ML12335A440
ML12335A440 | |
Person / Time | |
---|---|
Site: | Indian Point ![]() |
Issue date: | 12/22/2011 |
From: | - No Known Affiliation |
To: | Atomic Safety and Licensing Board Panel |
SECY RAS | |
References | |
RAS 21611, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01 | |
Download: ML12335A440 (188) | |
Text
{{#Wiki_filter:United States Nuclear Regulatory Commission Official Hearing Exhibit In the Matter of
- Entergy Nuclear Operations, Inc. (Indian Point Nuclear Generating Units 2 and 3)
ASLBP #:07-858-03-LR-BD01 Docket #:05000247 l 05000286 Exhibit #: Identified: Admitted: Withdrawn: Rejected: Stricken: Other: NYSR0014F-00-BD01 10/15/2012 10/15/2012 NYSR0014F Revised: December 22, 2011 v .... REGU<..q" < 0 IJI ., o !>' c;-'e-/i-o? ****. IP2 FSAR UPDATE Turbine inlet pressure increases with load and varies from 0 psia at no load to approximately 655 psia at full load, based on modifications to the HP Turbine and its steam inlet configuration. It is sensed by two pressure transmitters and applied to a programmer (controller) that generates the function K1 + K2 Pturbine inlet. The constants K1 and K2 are chosen such that the output of the programmer will correspond to the i1P signal for 40-percent steam flow from no load to 20-percent load and ramped to 110-percent for full load (see Plant Drawing 243315 [Formerly UFSAR Figure 7.2-22]). The output from one programmer is used as an input to a comparison bistable. A steam flow signal from one steam generator is used as the second input. If the steam flow signal exceeds the programmed signal, that particular channel will be tripped. The second steam flow and programmed turbine inlet pressure signals are used in a redundant bistable comparison circuit. The output of the two bistables is sent to a one-out-of-two logic circuit. Each programmed turbine inlet pressure signal is applied to four comparison circuits, one for each steam generator. Each of the four one-out-of-two logic circuits is then fed to a two-out-of-four logic for the generation of the steam line break signal. Thus, a steam line break downstream of the isolation valves must be sensed by two-out-of-four channels to initiate a safety injection signal. See Plant Drawing 225103 [Formerly UFSAR Figure 7.2-10] for the logic diagram of this circuitry. The high steam line flow signal is so interlocked that it cannot initiate a safety injection signal unless it is accompanied by either a low T avg signal (two-out-of-four T avg channels below 542°F) or a low steam-generator pressure signal (two-out-of-four steam pressure channels below 565.3 psig). The Tavg channels are derived from resistance temperature detectors in the reactor coolant system. These interlocks are provided to allow for startup, steam dump, or atmospheric relief valve protection. Under these conditions the steam flow will be greater than the value programmed by the turbine inlet pressure; however, it is acceptable under these circumstances. If a steam line break did actually occur, the average reactor coolant temperature would decrease as would the steam generator pressure because there is now an uncontrollable steam release. The high steamline flow coincident with low T avg or a low steam generator pressure signal is delayed up to two seconds prior to being sent out to safeguard activation logic to provide main steam line isolation and safety injection. 7.2.3.2.3.4 High Containment Pressure A containment pressure of 2.0 psig, as indicated by two-out-of-three containment pressure signals, will initiate a safety injection trip signal. This protection is provided for the case where a small leak into containment (either primary or secondary) exists and is within the bounds of the control and protection systems. It is required in order to limit the maximum pressure inside containment should the leak increase to major proportions. See Plant Drawing 225105 [Formerly UFSAR Figure 7.2-12] for this logic diagram. Chapter 7, Page 29 of 109 Revision 20, 2006 OAG10000215_0941 7.2.3.2.3.5 IP2 FSAR UPDATE High-High Containment Pressure High-high containment pressure, as indicated by the actuation of redundant two-out-of-three logics, will initiate a containment spray actuation signal. The bistable devices will be actuated when the containment pressure reaches 24 psig. In addition to initiating containment spray, high-high containment pressure will also result in a phase B containment isolation, a containment ventilation isolation, safety injection trip signal, and steam line isolation. This safety injection actuation acts as a backup to the high containment pressure logic. The steam line air-operated check valves are closed to prevent overpressurization of containment from a steam break inside containment with simultaneous failure of the nonreturn check valve in that loop, as discussed in UFSAR Section 14.2.5.4, Cases C and D. A secondary reason is that had the increase in pressure been caused by a steam line rupture, a path through the rupture will exist, which connects the containment atmosphere to the secondary plant or outside atmosphere. This path must be blocked to prevent any uncontrolled radioactivity release. This path must be blocked to prevent any uncontrolled radioactivity release. Dual actuation logic is used in the formation of the high-high containment pressure signal in each redundant Train, to prevent containment spray system actuation on a spurious signal. See Plant Drawing 225105 [Formerly UFSAR Figure 7.2-12]for this logic diagram. 7.2.3.2.3.6 Manual Push Buttons Two push buttons are provided for manual initiation of safety injection. Each button will activate one train of safety injection logic. While the primary purpose of these push buttons is to initiate safety injection manually, pressing these buttons will also result in a reactor trip. Safety injection can be reset without first clearing the automatic initiating signal(s), by placing the Train A or Train B "Normal -Defeat" key interlock switches in the "Defeat" position, and then using the reset push buttons. When these key switches are in "Defeat" position, lights above the switches illuminate and an alarm annunciates in the CCR. The manual actuation push button will override the defeat and reset function to reinitiate safety injection. Push buttons for manual system actuation are provided for the containment isolation Phase A, containment isolation Phase B, and containment spray functions. Key interlock "Defeat" switches for system level reset are not provided for these functions. However, key bypass switches are provided for containment isolation Phase A and containment ventilation isolation (Train B only) to enhance reset capability at the equipment level in case of a failure in the daisy chain reset logic. The automatic initiating signal(s) for containment isolation Phase A, containment isolation Phase B, and containment spray functions must first be cleared before the system actuation can be reset. The manual system actuation push buttons may be used at any time to reinitiate the system function. 7.2.3.2.3.7 Steam Line Isolation Any of the following signals (discussed in Sections 7.2.3.2.3.2 and 7.2.3.2.3.3) will close all steam line isolation valves: 1. Coincidence of high steam flow in any two steam lines with low Tavg (2/4) or low steam pressure (2/4). Automatically blocked when Tavg and steam pressure are above certain limits. Chapter 7, Page 30 of 109 Revision 20, 2006 OAG10000215_0942
- 2. 3. 7.2.3.2.3.8 IP2 FSAR UPDATE High-high containment pressure signals (2/3 high-high
+ 2/3 high-high pressure). Steam line isolation valves can also be closed one at a time by manual action. Main Feedwater Line Isolation A safety injection signal or high-high water level (2/3) in any steam generator will close the discharge valves from both main feedwater pumps and will close feedwater control (main and low flow bypass) valves. Each main feedwater pump will trip on closure of its discharge valve. See Plant Drawing 225106 [Formerly UFSAR Figure 7.2-13]. 7.2.3.2.3.9 Deleted 7.2.4 System Safety Features 7.2.4.1 Separation of Redundant Protection Channels The reactor protection system is designed on a channelized basis to achieve separation between redundant protection channels. The channelized design, as applied to the analog as well as the logic portions of the protection system, is illustrated by Figure 7.2-23 and is discussed below. Although shown for four-channel redundancy, the design is applicable to and three-channel redundancy. The separation of redundant analog channels originates at the process sensors and continues through the field wiring and containment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve the separation of redundant transmitters. The separation of field wiring is achieved using separate wireways, cable trays, conduit runs, and containment penetrations for each redundant channel. Analog equipment is separated by locating redundant components in different protection racks. Each channel is energized from a separate AC power feed. The reactor trip bistables are mounted in the protection racks and are the final operational component in an analog protection channel. Each bistable drives two logic relays ("C" and "0"). The contacts from the C relays are interconnected to form the required actuation logic for trip breaker 1 through DC power feed 1. The transition from channel identity to logic identity is made at the logic relay coil/relay contact interface. As such, there is both electrical and physical separation between the analog and the logic portions of the protection system. The above logic network is duplicated for trip breaker 2 using DC power feed 2 and the contacts from the 0 relays. Therefore, the two redundant reactor trip logic channels will be physically separated and electrically isolated from one another. Overall, the protection system is composed of identifiable channels that are physically, electrically, and functionally separated and isolated from one another. 7.2.4.1.1 Reactor Protection and Engineered Safety Equipment Identification A color code of red, white, blue, and yellow is established for analog protection channel sections I, II, III, and IV, respectively. Large identification plates with the appropriate background color are attached at the front and back surface of each analog rack for the identification of analog protection channel racks. Protection and safeguards relay racks are identified similarly on the Chapter 7, Page 31 of 109 Revision 20, 2006 OAG10000215_0943 IP2 FSAR UPDATE input side of the racks where protection signals from the various protection channels are received. Cable trays and cables have numbered tags for identification, which in conjunction with plant drawings, can be related to specific functions. The identification tags do not themselves differentiate between protection and non protection cables and trays. 7.2.4.1.2 Access to Reactor Protection System Panels Because of the control room arrangement, access to the protection racks is under the administrative control of the plant operator as authorized by the shift supervisor. The opening of a rack door is not annunciated; however, the opening of any of the test panel covers that give access to the switches and signal injection points are annunciated on a protection set basis (i.e., four windows, one for each protection set). Access to these switches and signal injection points permits the channel to be defeated. 7.2.4.1.3 Physical Separation The physical arrangement of all elements associated with the protection system reduces the probability of a single physical event impairing the vital functions of the system. System equipment is distributed between instrument cabinets so as to reduce the probability of damage to the total system by some single event. Wiring between vital elements of the system outside of equipment housing is routed and protected so as to maintain the true redundancy of the systems with respect to physical hazards. 7.2.4.1.4 Reactor Protection and Engineered Safety System Cable Circuits The reactor protection and engineered safety system cable circuits are divided into as many channels as is required to preserve the basic redundancy and independence of the systems. Channel separation is maintained as indicated below and is continuous from the sensors at the entrance to the receiver racks to logic cabinets to actuation devices in such a manner that failure within a single channel is not likely to cause the loss of the basic protection system or cause a failure that would prevent the actuation of the minimum safeguards devices when called for. To satisfy the above criteria, the following are provided: for instrument cables, four separate channels throughout; for control and small power cables, a minimum of two separate channels throughout, a third in many portions of the raceway system and a fourth as required; for heavy power cables, a minimum of two separate channels throughout and a third in most portions of the raceway system; and diesel and switchgear direct current control feeds that originally required two separate channels have been upgraded to four separate channels as part of the improvements made to the 125-V DC supplies. In addition to such channels of separation, cables are also assigned to individual routing systems in accordance with voltage level, size, and function category. $§¥§Q(Z)W?jpt independent conduit and/or tray systems are used for such purposes and establish the separation of the following:
- 1. 6.9-kV AC power cables. 2 Heavy 125-V DC power cables and heavy 480-V AC (over 100 hp) power cables. Chapter 7, Page 32 of 109 Revision 20, 2006 OAG10000215_0944 IP2 FSAR UPDATE 3. Lighting panel feeders and medium power (greater than No. 12 AWG wire size) 480-V AC cables. 4. Control and small power cables. 5. Instrument cables. 6. Rod control cables. 7 The separation of channels is established wherever practical by the use of separate trays and conduits.
