ML21125A292

5 to Updated Final Safety Analysis Report, Chapter 6, Engineered Safeguards Systems, Sections

ML21125A292
Person / Time
Site:	Palisades
Issue date:	04/14/2021
From:	Entergy Nuclear Operations
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21125A344	List: ML21125A285 ML21125A287 ML21125A288 ML21125A290 ML21125A291 ML21125A292 ML21125A293 ML21125A294 ML21125A295 ML21125A296 ML21125A297 ML21125A298 ML21125A299 ML21125A300 ML21125A301 ML21125A302 ML21125A303 ML21125A304 ML21125A305 ML21125A306 ML21125A307 ML21125A308 ML21125A309 ML21125A310 ML21125A311 ML21125A312 ML21125A313 ML21125A314 ML21125A315 ML21125A316 ML21125A317 ML21125A318 ML21125A319 ML21125A320 ML21125A321 ML21125A322 ML21125A323 ML21125A324 ML21125A325 ML21125A326 ML21125A327 ML21125A328 ML21125A329 ML21125A330 ML21125A331 ML21125A332 ML21125A334 ML21125A335 ML21125A336 ML21125A337 ... further results
References
PNP 2021-008
Download: ML21125A292 (52)

Text

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-1 of 6.1-23 6.1 SAFETY INJECTION SYSTEM 6.1.1 DESIGN BASES

1. Emergency Core Cooling System (ECCS)

The system was originally designed to prevent fuel and cladding damage that could interfere with adequate emergency core cooling, and to limit the cladding-water reaction to less than approximately 1%,

for all break sizes in the primary system piping up to and including the double-ended rupture of the largest primary coolant pipe, for any break location, and for the applicable break time. Since the time of the original system design, the engineered safeguards systems design was rereviewed as part of the NRC's Systematic Evaluation Program and found to meet present day safety criteria as reported in NRC - Integrated Plant Safety Assessment Report NUREG-0820, dated November 1982.

The Safety Injection System also functions to provide rapid injection of large quantities of borated water for added shutdown capability during rapid cooldown of the primary system caused by a rupture of a main steam line.

The design bases are met with the operation of the safety injection tanks and the following minimum active safeguards:

1. One High-Pressure Safety Injection (HPSI) Pump

2. One Low-Pressure Safety Injection (LPSI) Pump

3. One Emergency Generator The system is designed to keep the core covered for extended periods of time after initial injection. One high-pressure pump has sufficient capacity to make up the inventory lost due to boil off by decay heat at the start of recirculation. If primary system pressure permits, one low-pressure safety injection or one containment spray pump also has sufficient capacity to maintain core water level. The makeup flowrate to the core for any of the injection paths discussed assumes the break to be in the leg that maximizes the spillage out of the PCS.

All system components, as described in Subsection 6.1.2.2, are designed CPCo Design Class 1. This classification requires that each component be designed to withstand the appropriate seismic loads simultaneously with other applicable loads without loss of function (see Section 5.2).

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-2 of 6.1-23 Components located within the containment building and required to operate in the post-LOCA environment are designed for an ambient condition of 283°F, 55 psig, and 100% relative humidity. Components located within the containment building and required to operate in the post-MSLB environment are designed for an ambient condition of 364F, 55 psig, and 100% relative humidity. Equipment located in the engineered safeguards rooms in the basement of the auxiliary building is designed for ambient conditions of 135°F and 100% relative humidity. Components whose function has not been proven under such conditions were subjected to testing to demonstrate satisfactory operation. The results of that testing for electrical and instrument and control equipment are provided in Consumers Power Company's report on environmental qualification of electrical equipment (refer to FSAR Chapter 8, Subsection 8.1.3).

Integrated radiation doses are specified as a design condition for components subject to damage from irradiation and located in a radiation field, inside or outside of the containment. Refer to Section 11.6 for further discussion of radiation zones.

Generic Letter (GL) 2008-01, "Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems," (Reference 26) requested licensees to take actions to ensure that gas accumulation in the ECCS, the Shutdown Cooling System, and the Containment Spray System is managed such that operability of these systems is not challenged and that appropriate action is taken when conditions that could impact system operability are identified. The NRC requested in the generic letter that licensees perform evaluations and submit information regarding gas management activities. As part of Palisades' response to the letter, the susceptibility of plant systems to gas accumulation was evaluated, fill and vent procedures were reviewed, acceptance criteria for allowable gas volumes was developed, and procedures and administrative controls were developed for periodic monitoring and trending of gas accumulation (References 27 and 28). These actions provide assurance that systems are kept sufficiently filled with water to ensure system operability.

2. Decay Heat Removal (DHR)

A portion of the system is also used to remove heat from the primary system for normal cooldown and to maintain a suitable temperature for refueling and maintenance. This reduces the complexity of the Plant auxiliary systems. In addition, the periodic operation of this equipment further assures that it will perform as designed during accident conditions.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-3 of 6.1-23 The system is designed to cool the primary system from 300°F to refueling temperature with the low-pressure injection pumps and 90°F component cooling water. The maximum pressure of the primary coolant during this cooldown is 270 psia.

In response to Generic Letter 88-17 (References 10 and 11),

Consumers reassessed of Palisades' decay heat removal (DHR) capability. Particular emphasis was given to the potential for losing shutdown cooling flow during operations with a reduced inventory of reactor coolant. A loss of DHR is usually a slow-moving event which allows considerable time for operator actions to avoid core uncovery and fuel damage. During conditions of reduced reactor coolant inventory, however, more rapid operator response can be needed to avoid boiling in the core. Reduced inventory is defined as a reactor coolant level lower than three feet below the reactor vessel flange.

While the ability to cope with a loss of decay heat removal is a licensing basis for the plant, this event is not an accident to be analyzed in the same sense as a Chapter 14 (Standard Review Plan Chapter 15) event. NRC acceptance of the plant's ability to cope with a loss of DHR is instead based on Consumers's certification that the recommendations of Generic Letter 88-17 are met whenever there is irradiated fuel in the reactor vessel. The Generic Letter recommendations which have continuing significance to plant operation are as follows:

a. Two independent means of reactor vessel indication shall be provided whenever the PCS is in a reduced inventory.

b. Two independent means of temperature indication representative of core exit temperature shall be provided whenever the PCS level is in a mid-loop condition (level below the top of the hot leg opening into the reactor vessel), and the reactor vessel head is located on top of the vessel.

c. Provisions shall be made for two means of PCS inventory makeup which can be ready for use quickly enough to avoid core uncovery.

d. Procedures and administrative controls shall be provided to assure that both hot legs are not blocked by steam generator nozzle plugs unless a vent path exists which would prevent pressurization of the upper vessel plenum.

e. Provide procedures and administrative controls which reasonably assure that operations which could cause PCS perturbations are avoided whenever practical, and that the PCS will remain in a stable, controlled condition in spite of operations which could cause PCS or support system perturbations.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-4 of 6.1-23

3. Long Term Post LOCA Core Cooling For long term core cooling days and weeks after a large LOCA, the original plant design provided the ability to recirculate PCS water from the containment sump through the shutdown cooling heat exchangers and back into the normal cold leg safety injection paths.

In response to Generic Letter 2004-02 (Reference 25), passive containment sump strainer assemblies were installed for segregating post-LOCA generated debris from the containment sump envelope to address Generic Safety Issue 191, Assessment of Debris Accumulation on PWR Sump Performance. The strainer assemblies are sized for the bounding debris load generated following a large break loss-of-coolant-accident (LOCA) in order to ensure that HPSI and containment spray pump net positive suction head and system flow rate requirements are met. In addition, passive debris screens are provided on the four remaining containment sump downcomers, seven 590 elevation containment floor drains and two existing containment sump vent lines to ensure that post-LOCA generated debris does not enter the containment sump envelope. Both the sump strainer assemblies and the debris screens meet CPCo Design Class 1 requirements.

In addition to the passive containment sump strainer assemblies and debris screens, systematic administrative processes and activities are implemented to minimize potential debris within containment under post-LOCA conditions. These processes and activities include procedural controls, specification requirements, containment and equipment inspections, and modification process controls.

In response to an NRC letter dated March 14, 1975 (Reference 12), an additional design basis was established to provide a safety injection flow path into a hot leg. Hot-leg injection assures that for a large cold-leg PCS break, net core flushing flow can be maintained and excessive boric acid concentration in the core which could result in eventual precipitation and core flow blockage will be prevented.

Between 5-1/2 and 6-1/2 hours after a LOCA, if shutdown cooling is not in operation, the operator initiates simultaneous hot- and cold-leg injection. The minimum flow required during simultaneous hot- and cold-leg injection is 222 gpm to both the hot-leg location and the combined cold-leg injection points to make up for liquid boil off 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the reactor trips from 2,650 MWt. An additional 5 gpm flushing flow (for a total of 227 gpm per injection path) is required to ensure boron precipitation does not occur (see References 1 and 8). The small break LOCA analysis of Section 14.17 is more limiting with respect to total HPSI system performance. Hot-leg injection motor-operated valve throttle position and installed flow orifices cause HPSI flows to be split approximately equally between hot- and cold-leg injection paths.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-5 of 6.1-23 This long-term cooling modification uses portions of the HPSI and the PCS. The hot-leg injection piping connects the HPSI Train 1 header and the HPSI Train 2 header to the PCS hot-leg drain line. All components of the long-term cooling modifications located inside the containment are Seismic Category I and are designed in compliance with the requirements of ANSI/ASME B31.1-1980 and ANSI N18.2-1973. These components are capable of withstanding a 60-year integrated normal and accident dose of 0.285 x 108 Rads for gamma radiation and 0.965 x 108 Rads for beta radiation.

6.1.2 SYSTEM DESCRIPTION AND OPERATION 6.1.2.1 General Description

1. Emergency Core Cooling Borated water is injected into the Primary Coolant System (PCS) by the safety injection tanks and the high- and low-pressure safety injection pumps. The components and the flow paths are shown on Figures 6-1 and 6-2.

The borated water in the elevated safety injection tanks is at safety injection and refueling water (SIRW) tank concentration range of 1,720 to 2,500 ppm boron; the tanks are pressurized with nitrogen to greater than 200 psig. They are connected to the Primary Coolant System cold legs through isolation valves which are normally open and have had the electrical power removed from the valves' electrical system in order to meet the ECCS single failure criteria.

