ML20212K225

Proposed Tech Spec,Consisting of Tech Spec Change Request 166,providing Operability & Surveillance Requirements for Emergency Feedwater,Including Heat Sink Protection Sys

ML20212K225
Person / Time
Site:	Crane
Issue date:	01/23/1987
From:	GENERAL PUBLIC UTILITIES CORP.
To:
Shared Package
ML20212K220	List: ML20212K216 ML20212K222 ML20212K225
References
NUDOCS 8701290009
Download: ML20212K225 (13)

Text

'

o 3.4 DECAY HEAT REMOVAL CAPABILITY Applicability Applies to the operating status of systems and components that function to remove decay heat when one or more fuel bundles are located in the reactor vessel.

Objective To define the conditions necessary to assure continuous capability of decay heat removal.*

g Specification 3.4.1 Reactor Coolant System temperature greater than 250*F.

3.4.1.1 With the Reactor Coolant System temperature greater than 250*F, three independent EFW pumps and associated flow paths shall be OPERABLE ** with:

I a.

Two EFW pumps, each capable of being powered from an 00ERABLE emergency bus, and one EFW pump capable of being powered from i

an OPERABLE steam supply system.

l b.

With one pump or flow path inoperable, restore the inoperable l

pump or flow path to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in COLD SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. With more than one EFW pump or flow path inoperable, restore the inoperable pumps l-or flow paths to OPERABLE status or be subcritical within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in COLD SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

c.

Four of six turbine bypass valves OPERABLE.

d.

The condensate storage tanks (CST) OPERABLE with a minimum of 150,000 gallons of condansate available in each CST. With a CST inoperable, restore the CST to operability within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT-SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and COLD SHUTDOWN within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. With more than one CST inoperable, restore the inoperable CST to OPERABLE status or be subcritical within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in COLD SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

l l

l

• These requirements supplement the requirements of Sections 3.1.1.1.c, 3.1.1.2, 3.3.1 a nd 3.8.3.

• • HSPS operability is specified in Section 3.5.1.

3-25 Amendnent No. (, 78, 98, 119 t

(

B7012 g { M h e9 PDR PDR P

Bases A reactor shutdown following power operation requires removal of core decay heat. Normal decay heat removal is by the steam generators with the steam dump to the condenser when RCS temperature is above 250*F and by the decay heat removal system below 250*F. Core decay heat can be continuously dissipated up to 15 percent of full power via the steam bypass to the condenser as feedwater in the steam generator is converted to steam by heat absorption.

Normally, the capability to return feedwater flow to the steam generators is provided by the main feedwater system.

The main steam safety valves will be able to relieve to atmosphere the total steam flow if necessary.

If Main Steam Safety Valves are inoperable, the power level must be reduced, as stated in Technical Specification 3.4.1.2 such that the remaining safety valves can prevent overpressure on a turbine trip.

In the unlikely event of complete loss of off-site electrical power to the station, decay heat removal is by either the steam-driven emergency feedwater pump, or two half-sized motor-driven pumps.

Steam discharge is to the atmosphere via the Main Steam Safety Valves and controlled atmospheric relief valves, and in the case of the turbine driven pump, from the turbine i

exhaust.(1)

Both motor-driven EFW pumps, or the steam-driven EFW pump are required l

initially to remove decay heat with one EFW pump eventually sufficing. The minimum amount of water in the condensate storage tanks, contained in Technical Specification 3.4.1.1., will allow cooldown to 250*F with steam being discharged to the atmosphere. Af ter cooling to 250*F, the decay heat removal system is used to achieve further cooling.

When the RCS is below 250*F, a single DHR string, or single OTSG and its associated emergency feedwater flowpath is sufficient to provide removal of decay heat at all times following the cooldown to 250*F. The requirement to maintain two OPERABLE means of decay heat removal ensures that a single failure does not result in a complete loss of decay heat removal capability.

l The requirement to keep a system in operation as necessary to maintain the system subcooled at the core outlet provides the guidance to ensure that steam conditions which could inhibit core cooling do not occur.

Limited reduction in redundancy is allowed for preventive or corrective maintenance on the primary means for decay heat removal to ensure that maintenance necessary to assure the continued reliability of the systems may be accomplished.