In the cable spreading room, electrical tunnel, and other areas with a high density of electrical cables, multiple channels are run in a single ladder tray, but separation is maintained by the use of 16-gauge sheet metal barriers 4-in. high within the tray. Where such barriers are used in heavy power cable trays, a double sheet metal barrier with approximately 1-in. of space between is used. In addition, whenever a power tray is located beneath an instrument or control channel tray, or a different channel of heavy power cables, a 0.2S-in.-thick transite barrier or sheet metal barrier is installed between the trays. Such barriers are considered to be redundant as the power cable insulation being used is fire retardant and will not support combustion without excitation. Thermal blankets are used to enhance separation of cables in certain locations. Use of blankets inside the containment has been evaluated to show they will not degrade and block the recirculation sump in the event of a loss-of-coolant accident. Thermal blankets are not intended to be rated fire barriers for purposes of meeting requirements of NFPA or 10 CFR 50 Appendix R. A few non-safety related power cables run with or cross-over redundant safety circuits. Fuses and/or current limiters (which are similar to fuses) have been installed in these circuits to ensure that an overload or fault will not cause them to exceed thermal limits and affect redundant channels. The electrical tunnel consists of a square concrete conduit having an inside dimension of approximately 10-ft wide and 8-ft high. Arrayed on either side of a 3-ft aisle are seven 36-in. ladder trays on one side and four 36-in. and one 1-ft tray on the other side. Channel separation is maintained in the tunnel as outlined above. The minimum vertical channel separation for instrument and control circuits is approximately 7.S-in. with the majority having a separation of over 19-in. Horizontal separation varies from a 16-gauge-thick 4-in.-high metal barrier as previously outlined to the width of the aisle (3-ft). r channels have a vertical separation of 7.S-in. with a sheet metal barrier between trays as previously described. Power channels are separated horizontally by two 16-gauge sheet metal barriers with 1-in. space between them. The four channels of nuclear instrumentation sensor cables are in individual conduits that are supported at the end of four trays and have a separation of approximately 12-in. Chapter 7, Page 33 of 109 Revision 20, 2006 OAGI000021 5_0945 IP2 FSAR UPDATE Plant Drawing 243317 [Formerly UFSAR Figure 7.2-24] shows a section view of the tunnel and identifies the channeling used within the area. 7.2.4.1.S Electrical Penetrations The electrical penetrations are in a single area, composed of about 60 assemblies arrayed in a group of low voltage power, control, and instrument wire assemblies and a separate group of 6.9-kV assemblies. The 6.9-kV assemblies are separated from the rest of the units by a distance of approximately 6-ft. The main group of assemblies (penetration canisters) are arranged in four rows high, with each row separated from another row by 3-ft. Each assembly in a row is spaced on approximately 3-ft centers. Each assembly has only one category of circuit within it. The various penetration canisters consist of units of No. 12 AWG, No. 16 AWG shielded twisted pairs, No. 16 AWG shielded twisted quads, No. 10 AWG, No.4 AWG, 2S0 MCM No. 4/0 AWG, and triax. Channel separation is maintained to and from the netrations and no two channels are run th has In general, the separation between redundant or channelized circuits is expected to be greater than the spacing between two adjacent assemblies. In the containment electrical penetration area, the free air spacing between redundant channel conductors, located in adjacent penetrations is at least twenty-eight (28") inches. It is unlikely that any incident could affect more than one penetration. However, transite barriers above the power cables at the penetrations inside and outside of containment are designed to give added protection against damage to cables located above in the event of a high-capacity fault. However, some low voltage power, control and instrumentation channels, located in adjacent electrical penetrations, have free air spacing between redundant channel conductors, of at least twenty-eight (28") inches. The control instrument and small power assemblies are furnished with factory installed pigtails, and field splices are therefore well away from the canister face. The electrical penetration area is in a concrete vault, dead ended at one end so that no traffic is expected in this area. 7.2.4.1.6 Cable Separation The design and use of fire stops, seals and barriers to meet 10 CFR S0.48 criteria for the prevention of flame propagation where cable and and floors is found in the document under separate cover entitled, The safeguards control panels (SB-1, SB-2) have protective barriers installed to prevent inadvertent contact or damage to control cables, fuses, relays, and switches by personnel in the service aisle. These devices consist of barriers over horizontal terminal strips, vulnerable switch terminals, and expanded metal covers over the back of the front safeguards panels and the front of the rear safeguards panels. Chapter 7, Page 34 of 109 Revision 20, 2006 OAG1000021S_0946 IP2 FSAR UPDATE Cables are protected in hostile environments by a number of devices. Running the cable in a rigid, galvanized conduit is the most frequently used method of protection. For underground runs, polyvinyl chloride heavy wall conduit encased in a concrete envelope provides maximum protection. When cable is run in a tray, peaked covers are used in areas where physical damage to cables may result from falling objects or liquids. In addition, covers are provided on horizontal cable trays that are exposed to the sun. The control over and administrative responsibility for all of the above during design and installation rested with United Engineers and Constructors, Inc., as the architect-engineer and with WEDCO as the construction contractor. In the containment electrical penetration area, the free air spacing between redundant channel conductors, located in adjacent penetrations, is at least twenty-eight (28") inches. It is considered unlikely that any incident could affect more than one penetration. However, transite barriers above the power cables at the penetrations inside and outside of containment are designed to give added protection against damage to cables located above in the event of a high-capacity fault. Redundancy and separation requirements were initiated by the cognizant electrical or mechanical design engineer. These were then reviewed by the designers of the electrical system installation, thus providing a check. The work of the designer, who prepared the applicable circuit schedule sheet (which designates the cable routing and termination), was spot checked by the cognizant electrical engineer. The construction group installed the cable as directed by the circuit schedule sheet. The installations were followed by Westinghouse field engineers, and spot checks of circuit installations were made to ensure further that the installation was in accordance with the design. Con Edison also spot checked the installation. 7.2.4.1.7 Cables The bulk of original plant cables outside the containment, with the exception of the 8-kV, are insulated with polyvinyl chloride with a fire retardant asbestos jacket. Excluding the 8-kV cables, cables used inside the containment are silicone rubber or Kerite insulated to provide greater radiation resistance. The 8-kV cables are insulated with XLPE and are run in separate trays with maintained spacing. Cables used for plant additions include EPR/neoprene insulation for outside the containment and cross-linked polyethylene insulation for inside and outside of the containment. In all cases, cables used for plant additions have been designed to originally referenced FSAR cable tests and the latest applicable versions of I EEE-323 and I EEE-383. Cables in trays with no maintained spacing were derated according to their temperature rating, the number of cables in the tray, and size variation of these cables. The base rating and Chapter 7, Page 35 of 109 Revision 20, 2006 OAG10000215_0947 IP2 FSAR UPDATE foundation for all derating calculations was taken from I PCEA Publication P-46-426, "Power Cable Ampacities -Copper Conductors," using the proper conductor temperature and ambient conditions for the application. A derating factor was then applied to the baser(:iting according to the number of conductors in the tray. Cables on opposite sides of the in power trays were considered to be in different trays for this calculation. The derating factor used was based on standard load diversity. Lastly, the cables were derated to eliminate any hot spots that might occur due to the presence of larger-than-average size conductors in the tray. For the pressurizer heater cables that have no diversity, a thermal study was made using actual load conditions to determine that the internal temperature of the cables was within safe limits. All cables serving 6.9-kV motors, station service transformers, 4S0-V switchgear supplied motors, and 4S0-V motor control centers are protected against overloads by circuit breakers. The 4S0-V circuits for motors under 125 hp are protected by fuses and/or circuit breakers. In some instances, fuses are backed up by circuit breakers or overload devices in the starters for these motors. Instrumentation and direct current circuits are protected by circuit breakers. To provide forced-air circulation to maintain cable conductor temperatures within acceptable limits, two separate fans either of which is capable of removing all heat necessary to prevent excessive cable temperatures during operation of the safeguard equipment, have been provided for the electrical tunnel. These fans are supplied from separate diesel-generator buses. 7.2.4.2 Electrical Equipment Design The safety-related electrical equipment is designed to operate and perform its design function within specified safe limits without degradation of performance (accuracy, repeatability, time response) under the expected normal and abnormal ambient conditions associated with its location. The normal ambient design temperature range is 75°F plus or minus 10°F for equipment located in the central control room. The abnormal ambient condition associated with the design of the safety equipment in the central control room is 120°F for short-term operation associated with a loss of air conditioning. Safety-related electrical equipment in other than the central control room is designed to operate under the worst-case environment for which it is required to perform its function. For example, in the containment, the ex-core neutron detectors and cables are designed to operate continuously in an ambient temperature of 135°F and for a period of at least eight (S) hours in an ambient temperature of 175°F, and a maximum pressure of 100 psia, provided the detector connectors are protected against moisture intrusion. However, as discussed in the NRC's November 27, 1995 Supplemental Safety Evaluation, the excore neutron flux instrumentation doesn't need to be environmentally qualified per Regulatory Guide 1.97 Revision 2 because accident diagnosis and plant recovery can be accomplished using alternate instrumentation and boron capability as directed by plant Emergency Operating Procedures. All plant areas which can be subjected to harsh environmental conditions as a result of LOCA or HELB and environmental parameters for those areas, at IP2, are identified by Calculation
- PGI-0040S-00 Rev. 0 (Reference 9). Environmentally qualified safety related process transmitters and sensors throughout the plant will function normally in a normal environmental conditions, and under an accident situation to abnormal environmental conditions, subjected to environmental parameters as defined by their site specific locations per Tables 9.1-1 & 9.1-2 of the Electrical Equipment Environmental Qualification Program (Reference
- 10) and IP2-EQ Master List (Reference 11). The effective inside containment normal temperature for calculating equipment qualified life is a continuous annual temperature of 120°F. It has been demonstrated by analyses that a continuous annual temperature of 120°F is a conservative temperature for equipment qualification purposes, as it envelopes the thermal Chapter 7, Page 36 of 109 Revision 20, 2006 OAG10000215_094S IP2 FSAR UPDATE degradation resulting from utilization of average monthly temperatures ranging from 95 to 130°F (Reference 9). The ventilation systems of concern outside the central control room are designed to cope with a single active failure. For example, in the event of a design basis accident with the single active failure occurring in the PAB ventilation system, all safety related systems would survive the resulting increase in area temperature.