Two check valves prevent primary coolant from entering the tanks.

Injection will occur whenever the primary system pressure falls below the combined pressure of the static waterhead plus the tank gas pressure.

Following injection of water from the Safety Injection Tanks, core cooling is provided by the safety injection pumps. The safety injection pumps are started automatically by a safety injection signal (SIS) which is supplied by the engineered safeguards control system (see Section 7.3). Flow from the low pressure safety injection pumps is ensured since the shutdown cooling heat exchanger bypass valve is normally locked open and has had the air supply removed in order to meet the ECCS single failure criteria.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-6 of 6.1-23 The safety injection signal also opens certain valves, as shown on Figures 6-1, Sheet 2. Borated water at a minimum concentration of 1,720 ppm boron is initially pumped from the SIRW tank to the Primary Coolant System. In 1979, a system valve modification was made to eliminate a potential deficiency that could, with the failure of one of the emergency diesel generators, limit available high-pressure injection to two of eight paths. The modification involved switching the electrical power sources between the isolation valves on the high-pressure and redundant high-pressure injection lines going to Primary Coolant Loops 2A and 2B. In addition, two upstream valves had their normal positions changed to provide train separation.

The pump suctions are automatically switched to the containment sump when the SIRW tank level falls to a preset point. At this time, the flow path from the containment sump is opened, the SIRW tank flow path is closed, the low-pressure safety injection pumps are stopped and water is recirculated from the sump by the high-pressure pumps.

The high pressure safety injection subcooling valves are opened to ensure adequate NPSH for operating high pressure safety injection pumps. Water from the containment sump is also circulated by the containment spray pumps and cooled by the shutdown cooling heat exchangers.

Upon a Safety Injection Actuation Signal, the Safety Injection System and Chemical and Volume Control System inject borated water into the Primary Coolant System to increase the shutdown margin during the rapid cooldown following a main steam line break (MSLB). Presently, no credit is taken in the accident analysis for concentrated boric acid from the Chemical and Volume Control System (CVCS). Upon a steam line break, Primary Coolant System pressure drops due to system shrinkage. The high-pressure safety injection pumps begin to deliver borated water which partially compensates for the reactivity addition due to cooldown (see FSAR Section 14.14).

The safety injection tanks and the loop injection valves and manifold are located inside containment but outside of the missile shield. The bottoms of the safety injection tanks are approximately 100 feet above the injection nozzles. The inner check valve in each injection line is located close to the primary coolant pipe. This location provides maximum protection to the Primary Coolant System from a rupture in the safety injection piping.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-7 of 6.1-23 The SIRW tank is located between the reactor building and turbine building above the control room on the auxiliary building roof. The safety injection pumps and all other components of the Safety Injection System are located at the lowest level of the auxiliary building in a tornado-proof area. This location maximizes pump suction head when recirculating from the containment sump. The safety injection equipment inside the auxiliary building is located in two separate rooms which are protected from external and plant internal flooding.

Sufficient space is provided around equipment in these rooms to permit installation of temporary shielding for maintenance. Valves required to isolate equipment are provided with remote operators.

An interconnection is provided from the Chemical and Volume Control System to allow testing of the injection line inner check valves during reactor operation; however, in practice, the check valves are tested in the cold shutdown mode (partial stroke test) or in the refueling mode (full stroke test).

2. Decay Heat Removal During a normal reactor shutdown, the low-pressure safety injection pumps and the shutdown heat exchangers are used to cool the primary system from 300°F to refueling temperature and to maintain this temperature during refueling or maintenance. For this operation, the pump suction is manually aligned to the primary system and the pump discharge manually aligned to the shutdown heat exchangers and back to the primary system through the low-pressure injection lines. The cooldown rate is controlled by throttling the primary coolant flow through the shutdown cooling heat exchangers.

The refueling cavity, when filled to greater than or equal to 647' elevation, is capable of providing decay heat removal capability in the event that one of the two shutdown cooling trains is inoperable (Reference 20). Decay heat is removed by natural convection to the large mass of water in the refueling cavity. The heat storage capacity of the filled refueling cavity provides a temporary method of decay heat removal which provides time to restore the inoperable shutdown cooling train.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-8 of 6.1-23

3. Long Term Post LOCA Cooling Following initiation of the recirculation phase, the safety injection pumps can continue to provide core cooling for extended periods of time. Cooled water from the shutdown cooling heat exchangers would initially be circulated by a high pressure safety injection pump directly into PCS cold leg injection points. Approximately 5 1/2 to 6 1/2 hours post-LOCA, this flow would be split between hot and cold leg injection points. The low pressure safety injection pump can also be used for long term cooling injection into the cold leg injection points if the primary coolant pressure is sufficiently low.

6.1.2.2 Component Design

1. Safety Injection and Refueling Water (SIRW) Tank The SIRW tank contains a minimum of 250,000 gallons of water containing boron in the range of 1,720 ppm to 2,500 ppm. This is sufficient water to fill the refueling cavity. When the tank reaches the Recirculation Actuation Setpoint (RAS), the safety injection and containment spray pump suction will be switched to the containment sump. The actual time that RAS occurs will vary depending on tank level and pump flow rates. The minimum time is approximated to be 20 minutes. This assumes that the tank is at its minimum level and all pumps are operating at near runout conditions. The tank is constructed of aluminum and is cathodically protected with insulating flanges. Heating steam is provided to maintain the tank above 40°F to prevent freezing. It is field fabricated to the requirements of ASA B96.1. The SIRW tank design parameters are shown in Table 6-1.

If the SIRW tank is no longer available following a seismic event, borated water from the spent fuel pool (SFP) may be used for primary coolant system makeup while the Plant is shut down. The flow path is via a fire hose connected between the discharge of the SFP cooling system and the charging pump suction header (see Section 1.8.5).

2. Low-Pressure Safety Injection (LPSI) Pumps The low-pressure safety injection pumps are used to inject large quantities of borated water into the Primary Coolant System. They are also used to circulate primary coolant during shutdown to remove residual and decay heat. There are two pumps, each of which can circulate sufficient water to keep the temperature rise through the core to less than the full power value with the reactor shut down at the end of core life. The pumps are designed and tested for thermal transients which are more restrictive than expected in operation. They were subjected to a similar test program as outlined for the high-pressure safety injection pumps.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-9 of 6.1-23 The pumps are horizontal, single stage, centrifugal design. The pumps are provided with mechanical seals backed up by a bushing with leak offs to collect the leakage past the mechanical seal. The LPSI pump and seals are designed for operation at 325°F and require a continuous component cooling water flow at a minimum rate of 4.0 gpm to prevent seal degradation or failure and damage to bearings under the worst case conditions evaluated by the vendor. The pump motor is capable of starting and accelerating the pump to full speed with 70% of rated voltage. The pumps are provided with drain and flushing connections to permit reducing radiation levels before maintenance operations. The pressure containing portions of the pumps are stainless steel with internals selected for compatibility with boric acid. The pumps are provided with minimum flow protection to ensure that no damage results when starting against a closed system.

The low-pressure pump data summary is shown in Table 6-2.

3. High-Pressure Safety Injection (HPSI) Pumps The high-pressure safety injection pumps inject borated water at high pressure into the Primary Coolant System during emergency conditions. The pumps are sized to ensure that, following the rapid depressurization of the Primary Coolant System and recovering of the core by the safety injection tanks, one high-pressure pump has sufficient capacity to make up the inventory lost due to boil off by decay heat. The makeup flowrate to the core assumes the break to be in the leg that maximizes the spillage out of the PCS. The requirements for boron injection for the steam line break and the injection requirements for smaller primary system break sizes are also considered in the sizing. The HPSI pumps were originally designed to withstand thermal transient conditions of 40°F to 300°F in five seconds and 300°F to 40°F in five seconds. The duration of this transient was later changed to ten seconds in the pump specification to align with thermal transient conditions that could be achieved during full scale hydraulic testing of the pumps. Subsequent investigation of pump vendor analyses indicated that transients of shorter duration would not adversely impact pump performance (See Reference 16).

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-10 of 6.1-23 The HPSI pumps are seven-stage, horizontal, centrifugal units.

Mechanical seals are used. Any leakage past the seal is collected in the gland ring and is gravity drained through leak off ports to the pump skid, floor drain and room sump. Although the seals are designed for operation at 300°F without cooling and the pump bearings are designed for operation at 250°F without cooling, the HPSI pump and seals are provided with cooling water flow at a minimum rate of 14.5 gpm as recommended by the vendor to extend component life. In addition, normal cooling by the component cooling water system is backed up by cooling water from each of the two service water lines serving the engineered safeguards equipment. Also, a low-flow alarm is provided on the seal cooling water to the pumps to warn of cooling water or seal cooling malfunction. The pump motor is capable of starting and accelerating the pump to full speed with 70% of rated voltage. The pumps are provided with drain and flushing connections to permit reducing the radiation levels before maintenance operations.

The pressure containing portions of the pump are stainless steel with internals selected for compatibility with boric acid. The materials selected are analyzed to ensure that differential expansion during the design transients can be accommodated with the clearances selected.

The pumps are provided with minimum-flow protection to ensure that no damage will occur from operation against a closed discharge.

A full-scale hydraulic test was performed on each pump assembly. All pump test setups, test procedures and instrumentation were in accordance with the Standards of the Hydraulic Institute, 11th edition, 1965 and the ASME Power Test Code, PTC-8.2-1965. This included verification of satisfactory operation of the stated NPSH. It also included measurement of starting and operating current drawn by the motor when pumping 40°F and 300°F water.

These tests included a transient test at the pump design point under the following conditions:

a. Suction temperature increase from 40°F to 300°F in 10 seconds

b. Suction temperature decrease from 300°F to 40°F in 10 seconds After the tests were completed, the unit was disassembled and inspected.

The high-pressure pump data summary is shown in Table 6-3.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-11 of 6.1-23

4. Shutdown Cooling Heat Exchangers The shutdown cooling heat exchangers are used to remove decay and sensible heat during Plant cooldowns and cold shutdowns.