As decay heat loads are reduced through decay time or fuel off loading, alternate flow paths will provide adequate cooling for a time sufficient to take compensatory action if the normal means of heat removal is lost.

I l

i i

(

3-26b Amendment No.119

3.5.1.7.1 Power may be restored through the breaker with the failed trip feature for up to two hours for surveillance testing per T.S. 4.1.1.

3.5.1.8 During STARTUP, HOT STANDBY or POWER OPERATION, in the event that one of the two regulating control rod power SCR electronic trips is inoperable, within one hour:

a.

Place the inoperable SCR electronic trip in the tripped condition or b.

Remove the power supplied to the associated SCRs.

Specification 3.0.1 applies.

3.5.1.8.1 Power may be restored through the SCRs with the failed electronic trip for up to two hours for surveillance testing per T.S. 4.1.1.

3.5.1.9 The reactor shall not be in the Startup mode or in a critical state unless both HSPS actuation logic trains associated with the Functional units listed in Table 3.5-1 are operable except as provided in Table 3.5-1,D.

3. 5.1.9.1 With one HSPS actuation logic train inoperable, restore the train to OPERABLE or place the inoperable device in an actuated state t

within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

With both HSPS actuation logic trains inoperable, restore one train to OPERABLE within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Bases Every reasonable effort will be made to maintain all safety instrumentation in operation. A startup is not permitted unless three power range neutron instrument channels and two channels each of the following are operable:

four reactor coolant temperature instrument channels, four reactor coolant flow instrument channels, four reactor coolant pressure instrument channels, four pressure-temperature instrument channels four flux-imbalance flow instrument channels, four power-number of pumps instrument channels, and four high reactor building pressure instrument channels. The reactor trip, on loss of feedwater may be bypassed below 7% reactor power.

the bypass is automatically removed when reactor power is raised above 7%. The reactor trip, on turbine trip, may be bypassed below 20% reactor power. The safety feature actuation system must have two analog channels functioning correctly prior to startup.

The anticipatory reactor trips on loss of feedwater pumps and turbine trip have been added to reduce the number of challenges to the safety valves and power operated relief valve but have not been credited in the safety analyses.

Operation at rated power is permitted as long as the systems have at least the redundancy requirements of Column "B" (Table 3.5-1).

This is in agreement with redundancy and single failure criteria of IEEE 279 as described in FSAR Section 7.

There are four reactor protection channels.

Normal trip logic is two out of four.

Required trip logic for the power range instrumentation channels is two out of three. Minimum trip logic on other instrumentation channels is one out of two.

3-27a Amendment No. 123

The four reactor protection channels were provided with key operated bypass switches to allow on-line testing or maintenance on only one channel at a time during power operation.

Each channel is provided alarm and lights to indicate when that channel is bypassed. There will be one reactor protectior system bypass switch key permitted in the control room.

Each reactor protection channel key operated shutdown bypass switch is provided with alarm and lights to indicate when the shutdown bypass switch is being used.

Power is normally supplied to the control rod drive mechanisms from two separate parallel 460 volt sources. Redundant trip devices are employed in each of these sources. The AC Trip Breaker is one means to trip a source.

The redundant means is a parallel configuration consisting of two DC Trip Breakers and five SCR power supplies. The SCRs are turned off by the

" electronic trip relays."

Diverse trip features are provided on each breaker.

These are the undervoltage relay and shunt trip attachment.

Each trip feature is tested separately. Failure of one breaker trip feature does not result in loss of redundancy and a reasonable time limit is provided for corrective action.

Failure in the untripped state of a breaker or SCR electronic trip results in loss of redundancy and prompt action is required. Failure of both trip features on one breaker is considered failure of the breaker.

Power may be restored through the failed breaker (SCRs) for a limited time to perform required testing.

Automatic initiation of EFW is provided on loss of all reactor coolant pumps, loss of both main feedwater pumps, low OTSG level, and high reactor building pressure. High reactor building pressure would be indicative of a loss of l

coolant accident, main steam line or feedwater line break inside the reactor building.

Operability of these instruments is required in order to assure that the EFW system will actuate and control at the appropriate OTSG level without operator action for those everts where timely initiation of EFW is required.