Credit is taken for operator action upon entry into the recirculation phase. The limiting case is the Small Break Loss of Coolant Accident, wherein recirculation is delayed until 4 hours after the accident. At this point the maximum temperature is 144°F (by analysis) in the SI pumps room. The central control room contains most of the safety-related equipment; therefore, it represents the limiting condition for temperature that would require reactor shutdown. The central control room ventilation system is designed to accommodate certain active or passive failures. Operator action is not required to prevent unacceptable temperatures in safety-related equipment located in the central control room. The central control room air conditioning system consists of an air conditioning unit with design flow of 9,200 cfm, a back-up ventilation fan in parallel with the same design capacity, one 2,000 cfm high efficiency particulate air (HEPA) charcoal filter unit, two (for redundancy) 2,000 cfm booster fans for filter operation, one 2,300 cfm emergency ventilation fan located in the supervisory control panel exhaust system, and associated duct work and dampers. The back up fan unit starts automatically on a loss-of-air flow. The Indian Point Unit 2 central control room air conditioning and ventilating system is powered from redundant buses serviced by the emergency diesel generators. It is design policy that the functional capacity of the central control room shall be maintained at all times inclusive of accident conditions, such as a maximum credible accident (MCA) or a fire. Hence, to specify the limiting conditions, two cases must be considered: failure of the air conditioning system during normal operation and failure subsequent to or coincident with an MCA. Considering first the case where failure occurs during normal operation, the objective is to ensure that temperatures do not exceed levels where reactor protection system and safeguards system setpoints are altered appreciably and to ensure that remote hot shutdown capability is not compromised. The maximum tolerable upper limit is 120°F. On a loss of the Indian Point Unit 2 air conditioning system, the control room temperature under operating conditions and outside design temperatures of 93°F dry bulb and 75°F wet bulb will rise to a level where the heat released to the room by the equipment and lights will balance the transmission losses through the walls, floor, and ceiling. This temperature has been calculated for the following condition: Unit 1 air conditioning system operating with 100-percent recirculated air (no outside air). In this case, when the loss of Unit 2 air conditioning occurs, the following action will take place: 1. All lights except emergency lights will be turned off. 2. The emergency vent fan on the supervisory control panel exhaust system will start automatically. Under these conditions, the maximum room temperature will be 104.6°F. Chapter 7, Page 37 of 109 Revision 20, 2006 OAG10000215_0949 IP2 FSAR UPDATE The room supply air to the supervisory panel will be at a temperature approximately 2°F lower than this room temperatures because of stratification. Therefore, the supervisory panel temperatures will be approximately: [Note: 4. = temperature rise due to heat pickup in supervisory control panel based on 3-kW load] There is no latent heat released to the room from equipment and an insignificant amount from the operators. Therefore, the humidity will remain 50-percent or lower and will decrease as the temperature increases. The design basis is that the safety-related analog-type electrical equipment will perform its required functions within the required accuracies for ambient conditions of 120°F. If the central control room (CCR) temperature reaches 104°F with no outside air, or 109°F with outside air intake, a plant shutdown will be initiated. If the CCR temperature reaches 120°F, the reactor will be manually tripped. Central control room annunciation is not provided for high ambient temperatures or loss of air conditioning. A self-contained refrigerant air conditioning system has been installed to further circulate and cool air within the central control room. The system provides more cooling for operator comfort during the summer months. The system is not required for an accident. For this reason, the system does not meet seismic Class I design criteria, but it has been reinforced to withstand the safe-shutdown earthquake in order to prevent it from damaging the central control room postaccident ventilation system on the roof and the safety equipment inside the central control room. The outside makeup air to the Indian Point Unit 1 control room has been cut off. The outside control dampers are disconnected and sheet metal closure plates are installed. During the postaccident period, the Indian Point Unit 2 charcoal filter and fan system for the central control room ventilation system functions to remove fission products as described in Section 9.9. Factory testing was performed on various safety-related systems such as process control, nuclear instrumentation, and logic relay racks. This testing involved demonstrating the operation of proper safety functions with increased ambient temperatures of at least 120°F for process control and nuclear instrumentation. The logic relay racks were tested to determine temperature rise of the cabinet under full-load conditions. From this test, it was determined that the relays would perform their function in an ambient temperature of 130°F. 7.2.4.2.1 Loss of Instrument Power A loss of power in the reactor protection system ensures the affected channel to trip. All bistables operate in a normally energized state and go to a deenergized state to initiate action. Loss of power thus automatically forces the bistables into the tripped state. The availability of power at each instrument bus is continuously monitored by selecting individual bus voltage indication at a common voltmeter located at the rear of Flight Panel FD. The loss of instrument power to sensors or instruments in a protection channel deenergizes the Chapter 7, Page 38 of 109 Revision 20, 2006 OAG10000215_0950 IP2 FSAR UPDATE bistable(s) to actuate the engineered safety features (ESF) logic associated with that channel, except for containment spray, where the bistable(s) energize to actuate the containment spray logic. 7.2.4.2.2 Primary Power Source The primary source of control power for the reactor protection system is the vital instrument buses described in Section 8.2. The source of power for the measuring elements and the actuation circuits in the engineered safety features instrumentation is also from those buses. The safety injection master and auxiliary relays are energized to actuate by the 125-V DC system. 7.2.4.3 Reactor Trip Signal Testing Provisions on nonnuclear instrumentation are made for "at power" testing of all portions of each trip circuit including the reactor trip breakers. Administrative procedures require that the final element in a trip channel (required during power operation) is placed in the trip or bypass mode before that channel is taken out of service for repair or testing. In the source and intermediate ranges where the trip logic is one-out-of two for each range, bypasses are provided for this testing procedure. Nuclear power range channels are tested by superimposing a test signal on the normal sensor signal so that the reactor trip protection is not bypassed. On the basis of coincident logic out-of-four), this will not trip the reactor; however, a trip will occur if a reactor trip is required. Provision is made for the insertion of test signals in each analog loop. The verification of the test signal is made by station instruments at test points specifically provided for this purpose. This enables testing and calibration of meters and bistables. Transmitters and sensors are checked against each other and against precision readout equipment during normal power operation. 7.2.4.3.1 Analog Channel Testing Testing of analog protection channels is discussed in Section 7.2.2.7. Administrative controls prevent the nuclear instrumentation source range and intermediate range protection channels from being disabled during periodic testing. Power range overpower protection cannot be disabled because this function is not affected by the testing of circuits. Administrative controls also prevent the power range dropped rod protection from being disabled by testing. In addition, the rod position system would provide indication and associated corrective actions for a dropped rod condition. 7.2.4.3.2 Logic Channel Testing The general design features of the logic system are described below. The trip relays for typical trip functions are shown in Figure 7.2-26. The analog portions of these channels are described in Plant Drawings 243324 and 243311 [Formerly UFSAR Figures 7.2-27 and 7.2-28]. Each bistable drives two relays ("A" and "8" for level and "C" and "0" for pressure). Contacts from the A and C relays are arranged in two-out-of-three and two-out-of-four trip matrices, which actuate the trip relays for trip breaker A. These configurations are duplicated for trip relays for breaker 8 using contacts from the 8 and 0 relays. A series configuration is used for the trip breakers as Chapter 7, Page 39 of 109 Revision 20, 2006 OAG10000215_0951 IP2 FSAR UPDATE they are actuated (opened) by undervoltage coils. This approach is consistent with a deenergize-to-trip preferred failure mode. Additionally, the reactor trip breakers are equipped with shunt trip coils, which are activated on a trip signal (Figure 7.2-30). The logic system testing includes exercising the reactor trip breakers to demonstrate system integrity. Bypass breakers are provided for this purpose. During normal operation, these bypass breakers are open and racked out. Administrative control is used to minimize the amount of time these breakers are closed. Closure of the breaker is controlled from its respective logic test panel in the central control room. An interlock is provided that trips both bypass breakers open if a second bypass breaker is closed. The status of the reactor trip breaker is indicated in the central control room by indicating lights. As shown in Figure 7.2-26, the trip signal from the logic network is simultaneously applied to the main trip breaker associated with the specific logic chain as well as the bypass breaker associated with the alternative trip breaker. Should a valid trip occur while BY A is bypassing RTA, RTB will be opened through its associated logic train. The trip signal applied to RTB is simultaneously applied to BY A, thereby opening the bypass around RT A. RTA would either have been opened manually as part of the test or would be opened through its associated logic train, which would be operational or tripped during a test. An auxiliary relay is located in parallel with the undervoltage coils of the trip breakers. This relay is tied to the safety assessment system to indicate the transmission of a trip signal through the logic network during testing, and to record trip system demands. Lights are also provided to indicate the status of the individual logic relays. The following procedure illustrates the method used for testing trip breaker A and its associated logic network: 1. With the bypass breaker BYA racked out, manually close and trip BY A to verify operation.
- 2. Rack in and close BY A. Trip RT A. 3. Sequentially deenergize the trip relays (A 1 ,A2,A3) for each logic combination (1-2,1-3,2-3).
Verify that the logic network deenergizes the undervoltage coil on RTA for each logic combination. Neon lights have been provided to indicate the operation of the undervoltage coil. 4. Repeat step 3 for every logic combination in each matrix. 5. Reset RT A. Rack BYB to the test position.