The units, operating together, are sized to hold the refueling temperature with the design component cooling water temperature of 90°F. The units are further specified to accept a 40°F to 300°F transient in five seconds when the containment spray pump suction is switched to the containment sump. During this period of operation, the tube side flow is specified as the output of two containment spray pumps and the component cooling water inlet temperature is specified at 114°F. The units are designed and constructed to the standards of ASME B&PV Code,Section III, Class C, 1965 and TEMA Class R, 4th edition, 1959 requirements. In addition to the requirements of the code, a fatigue analysis was performed which considered all specified transient conditions. The units are of a U-tube design with two tube side passes and a single shell side pass. The tubes are austenitic stainless steel and the shell is carbon steel. The data summary for the shutdown heat exchangers is given in Table 6-4.

5. Safety Injection Tanks (SIT)

The four safety injection tanks are used to flood the core with borated water following a depressurization of the Primary Coolant System. The tanks are sized to ensure that three of the four tanks will provide sufficient water to recover the core following a DBA. The tanks contain borated water at a boron concentration of 1,720 ppm to 2,500 ppm.

The tanks are pressurized with nitrogen to greater than 200 psig which, together with the elevation head, assures that the core is protected.

Level and pressure instrumentation is provided to monitor the availability of the tanks during Plant operation. Provisions have been made for sampling, filling, draining, venting and correcting boron concentration. The tanks are carbon steel with a stainless steel lining.

Design and construction are to the standards of ASME B&PV Code,Section III, Class C, 1965. The SIT design parameters are shown on Table 6-5.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-12 of 6.1-23

6. Relief Valves Thermal relief valves between the safety injection and containment spray pumps and isolation valves are provided to relieve a flow rate equivalent to the expansion of water due to a sudden increase in room temperature. They discharge to the engineered safeguard room sump.

The temperature increase is from ambient room conditions to 135°F.

The relief valves on the two HPSI trains and one LPSI header (RV-3165, 3264 and 3162) and the safety injection test and leakage lines (RV-3161) are sized for expansion rates with a five-second temperature increase from 104°F to 300°F. A modification (FC-219) completed in 1975 routed RV-3162, 3165 and 3264 to the containment floor drains. These valves were previously routed to the Quench Tank (T-73).

The safety injection test and leakage lines are provided with relief valve protection (RV-3161). This valve is sized to pass 200 gpm with a maximum backpressure of 110 psig in Quench Tank (T-73). The setpoint is presently 500 psig. The original setpoint pressure of this valve has been increased twice to prevent inadvertent lifting while filling the Safety Injection Tanks. Relief Valve RV-3164, located on the shutdown cooling line from the primary loop to the low-pressure safety injection pumps, is sized for 133 gpm.

7. Piping The Safety Injection System piping is austenitic stainless steel and conforms to the standards set forth in ASA B31.1-1955 and applicable nuclear code cases. A stress analysis was performed on all piping including flexibility analyses considering thermal stresses and seismic loads.

The following tests were performed to ensure the quality of fabrication and erection:

a. Piping shop welds were 100% radiographically inspected.

b. Piping was hydrostatically tested in the shop in accordance with the appropriate ASTM specifications.

c. Cast valve bodies were 100% radiographically and dye-penetrant inspected in accordance with Nuclear Code Cases N2 and N10 of ASA B31.1-1955.

d. Valve bodies were hydrostatically tested in the shop in accordance with ASTM specifications.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-13 of 6.1-23

e. Field welds were 100% radiographically inspected.

f. Field welds were hydrostatically tested in accordance with ASA B31.1-1955.

Engineered safeguards piping connected to the containment sump is an extension of reactor containment during the recirculation mode of core and containment cooling. The following items pertain to suction piping from the sump to the first isolation valve:

a. The piping has a nominal wall thickness of 0.375 inch which results in a maximum allowable pressure for the pipe minimum wall thickness of at least 8 times the maximum expected pressure of 55 psig.

b. The piping has been subjected to flexibility analyses considering thermal stresses and seismic loads. The resultant stresses are 30% of code allowable.

c. All shop piping welds were 100% radiographically inspected.

d. The piping was hydrostatically tested in the shop at 705 psig.

e. The isolation valves are ASA rated 150 pounds based on flange ratings. The valves can withstand 210 psig at 300°F. These valves are actually furnished with weld ends and can thus withstand higher pressures.

f. The valve bodies were 100% radiographically and dye-penetrant inspected.

g. The valve bodies were hydrostatically tested in the shop at 425 psig.

h. The field welds between valves and piping were 100% radiographically inspected.

i. The field welds were hydrostatically tested in accordance with ASA B31.1-1955.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-14 of 6.1-23

8. Instrumentation

a. Temperature The SIRW tank temperature is indicated and alarmed for high and low temperatures in the main control room. Temperature before and after the shutdown cooling heat exchangers is monitored in the control room. Each shutdown cooling heat exchanger discharge is monitored by local temperature indicators.

b. Pressure Pressure in each cold and hot leg safety injection header is indicated in the main control room.

Pressure between the injection check valves is indicated in the main control room. The pressure is individually controlled in each of these four injection lines.

The pressure of each safety injection tank is indicated in the main control room. Redundant high- and low-pressure alarms are provided.

c. Level The water level in the safety injection and refueling water tank is monitored by either of two separate level indicators in the main control room. Each indicator is equipped with both high- and low-level alarms.

Level instrumentation mounted on each safety injection tank provides indication in the main control room. Redundant high- and low-level alarms on each tank are provided.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-15 of 6.1-23 Containment sump level indication provides indication of leakage into the sump from sources such as the PCS and service water. The original plant design provided two level switches and two level indicators to monitor the containment sump water level. One of these two level indicators has been disabled. The level switches activate a single high level alarm.

The level indicator activates a separate high level alarm. Level indication is provided in the control room and all alarms are annunciated in the control room. This original instrumentation was not qualified for harsh environments; therefore, two additional level transmitters were added in 1982, pursuant to NUREG-0578, to provide diverse, redundant and environmentally qualified sump level indication.

Water level in each engineered safeguards pump room is indicated in the main control room.

d. Flow Shutdown cooling and total low-pressure injection flow rates are measured by an orifice meter installed in the low-pressure injection header. Flow rate is indicated in the main control room. The flow element also transmits a signal to a controller which will provide automatic flow control during shutdown cooling operation. Each of the four cold leg low-pressure injection branch lines and each of the four cold leg high-pressure branch lines is equipped with flowmeters which can be used to balance injection flow rates. The hot leg injection lines also have flow indication.

A flowmeter installed in the safety injection and spray pump recirculation line to the SIRW tank is used during operational tests of the Safety Injection System.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-16 of 6.1-23 6.1.2.3 Operation The Safety Injection System is used during various Plant operating modes as follows:

1. Normal Operation During normal Plant operation, there are no components of the system in operation. All components are on standby for possible emergency operation.

2. Start-Up and Shutdown The shutdown cooling function may be used during the early stages of Plant start-up to control the primary coolant temperature. As the primary coolant temperature approaches 300°F and the primary coolant pressure approaches 270 psia, this function is discontinued, and the system aligned for emergency operation.

The shutdown cooling function of the system is brought into use when the primary coolant temperature falls below 300°F and the primary coolant pressure falls below 270 psia. At this time, the system must be realigned for shutdown cooling. In 1982, per NUREG-0737, Item II.B.2, Valves MV-3189, MV-3190, MV-3198 and MV-3199 were given motor operators to provide for remote realignment for shutdown cooling due to potential high radiation in the area. Subsequent to installation of motor operators, designation of valves was changed to MO-3189, MO-3190, MO-3198 and MO-3199. Realignment consists of unlocking and opening four valves on the low-pressure pump suction, closing the valves in the low-pressure pump suction line from the SIRW tank, unlocking and opening the two crossover valves from the low-pressure pumps to the shutdown cooling heat exchangers and closing the manual valves in the spray header lines. Prior to placing the system in operation, the boron concentration in the system is verified. During the early stages of shutdown cooling, the cooldown rate is controlled by limiting the flow through the tube side of the heat exchanger. In order to use this valve, it must be unlocked, its air supply returned to service and its flow controller placed in automatic operation.

3. Safe and Stable Conditions After Fire Refer to the Fire Safety Analyses (Section 9.6.3) for information concerning operation of this equipment in a post-fire safe and stable scenario.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-17 of 6.1-23

4. Emergency Operation

a. Safety Injection Safety injection is automatically initiated upon receipt of a safety injection signal (SIS). The SIS starts the high- and low-pressure injection pumps, opens the safety injection valves and closes the primary system check valve leakage paths. The rest of the system is always aligned for safety injection during power operation. The safety injection tanks will discharge into the primary system when the pressure drops to approximately 240 psig.

Motor-operated valve and system piping design are such that safety injection flow will be distributed approximately equally between the four PCS cold legs. No throttling of motor-operated valves or other operator action is required to distribute flow.

b. Recirculation When the water in the SIRW tank reaches a predetermined low level, the recirculation actuation signal (RAS) is initiated on coincident 1 out of 2 (taken twice) low-level switch actuation.

The RAS opens the containment sump valves, throttles the containment spray valves CV-3001 and CV-3002 to a predetermined position, closes the SIRW tank valves, stops the low-pressure pumps and closes the valves in the pump minimum flow lines provided that the Control Room Operators have enabled the close permissive by placing the minimum flow valve handswitches to a closed position. The valves in the minimum flow recirculation lines have also been provided with an isolation contact and redundant position indication in the control room to meet single failure criterion. The stroke times on the containment sump and SIRW tank valves are set up to ensure an adequate overlapping stroke in order to provide a continuous supply to the engineering safeguards pumps during transfer of suction, and the close stroke times of the pump minimum flow line valves are set to isolate the containment sump from the SIRW tank. The low-pressure pumps may be manually restarted to obtain increased cooling flow when the Primary Coolant System pressure is reduced. One or more spray pumps can also be used to augment flow to the core after the pressure is reduced.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-18 of 6.1-23 In order to meet NPSH requirements, the RAS opens the HPSI subcooling valve CV-3071 if the associated HPSI pump is running. After the containment sump valve CV-3030 opens from RAS, HPSI subcooling valve CV-3070 will open if the associated HPSI pump is running. Also, RAS will close the containment spray valve CV-3001 if the containment sump valve CV-3030 does not open.

In addition, after the RAS, if one ECCS train is idle, then the LPSI cross-tie valves (MO-3190 and MO-3199) are manually opened to prevent containment sump back-leakage from entering the SIRW tank via the SIRW tank discharge lines. This back-leakage to the SIRW tank could increase radiological dose to the control room operators.