Operability of the EFW automatic initiation on low OTSG level is not required below 30% power because loss of feedwater events at low power are less severe and more time is allowable for the operator to manually initiate EFW. Since the OTSG is on low level limits at low power levels, there is some possibility of inadvertent actuation due to transients such as starting and stopping of pumps.

The system is allowed to be bypassed to prevent unnecessary actuations.

Automatic isolation of main feedwater is provided on low OTSG pressure in l

order to maintain appropriate RCS cooling (minimize overcooling) following a l

- loss of OTSG integrity and minimize the energy released to the Reactor l

Building atmosphere, l

3-?8 Amendment No. 78

HSPS instrument operability specified meets the single failure criterion for the EFW system. Four instrument channels are provided for automatic EFW initiation on OTSG low level and high reactor building pressure, and for automatic main feedwater isolation on low OTSG pressure.

Normal trip logic is two out of four.

With one of the 4 channels in bypass, a second channel nmy be taken out of service (placed in the tripped position) and no single active failure will prevent actuation of the associated HSPS train actuation logic.

No single active failure of either HSPS train will prevent the other HSPS train from operating to supply EFW to both OTSGs.

REFERENCE FSAR, Section 7.1 3-28a Amendment No.123

TABLE 3.5-1 (Continu:d)

INSTRUMENTS OPERATING CONDITIONS (A)

(B)

(C)

Functional Unit Minimum Operable Minimum Degree Operator Action if Channels of Redundancy Conditions of Column (a s4 and B Cannot Be Met C.

Engineered Safety Features (cont'd) 3.)

Reactor Building Isolation and Reactor Building Cooling System a.

Reactor Bldg. 4 psig 2

1 Hot Shutdown l

Instrument Channel b.

Manual Pushbutton 2

1 Hot Shutdown c.

RPS Trip 2

1 Hot Shutdown d.

Reactor Building 30 psig 2

1 Hot Shutdown e.

RCS Pressure less than 1600 psig 2

1 Hot Shutdown t'

f.

Reactor Bldg. Purge line 1

0 (f) ks Isolation (AHV-1 A and AHV-lD) High Radiation 4.) Reactor Building Spray System a.

Reactor Bldg. 30 psig 2(d) 1 Hot Shutdown i

Instrument Channel b.

Spray Pump Manual Switches (c) 2 1

Hot Shutdown 5.) 4.16KV ES Bus Undervoltage Relays a.

Degraded Grid Voltage Relays 2

1 (e) b.

Loss of Voltage Relay 2

1 (e)

TABLE 3.5-1 (Continu:d) k INSTRUMENTS OPERATING CONDITIONS h

k Functional Unit 5

C.

Engineered Safety Features (cont'd)

E (a)

If minimum conditions are not met within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the unit shall then be placed in a cold shutdown condition.

ym (b) Also initiates Low Pressure Injection (c) Spray valves opened by manual pushbutton listed in Item 3 above.

(d) Two out of three switches in each actuation channel operable.

(e)

If a relay fails in the untripped state, it shall be placed in a tripped sate within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to obtain a degree of redundancy of 1.

The relay may be removed from the tripped state for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for functional testing pursuant to Table 4.1-1.

(f) Discontinue Reactor Building purging and close AHV-1 A,1B,1C, and 1D.

Note:

(a) above does not apply if AHV-1 A,1B,1C and lD are closed.

w a

TABLE 3.5-1 (Continusd)

INSTRUMENTS OPERATING CONDITIONS l

(A)

(B)

(C)

Functional Unit Minimum Operable Minimum Degree Operator Action if Channels of Redundancy Conditions of Column (a)

A and B Cannot Be Met D.

Heat Sink Protection System i

1.)

EFW Auto Initiation a.

Loss of both Feedwater Pumps N/A(b)

N/A(b)

Hot Shutdown b.

Loss of all RC Pumps N/A(b)

N/A(b)

Hot Shutdown c.

OTSG A Low Level 2(c)(d) 1(c)(d)

Hot Shutdown d.

OTSG B Low Level 2(c)(d) 1(c)(d)

Hot Shutdown e.

High Reactor Building Pressure 2

1 Hot Shutdown 2.) MFW Isolation a.

OTSG A low Pressure 2

1 Hot Shutdown i

b.

OTSG B Low Pressure 2

1 Hot Shutdown

[

3.)