- 6. Trip RTA and BYB by their undervoltage coils to validate prior test results as evidenced by the neon lights. 7. Reset RTA, then trip it by the shunt trip coil. 8. Reset RT A. Trip and rack out BY A and BYB. Chapter 7, Page 40 of 109 Revision 20, 2006 OAG10000215_0952 7.2.4.4 Bypass Breakers IP2 FSAR UPDATE The intention is to leave the bypass breakers, housed in their respective switchgear units, locked in the withdrawn (nonoperating) position.
The positioning of these breakers to the operating position for logic system testing is under the administrative control of the operator. The closing of the breaker is controlled from its respective logic test panel in the central control room. The status of the breaker is indicated in the control room by indicating lights. An interlock is provided that will trip both bypass breakers open if a second bypass breaker is closed. Reactor trip breaker position lights for both the main and bypass breakers (four) are in the control room on the reactor protection test panels. In order to minimize the possibility of operational errors from either the standpoint of tripping the reactor inadvertently or only partially checking all logic combinations, each logic network includes a logic channel test panel. This panel includes those test switches and indicating lights, needed to verify correct functional performance of the reactor protection system logic trip matrices. The test switches used to deenergize the trip bistable relays operate through interposing relays as shown in Plant Drawings 243322 and 243324 [Formerly UFSAR Figures 7.2-25 and 7.2-27]. This approach avoids violating the separation philosophy used in the analog channel design. Thus, although test switches for redundant channels are conveniently grouped on a single panel to facilitate testing, physical and electrical isolation of redundant protection channels is maintained by the inclusion of the interposing relay, which is actuated by the logic test switches. 7.2.4.5 Engineered Safety Features Actuation Instrumentation Description The engineered safety features actuation circuitry is designed to maintain channel isolation up to and including the bistable operated logic relay, similar to that of the reactor protection circuitry. The general arrangement of this layout is shown in Figure 7.2-15, with supplemental details in Plant Drawings 243319 and 243320 [Formerly UFSAR Figures 7.2-16 and 7.2-17]. Although a four-channel system is illustrated in Figure 7.2-15, circuitry and hardware layout discussion is sufficiently general to apply to an "n" channel system. Channel separation is maintained by providing separate racks for each analog protection channel and separate relay rack compartments for each logic train. Channel identity is lost in the relay wiring required for matrix logic makeup. It should be noted that although channel individualization is lost, twin matrix logic trains are developed, thus ensuring a redundant actuation system. The engineered safety feature bistables drive the logic relay coils C and D as shown in Figures 7.2-15 and 7.2-17. These logic relay coils are deenergized by their bistables when an abnormal condition exists; exceptions to this deenergized-to-operate principle are initiation of containment spray and the pressurizer pressure manual block permissive. Each bistable will actuate two (2) logic relays, one for each Train, which contacts are utilized to develop the logic matrices for initiating safeguards action. I n Figure 7.2-15, these relay contacts are shown directly below the relay coil. Because these coils would normally be energized, their contacts would remain open and thus an open circuit between the voltage source and master actuating relay would exist. Deenergizing any of the two logic relay coils would cause their corresponding contacts to close, which would complete the circuit and energize the master actuating relays. Although the illustration here is for a two-out-of-four matrix, the design and sequence of operation for any of the logic matrices is the same. The master actuating relay (M) is a latch-type relay having an operate (M/O), an intermediate (K) and a reset (M/R) coil. Once the logic matrix is made up, as described above, the circuit that energizes the master actuating relay is complete. Figure 7.2-15 illustrates the master actuating relay (M); an enlarged view may be found in Plant Drawing Chapter 7, Page 41 of 109 Revision 20, 2006 OAG10000215_0953 IP2 FSAR UPDATE 243319 [Formerly UFSAR Figure 7.2-16]. With potential applied to the relay, the operate coil (M/O) is energized, thus closing the (M) contacts that energize the slave relays (SRs), as shown in Figure 7.2-15. The master relay is latched in this position until the reset coil (M/R) is energized. As a minimum, slave relay outputs from the Train A logic system actuate the Train A safeguards components, and slave relay outputs from the Train B logic system actuate the Train B safeguards components. All components not identified with a specific Train and many safeguards components are actuated by both logic systems. After an approximately 2-min time delay to ensure the completion of the actuation sequence, the master actuating relay may be manually reset by operating the reset switch (see Figure 7.2-15 and Plant Drawing 243319 [Formerly UFSAR 7.2-16]). With the reset coil (M/R) energized, all of the (M) contacts are returned to their deenergized positions as shown in Figure 7.2-15. Resetting the master relay does not interfere with the operation status of the engineered safety features equipment. Manual safety injection initiation is maintained even with reset activated. A study was conducted to determine whether or not, upon the reset of an engineered safety features actuation signal, all associated safety-related equipment remains in its emergency mode. The review resulted in the addition of some actuation relays with a self-seal-in feature that will maintain the respective safeguards equipment in the emergency or safeguards mode when the engineered safety features signal is reset. 7.2.4.6 Engineered Safety Features Logic Testing Figures 7.2-15 and 7.2-17, and Plant Drawing 243319 [Formerly UFSAR Figure 7.2-16] illustrate the basic logic test scheme. Test switches are located in the associated relay racks rather than in a single test panel. The following steps indicate the method of testing the logic matrices:
- 1. Test of either train A or train B is performed one train at a time; this is under administrative control. 2. A selection of the matrix function to be tested is made. Plant Drawing 243319 [Formerly UFSAR Figure 7.2-16], for example, illustrates some of these functional matrices.
- 3. The logic test switch is a dual function switch that is first turned to operate one series of contacts and then depressed to operate other contacts.
Turning the logic test switch to the right will illuminate the "test switch in test position" lamp. The slave actuating relays are removed from this part of the test by opening Flexitest switches located in the output circuit of the master relay in order to avoid unintentional starting of the engineered safety features equipment. Intentional start is available through the other train that has operational status. 4. Depressing the logic test switch, will deenergize the logic relay coil, thus closing contacts of that logic relay (i.e., closing logic relay contacts forms the logic matrix to energize the associate master relay as shown in Figure 7.2-15 or 7.2-17). By performing the above sequence, it is possible to simulate all actuating logic combinations required to develop the matrix. When the matrix is made, the master relay is actuated, which verifies proper operation of this matrix. As indicated in paragraph 3 above the slave relays remain deenergized, preventing actuation of ESF equipment. Chapter 7, Page 42 of 109 Revision 20, 2006 OAG10000215_0954 IP2 FSAR UPDATE 5. Proper test development of a logic matrix would be indicated by illumination of a matrix test lamp, as shown in Figure 7.2-17. 6. When testing of the logic matrix is complete, the equipment is returned to operational status by turning all test switches to the left and closing the Flexitest switches. The control board annunciator warns the operator of any test switch left in the test position; thus, return to operational status by action of the individual doing the test is verified by the operator at the control board. Testing steps for the logic matrices of train B are identical to that described above for train A. 7.2.5 Protective Actions 7.2.5.1 Reactor Trip Description Rapid reactivity shutdown is provided by the insertion of the rod cluster control assemblies by gravity fall to compensate for fast reactivity effects (e.g., doppler and moderator temperature effects). Duplicate series-connected circuit breakers supply all power to the control rod drive mechanisms. The full-length control rod drive mechanism coils must be energized for the rod cluster control assemblies to remain withdrawn from the core. The rod cluster control assemblies fall by gravity into the core upon loss of power to the control rod drive mechanism coils. The trip breakers are opened by the undervoltage coils on both breakers (normally energized), which become deenergized by any of several trip signals. The shunt trip coils of the breakers provide a backup to the undervoltage trip coils for the automatically initiated reactor trip signals with the utilization of relays ST and ST-1 in the trip coil circuits shown schematically in Figure 7.2-30. Both relays must be deenergized to actuate the shunt coil. The electrical state of the devices providing signals to the circuit breaker undervoltage trip coils is such as to cause these coils to trip the breaker in the event of reactor trip or power loss. Certain reactor trip channels are automatically bypassed at low power where they are not required for safety. Nuclear source range and intermediate range trips that are specifically provided for protection at low-power or subcritical operation are bypassed by operator manual action after receiving a permissive signal from the next higher range of instrumentation to establish operational status to permit low-power operation. During power operation, a sufficiently rapid shutdown capability in the form of rod cluster control assemblies is administratively maintained through the control rod insertion limit monitors. Administrative control requires that all shutdown rods be in the fully withdrawn position during power operation. A resume of reactor trips, means of actuation, and the coincident circuit requirements is given in Table 7.2-1. The permissive circuits (e.g., P-7) are listed in Table 7.2-2. 7.2.5.1.1 Manual Trip The manual actuating devices are independent of the automatic trip circuitry and are not subject to failures that make the automatic circuitry inoperable. Either of two manual trip devices Chapter 7, Page 43 of 109 Revision 20, 2006 OAG10000215_0955 IP2 FSAR UPDATE located in the control room will initiate a reactor trip. There are no interlocks associated with these trip actuating devices. A manual trip energizes the shunt trip coils of the reactor breakers. The coils are fed by two independent sources. The channelization matches the power trains of the reactor protection trip logic channels associated with each reactor breaker, enhancing the manual reactor trip availability. 7.2.5.1.2 High Nuclear Flux (Power Range) Trip This circuit trips the reactor when two-out-of-four power range channels read above the trip setpoint. There are two independent trip settings, a high and a low setting. The high trip setting provides protection during power operation. The low setting, which provides protection during startup, can be manually bypassed when two-out-of-four power range channels read above approximately 10-percent power (P-1 0). Three-out-of-four channels below 10-percent automatically reinstates the trip protection. The high setting is always active. 7.2.5.1.3 High Nuclear Flux (Intermediate Range) Trip This circuit trips the reactor when one-out-of-two intermediate range channels reads above the trip setpoint. This trip, which provides protection during reactor startup, can be manually bypassed if two-out-of-four power range channels are above approximately 10-percent power (P-10). Three-out-of-four channels below this value automatically reinstates the trip protection. To prevent inadvertent and unnecessary reactor trips during power reductions prior to shut down, operating procedures allow these trips to be manually bypassed until they have reset to the untripped condition and the reset has been verified. The intermediate channels (including detectors) are separate from the power range channels. 