During the first 5-1/2 to 6-1/2 hours after the LOCA, the hot-leg injection lines are isolated from the PCS. Hot-leg injection is initiated by operator action to realign two valves in each HPSI train for simultaneous hot- and cold-leg injection. There are two HPSI pumps, each capable of supplying sufficient injection water. Normally, one HPSI pump is aligned to the HPSI Train 1 header and the second HPSI pump is aligned to the HPSI Train 2 header.

During simultaneous hot-leg and cold-leg injection, the operating HPSI pump(s) continue to be supplied by containment spray pump discharge via the subcooling line(s). The HPSI pumps discharge approximately 50% of the flow to the hot-leg drain nozzle in Hot Leg 1 and the remainder to the four injection nozzles in the cold legs. One branch run from HPSI Train 1 joins a branch run from HPSI Train 2 into one line that connects to the hot-leg drain line. To prevent HPSI pump runout, cold-leg injection flow is diverted through restricting orifices and hot-leg injection flow is throttled by preset valve limit switches. To ensure the system is not misaligned by operator actions, interlocks exist between valve operators to prevent opening of hot-leg injection valves until the restricting orifice bypass valves are closed.

Leaks in the engineered safeguards pump rooms during the recirculation mode are detected as follows:

(1) Room Vent Radiation Monitor (2) Sump Water Level (3) Process Flow Instrumentation

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-19 of 6.1-23 Isolation will be required if the leakage is beyond the capability of the room sump pumps (50 gpm). If the vent radiation releases are beyond permissible limits, the vent exhaust damper is automatically closed and the recirculation cooling units will permit continued equipment operation.

If sump and/or high radiation indication is accompanied by an observable change in process flow, the appropriate valves will be closed and the alternate flow path will be activated. If this action does not stop the leakage, the affected system will be shut down or all equipment in the affected room will be shut down, minimum safeguards in the other room will be started and the suction header isolation valve for the affected room will be closed.

If sump and/or high radiation is the only indication of leakage, the equipment in the affected room will be shut down and isolated on a system-by-system basis. The unaffected systems in the other room will be started to maintain minimum safeguards. If this method does not isolate the leak, the suction header valves for the affected room will be closed to complete isolation of the room.

To prevent highly radioactive waste from being transferred to the dirty waste drain tank and possibly beyond in a post-accident scenario, the receipt of a containment high-radiation signal will prevent auto start or stop the engineered safeguards pump rooms sump pumps if the pumps are running in the normal auto position.

With the pumps not operating, any system leakage will be restrained in the engineered safeguards room. Appropriate safety systems isolation will be taken as stated in the cases above. The pumps can still be run in the manual position if the need arises.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-20 of 6.1-23 6.1.3 TESTING 6.1.3.1 Operational Testing

1. Routine operational testing of major portions of the logic circuits, pumps and power-actuated valves in the Safety Injection System is described in Section 7.3 and Appendix 7A.

2. Pump and valve operability tests are conducted in accordance with the inservice test codes required by 10 CFR 50.55a.

The inservice test program described in Site Engineering Program SEP-PLP-IST-101, "Inservice Testing of Plant Valves," is applied to the following Safety Injection System and related Primary Coolant System check valves:

a. Safety Injection Tank (SIT) and Primary Coolant System (PCS) check valves are tested by allowing water from each safety injection tank to flow past the check valves into the PCS. Full stroke testing can only be accomplished during Mode 6.

b. Low Pressure Safety Injection (LPSI) check valves are tested by using a LPSI pump and pumping water through each LPSI loop into the PCS. Full stroke testing can only be accomplished during Mode 5 and 6.

c. High Pressure Safety Injection/Redundant High Pressure Safety Injection (HPSI/RHPSI) check valves are tested by using a HPSI pump and pumping water through each HPSI and RHPSI loop into the PCS. Full stroke testing can only be accomplished during Mode 6 when the reactor vessel head has been removed.

d. Hot Let Injection (HLI) check valves are tested by using a HPSI pump and pumping water through each HLI line to the PCS.

Full stroke testing can only be accomplished during Mode 6 when the reactor vessel head has been removed.

Testing is accomplished by a combination of flow testing and application of non-intrusive testing techniques to verify each check valve is capable of performing its safety functions.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-21 of 6.1-23

3. Additionally, test connections have been added upstream of each of the Class 1 boundary check valves, on both the low- and high-pressure safety injection lines. Because the low-pressure safety injection line check valves provide overpressure protection from the high-pressure Safety Injection System, their proper closure is confirmed after each use of the system for shutdown cooling, per Technical Specifications requirements.

6.1.3.2 Environmental Testing In addition to the testing described for the high-pressure and low-pressure pumps, environmental testing has been performed on equipment required to perform safety-related functions in harsh environments post-DBA.

Subsequent additional testing and evaluation has also been completed as part of Consumers Power Company's response to the requirements of 10 CFR 50.49. Refer to Subsection 8.1.3 and Appendix 7C for details.

6.1.4 DESIGN ANALYSIS Ability to meet the core protection criteria is assured by the following design features:

1. A high-capacity passive system which requires no outside power source and will supply large quantities of borated water to rapidly recover the core after a major Loss of Coolant Accident up to a break of the largest primary coolant line.

2. A pumping and water storage system with internal redundancy which will inject borated water to provide core protection for primary coolant break sizes equal to and smaller than the largest connecting line to the primary system (the 12 inch ID pressurizer surge line). This system also provides borated water to maintain cover over, and continue cooling, the core after the passive system supply has been injected. In addition, this system will remove reactor core decay and stored heat for a long time period (one year) after the primary coolant rupture.

Instrumentation and sampling provisions allow monitoring of the recirculated coolant.

3. Separated pump rooms and redundant pumping systems which will permit minimum safeguards equipment to operate should one pump room flood in the event of a pipe failure during long-term operation.

4. Redundant onsite power supplies in the form of two emergency generators, each of which has sufficient capacity for minimum safeguards operation.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-22 of 6.1-23

5. Except for certain primary system instrumentation sensors, all active components which must function individually for the system's performance to meet the criteria stated for core protection can be tested during normal reactor operation. In addition, extensive shop and preoperational tests are performed to verify adequate component and system operation.

6. Most of the active components are located outside the containment where they are protected from Primary Coolant System accident-generated missiles and post-accident environmental conditions. In 1980, pursuant to NUREG-0588, all safety-related electrical and control equipment functionability was reevaluated for environmental condition. Refer to Subsection 8.1.3 for additional details. Those active components located inside containment are shielded by missile barriers and need only operate for a short time period after the accident. These components were tested for operation under simulated post-accident conditions before installation.

7. The four injection lines are arranged such that ruptured primary coolant pipe movement will not cause a subsequent failure of injection lines in nonruptured loops. The maximum movement of the primary coolant pipe at the injection nozzle, in the nonruptured loop, is less than the three inches allowable for the injection line.

8. The Safety Injection System has been designed to meet the single failure criterion. This includes the fluid subsystem and instrument subsystem. Since the time of the original design, it has been determined that there are five valves which satisfy these criteria only under certain conditions. The safety injection tank motor-operated outlet valves must be in the open position and have the electrical power removed from the valves' electrical system, eg, the 480 V breaker open. The shutdown cooling heat exchanger bypass valve must be in the locked open position and the air supply removed, eg, the instrument air supply valve closed. All pumps and critical power-operated valves can be actuated from their respective switchgear locations or local panels. Instrumentation was also provided at locations other than the control room to ensure adequate control of the safety system if control room evacuation were required.

9. All Safety Injection System components, described in Subsection 6.1.2.2, are designated CPCo Design Class 1. This classification requires that each component be designed to withstand the appropriate seismic loads simultaneously with other applicable loads without loss of function (see Chapter 5).

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.1 Page 6.1-23 of 6.1-23

10. Analysis of the long-term cooling modification indicates that the simultaneous injection of approximately even flow through the hot leg and the cold legs is adequate to maintain the core integrity and prevents any boric-acid deposit in the core region (see Reference 1).

The design and selection of the flow parameters are based on meeting the ECCS acceptance criteria (see Reference 2). The flow indicators were seismically tested in accordance with IEEE Standard 344-1975, as required by Regulatory Guide 1.97.

The effectiveness of the Safety Injection System to satisfy the criteria stated for core protection can be shown by the blowdown and refill transient curves following a Loss of Coolant Accident. This analysis is presented in Section 14.17, Loss of Coolant Incident.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.2 Page 6.2-1 of 6.2-5 6.2 CONTAINMENT SPRAY SYSTEM 6.2.1 DESIGN BASIS The function of the Containment Spray System shown on Figures 6-1 and 6-2 is to limit the containment building pressure rise and reduce the airborne radioactivity in containment by providing a means for spraying the containment atmosphere after occurrence of a Loss of Coolant Accident or a main steam line break. The containment spray system also provides subcooling to the operating high pressure safety injection pumps following receipt of a Recirculation Actuation Signal (RAS).

The spray system is designed to give complete volume coverage above the 607 and 649 floor levels, with either half of the system operating and minimum interference between spray patterns with both halves of the system operating. The spray headers are located in the containment building giving a free fall height of spray water of 100 feet.

Pressure reduction is accomplished by spraying cool borated water into the containment atmosphere. Heat removal is accomplished by recirculating and cooling the water through the shutdown heat exchangers. It is sized such that two of the three pumps which start off the emergency diesel generator will limit containment pressure to less than design pressure following a DBA without taking credit for the containment air coolers. In addition, the spray lines within containment are maintained filled to elevation 735 feet to provide for rapid-spray initiation.

The reduction of airborne radioactivity (mainly iodine) may be aided by the recirculation of the unsprayed containment atmosphere by the containment air cooler ventilation fans. This recirculation is accomplished by V-1A, V-2A, or V-3A (powered from right channel) and V-4A (powered from left channel).

All system components are designed to withstand CPCo Design Class 1 loadings as described in Chapter 5.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.2 Page 6.2-2 of 6.2-5 6.2.2 SYSTEM DESCRIPTION AND OPERATION 6.2.2.1 General Description The system consists of three half-capacity pumps, two shutdown cooling heat exchangers (shutdown heat exchangers) and all necessary piping, instruments and accessories. The pumps discharge the borated water through the two heat exchangers to a dual set of spray headers and spray nozzles in the containment. These spray headers are supported from the containment roof trusses and the spray nozzles are arranged in the headers to give complete spray coverage of the containment horizontal cross-section area.