EFW Level Control g!

a.

OTSG A Level Control N/A(b)

N/A(b)

Hot Shutdown b.

OTSG B Level Control N/A(b)

N/A(b)

Hot Shutdown I

(a.) If minimum conditions are not met within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the unit shall be placed in Hot Shutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

(b.) Operability requirements are specified in section 3.5.1.9.

(c.) Train actuation may be defeated during low power physics tests.

(d.) Bypass of the OTSG Low Level EFW train initiation may be placed in effect when indicated power is less than 30%. The bypass shall be removed when indicated reactor power is raised above 30%.

l l

4.

SURVEILLANCE STANDARDS During Reactor Operational Conditions for which a Limiting Condition for Operation does not require a system / component to be operable, the associated surveillance requirements do not have to be performed.

Prior to declaring a system / component operable, the associated surveillance requirement must be current. The above applicability requiremerts assure the operability of systems / components for all Reactor Operating Conditions when required by the Limiting Conditions for Operation.

4.1 OPERATIONAL SAFETY REVIEW Applicability Applies to items directly related to safety limits and limiting conditions for operation.

Objective To specify the minimum frequency and type of surveillance to be applied to unit equipment and conditions.

Specification l

4.1.1 The minimum frequency and type of surveillance required for reactor protection system, engineered safety feature protection system, and l

heat sink protection system instrumentation when the reactor is critical shall be stated in Table 4.1-1.

4.1.2 Equipment and sampling test shall be performed as detailed in Tables 4.1-2 and 4.1-3.

4.1.3 Each post accident monitoring instrumentation channel shall be l

demonstrated OPERABLE by the performance of the check, test and calibration at the frequencies shown in Table 4.1-4 Bases Check Failures such as blown instrument fuses, defective indicators, or faulted amplifiers which result in " upscale" or "downscale" indication can be easily recognized by simple observation of the functioning of an instrument or system. Furthermore, such failures are, in many cases, revealed by alarm or annunciator action. Comparison of output and/or state of independent channels measuring the same variable supplements this type of built-in surveillance.

Based on experience in operation of both conventional and nuclear systems, when the unit is in operation, the minimum checking frequency stated is deemed adequate for reactor system instrumentation.

Calibration Calibration shall be performed to assure the present& tion and acquisition of accurate information.

The nuclear flux (power range) channels amplifiers shall be checked and calibrated if necessary, every shif t against a heat balance standard.

difference between the outquency of heat balance checks will assure that the The fre of-core instrumentation and the h(at balance remains less than 4%.

4-1 Amendment No. AS, 77,100 (Corrected February 19, 1085)

TABLE 4.1-1 (Continued)

F CHANNEL DESCRIPTION CHECK TEST CALIBRATE REMARKS-a i

38.

OTSG Full Range Level W

NA R

l 39.

Turbine Overspeed Trip NA R

NA l,

40.

BWST/NaOH Differential NA NA R

s Pressure Indicator M

41.

Sodium Hydroxide Tank Level NA NA R

Indicator 42.

Diesel Generator Protective NA NA R

Relaying 43.

4 KV ES Bus Undervoltage Relays i

(Diesel Start) a.

Degraded Grid NA M(1)

R (1) Relay operation will be checked by local test pushbuttons b.

Loss of Voltage NA M(1)

R (1) Relay operation will be checked by local test pushbuttons b

44.

Reactor Coolant Pressure S(l)

M R

(1) When reactor coolant system is DH Valve Interlock Bistable pressurized above 300 psig or Tave is greater than 200 F 45.

Loss of Feedwater Reactor Trip S(l)

M(1)

R (1) When reactor power exceeds 7% power 46.

Turbine Trip / Reactor Trip S(1)

M(1)

R (1) When reactor power exceeds 20%

Power j

47a.

Pressurizer Code Safety Valve and S(l)

NA R

(1) When Tave is greater than 525'F i

PORY Tailpipe Flow Monitors b.

PORY - Acoustic / Flow NA M(1)

R (1)- When Tave is greater than 525'F 48.

PORY Setpoints NA M(1)

R (1) Per Specification 3.1.12 i

excluding valve operation l

c

3T TABLE 4.1-1 (Continued) k f;

CHANNEL DESCRIPTION CHECK TEST CALIBRATE REMARKS if 49.

