation system are directly affected by this change. The ATHS system is affected by the addition of eight trip output relays, each to be connected in parallel with one of eight existing trip output relays.

Recirculation System The recirculation system is affected by the addition of a second trip coil to the Reactor Recirculation MG Set Drive Motor Breakers

+ .q

'(A301) and'A401). Two additional trips will be. _l added (one to each breaker trip coll). This change will not degrade the recirculation l system since the trip logic will need.to be .;

energized to trip and it will also require a I two out of two twice actuation (pressure and/or j low water level) to trip the breaker.-

l Therefore, one. failure will have no affect on  ;

the system. In addition, this installation ,

will be handled as "0".  !

i Power Suoolies

-l Safety related AC and DC power supplies are indirectly affected by this' modification. '

l- Table'l lists the affected power supplies, breaker providing isolation, and associated loads-1 Table 1 - ATHS Power Sucolies Panel Breaker Load Y3 8 C2277 4

Y4 8 C2278 -

D36 2 C2277 D37 2 C2278 D4 7 Al Control '

Power i D5 7 A4 Control Power The breakers listed in Table 1: provide .the isolation between the safety related power ,

supplies and the non-safety ATHS system. . In -]

addition, the relays in C2277 and C2278 provide coil to contact separation of the trip cards and the remainder of the circuit, including cables and trip coils.

Comoonents Affected ATHS panels C2277 and C2278-will have eight spare relays, already mounted in the ATHS l cabinets, rewired so that one-each is in- ]

parallel with existing trip relays. No  ;

additional heat load to the ATHS cabinets will  !

be added as the relays are energized only in.

the trip mode. The additional load on the power supplies has been reviewed to verify that the capacity of the power supplies is not exceeded.

i

.)

lu i

a

The Reactor Recirculation MG set breakers (A301 and A401) will have a second trip coil added.

Each trip coil (the existing coil and the new coll) will receive a signal from the ATHS l system. One coil will receive a Division I  !

trip signal and the other coil will receive a l Division II trip signal. The wires within the  !

switchgear will be separated from each other as  !

much as practical so as to minimize the l potential of the failure of one division J affecting the other division.

The non-Q Reactor Recirculation MG Set Breakers will not be degraded by the change for the following reasons: (1) the existing trip cards were purchased from Rosemount as "Q" items and have a proven record of reliability throughout the industry; (2) the logic will be a two out of two logic so that a single failure of a trip card or transmitter will not cause the motor drive breaker to trip (3) the cables from the ATHS panels to the switchgear will be routed in seismic class raceway (separate raceway for each division) to ensure that failure of one division will not affect the other division; (4) the wires within the switchgear will be separated as much as practical; (5) the new trip coil will be purchased via the CQI process to ensure the quality is the best available for commercial parts; and (6) installation will be performed and inspected per "Q" standards. As a result the reactor recirculation 4160V breakers and the reactor recirculation system will not be degraded.

3.13.3.2 Safety Functions of Affected Systems / Components The recirculation system has two safety functions: (1) to maintain adequate fuel barrier thermal margins following recirculation pump malfunctions; and (2) assure an adequate floodable volume under any piping system failure. The ATHS system (recirculation pump trip and alternate rod insertion) has a design objective of introducing negative reactivity to the reactor in the unlikely event of a failure to scram (FSAR 3.9-1). The existing recirculation pump trip (field breaker) together with this change (4160V drive motor breaker trip) will supplement the functional performance of the Reactor Protection System (RPS) and is independent of the RPS (FSAR 3.9.2). The RPT occurs at either high reactor i pressure (1175 psig) or low reator water level

(-46 inches indicated level) (Technical Specification pages 44a and 59a). j

e The function'of the ATHS panels (C2277 and C2278) is to process the signals (proportional to reactor pressure) from PT263-122A, B, C, and D and the signals (proportional to reator level) from LT263-122A, B, C, and D. The panels currently provide a trip signal to the recirculation pump motor generator field breaker at 1175 psig or -46 inches indicated level. This change will add relays to provide a parallel trip signal to the reactor recirculation pump motor generator drive motor breakers (A301 and A401).

3.13.3.3 Potential Effects and Analysis of Effects on Safety Funct eni The first recirculation system safety function is to ensure adequate fuel barrier thermal-margins following recirculation pump malfunctions. These malfunctions are described and evaluated in Section 14 of the FSAR. The addition of the new drive motor trip coils does not introduce any recirculation pump malfunctions beyond those previously analyzed.

This change does not affect the recirculation system piping. Therefore, it has no affect on the second recirculation system safety function.

The change could affect the power generation design basis of the recirculation system due to adding new methods to trip the recirculation .i pump drive motor breakers. Failures in the circuit that could cause the trip coil to be energized, could cause an inadvertent trip of the recirculation pumps. The potential failure has been minimized by purchasing the indicating-lights and cable to the same criteria as safety related equipment. The trip coil, fuse blocks, and fuses will be purchased via the Commercial Quality Item (CQI) process. The installation of all items will be performed and inspected by Quality Control personnel as safety related equipment. Th2 raceways will be supported per the criteria for Seismic Class I raceway.