Two of the pumps are on one 2,400 volt bus, while the third is on a second 2,400 volt bus. These buses receive power from the offsite power sources or, upon loss of these sources, each bus is supplied from a separate emergency diesel generator. Two pumps will meet the capacity requirements in the event of a design basis accident (DBA).

The containment spray pump and seals are designed for operation at 325°F and require a continuous cooling water flow at a rate of 8.0 gpm to prevent seal degradation or failure and damage to bearings under the worst case conditions evaluated by the vendor. The two spray pumps and the shutdown cooling heat exchangers cooled by component cooling water are located in the west engineered safeguards room; the remaining pump is in the east room. Both engineered safeguards rooms are located on elevation 570 feet, in the CPCo Design Class 1 portion of the auxiliary building. Each room has a separate pump suction from both the SIRW tank and the containment sump to ensure that the pumps in one room will have adequate suction if the suction line to the second room fails. The Containment Spray System is shown in Figures 6-1 and 6-2.

6.2.2.2 Component Description Ratings and materials of construction are shown in Table 6-6. All portions of the system in contact with the Primary Coolant System or borated water are fabricated of stainless steel or other corrosion resistant material.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.2 Page 6.2-3 of 6.2-5 6.2.2.3 System Operation

1. Normal and Shutdown Operation During the period of normal or shutdown Plant operation, the spray system is not in service.

2. Post-DBA Operation The spray system is initiated by a containment high-pressure signal or remote-manual operation from the control room. If offsite power is available, the signal starts all three spray pumps and opens the isolation valves to the dual containment spray headers. If the offsite power sources are not available, the emergency diesel generators are started and the DBA sequencers allow all three spray pumps to start.

A time delay relay is present in the start circuitry of one of the two pumps that are on the same electrical bus. Upon receiving a CHP signal, the start signal of one of the pumps will be delayed by approximately 15 seconds. The delay will prevent the simultaneous starting of two containment spray pumps with other DBA sequencer loads during or after sequencing onto the diesel generator. This is required to prevent degrading bus voltage below acceptable levels.

Initially, the pumps take suction from the SIRW tank. Upon reaching low tank level, continuation of containment spray is accomplished by automatic transfer of the pump suction to the containment sump.

Transfer is automatically accomplished by closing the SIRW tank suction valves and opening the containment sump outlet valves.

Switchover is initiated on a one-out-of-two taken twice low-level signal from the four low-level switches on the SIRW tank. Also, the RAS throttles the containment spray valves CV-3001 and CV-3002 to a predetermined throttled position to ensure that the spray pumps have sufficient NPSH. The recirculated water is cooled by component cooling water in the shutdown heat exchangers prior to discharge into the containment atmosphere. During the recirculation phase from the containment sump, a portion of the cooled effluent from the shutdown heat exchangers is directed to the suction of operating high-pressure safety injection pumps to ensure that they have sufficient NPSH. In addition, if only one containment spray pump is operating, then one of the two containment spray headers is isolated to ensure that the containment spray pump has sufficient NPSH.

3. Safe and Stable Conditions After Fire Refer to the Fire Safety Analyses (Section 9.6.3) for information concerning operation of this equipment in a post-fire safe and stable scenario.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.2 Page 6.2-4 of 6.2-5 6.2.3 DESIGN ANALYSIS 6.2.3.1 Margins of Safety The spray pump pressure containing parts have been hydrotested at 1.5 times the design pressure which they will contain. The motor drivers have been selected to be acceptable over the entire pump operating range.

The maximum allowable pressure for the pipe minimum wall thickness is at least four times the maximum expected operating pressure for the pump suction piping. Upon depletion of the SIRW tank, the containment spray pumps will be supplied with water from the containment sump for return through the two heat exchangers to the containment spray headers. The discharge from the containment spray pumps is piped into the containment building and into each of the duplicate spray headers. The maximum allowable pressure for the minimum wall thickness of the discharge piping is approximately 1.4 times the maximum expected pressure (Reference 17).

The maximum allowable pressure for the minimum wall thickness of the portions of the HP pump suction lines from the pump suctions to the first check valves in the suction lines and from the pump suctions to the discharge of the shutdown heat exchanger is approximately two times the maximum expected operating pressure (Reference 17).

6.2.3.2 Margins of Capacity See Section 14.18 for spray flow rates required to mitigate a design basis accident.

The spray system is designed for a heat absorbing capacity of 240 x 106 Btu/h during the injection phase for two pumps and a containment temperature of 283°F.

The nozzles are designed to discharge spray droplets with a mass mean diameter of 1800 microns at a nozzle pressure drop of 16 psid. The minimum vertical drop from the spray nozzles is approximately 100 feet. Thus, the spray water will effectively be in thermal equilibrium with the containment atmosphere before reaching the containment sump. In addition, the fission product removal efficiency of the spray droplets is maintained.

6.2.3.3 Testing The spray pumps and shutdown cooling heat exchangers are located outside the containment to permit access for periodic testing and maintenance during normal Plant operation.

Recirculation lines to the SIRW tank are provided for testing purposes. These lines include the three individual pump mini recirc lines, one SIRW tank fill line and two containment spray recirculation lines. Valves in each of these lines are normally locked closed, and opened only for testing.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.2 Page 6.2-5 of 6.2-5 The three identical spray pumps have been shop tested at sufficient head capacity points to generate complete performance curves. NPSH requirements for the capacity range were verified by a suction pressure suppression test for each pump. A shop thermal transient test from 101°F to 350°F in ten seconds performed on one pump assured that the design is suitable for the switchover from the injection to the recirculation mode.

Certified performance data for one spray nozzle have been provided which show manufacturing tolerances such that the maximum spray droplet mass mean diameter will not exceed 1800 microns at 16 psid.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-1 of 6.3-6 6.3 CONTAINMENT AIR COOLERS 6.3.1 DESIGN BASES The function of the containment air recirculation and cooling system (see Figure 9-14) is to remove heat and vapor from the containment atmosphere during normal Plant operation and, in the event of a DBA, to limit the containment building pressure rise and reduce the leakage of airborne radioactivity by providing a means of cooling the containment atmosphere.

The containment air recirculation and cooling system is independent of the Safety Injection and Containment Spray Systems. Refer to Chapter 14 for Engineered Safeguards Equipment Alignment. For purpose of design diversification for greater electrical reliability, the three fan units are aligned with one containment spray pump, while the fourth fan unit is aligned with the remaining two containment spray pumps.

The containment air cooler fans are not relied upon but help to mix the containment atmosphere to prevent local accumulation of combustible gases and improve the effectiveness of the iodine removal rate of the containment sprays (Section 6.2).

All system components are designed to withstand CPCo Design Class 1 loadings as described in Section 5.2.

6.3.2 SYSTEM DESCRIPTION AND OPERATION 6.3.2.1 General Description The containment air recirculation and cooling system includes four air handling and cooling units located entirely within the containment building.

Plant service water from the critical service water header is circulated through the air cooling coils.

One non-safety related cooler consists of four coils piped to manifolds for supply and return connections to the Service Water System.

The remaining three safety related coolers also consist of four coil banks each. The headers from each coil bank are connected to the piping of the Service Water System.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-2 of 6.3-6 The service water supply line for each safety-related cooler has an air-operated stop valve which is electrically locked open. The return line for each safety-related cooler has an air-operated discharge valve which is normally held closed and a temperature control valve in a bypass line around the closed discharge valve. The normal operating position of the service water discharge valve for VHX-3 is open to preclude the potential for silt/sand buildup on the closed valve disc which may cause valve binding. The non-safety related cooler (VHX-4) has air operated valves in its service water supply and return lines that are normally open. The service water supply and discharge valves for all the coolers go to their safety position upon loss of control power or instrument air. The supply and discharge valves may be manually operated from the main control room and the engineered safeguards local panel. The temperature control valves were modified by SC 054 to eliminate the automatic temperature control function for the three safety-related coolers and are normally open using a constant air supply to the valve. The temperature control valve for VHX-4 was failed closed by removing its air line per FC-713.

Air is drawn through the coils by two matched vaneaxial fans with direct connected motors. One 30 hp fan motor is rated for normal operating conditions and the second 75 hp fan motor is rated for post-DBA conditions. The fan motors rated for the post-DBA condition are fed from the emergency power buses. All fans may be manually started or stopped from the main control room or at the individual breakers.

Air filters are located in each cooler ahead of the coil bank to maintain coil surface cleanliness.

Gravity-operated dampers are installed in each fan discharge to assure that the airflow will not short circuit back to the fan inlet plenum when only one fan is operating.

Each cooler has a sump with a drain, a liquid level switch and an overflow valve.

Normally, very little water will be condensed from the air and the small amount will easily flow out through the drain. If a cooling coil leak or steam leak occurs to cause a flow to the sump greater than 20 gpm, the level in the sump will rise to the liquid level switch and initiate an alarm in the control room. A sketch of this arrangement appears in Figure 6-3. During post-DBA operation, water flows of over 130 gpm (Reference 24) will flow through the overflow valve.

Ratings and materials of construction are shown in Table 6-7. Service water flow is shown in Figure 9-1.

The impact on the containment air coolers of a postulated water hammer event during design basis accident conditions is discussed in Section 9.1.3.4.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-3 of 6.3-6 6.3.2.2 System Operation

1. Normal Operation Four units are normally in operation with two fans in each unit operating. Each unit cools with service water controlled by a temperature control valve and/or high-capacity valve on the discharge piping. Containment temperature is maintained through combined operation of containment air cooler fans and the positioning of the service water valves. During normal operation, the service water flow to the three safety-related coolers is constantly supplied through the temperature control valves, and if necessary, the high capacity discharge valves. FC-713 failed VHX-4's temperature control valve closed by removing its air supply line; however, VHX-4 can still be used for normal cooling by opening its high-capacity discharge valve.

Refer to Table 6-8 for containment air cooler performance data during normal operation.

2. Plant Shutdown Operation During Plant shutdown, all cooling units continue to operate as in normal operation.

3. Emergency Operation The coolers are automatically changed to the emergency mode by a safety injection signal (SIS). This signal will trip the normal rated fan motor in each unit and open the high-capacity service water discharge valve from VHX-1, VHX-2, VHX-3, and VHX-4 and close the service water supply valve to VHX-4.