7.2.5.1.4 High Nuclear Flux (Source Range) Trip This circuit trips the reactor when one of the two source range channel count levels (neutron flux) reads above the level trip setpoint. The trip, which provides protection during reactor startup, can be manually bypassed when one-out-of-two intermediate range channels reads above the P-6 setpoint value. This trip is also bypassed by two-out-of-four high power range signals (P-10). It can be reinstated below P-10 by an administrative action requiring coincident manual actuation. The trip point is set between the source range cutoff power level and the maximum source range power level. 7.2.5.1.5 Overtemperature L1 T Trip The purpose of this trip is to protect the core against departure from nucleate boiling (DNB). This circuit trips the reactor on coincidence of two-out-of-four signals, with two sensors (two sets of temperature measurements, hot and cold) per loop. The setpoint for this reactor trip is continuously calculated for each channel by solving equations of this form: AT""oill' = AT, [ K, -K,C ::::}T -T')+ K, (p -P'j-f,(LV) where Chapter 7, Page 44 of 109 Revision 20, 2006 OAG10000215_0956 IP2 FSAR UPDATE i1 T 0 = loop specific indicated i1 T at rated power (OF) K1 = setpoint bias K 2 , = constants based on the effect of temperature and pressure on the DNB limits S = laplace transform operator, sec -1 T = measured reactor coolant average temperature (OF), two measurements (Tc, Th) in each loop) T' = loop specific indicated average temperature at rated power (OF) T 1 T 2 = time constants, sec P = measured pressurizer pressure, four independent measurements (psig) P' = nominal pressure at rated power, 2235 psig F1(i1I) = function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains to be selected on the basis of measured instrument response during plant startup tests 7.2.5.1.6 Overpower i1 T Trip The purpose of this trip is to protect against excessive power (fuel rod rating protection). This circuit trips the reactor on coincidence of two-out-of-four signals, with two hot and cold sensors (two sets of temperature measurements) per loop. The setpoint for this reactor trip is continuously calculated for each channel by solving equations of the form: 1'1 Tsetpo int = I'1 T o [K4 -Ks ( T3 S JT -K6 (T -Til) -12 (1'11): 1+T 3 S where i1T 0= loop specific indicated i1T at rated power (OF) = setpoint bias Ks = constant T 3 = time constants, sec S= laplace transform operator, sec -1 T = measured reactor coolant average temperature (OF), two measurements (Tc, T h) in each loop (OF) Chapter 7, Page 45 of 109 Revision 20, 2006 OAG10000215_0957 = constant IP2 FSAR UPDATE T" = loop specific indicated average temperature at rated power (OF) F2(i1I) = function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains to be selected on the basis of measured instrument response during plant startup tests 7.2.5.1.7 Low Pressurizer Pressure Trip The purpose of this circuit is to protect against excessive core steam voids that could lead to departure from nucleate boiling. The circuit trips the reactor on coincidence of two-out-of-four low pressurizer pressure signals. This trip is blocked when three-out-of-four power range channels and two-out-of-two turbine inlet pressure channels read below approximately 10-percent power (P-7). 7.2.5.1.8 High Pressurizer Pressure Trip The purpose of this circuit is to limit the range of required protection from the overtemperature i1T trip and to protect against reactor coolant system overpressure. This circuit trips the reactor on coincidence of two-out-of-three high pressurizer pressure signals. 7.2.5.1.9 High Pressurizer Water Level Trip This trip is provided as a backup to the high pressurizer pressure trip. The coincidence of out-of-three high pressurizer water level signals trips the reactor. This trip is bypassed when any of three-out-of-four power range channels and two-out-of-two turbine inlet pressure channels read below approximately 10-percent power (P-7). 7.2.5.1.10 Low Reactor Coolant Flow Trip A reactor trip on underfrequency is generated by a signal indicating an underfrequency condition on two-out-of-four buses, which opens all reactor coolant pump breakers, which in turn trips the reactor. The purpose of this trip is to provide protection following a major network frequency disturbance. This design satisfies the proposed I EEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. An undervoltage trip is also generated on a signal indicating an under-voltage condition of out-of-four buses, with one signal per bus. An undervoltage trip is provided for protection following a complete loss of power. This design satisfies the proposed IEEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. With a reactor coolant pump bus underfrequency, all reactor coolant pumps are tripped with this signal generating a reactor trip. In the event of a frequency disturbance, the primary requirement is to release the reactor coolant pumps from the network to preserve their kinetic energy. The means of sensing a loss-of-coolant-flow accident are as follows: Chapter 7, Page 46 of 109 Revision 20, 2006 OAG10000215_0958 IP2 FSAR UPDATE 1. Measured low flow in the reactor coolant loop -The low flow trip signal is actuated by the coincidence of two-out-of-three signals for any reactor coolant loop. The loss of flow in any two loops causes a reactor trip in the power range above approximately 10-percent (P-7). Above approximately 20-percent power (P-8), the loss of flow in any loop causes a reactor trip. The instrument used for flow measurement is an elbow tap and is discussed in Chapter 4. 2. Undervoltage on any two-out-of-four reactor coolant pump buses will cause a reactor trip above approximately 1 O-percent power (P-7). 3. Reactor coolant pump circuit breaker open a. Underfrequency on any two-out-of-four reactor coolant pump buses will trip the breakers of all four reactor coolant pumps and cause a reactor trip above approximately 10-percent power (P-7). b. Undervoltage on any single bus will trip the breaker of the associated reactor coolant pump after a time delay. Above approximately 10-percent power (P-7) a reactor trip will occur if any two reactor coolant pump circuit breakers are open. Above approximately 20-percent power (P-8) any open reactor coolant pump circuit breaker will cause a reactor trip. Technical Specification 3.3.1 allows the single loop loss of flow trip to be bypassed whenever reactor power is below approximately 20-percent power (P-8 setpoint). Below this setpoint and above the permissive setpoint P-7, a loss of flow in two loops would cause a reactor trip. This permits an orderly plant shutdown under administrative control following a single-loop loss of flow during low-power operation. Since the plant will not be maintained in operation above permissive power setting P-7 without three loops in service, independent accidents simultaneous with a single-loop loss of flow at low power are not considered in the protection system design. 7.2.5.1.11 Control Rod Protection Trip This trip provides a backup to the manually initiated action (during reactor coolant system cooldown) of opening the reactor trip breakers prior to Teold decreasing below 381°F. This trip is required to avoid mechanical interference caused by thermal contraction between the fuel and control rods. Two-out-of-three channels will actuate this trip. 7.2.5.1.12 Deleted 7.2.5.1.13 Safety Injection System Actuation Trip A reactor trip occurs when the safety injection system is actuated. The means of actuating the safety injection system trip are listed below. This design satisfies the proposed I EEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. 1. Low pressurizer pressure (2/3). 2. High containment pressure (2/3), set at approximately 2 psig. (10.0 psig assumed in safety analysis). Chapter 7, Page 47 of 109 Revision 20, 2006 OAG10000215_0959
- 3. 4. 5. 6. 7.2.5.1.14 IP2 FSAR UPDATE High differential pressure between any two steam lines (2/3). High steam flow (2/4) coincident with low Tavg (2/4) or low steam line pressure (2/4). High-high containment pressure (2 sets of 3, 213, high-high pressure) set at approximately 50-percent of containment design pressure.
Manual. Pressurizer Signal Diversity In 1970, the available pressurizer automatic protection functions were a reactor trip on low pressurizer pressure and an ESF trip on low pressurizer pressure coincident with low pressurizer water level. These two trips provided functional diversity in the event of depressurizations of the primary system. To provide additional diversity in the event of small breaks in the primary system, a Containment Pressure High ESF trip setpoint of 2.0 psig was chosen. In 1979 following the Three Mile Island Unit 2 (TMI-2) event, IE Bulletin 79-06A (Revision 0 and Revision 1) identified actions to be taken by the licensees of reactors designed by Westinghouse. One of the actions identified in IE Bulletin 79-06A was to eliminate the coincident requirement of low pressurizer water level with low pressurizer pressure for an ESF trip. As a result, an ESF trip occurs on low pressurizer pressure only. In the review of the TMI-2 event, it was determined that the low pressurizer water level coincidence limited the reliability of the pressurizer ESF trip. Also, analyses of small breaks located at the top of the pressurizer showed that the pressurizer water level would increase (although the pressure and mass of the primary system would be decreasing), which would preclude an ESP trip. The NRC in their Safety Evaluation Report dated July 10, 1979, concluded that this change satisfied the requirements of IEEE 279-1971 and that none of the transient and accident analyses are adversely affected by the change.7 As such, the diversity of the pressurizer trip functions was strengthened by removing the pressurizer water level coincidence logic from the pressurizer ESF trip function. The low pressurizer pressure reactor trip signal and the low pressurizer ESF trip signal are actuated by separate and diverse logic trains. Also, the overtemperature delta-temperature (aT L1 T) reactor trip is available depending on initial conditions for providing diverse reactor trip in the event of a depressurization of the primary system. Although the Containment Pressure High ESF safety analysis trip setpoint is relaxed to 10.0 psig, it is still available to provide diverse protection for a range of breaks in the primary system. 7.2.5.1.15 Deleted 7.2.5.1.16 Steam/Feedwater Flow Mismatch Trip This trip protects the reactor from a sudden loss of heat sink. The trip is actuated by (1/2) steamlfeedwater flow mismatch, coincident with (1/2) low steam-generator water level, in the same loop. Plant Drawing 225103 [Formerly UFSAR Figure 7.2-10] shows the logic of this trip. The design satisfies the Control and Protection System Interaction Criteria of the proposed IEEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968, for plants with three level channels per steam generator. Chapter 7, Page 48 of 109 Revision 20, 2006 OAG10000215_0960 7.2.5.1.17 IP2 FSAR UPDATE Low-Low Steam-Generator Water Level Trip The purpose of this trip is to protect the steam generators in case of a sustained steam/feedwater flow mismatch. The trip is actuated on two-out-of-three low-low water level signals in any steam generator. A diagram of the steam-generator level control and protection system is shown in Plant Drawing 243328 [Formerly UFSAR Figure 7.2-32]. 7.2.5.1.18 Turbine Trip/Reactor Trip A turbine trip is sensed by two-out-of-three signals from auto-stop oil pressure. The analysis discussed in Section 14.1.8 indicates that an immediate reactor trip on turbine trip is not required for reactor protection; therefore, the design need not satisfy the proposed I EEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. Plant Drawing 225096 [Formerly UFSAR Figure 7.2-3] is a logic diagram for the turbine and generator trips. A turbine trip signal redundantly dumps the auto-stop oil, which, in turn, closes all turbine stop valves. Conversely, a reactor trip on turbine trip is generated by redundantly sensing the loss of auto-stop oil. 7.2.5.1.19 Steam Line Isolation Any of the following conditions will generate a steam line isolation signal; the design satisfies the proposed IEEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. 1. 2. 3. 