1 l i

'The trip of the Generator field breaker on low

- water level required the addition of a time delay which was to be set at 9 *1 second. This timer was added to ensure the original plant licensing FSAR basis for analysis was still ,

l bounding. That is, the pump coastdown (flow l l versus time) which was based on the trip of the l drive motor breaker and was used in the 3 original Loss of Coolant Accident and transient l' analysis would not be invalidated by the addition of the field breaker trip.

The level sensor, logic and breaker time delay of 1.03 seconds is in addition to the 10 second j (9 *1 second) timer. The timers are usually set at 9 seconds to allow for instrument uncertainty.

Transient analyses for Chapter 14 and reload analyis are unaffected by the new pump breaker trip since the existing field breaker trip (which is included in the present analysis) results in the faster coastdown of the pump.  ;

The two trip coils (one existing and one new) i have to be mounted side by side in the breaker cubicle. Separation of the coils in the non-safety related breaker is not possible.

The wires within the switchgear will be separated as much as practical in an effort to prevent failure in one circuit from affecting the other circuit. Switchgear A3 and A4 do not have existing seismic qualification data available and, therefore, mounting of the additional trip coil and fuse blocks cannot be i analyzed for their effect on the breaker and the switchgear. The equipment will be mounted as rigid as possible.

The safety function of the vital DC (Y3 and Y4) and DC (04, DS, D36 and D37) power panels will not be affected by this change because the i isolation breakers, as listed in Table 1, are j not being modified. During normal operation, there is no additional load on D4 and DS.

Fuses are being placed in the trip circuitry )

(located in both the switchgear and ATHS panels) for ease of maintenance, not for separation of safety and non-safety equipment.

l Failures in the trip ' coil circuitry cannot (

affect the remainder of the ATHS system because of the contact to coil separation provided by {

1 the relays in the ATHS panels. l

)

- _ - - - - _ - - - - - - - - - - - - - - - - - - 1

1

)

{ The logic circuitry will be installed in C2277 l- and C2278 which are located in separate fire zones, separated by a water curtain.

Therefore, a fire in the reactor building on the 51 feet elevation will not disable both trip systems.

The raceways from C2277 to A301 and C2278 to A401 will be separated as much as possible so as to reduce the possibility of a fire affecting both trip circuits and preventing the ATHS system from performing its design function.

This chnage will have no affect on ATHS  ;

instrument racks C2275 and C2276.

3.13.3.4 Design Change Evaluation Conclusions The additional Recirculation Pump Trip feature I does not degrade the existing recirculation system, ATHS system or safety related power supplies. The change will not affect normal plant operation.

1 I

l l

l l

l l

1 1

C lI , ,s 7

R S A y 1

1 B T

P S

8 7

I S 3 2 2 y K C P F T

M 2-

- (.

E I -

)-

RR T 4

5A 2A A

N J

c i

s, A

6 2

Jj 1-5 2-S M

3 e

t sA u8 le f W p f - f D s

e s/ -

M R 1 k,

{' A .

'm - .

) )

(

E E A

%y.

- - g g_ 0 T W ,

,n 's 4

~_

S K3 4

, g M -

.T' =

Y A1 4" i f, , , _%

i, "f,j SE3 '

I#"

R -

S BE R WR U A f

g g

f f

0 f -

T f y K f -

AOG

= , "

~

P,"

TI F

~

~ 1 d O LO .

yA 2O 1J y .

3 2.

f j

O e O J'

AM N

^

. S OTE I

M r

c, 1

/

4 94 E

=

,C T  ! _ T' A* - $ -

I S -

T ' 2 p y ~ . -.

D DG >

AM =

.e ,3 l

~ O W r:

i jw R, nf P

" , sc A 0g?r

. o v '

s e c oB Y4 s; D

J f

B I

sn 1

r'n,A s

o g[

^r! I

_ f/ A a s

i s

Efb ,,r r,rc c '$

'i Ac'f' , T,

/t 0 nnr"7 i

s es r r e

>^ " c> S' t $ C",9 I Ao

~EcA"c4 l

c rts3'"

$ r l l

'$s I * ,s

. 8 ?.

4.0 DJSCg% ION OF OPERATIONAL PLANT SAFETY ENHANCEMENTS This information will be provided in a subsequent revision to this report.

l 1

l l

i

-100-

s l

5.0 [ANLLMIDE ]

I )

l The report concludes: j t

1. That the Boston Edison Safety Enhancement Program will enhance 1 Pilgrim Station safety by: )

i (a) addressing complex severe accident issues both from core j damage prevention and mitigation standpoints; j (b) using broad technical expertise to resolve technical issues; (c) providing additional plant capabilities to handle potential severe accident scenarios, including those the issues raised in the NRC's proposed BWR severe accident containment policy; I d) providing improved emergency operating procedures and training to ensure that operators are reasonably able to recognize ,

severe accident conditions and use plant equipment to best I advantage under such conditions,

{

and thereby mir.imize public risk and assure continued reliable )

operation.

2. That the plant design and operational changes do not: {

I (a) increase the probability of occurrences of consequences to l plant safety previously evaluated; (c) create the possibility for events other than those previously I evaluated; and '

(c) reduce the plant margin of safety.

-101-

_ _ _ _ _ _ .A