With offsite power available under this mode of operation, all four units continue in operation as described above. If offsite power is not available and an SIS occurs, the emergency diesel generators are started and the DBA sequencers allow all four coolers to start using the DBA rated fans. Three coolers fans are on one emergency generator bus and one cooler fan is on the other emergency generator bus. Note that VHX-4 will not be providing cooling since its inlet valve is closed.

Each safety-related unit has the capability of 1/3 of the required cooling in the event of a DBA. Refer to Table 6-9 for containment air cooler performance data during post-DBA operating conditions.

4. Safe and Stable Conditions After Fire Refer to the Fire Safety Analyses (Section 9.6.3) for information concerning operation of this equipment in a post-fire safe and stable scenario.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-4 of 6.3-6 6.3.3 DESIGN ANALYSIS

1. The direction of flow from operating areas toward the missile shielded area will tend to sweep the moisture into the coolers and condense it, thereby maintaining a dryer atmosphere in the containment building.

2. The coil capacity is based upon the service water flows and temperatures shown in Table 9-1.

3. The cooling coils are equipped with removable header cover plates to permit cleaning and tube plugging in the field.

4. The containment cooler cabinets, filters, coils and fans are protected from physical damage by missile shields. The cabinet and necessary ductwork are designed for pressure differences occurring during a DBA and seismic loads from earthquakes. A large relief panel is located in the elbow to each cooler which will divert the blast of steam and water away from the cooler and reduce the forces upon the cooler structures, filters, coils and fans (see Figure 6-3).

5. Failure of the electrical power supply will automatically put all of the four 75 hp fans on emergency electric power. These fan motors are specially rated for post-DBA conditions.

6. The fans are designed to operate for the life of the Plant. There are no belts or flexible couplings. The motor is directly connected to the fan wheel and the motor is cooled by the air flowing through the fan wheel.

The fans that remain running during an emergency are rated for the design load at the emergency condition which is two-and-a-half times the normal load. Therefore, they will normally operate at a very light load, preserving insulation life and bearing life.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-5 of 6.3-6

7. An excessive drain water flow from the coil will be indicated in the control room by an alarm. By shutting down the cooler with the indicated high water flow, it can be determined whether the coil is leaking or if excessive condensate is being formed. A steam leak or primary coolant leak would be accompanied by an increase in the containment atmosphere humidity which would be detected by the containment humidity sensors and indicated in the control room. The absence of humidity indication would indicate the excessive water is from a leaking coil. If a leak does exist, the cooler in the vicinity of the defective unit may meet the increased duty by the manual opening of the service water high capacity discharge valves and permitting the emergency flow set during system flow balancing to flow through the coil. Significant leakage is detected by the service water break detector. This is a switch that subtracts the service water flow leaving containment from the flow entering. This alarms when the difference is 300 gpm. The system was originally intended to provide a means of finding an air cooler with a serious leak by isolating air coolers singly to see which would clear the alarm.

6.3.4 COMPONENT TESTING 6.3.4.1 Coils To prove the design of the cooling coil units, a coil section duplicating the full-size unit characteristics was laboratory tested to determine its thermal performance. The coil section was tested in an independent laboratory facility and all quality-related aspects of the test program were subject to a Quality Assurance program and the applicable requirements of ANSI N45.2-1972, 10CFR50 Appendix B and 10CFR21.

The laboratory test program was initiated to accurately determine the performance parameters of the cooling coil heat transfer configuration in simulated LOCA conditions. The sample coil section was tested in a pressure vessel designed to duplicate LOCA type conditions. A series of tests collected data on the coils air and water temperatures and flow rates, condensate flow rates and temperatures, and system pressures. The test data was tabulated and later used to develop and validate a computer model for the coil unit. The computer model accurately predicts the LOCA performance characteristics for the full-sized installed cooling coil units.

(Reference 18)

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 32 SECTION 6.3 Page 6.3-6 of 6.3-6 6.3.4.2 Fans

1. A fan has been tested at design load to prove its ability to operate continuously for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at the maximum design conditions of 283°F, 55 psig and 100% relative humidity. The motor stator was baked for 9 days at 220°C before the test to degrade the insulation and simulate the effects of normal operation for 10 years. During the test of the motor: field windings, bearings and internal air space temperatures were monitored along with motor current, voltage and power.

2. At the completion of the 24-hour period, the fan continued to run for an additional 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> at approximately 100°F. At the completion of this 48-hour run, the motor was cooled down to room temperature and the insulation resistance checked and compared to the original readings.

The motor bearings were inspected for damage by the motor manufacturer. Then the test chamber was again pressurized to the design condition of 55 psig and 283°F with the addition of live steam.

The fan motor was started and run until the motor operating temperatures reached those determined during the 24-hour test.

6.3.4.3 Testing Heat transfer capability of the safety related Containment Air Coolers, VHX-1, VHX-2, and VHX-3 could not be verified during performance testing due to small heat loads and instrument inaccuracies. Therefore, periodic cleaning and inspection of the coils is performed in lieu of testing in accordance with GL-89-13.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 30 SECTION 6.4 Page 6.4-1 of 6.4-3 6.4 CONTAINMENT SUMP PH CONTROL 6.4.1 DESIGN BASIS Pursuant to Amendments 158 and 165 to the Operating License DPR-20 and the changes to the Technical Specifications, the existing Iodine Removal System involving hydrazine and sodium hydroxide addition has been deleted.

The Containment Spray System acts to reduce the post-accident level of fission products in the containment atmosphere. In addition, baskets of sodium tetraborate (NaTB) are installed in the containment to maintain a neutral containment sump solution by the onset of the recirculation phase, for purposes of iodine retention.

6.4.2.1 General Description The sodium tetraborate (NaTB) baskets consist of wire mesh baskets containing between 8,186 and 10,553 lbs of granular NaTB decahydrate (Reference 25) and are placed inside the containment at the 590' elevation.

The baskets have solid lids and are raised from the floor to avoid loss of NaTB due to any spillage or leakage on the containment floor during normal plant operations. The NaTB baskets are sized and designed to ensure timely dissolution of NaTB by the onset of containment spray recirculation, and to ensure contact with flooding. The approximate time for a Recirculation Actuation Signal (RAS) is 20 minutes after a large break LOCA with both trains of engineered safeguards equipment operating.

6.4.2.2 Operation Prior to Recirculation Actuation Signal (RAS), borated water from the containment spray and the postulated pipe break would be flowing towards the containment sump. In the case of a large break LOCA, the Emergency Core Cooling System (ECCS) water is pumped into the containment and thus creating a highly turbulent environment. The granular NaTB is submerged and dissolved in the flood, thus raising the pH of the containment sump solution by the onset of containment spray recirculation. In the case of a much smaller break, the flow rate would not be as high as that after a large break LOCA. However, RAS would not occur as quickly as in the large break scenario and consequently a longer period of time would be available for the NaTB to dissolve.

The pH of the aqueous solution collected into the containment sump should be maintained at a level sufficiently high to provide assurance that significant long term iodine re-evolution does not occur. Long term iodine retention may be achieved only when the equilibrium sump solution pH, after mixing and dilution with the primary coolant and ECCS injection, is above 7. This pH value is achieved by the onset of the spray recirculation mode. Containment sump pH control with granular NaTB is completely passive, requiring no active mechanical or operator action. Periodic samples of NaTB are taken to ensure the NaTB 's dissolution and buffering capabilities.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 30 SECTION 6.4 Page 6.4-2 of 6.4-3 6.4.2.3 Materials The material of the equipment and components of the Emergency Core Cooling Systems have been examined for compatibility with the sodium tetraborate solution and are adequate for extended operation in contact with this solution. The components and materials are listed in Table 6-10. The NaTB baskets are fabricated from all stainless steel materials to be chemically compatible with the NaTB.

Service Water Valves Body - Carbon Steel ASTM A 216 WCB Operator Enclosure - Cast Iron Containment Spray Nozzles The design of the spray nozzles was reviewed to confirm that the spray nozzles are not subject to clogging from debris entering the recirculation system through the containment sump screens. It was concluded that sodium tetraborate solution will have no effect on containment spray system operation.

Containment Air Cooler Fan Blades The fan blades are aluminum and would be affected by this solution if exposure were credible. Exposure is not considered possible since the fans draw suction from the steam generator compartments which are covered and, therefore, not exposed to the spray water. Any droplets carried into these compartments will first pass through an inlet filter and then are passed over the coils. The filter will remove most of these droplets and the coils will remove the balance. Any droplets passing through the filter will be intercepted by the coils and diluted by the condensate on the coils. Any droplets which might escape the coils will be considerably diluted; further, the low velocity in the fan inlet plenum will allow any droplets which escape the coils to fall into the condensate collection chamber and the physical location of the fans in a vertical duct approximately six feet above the outlet of the coolers precludes the transport of droplets to the fan blades. Additionally, when the containment air cooler fans were replaced under Facility Change FC-548, the new fan blades and fan wheel hubs were coated with stainless steel, which prevents the aluminum from being chemically affected.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 30 SECTION 6.4 Page 6.4-3 of 6.4-3 6.4.2.4 Paint The paint systems used on the large surface area equipment inside containment were selected on the basis of withstanding the post-MHA environmental condition of 283°F, 55 psig, 100% relative humidity, borated water, an integrated dose of 2 x 107 rads, and suitable heat transfer to the heat sinks.

To meet these requirements, the primary paint system selected was a Carboline Co inorganic zinc system, Carbo Zinc 11 primer and inorganic zinc finish No 3912. Inorganic zinc paint systems have been tested as follows:

1. Irradiated at 2.6 x 106 R/h to a cumulative dose up to 1 x 1010 R as covered by ORNL Report No 3916 and ORNL Report No 3589 (see References 3 and 4). The conclusions based on the results of the irradiation tests are that the inorganic zinc paint systems will withstand the post-MHA radiation.

2. Subjected to 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />' test with samples submerged in a solution at 212°F, 1.3% boric acid and 9.5 pH. Conclusions derived from the ORNL test data are that the inorganic zinc systems will withstand the post-MHA condition with negligible hydrogen production.

3. Subjected to manufacturer's test with samples submerged in a solution of 9.5 pH with the temperature varied as follows:

150°F to 285°F in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 285°F held for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 285°F to 200°F in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> From the test results, the manufacturer has reported no significant physical change in the paint system and calculates a hydrogen production of 5 x 10-6 grams/square foot/hour of surface.