Saturation Margin Monitor S(l)

-M(1)

R (1) When Tave is greater than 525*F-Bi 50.

Emergency Feedwater Flow NA M(1)

R (1) When Tave is greater than 250*F i

Instrumentation 5

• 51.

Heat Sink Protection System (1)

Includes logic test only a.

EFW Auto Initiation Instrument Channels 1.

Loss of both Feedwater Pumps NA Q(1)

R i

2.

Loss of all RC Pumps NA Q(1)

R j

3.

Reactor Building Pressure NA Q

R

~

4.

OTSG Low Level W

.Q R

l b.

MFW Isolation OTSG Low Pressure NA Q

R a

I da c.

EFW Control Valve Control System 4

1 1.

OTSG Level Loops W

Q R

2.

Controllers W

NA R

d.

HSPS Train Actuation Logic NA Q(1)

R i

52.

Backup Incore Thermocouple Display M(1)

NA R

(1) When Tave is greater than 250*F l

l S - Each Shift T/W - Twice per week R

- Each Refueling Period D - Daily B/M - Every 2 months NA - Not. applicable W - Weekly Q

- Quarterly B/W - Every two weeks M - Monthly P

- Prior to each startup l

if not done previous week I

4.9 DECAY HEAT REMOVAL CAPABILITY - PERIODIC TESTING Applicability Applies to the periodic testing of systems or comporants which function to remove decay heat.

Objective To verify that systems / components required for decay heat removal are capable of performing their design function.

Specification 4.9.1 Emergency Feedwater System - Periodic Testing (Reactor Coolant System Temperature greater than 250*F.)

4.9.1.1 Whenever the Reactor. Coolant System temperature is greater than 250*F, the EFW pumps shall be tested in the recirculation mode in accordance with the requirements and acceptance criteria of ASME Section XI Article IWP-3210. The test frequency shall be at least every 31 days of plant operation at Reactor Coolant Temperature above 250*F.

4.9.1.2 During testing of the EFW System when the reactor is in.STARTUP, HOT STANDBY or POWER OPERATION, if one steam generator flow path is made inoperable, a dedicated qualified individual who is in communication with the control room shall be continuously stationed at the affected EFW local manual valves.

On instruction l

from the Control Room Operator, the individual shall realign the valves from the test mode to their operational alignment.

l 4.9.1.3 At least once per 31 days, each EFW System flowpath valve from both CSTs to the OTSGs via the motor driven pumps and the turbine driven pump shall be verified to be in the required status.

4.9.1.4 On a refueling interval basis:

a.) Verify that each EFW pump starts automatically upon receipt of an EFW test signal b.) Verify that each EFW control valve responds upon receipt of an EFW test signal c.) Verify that each EFW control valve responds in manual control from the control room and remote shutdown panel.

4.9.1.5 Prior to start-up, following a refueling shutdown or a cold shutdown greater than 30 days, conduct a test to demonstrate that the motor driven EFW pumps can pump water from the condensate tanks to the Steam Generators.

4-52 l

Amendment No. 75,119

r 4.9.1.6 Acceptance Criteria l

These tests shall be considered satisfactory if control board indication and visual observation of the equipment demonstrates that all components have operated properly except for the tests required by Specification 4.9.1.1.

4.9.2 Decay Heat Removal Capability - Periodic Testing (Reactor Coolant System Temperature 250*F or less).*

4.9. 2.1 On a daily basis, verify operability of the means for decay heat removal required by specification 3.4.2 by observation of console status indication.

These requirements supplement the requirements of 4.5.2.2 and 4.5.4.

Bases The 31-day testing frequency will be sufficient to verify that the turbine driven and two motor-driven EFW pumps are operable and that the associated valves are in the correct alignment. ASME Section XI, Article IWP-3210 specifies requirements and acceptance standards for the testing of nuclear safety related pumps. Compliance with the normal acceptance criteria assures that the EFW pumps are operating as expected. The surveillance requirements if ensure that the overall EFW System functional capability is maintained.

Daily verification'of the operability of the required means for decay heat removal ensures that sufficient decay heat removal capability will be mai ntai ned.

1 4-52a Amendment No. 78, 119

-