7.2.5.1.20 High steam flow (2/4) in coincidence with low Tavg (2/4) or low steam pressure (2/4). High-high containment pressure (2/3, twice). Manual action. Turbine Runback A turbine runback is employed following a rod drop event (bypass switches have been installed, which are normally in the DEFEAT position, so as to bypass the runback on this signal) or loss of one main feedwater pump. A turbine runback, which uses the mechanical hydraulic turbine governor control, is achieved by reducing the signal to each of two load limit valves as required to achieve the required load reduction. Turbine runback is not required for reactor protection; therefore, this design need not satisfy the proposed I EEE criteria for nuclear power plant protection system (lEEE-279 Code), dated August 28, 1968. Beginning with the Cycle 11 reload up to and including the current cycle, dropped rod analyses with and without Turbine Runback were used and the ON B design basis was satisfied as discussed in Section 14.1.4. 7.2.5.2 Rod Stops A list of rod stops is provided in Table 7.2-3. Some of these have been previously noted under permissive circuits, but are listed again for completeness. Chapter 7, Page 49 of 109 Revision 20, 2006 OAG10000215_0961 7.2.5.2.1 Rod Drop Protection IP2 FSAR UPDATE Two independent systems are provided to sense a dropped rod: (1) a rod bottom position detection system and (2) a system, which senses sudden reduction in ex-core neutron flux. Both protection systems initiate protective action in the form of a turbine load cutback if above a given power level (see below). This action compensates for possible adverse core power distributions and permits an orderly retrieval of the dropped rod cluster control (as discussed in Section 14.1.4). The primary protection for the dropped rod cluster control accident is the rod bottom signal derived for each rod from its individual position indication system. With the position indication systems, initiation of protection is independent of rod location or reactivity worth (as discussed in Section 14.1.4). Backup protection is provided by use of the out-of-core power range nuclear detectors and is particularly effective for larger nuclear flux reductions occurring in the region of the core adjacent to the detectors. Bypass switches have been installed, which are normally in the DEFEAT position, so as to bypass this runback signal. The use of these bypass switches is acceptable based on the results of analyses discussed in Section 14.1.4. The rod drop detection circuit from nuclear flux consists basically of a comparison of each ion chamber signal with the same signal taken through a first-order lag network. Since a dropped rod cluster control assembly will rapidly depress the local neutron flux, the decrease in flux will be detected by one or more of these four sensors. Such a sudden decrease in ion chamber current will be seen as a different signal as discussed in Section 14.1.4. A signal greater than 5-percent reactor power reduction with an impulse unit time constant of 5 sec from anyone of the four power range channels will actuate the rod drop protection circuitry if the turbine runback switches are not in the DEFEAT position. Figure 7.4-2 indicates schematically the dropped rod detection circuit and the nuclear protection system in general. The potential consequences of any dropped rod cluster control assembly are discussed in Section 14.1.4. 7.2.5.2.2 Alarms Any of the following conditions actuate an alarm: 1. Reactor trip (first-out annunciator).
- 2. Trip of any reactor trip analog channel. 3. Actuation of any permissive circuit or override. (Note: P-7, P-8, pressurizer low pressure trip block permissive, and auto rod control permissive (15-percent power) are provided with an indication light only on the flight panel.) 4. Significant deviation of any major control variable (pressure, T avg, pressurizer water level, and steam-generator water level). Chapter 7, Page 50 of 109 Revision 20, 2006 OAG10000215_0962 7.2.5.2.3 IP2 FSAR UPDATE Control Group Rod Insertion Limits The lower insertion limit system is used in an administrative control procedure with the objective to maintain a rod cluster control assembly shutdown margin. The control group rod insertion limits, ZLL, are calculated as a linear function of reactor power and reactor coolant average temperature.
The equation is where A and B are preset manually adjustable gains and C is a preset manually adjustable bias. The (i1 T)avg and (T avg) are the average of the individual temperature differences and the coolant average temperatures, respectively, measured from the reactor coolant hot leg and the cold leg. One insertion limit monitor with two alarm setpoints is provided for control bank D. A description of control and shutdown rod groups is provided in Section 7.3.2. The "APPROACHING ROD INSERTION LIMIT 12.5' alarm alerts the operator of an approach to a reduced shutdown reactivity situation requiring boron addition by following normal procedures with the chemical and volume control system (Section 9.2). Actuation of "ROD INSERTION LIMIT 0"" alarm requires the operator to take immediate action to add boron to the system by anyone of several alternative methods. 7.2.6 System Evaluation 7.2.6.1 Reactor Protection System and Departure From Nucleate Boiling The following is a description of how the reactor protection system prevents departure from nucleate boiling (DNB). The plant variables affecting the DNB ratio (DNBR) are as follows: 1. Thermal power. 2. Coolant flow. 3. Coolant temperature.
- 4. Coolant pressure.
- 5. Core power distribution (hot-channel factors).
Figures 7.2-33 Sh. 1 & 2 illustrates the core limits for which DNBR for the hottest rod is at the design limit and shows the overpower and overtemperature i1T reactor trips locus as a function of T avg and pressure. Reactor trips for a fixed high pressurizer pressure and for a fixed low pressurizer pressure are provided to limit the pressure range over which core protection depends on the variable overpower and overtemperature i1 T trips. Reactor trips on nuclear overpower and low reactor coolant flow are provided for direct, immediate protection against rapid changes in these variables. However, for all cases in which the calculated DNBR approaches the applicable DNBR limit, a reactor trip on overpower and/or overtemperature i1T would be actuated. Chapter 7, Page 51 of 109 Revision 20, 2006 OAG10000215_0963 IP2 FSAR UPDATE The i1 T trip functions are based on the differences between measurements of the hot-leg and cold-leg temperatures, which are proportional to core power. The i1 T trip functions are provided with a nuclear flux feedback to reflect a measure of axial power distribution. This will assist in preventing an adverse distribution that could lead to exceeding allowable core conditions. 7.2.6.1.1 Overpower Protection In addition to the high power range nuclear flux trips, an overpower i1T trip is provided of-four logic) to limit the maximum overpower. This trip is of the following form: AT,,,,","" = AT" [ K, -K, (12:,s JT -K,(T -T")-j, (Al)] where i1 T 0 = loop specific indicated i1 T at rated power (OF) = setpoint bias Ks = constant T 3 = time constants, sec S = laplace transform operator, sec -1 T = measured reactor coolant average temperature (OF), two measurements (T c, T h) in each loop = constant T"= loop specific indicated average temperature at rated power (OF) F2(i1I) = function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains to be selected on the basis of measured instrument response during plant startup tests In addition, a rod stop function is provided in the form: AT rod stop = AT trip -Bp where Bp is the setpoint bias (OF). 7.2.6.1.2 Overtem perature Protection A second i1T trip (two-out-of-four logic) provides an overtemperature trip that is a function of coolant average temperature and pressurizer pressure derived as follows: Chapter 7, Page 52 of 109 Revision 20, 2006 OAG10000215_0964 where IP2 FSAR UPDATE i1 To = loop specific indicated i1 T at rated power (0 F) K1 = setpoint bias K 2 , K3 = constants based on the effect of temperature and pressure on the DNB limits T 3 = time constants, sec S = laplace transform operator, sec -1 T = measured reactor coolant average temperature (0 F), two measurements in each loop (T c, T h) T' = loop specific indicated average temperature at rated power (OF) P = measured pressurizer pressure, four independent measurements (psig) P' = nominal pressure at rated power, 2235 psig F1(i1I) = function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains to be selected on the basis of measured instrument response during plant startup tests Four long ion chamber pairs are provided, and each one independently feeds a separate overtemperature i1T trip channel. Thus, a single failure neither defeats the function nor causes a spurious trip. The reset function is only in the direction of decreasing the trip setpoint; it cannot increase the setpoint. As shown above, if the difference between the top and bottom detectors exceeds a preset limit indicative of excess power generation in either half of the core, a proportional signal is transmitted to the overtemperature i1 T trip to reduce its setpoint. A similar rod stop function is provided in the form: where BT is the setpoint bias (OF). Automatic feedback signals are provided to reduce the overpower-overtemperature trip setpoints and block rod withdrawal to the trip setpoint. 7.2.6.2 Interaction of Control and Protection The design basis for the control and protection system permits the use of a detector for both protection and control functions. Where this is done, all equipment common to both the Chapter 7, Page 53 of 109 Revision 20, 2006 OAG10000215_0965 IP2 FSAR UPDATE protection and control circuits are classified as part of the protection system. Isolation amplifiers prevent a control system failure from affecting the protection system. In addition, where failure of a protection system component can cause a process excursion that requires protective action, the protection system can withstand another independent failure without loss of function. Generally, this is accomplished with two-out-of-four trip logic. Also, wherever practical, provisions are included in the protection system to prevent a plant outage because of single failure of a sensor. 7.2.6.2.1 Specific Control and Protection Interactions 7.2.6.2.1.1 Nuclear Flux Four power range nuclear flux channels are provided for overpower protection. Isolated outputs from all four channels are averaged for automatic control rod regulation of power. If any channel fails in such a way as to produce a lower output, that channel is incapable of proper overpower protection. Two-out-of-four overpower trip logic will ensure an overpower trip if needed, even with an independent failure in another channel. In addition, the control system will respond only to rapid changes in indicated nuclear flux; slow changes or drifts are overridden by the temperature control signals. The setpoint for this rod stop is below the reactor trip setpoint. 7.2.6.2.1.2 Coolant Temperature Four Tavg channels are used for overtemperature-overpower protection. (See Plant Drawing 243330 [Formerly UFSAR Figure 7.2-34] for single channel.) Isolated output signals from all four channels are also averaged for automatic control rod regulation of power and temperature. In addition, channel deviation alarms in the control system will block automatic rod insertion if any temperature channel deviates significantly from the others. Two-out-of-four trip logic is used to ensure that an overtemperature trip will occur if needed even with an independent failure in another channel. Finally, as shown in Section 14.1, the combination of trips on nuclear overpower, high pressurizer water level, and high pressurizer pressure also serve to limit an excursion for any rate of reactivity insertion. Additional reactor coolant temperature measurements are provided for the alternate safe shutdown system by four strap-on resistance temperature detectors installed on loops 21 and 22 with display in the fan house. These provide measurements of the hot-and cold-leg temperatures of their respective loops. 7.2.6.2.1.3 Pressurizer Pressure Four pressure channels are used for high-and low-pressure protection and for overpower protection. Isolated output signals from these channels also are used for pressure control and compensation signals for rod control. These are discussed separately below. 1. Control of rod motion: The discussion for coolant temperature is applicable (i.e., two-out-of-four logic for overpower protection as the primary protection), with backup from multiple rod stops and "backup" trip circuits. In addition, the pressure compensation signal is limited in the control system such that failure of the pressure signal cannot cause more than about a 10°F change in Tavg. This Chapter 7, Page 54 of 109 Revision 20, 2006 OAG10000215_0966 IP2 FSAR UPDATE change can be accommodated at full power without a DNBR being reduced below the applicable safety analysis DNBR limit. Finally, the pressurizer safety valves are adequately sized to prevent system overpressure.