Decontaminable coatings of the generic epoxy and phenolic type have been used in the Palisades containment. Both systems have also been subjected to and satisfactorily passed tests of irradiation up to 1 x 1010 rads as reported in ORNL-3589 and ORNL-3916 (see References 4 and 3, respectively).

Certain small surface area equipment has been coated with systems such as red lead primer on structural steel and various manufacturers' standard coatings on equipment. These systems have not been specifically subjected to tests at post-MHA conditions. Past experience of removing these systems indicates that, if the paint failed, it would become a granular residue and would not fail by large sheets falling from the surface. The granular residue would settle to the floors with minimum possibility of settlement entering the drain piping and recirculation piping. Therefore, failure of these paint systems to a granular residue would not result in plugging of any of the Palisades recirculation or spray equipment.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 21 SECTION 6.5 Page 6.5-1 of 6.5-1 6.5 CONTAINMENT VENTING CHARCOAL FILTER 6.5.1 GENERAL The containment atmosphere can be vented through a 1,000 ft3/min capacity charcoal filter by the main exhaust fan as shown on Figure 6-4 and Figure 9-14. The venting mode is established by manually opening the two isolation valves in the line to the charcoal filter. Air is drawn from the containment through the exhaust duct, through the filter, and into the plenum.

The radiological filter will hold 200 grams of methyl iodide and approximately 60 pounds of elemental iodide without an appreciable increase in differential pressure.

After venting the containment atmosphere, it will be necessary to provide makeup air to the containment by operating the air room purge fan.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 29 SECTION 6.6 Page 6.6-1 of 6.6-1 6.6 DELETED

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-1 of 6.7-6 6.7 CONTAINMENT ISOLATION SYSTEM 6.7.1 DESIGN BASIS The Containment Isolation System is designed to minimize the release of radioactivity from the containment building to the atmosphere in the event of an accident resulting in containment building high atmospheric pressure or radioactivity.

6.7.2 SYSTEM DESCRIPTION AND OPERATION 6.7.2.1 System Description All containment building penetrations are considered as potential sources of airborne radioactive leakage to the atmosphere in the event of a DBA or leakage of radioactive wastes. Isolation devices are provided in all process systems penetrating the containment which serve to isolate the containment building atmosphere when required. These isolation devices are of two basic types: those which automatically close and those which are locked closed during normal operation. Table 6-14 lists the isolation devices for which Technical Specification LCO 3.6.3, Containment Isolation Valves, is applicable.

The type and quantity of isolation valves for each pipe penetration are determined by the process system operational and physical characteristics in relation to the containment building atmosphere. The various types of penetration and isolation devices are classified as follows:

1. Class A1 These pipe penetrations include those systems that are normally open or may be open to the containment atmosphere during power operation. These penetrations have two valves in series which close automatically when required. Check valves are considered automatic and, with their exception, all valves can be remotely closed from the main control room.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-2 of 6.7-6

2. Class A2 These pipe penetrations include those systems that are normally closed to the containment atmosphere during power operation, with the exception of the service air line which may be infrequently opened. If a line is part of a closed system outside the containment which is designed for pressure equal to or greater than containment design pressure, the line contains one normally closed manual valve. If a line is part of a system external to the containment which is either an open system or a closed system whose design pressure is less than containment design pressure, the line contains two normally closed manual valves or one normally closed manual valve and a blind flange in series. A mechanical lock on each valve will ensure the valve is not left open or inadvertently opened during power operation.

3. Class B1 Penetrations in this class include those systems that are normally opened or may be opened to the Primary Coolant System during power operation. These lines contain two valves in series. If a line is part of a closed system external to the containment which is designed for pressure equal to or greater than containment design pressure, at least one of the valves must automatically close when required. If a line is part of a system external to the containment which is either an open system or a closed system whose design pressure is less than containment design pressure, both valves must automatically close.

Check valves are considered automatic and, with their exception, all valves can be remotely closed from the main control room.

4. Class B2 Penetrations in this class include those systems that are connected to the Primary Coolant System but are never opened during power operation. These lines contain two normally closed valves in series. A lock on each valve will ensure the valve is not left open or inadvertently opened during power operation.

5. Class C1 Penetrations in this class include those systems that are not connected to either the containment atmosphere or to the Primary Coolant System and are normally open or may be opened during power operation. These lines are protected from missiles originating inside the containment and the lines themselves form the boundary of the containment. One remote manually operated valve, locked closed manual valve or automatic isolation valve is provided in each line.

Check valves are considered automatic.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-3 of 6.7-6 Service Water System Penetrations 12 and 13 are designated as Class C1 penetrations. Reference 19 concluded that this system and associated penetrations are adequately protected from internally generated missiles and meet the requirements for design against missiles.

The inlet and bypass valves for steam traps between Main Steam Penetrations 2 and 3 and the Main Steam Isolation Valves may be open. This is considered acceptable because any release through these flow paths is already included in the radiological consequences for the bounding accident analyses.

6. Class C2 Penetrations in this class include systems that are not connected to either the containment atmosphere or to the Primary Coolant System and are normally open or may be opened during power operation.

These lines are not missile protected. If a line is part of a closed system external to the containment which is designed for pressure equal to or greater than containment design pressure, the line contains one remote manually operated valve, locked closed manual valve or automatic isolation valve. If the line is part of a system external to the containment which is either an open system or a closed system whose design pressure is less than containment design pressure, the line contains two automatic isolation valves in series. Check valves are considered automatic.

7. Class C3 Penetrations in this class include those systems that are not connected to either the containment atmosphere or to the reactor coolant system and are never opened during power operation. These lines contain two normally closed manual valves in series. A mechanical lock on each valve will ensure the valve is not left open or inadvertently opened during power operation.

8. Class X Penetrations in this class include those that are not covered or assigned to any of the above classes. These include penetrations for engineered safeguards, equipment access opening, personnel access air locks, fuel transfer tube, and electrical penetrations.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-4 of 6.7-6 6.7.2.2 Component Description The piping penetrating the containment and the containment isolation valves are rated for at least twice containment design pressure. All isolation valves were initially subjected to nondestructive testing in accordance with ASA B31.1-1955 and applicable nuclear code cases. Valves are presently tested as indicated in Section 6.9.

Isolation valves inside the containment are located outside the missile shield wall which surrounds the Primary Coolant System. Manual isolation valves outside the containment which may require operation in the event of a DBA are located in areas permitting limited access.

6.7.2.3 System Operation Each power-operated isolation valve may be opened or closed during normal Plant operation by means of a hand switch in the main control room. In the event of an accident resulting in containment high pressure or radiation, certain power-operated isolation valves are automatically driven closed. In the event of a Loss of Coolant Accident, certain isolation valves associated with engineered safeguards systems are automatically opened. Figure 6-5 lists all containment penetrations assigned for use and their service.

The containment isolation signal initiates closure of certain automatic isolation valves. This signal is derived from two out of four containment high-pressure signals (CHP) or two out of four containment high-radiation signals (CHR).

The safety injection signal (SIS) initiates the positioning of certain valves associated with the injection systems. The safety injection signal is derived from two out of four pressurizer low-pressure signals or two out of four containment high-pressure signals. The main steam line isolation signal initiates closure of the main steam line isolation valves and is derived from two out of four low-pressure signals from either steam generator or the containment high-pressure signals (CHP).

The containment isolation signal can be manually initiated with the test switch in the following sequence of operations:

Either of two redundant switches located in the control room turned to test position de-energizes two of the four channels which will initiate containment isolation, initiate SIS and start the containment spray pumps. The spray valves will not open in test position; if the spray valves are not both closed fully, the spray pumps cannot be started in test position.

The containment spray valves can be manually opened by means of their individual hand switches located in the control room. This second necessary manual operation to initiate the spray system will prevent inadvertently spraying inside containment with the borated water.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-5 of 6.7-6 Instrumentation and control circuits in the Containment Isolation System are fail-safe; ie, the valves will fail closed upon the loss of voltage or control air, with the exception of the component cooling water supply and return isolation valves. These valves are fail-open with normally de-energized solenoid valves, thereby preventing the loss of component cooling water through the primary coolant pumps' heat exchangers and lube oil coolers upon failure of the supply voltage, air supply or mechanical equipment and the resultant serious upset to the Plant's operating condition and safety. In the event of containment high pressure with a loss of instrument air, component cooling water supply and return isolation control valves will be held closed by air stored in accumulators. The accumulators for CV-0911 and CV-0940 were tested prior to start up in April of 1987. The accumulator for CV-0910 was installed during refueling outage 1R25 and tested after installation (Reference 29). Periodic testing will be performed in the future.

Control circuits which actuate automatic isolation valves arranged in a series configuration are completely separate, ensuring that no single failure will compromise the integrity of the containment isolation system. Electric motor-operated valves are not used for automatic isolation purposes.

Containment de-isolation is accomplished by a manual reset push button on each circuit when containment pressure and radiation have decreased below the isolation trip points on at least three of the four pressure and radiation sensors. In response to NUREG-0737, all automatic containment isolation valves are electrically locked closed to preclude automatic opening upon resetting of the containment isolation signal (CIS). Subsequent to resetting of CIS, the control switch for each valve will need to be moved to the "close" position and then to the "open" position to reopen the valve, with the exception of component cooling isolation valves and main steam isolation valves. Component cooling is isolated to containment upon a CHP signal.

The operator has the option of bypassing the standing signal under certain conditions. The control switch for the MSIVs is kept in the open position after automatic or manual closure of the valves. The switch is kept in the open position to extend the life of the solenoid valves in the control air system.

When the CHP signal decreases below its set point, after initiation, the solenoid valves for the MSIVs will automatically de-energize. To open the MSIVs, the solenoid valves in the control air system must be reset locally.

Prior to reopening any of the isolation valves following an accident, administrative controls will require samples of the containment atmosphere and of the recirculated water to be taken and checked for activity.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.7 Page 6.7-6 of 6.7-6 6.7.3 DESIGN ANALYSIS 6.7.3.1 System Reliability - Margins of Safety System reliability is achieved with the following features:

1. Automatic containment isolation valves are air-operated, fail-closed type, with the exception of the component cooling water supply and return isolation valves as explained previously. The electrical circuitry for developing the isolation signal and actuating the isolation valves is fully redundant and powered from the preferred ac system.