- 2. Pressure control: Spray, power-operated relief valves, and heaters are controlled by isolated output signals from the pressure protection channels.
7.2.6.2.1.4
- a. Low Pressure A spurious high-pressure signal from one channel can cause low pressure by spurious actuation of a pressurizer spray valve. Additional redundancy is provided in the protection system to ensure underpressure protection, i.e., two-out-of-four low pressure reactor trip logic and two-out-of-three logic for safety injection.
In addition, interlocks are provided in the pressure control system such that a relief valve will close if either of two independent pressure channels indicates low pressure. Spray reduces pressure at a lower rate, and some time is available for operator action (about 3 min. at maximum spray rate) before a low pressure trip is reached. b. High Pressure The pressurizer heaters are incapable of overpressurizing the reactor coolant system. Maximum steam generation rate with heaters is about 15,000 Ib/hr, compared with a total capacity of 1,224,000 Ib/hr for the three safety valves and a total capacity of 358,000 Ib/hr for the two power-operated relief valves. Therefore, overpressure protection is not required for a pressure control failure. Two-out-of-three high-pressure trip logic is therefore used. In addition, either of the two relief valves can easily maintain pressure below the high-pressure trip point. The two relief valves are controlled by independent pressure channels, one of which is independent of the pressure channel used for heater control. Finally, the rate of pressure rise achievable with heaters is slow, and ample time and pressure alarms are available for operator action. Pressurizer Level Three pressurizer level channels are used for high-level reactor trip (2/3). Isolated output signals from these channels are used for volume control, increasing or decreasing water level. A level control failure could fill or empty the pressurizer at a slow rate (on the order of half an hour or more). 1. High Level A reactor trip on pressurizer high level is provided to prevent rapid thermal expansions of reactor coolant fluid from filling the pressurizer: the rapid change from high rates of steam relief to water relief can be damaging to the safety valves and the relief piping and pressure relief tank. However, a level control failure cannot actuate the safety valves because the high-pressure reactor trip is Chapter 7, Page 55 of 109 Revision 20, 2006 OAG10000215_0967 IP2 FSAR UPDATE set below the safety valve set pressures. Therefore, a control failure does not require protection system action. In addition, ample time and alarms are available for operator action. 2. Low Level 7.2.6.2.1.5 For control failures that tend to empty the pressurizer, a signal of low level from either of two independent level control channels will isolate letdown, thus preventing the loss of coolant. Also, ample time and alarms exist for operator action. Steam-Generator Water Level/Feedwater Flow Before describing control and protection interaction for these channels, it is beneficial to review the protection system basis for this instrumentation. The basic function of the reactor protection circuits associated with low steam generator water level and low feedwater flow is to preserve the steam generator heat sink for removal of term residual heat. Should a complete loss of feedwater occur with no protective action, the steam generators would boil dry and cause an overtemperature-overpressure excursion in the reactor coolant. Reactor trips on temperature, pressure, and pressurizer water level will trip the plant before there is any damage to the core or reactor coolant system. However, residual heat after trip would cause thermal expansion and discharge of the reactor coolant to containment through the pressurizer relief valves. Redundant auxiliary feedwater pumps are provided to prevent this. Reactor trips act before the steam generators are dry to reduce the required capacity and starting time requirements of these pumps and to minimize the thermal transient on the reactor coolant system and steam generators. Independent trip circuits are provided for each steam generator for the following reasons: 1. Should severe mechanical damage occur to the feedwater line to one steam generator, it is difficult to ensure the functional integrity of level and flow instrumentation for that unit. For instance, a major pipe break between the feedwater flow element and the steam generator would cause high flow through the flow element. The rapid depressurization of the steam generator would drastically affect the relation between downcomer water level and generator water inventory.
- 2. It is desirable to minimize thermal transient on a steam generator for credible loss of feedwater accidents.
It should be noted that controller malfunctions caused by a protection system failure affect only one steam generator. Also, they do not impair the capability of the main feedwater system under either manual control or automatic T avg control. Hence, these failures are far from being the worst case with respect to decay heat removal with the steam generators.
- a. Feedwater Flow A spurious high signal from the feedwater flow channel being used for control would cause a reduction in feedwater flow and prevent that channel from Chapter 7, Page 56 of 109 Revision 20, 2006 OAG10000215_0968 IP2 FSAR UPDATE tripping.
A reactor trip on low-low water level, independent of indicated feedwater flow, will ensure a reactor trip if needed. In addition, the three-element feedwater controller incorporates reset on level, such that with expected gains, a rapid increase in the flow signal would cause only a 12-in. decrease in level before the controller reopens the feedwater valve. A slow increase in the feedwater signal would have no effect at all. b. Steam Flow A spurious low steam flow signal would have the same effect as a high feedwater signal, discussed above. c. Level A spurious high water level signal from the protection channel used for control will tend to close the feedwater valve. This level channel is independent of the level and flow channels used for reactor trip on low flow coincident with low level. (1) A rapid increase in the level signal will completely stop feedwater flow and actuate a reactor trip on low feed-water flow coincident with low level. (2) A slow drift in the level signal may not actuate a low feedwater signal. Since the level decrease is slow, the operator has time to respond to low-level alarms. Since only one steam generator is affected, automatic protection is not mandatory and reactor trip on two-out-of three low-low level is acceptable. REFERENCES FOR SECTION 7.2 1. Letter from J. D. O'Toole, Con Edison, to D. G. Eisenhut, NRC,
Subject:
Control Room Habitability Studies, Enclosure 2, dated May 12, 1981. 2. E. L. Vogeding, Seismic Testing of Electrical and Control Equipment, WCAP-7397 -L (Proprietary), Westinghouse Electric Corporation, January 1970. 3. J. Lipchak and R. Bartholomew, Test Report of Isolation Amplifier, WCAP-9011 (Proprietary), Westinghouse Electric Corporation.
- 4. Letter from J. D. O'Toole, Con Edison, to S. A. Varga, NRC,
Subject:
Seismic Qualification of Reactor Trip Breaker Shunt Trip Attachment, dated February 14, 1986. 5. Letter from M. Selman, Con Edison, to S. A. Varga, NRC,
Subject:
Seismic Qualification of DC Power Panels No. 21 and 22, Indian Point Unit 2, dated August 14, 1986. Chapter 7, Page 57 of 109 Revision 20, 2006 OAG10000215_0969 IP2 FSAR UPDATE 6. Letter (with attachments) from S. A. Varga, NRC, to J. D. O'Toole, Con Edison,
Subject:
NUREG-0737, Item No. 111.0.3.4 Control Room Habitability for Indian Point Unit No.2, Dated January 27, 1982 7. Letter from A. Schwencer, NRC, to W.J. Cahill,
Subject:
Safety Evaluation Report -Indian Point Station Unit 2 -Evaluation of Safety Injection System Actuation Technical Specification Change Request -Amendment No. 56 dated July 10, 1979 8. Letter from J. Durr, NRC, to S. Bram,
Subject:
Inspection Report No. 50-247/89-12 (including -Safety Evaluation Relating to Design Criteria for Electrical Cable Separation)
- 9. Calculation
- PGI-00408-00 Rev. 0, Identification Of Plant Areas Which Can Be Subjected To Harsh Environmental Conditions As A Result Of LOCA or HELB And The Environmental Parameters For The Area, Indian Point 2, dated December 1999. 10. Electrical Equipment Environmental Qualification Program Rev. 13, dated April 1999. 11. I P2-EQ Master List. Chapter 7, Page 58 of 109 Revision 20, 2006 OAG10000215_0970 o >> G) o o o o N --" 1U"1 o CD -....J --" 1. 2. 3. 4. 5. 6. 7. Reactor trip Manual Overpower nuclear flux Overtem perature i1 T Overpower i1T Low pressurizer pressure High pressurizer pressure (fixed setpoint)
High pressurizer water level 8a. Low reactor coolant flow 8b. Reactor coolant pump breaker open 8c. Undervoltage on reactor coolant pump bus IP2 FSAR UPDATE TABLE 7.2-1 (Sheet 1 of 5) List of Reactor Trips and Causes for Reactor Trips Coincidence Circuitry and Interlocks 1/2, no interlocks 2/4 2/4, no interlocks 2/4, no interlocks 2/4, blocked by P-7 2/3, no interlocks 2/3, blocked by P-7 2/3 per loop, 2/4 loops, blocked by P-7 2/3 per loop, 1/4 loops, blocked by P-8 1/1 per loop, 2/4 loops, blocked by P-7 1/1 per loop, 1/4 loops, blocked by P-8 2/4, blocked by P-7 Chapter 7, Page 59 of 109 Revision 20, 2006 Comments High and low settings; manual block and automatic reset of low setting by P-10 Permissive 10, Table 7.2-2 Underfrequency on 2/4 reactor coolant pump buses trips all reactor coolant pump breakers. o >> G) o o o o N --" 1U"1 o CD -....J N Reactor trip (continued)
- 9. Safety injection signal (actuation)