2. Where required, isolation valves are arranged in series so that no single failure will compromise Plant safety.

6.7.3.2 Provisions for Testing and Inspection Components of the Containment Isolation System outside the containment are accessible for periodic inspection during Plant operation. Components inside the containment are accessible only during Plant shutdown.

Provisions are made for pressure testing between all isolation valves in a series arrangement enabling the verification of valve seating or check valve operation.

Operation of the automatic isolation valves can be tested during cold shutdown by means of push buttons located in the main control room.

Indication of actuation is provided for each channel of containment high pressure and each channel of containment high radiation.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 21 SECTION 6.8 Page 6.8-1 of 6.8-2 6.8 REACTOR CAVITY FLOODING SYSTEM The flooding system consists of a network of floor drain piping as shown in Figure 6-6 arranged to perform two functions:

1. Collect normal expected floor drains and transport these drains to the containment sump for subsequent disposal outside the containment.

2. Collect a portion of the containment spray water and transport this water into the reactor cavity for flooding and cooling the outside of the reactor vessel bottom head.

The two one inch drain lines at the bottom of the reactor cavity contain drain plugs that are designed to inhibit the flow of core debris (corium) into the containment sump in the event of a core meltdown and subsequent reactor vessel failure. The plugs are also designed to permit the flow of water through the drain lines.

The drain lines serve no safety related function. If the plugs become degraded or are not installed, there is no impact on plant safety system operability. A core meltdown and subsequent failure of the reactor vessel is not a design basis event.

6.8.1 SYSTEM OPERATION

1. Normal Operation Normal floor drains from equipment leakage or washdown during power operation or during shutdown will enter the floor drain piping and flow by gravity onto the containment base slab at elevation 590 feet 0 inch, and then into the containment sump. This drainage will then flow by gravity to receiving equipment outside the containment. The outlet ends of the five 6-inch diameter floor drain downcomers discharging onto the 590-foot 0-inch base slab are capped, with a 1-1/4-inch diameter orifice hold drilled in each cap. These orifices are sized to pass the maximum expected normal floor drains with less than eight feet static head in the downcomers.

2. Flooding Operation In the event that the Containment Spray System is operating, the portion of spray water deposited on the floors above the 590-foot 0-inch base slab will enter the floor drain piping and flow by gravity toward the base slab. The 1-1/4-inch-diameter orifice holes will restrict the spray water flow discharge onto the base slab and cause the water to back up in the downcomers and flow into the reactor cavity at elevation 598 feet 11-7/8 inches. The flow path into the cavity is through five 6-inch-diameter pipes connected to the drain system downcomers.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 21 SECTION 6.8 Page 6.8-2 of 6.8-2 The flooding level in the reactor cavity will rise until the level reaches the primary coolant pipe openings through the biological shield. The flooding water will then flow out the cavity and into the containment sump.

The purpose of the flooding operation is to cool the reactor vessel during severe accidents that may progress to core melting. During these events, insufficient or no core cooling flow is available to remove the core decay heat. These accidents are beyond the scope of the Standard Review Plan events included in Chapter 14 of the FSAR. As a result, no credit is taken for the flooding system to mitigate the events described in the FSAR.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.9 Page 6.9-1 of 6.9-3 6.9 INSERVICE INSPECTION OF ASME CLASSES 1, 2 AND 3 SYSTEMS AND COMPONENTS SEP-ISI-PLP-003, "Palisades Inservice Inspection Master Program Fifth Interval, ASME Section XI, Division 1," is the basis document and database for the Inservice Inspection Program. Systems and components were selected for coverage by the inspection plan through Section 50.55a of 10 CFR 50 for ASME Class 1 systems and components. Regulatory Guide 1.26 was used to select ASME Classes 2 and 3 systems and components for coverage by the inspection plan. Additional inspection requirements are incorporated in the inspection plan by implementing Technical Specification LCO 3.4.14 and Operating Requirements Manual Specification 4.12. The inspection plan requires that ASME B&PV Code,Section XI unacceptable discontinuities be dispositioned through application of the Quality Program that is identified in Section 15.1. Fulfilling the requirements of this program will initiate additional code requirements identified in Section XI, which will be implemented by Plant procedures as necessary.

Selected portions of the major components and systems to be examined in accordance with Section XI are listed in Table 6-12.

The use of Code Cases and Relief Requests shall be documented in SEP-ISI-PLP-003.

The Inservice Inspection Program shall be updated to the latest approved edition and addenda of Section XI prior to the start of each new inspection interval in accordance with 10 CFR 50.55a(g)(4). Palisades may also optionally update the Inservice Inspection Program as allowed by 10 CFR 50.55a(g)(4)(iv) to use subsequent editions and addenda of Section XI as referenced by 10 CFR 50.55a(b). Updates are subject to approval by the NRC (Reference 7).

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.9 Page 6.9-2 of 6.9-3 6.9.1 STRUCTURAL INTEGRITY EXAMINATION Pursuant to Paragraph 50.55a(g) of 10 CFR 50, the fifth Inservice Inspection Interval examination requirements are based on the rules set forth in ASME Section XI, 2007 Edition through 2008 Addenda.

Temporary non-code repair of ASME XI Class 1, 2, and 3 components requires specific written relief granted by the NRC. Due to the frequency of small leaks in some Class 3 systems, the NRC issued Generic Letter 90-05 (Reference 14) which provides guidance to be considered by the NRC in evaluating relief requests submitted by licensees for temporary non-code repair of ASME Class 3 piping. Subsequent to GL 90-05, the NRC issued guidance (Reference 15) that permitted use of stop gap measures to limit leakage from a Class 3 system while a relief request for a non-code repair is being prepared. The criteria for using stop gap measures for Class 3 piping are that the structural integrity of the flawed piping must not be affected, the measures must be reversible, and the relief request must be submitted expeditiously.

System leakage tests, system functional tests, system inservice tests and system hydrostatic tests are performed in accordance with the latest edition of ASME Section XI approved for use at the Palisades Plant and with approved relief requests and requests for code case use.

In February of 1994, CPCo detected a leak in a containment sump check valve, CK-ES3166. CPCo requested and received approval from the NRC (NRC letter dated April 6, 1994) to use Code Case N-504-1 for a weld overlay repair as an alternative to the ASME B&PV,Section XI Code requirements.

The code case was used for repair of the valve and for the corresponding valve in the alternate train (CK-ES3181). A requirement of the NRC's approval was that CPCo commit to inspect the valves every refueling outage using surface and volumetric techniques demonstrated to be effective.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.9 Page 6.9-3 of 6.9-3 6.9.2 PUMP AND VALVE TESTING PROGRAM Inservice testing of ASME Classes 1, 2 and 3 pumps and valves is done in accordance with ASME OM Code-2004, Code for Operation and Maintenance of Nuclear Power Plants, with Addenda through 2006 as required by 10 CFR 50.55a(f), except where specific relief has been granted by the NRC. This testing provides assurance that these components will function if required.

6.9.2.1 Pump Testing Program The inservice pump test program is summarized in Table 6-13. The pumps are generally tested per OM-2004, OMb-2006, Subsection ISTA and ISTB, except where acceptable alternative testing in accordance with 10 CFR 50.55a is allowed by the NRC. Complete details are contained in Site Engineering Program SEP-PLP-IST-102, "Inservice Testing of Selected Safety Related Pumps."

6.9.2.2 Valve Testing Program Valves are generally tested per OM-2004, OMb-2006, Subsection ISTA and ISTC, except where acceptable alternative testing, in accordance with 10 CFR 50.55a, is allowed by the NRC. Complete details are contained in Site Engineering Program SEP-PLP-IST-101, "Inservice Testing of Plant Valves,"

and Site Engineering Program SEP-CV-PLP-002, Check Valve Condition Monitoring and Inservice Testing Program.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.10 Page 6.10-1 of 6.10-2 6.10 CONTROL ROOM HABITABILITY The control room habitability systems include radiation protection, air purification, and climatically controlled ventilation and air-conditioning systems, lighting and power systems, fire protection systems, storage capacity for food and water and sanitary facilities. Other equipment and systems are described only as necessary to define their connection with control room habitability and, accordingly, reference is made to other FSAR sections as appropriate.

6.10.1 DESIGN BASIS The control room habitability systems are provided to ensure that the control room operators can remain in the control room and take action to operate the Plant safely under normal conditions and to maintain it in a safe condition under all accident conditions per Criterion 19, "Control Room" of Appendix A, to 10 CFR 50.

6.10.2 SYSTEM DESIGN The control room heating, ventilation and air conditioning (CRHVAC) envelope consists of the control room, technical support center (TSC),

mechanical equipment room (MER) and former viewing gallery (now consisting of offices, restroom and corridor). These areas are served by the CRHVAC system. A description of the CRHVAC system is provided in Subsection 9.8.2. This subsection also includes schematic diagrams and design data for major components of the CRHVAC system.

As discussed in Section 9.8, the CRHVAC system functions to limit air in-leakage during normal and post-accident conditions by maintaining a positive air pressure in the control room envelope. During post-design basis accident operation, the system removes (by filtration) airborne radioactive iodines in the control room and the outside air makeup to ensure habitability of the control room. In the event of smoke, the system has the capability to purge the smoke. In 1983 the system was modified to extend the control room air intake from the then existing configuration, increasing the intake air duct to allow 100% makeup air, installing redundant charcoal filters, extending the control room habitability zone and replacing air intake and discharge dampers.

Shielding design for the control room is discussed in Subsection 11.6.4.

Normal and post-accident operation of the CRHVAC system is discussed in Section 9.8. During post-accident operation, ingress and egress to the control room (TSC) is via vestibules which further prevents depressurization and air in-leakage. Fire Protection System operation is discussed in Section 9.6.

FSAR CHAPTER 6 - ENGINEERED SAFEGUARDS SYSTEMS Revision 33 SECTION 6.10 Page 6.10-2 of 6.10-2 6.10.3 DESIGN ANALYSIS Radiological habitability in the CRHAVC system envelope following all design basis incidents is described in Section 14.24.

The noble gas and iodine radionuclide release rates used in the evaluation of the control room habitability were either taken directly from the analyses that form the basis for the current design basis incident descriptions in Section 14, or they were derived from the information in the Section 14 descriptions in such a way to ensure that they would be bounding for that incident.

Specifically, the release rates used for the evaluation of CRHVAC envelope radiological habitability following the MHA are based on Regulatory Guide 1.183 core inventory release fractions and the MHA analysis of Section 14.22.