- 10. Turbine generator (Low auto stop oil pressure signal) 11. Steamlfeedwater flow mismatch 12. Low-low steam generator water level 13. High intermediate range nuclear flux 14. High source range nuclear flux IP2 FSAR UPDATE TABLE 7.2-1 (Sheet 2 of 5) List of Reactor Trips and Causes for Reactor Trips Coincidence Circuitry and Interlocks 2/3 low pressurizer pressure, provided safety injection is not manually blocked (i.e., manual block permitted for 2/3 low pressurizer pressure if reactor coolant system pressure is below 1940 psig); or 2/3 high containment pressure (Hi pressure);
or 2/3 high differential pressure between any two steam generators; or two sets of 2/3 high-high containment pressure (Hi-Hi pressure); or 1/2 manual; or 2/4 high steam flow coincident with 2/4 low T avg or 2/4 low steam line pressure. 2/3, blocked by P-7 or P-8 1/2 steamlfeedwater flow mismatch, coincident with 1/2 low steam generator water level, in the same loop. 2/3, per loop 1/2, manual block permitted by P-10 1/2, manual block permitted by P-6, also blocked by P-10 Chapter 7, Page 60 of 109 Revision 20, 2006 Comments Trip not activated until both P-7 and P-8 have been unblocked. Manual block and automatic reset Manual block Manual reset o >> G) o o o o N --" 1U"1 o CD -....J 0) Containment isolation actuation
- 15. Safety injection signal (phase A) 16. Containment pressure (phase B) 17. Containment or plant ventilation activity Engineered safety features actuation
- 18. Safety injection signal (S) (phase A) 19. Containment spray signal (P) (phase B) IP2 FSAR UPDATE TABLE 7.2-1 (Sheet 3 of 5) List of Reactor Trips and Causes for Reactor Trips Coincidence Circuitry and Interlocks See item 9 Coincidence of two 2/3 containment pressure (high-high pressure, same signal which actuates containment spray), or manual 1/2 High-High activity signal, from the containment air particulate or the plant ventilation radiogas detector (1/3) See Item 9 Coincidence of two sets of 2/3 containment pressure (high-high pressure);
or manual 112 Chapter 7, Page 61 of 109 Revision 20, 2006 Comments Actuates all nonessential service containment isolation trip valves and actuates isolation valve seal water system. Actuates all essential service containment isolation trip valves. The containment air particulate and radiogas monitors also directly actuate the containment purge supply and exhaust valves and the containment pressure relief valves on high-high activity. Manual (1/2 spray push buttons) initiation will position valves and start the spray pumps anytime before or after automatically safety injection initiated pump sequencing is in progress. Safety injection reset will block automatic spray initiation. o >> G) o o o o N --" 1U"1 o CD -....J .j::>. Engineered safety features actuation (continued)
- 20. Deleted 21. Containment air recirculation cooling signal 22. Isolation valve seal water signal Steam line isolation actuation
- 23. Steam flow 24. Containment pressure 25. Manual IP2 FSAR UPDATE TABLE 7.2-1 (Sheet 4 of 5) List of Reactor Trips and Causes for Reactor Trips Coincidence Circuitry and Interlocks Safety injection signal initiates starting of all fans in accordance with the safety injection starting sequence, 2/3 high containment pressure or manual 1/2 Containment isolation (phase A) signal High steam flow in 2/4 lines plus (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines. Coincidence of two sets of 2/3 containment pressure (high-high pressure) (NOTE: bistables are energized-to-operate) 1/1 per steam line Chapter 7, Page 62 of 109 Revision 20, 2006 Comments o >> G) o o o o N --" 1(J1 o CD -....J (J1 Auxiliary feedwater actuation
- 26. Turbine driven pump 27. Motor driven pumps Main feedwater isolation
- 28. Close main feedwater control valves trip main feedwater pumps Control rod protection
- 29. Reactor trip breakers IP2 FSAR UPDATE TABLE 7.2-1 (Sheet 5 of 5) List of Reactor Trips and Causes for Reactor Trips Coincidence Circuitry and Interlocks Low-low level in any two steam generators; or Blackout (i.e., 1/2 480-V busses 5A and 6A undervoltage), coincident with a unit trip without safety injection; or 1/2 AMSAC; or 1/2 manual. 2/3 low-low level in any steam generator; Blackout (i.e., 1/2 480-V busses 5A and 6A undervoltage) and a unit trip; or trip of 1/2 main feedwater pump turbines; or 1/2 AMSAC; all without safety injection; or safety injection (i.e., with either offsite or onsite power available), coincident with a sequenced pump start; or 1/2 manual. Any safety injection signal (see item 9) Chapter 7, Page 63 of 109 Revision 20, 2006 Comments During RCS cooldown prior to Teold decreasing below 381°F 1 2 3 4 5 Number 1 IP2 FSAR UPDATE TABLE 7.2-2 Interlock and Permissive Circuits Function Prevent rod withdrawal on overpower Input for Blocking 1/4 high nuclear flux (power range) or 1/2 high nuclear flux (intermediate range) or 1/4 overtemperature i1T or 1/4 overpower i1T 2 Deleted 3 Deleted 5 6 7 8 10 Rod Stop Deleted Nuclear overpower High i1T Deleted Steam dump interlock Manual block of source range level trip Permissive power (block various trips required only at power) Block single primary loop loss of flow trip Manual block of low trip (power range) and intermediate range trips Rapid decrease of MWe load signal 1/2 high intermediate range flux allows manual block, 2/2 low intermediate range defeats block 3/4 low nuclear flux signals (power range) and 2/2 low turbine inlet pressure signals 3/4 low nuclear flux (power range) 2/4 high nuclear flux allows manual block, 3/4 low nuclear flux (power range) defeats manual block TABLE 7.2-3 Rod Stops Actuation Signal 1/4 high power range nuclear flux or 1/2 high intermediate range nuclear flux 1/4 overpower i1T or 1/4 overtemperature i1T Rod Motion to be Blocked Manual withdrawal Manual withdrawal T avg deviation 1/4 Tavg deviation from average Tavg Automatic insertion Chapter 7, Page 64 of 109 Revision 20, 2006 OAG10000215_0976 Figure No. Figure 7.2-1 Figure 7.2-2 Figure 7.2-3 Figure 7.2-4 Figure 7.2-5 Figure 7.2-6 Figure 7.2-7 Figure 7.2-8 Figure 7.2-9 Figure 7.2-10 Figure 7.2-11 Figure 7.2-12 Figure 7.2-13 Figure 7.2-14 Figure 7.2-15 Figure 7.2-16 Figure 7.2-17 Figure 7.2-18 Figure 7.2-19 Figure 7.2-20 Figure 7.2-21 Figure 7.2-22 Figure 7.2-23 Figure 7.2-24 Figure 7.2-25 Title IP2 FSAR UPDATE 7.2 FIGURES Index And Symbols -Logic Diagram, Drawing 225094 Reactor Trip Signals -Logic Diagram, Drawing 225095 Turbine Trip Signals -Logic Diagram, Drawing 225096 Replaced With Plant Replaced With Plant Replaced With Plant 6900 Volt Bus Automatic Transfer -Logic Diagram, Replaced With Plant Drawing 225097 Nuclear Instrumentation Trip Signals -Logic Diagram, Replaced With Plant Drawing 225098 Nuclear Instrumentation Permissives And Blocks -Logic Diagram, Replaced With Plant Drawing 225099 Emergency Generator Starting -Logic Diagram, Replaced With Plant Drawing 225100 Safeguard Sequence -Logic Diagram, Replaced With Plant Drawing 225101 Pressurizer Trip Signal -Logic Diagram, Replaced With Plant Drawing 225102 Steam Generator Trip Signals -Logic Diagram, Replaced With Plant Drawing 225103 Primary Coolant System Trip Signals And Manual Trip -Logic Diagram, Replaced With Plant Drawing 225104 Safeguard Actuation Signals -Logic Diagram, Replaced With Plant Drawing 225105 Feedwater Isolation
-Logic Diagram, Replaced With Plant Drawing 225106 Rod Stops And Turbine Loads Cutbacks -Logic Diagram, Replaced With Plant Drawing 225107 Safeguards Actuation Circuitry And Hardware Channelization, Replaced With Plant Drawing 243318 Simplified Diagram For Overall Logic Relay Test Scheme, Replaced With Plant Drawing 243319 Analog And Logic Channel Testing, Replaced With Plant Drawing 243320 Reactor Protection Systems -Block Diagram, Replaced With Plant Drawing 243321 Core Coolant Average Temperature Vs Core Power Pressurizer Level Control And Protection System, Replaced With Plant Drawing 243313 Pressurizer Pressure Control And Protection System, Replaced With Plant Drawing 243314 Steam Flow i1P Vs Power, Replaced With Plant Drawing 243315 Design Philosophy To Achieve Isolation Between Channels Cable Tunnel -Typical Section, Replaced With Plant Drawing 243317 Typical Analog Channel Testing Arrangement, Replaced With Plant Drawing 243322 Chapter 7, Page 65 of 109 Revision 20, 2006 OAG10000215_0977 Figure 7.2-26 Figure 7.2-27 Figure 7.2-28 Figure 7.2-29 Figure 7.2-30 Figure 7.2-31 Figure 7.2-32 Figure 7.2-33 Sh. 1 Figure 7.2-33 Sh. 2 Figure 7.2-34 Typical IP2 FSAR UPDATE Simplified Control Drawing 243323 Schematic, Replaced With Analog Channels, Replaced With Plant Drawing 243324 Plant Analog System Symbols, Replaced With Plant Drawing 243311 Deleted Reactor Trip Breaker Actuation Schematic Deleted Steam Generator Level Control And Protection System, Replaced With Plant Drawing 243328 Illustrations Of Overpower And Temperature i1T Trips High Temperature Operation Illustrations Of Overpower And Temperature i1T Trips Low Temperature Operation Tavgfi1T Control And Protection System, Replaced With Plant Drawing 243330 7.3 REGULATING SYSTEMS 7.3.1 Design Basis The reactor control system is designed to limit nuclear plant transients for prescribed design load perturbations, under automatic control, [Note -The automatic control rod withdrawal feature in plant operation has been physically disabled, allowing only the automatic control rod insertion mode to be in effect when rod control is automatic.] within prescribed limits to preclude the possibility of a reactor trip in the course of these transients. Overall reactivity control is achieved by the combination of chemical shim and 53 control rod clusters of which 29 are in control bank and 24 are in shutdown bank. Long-term regulation of core reactivity is accomplished by adjusting the concentration of boric acid in the reactor coolant. Short term reactivity control for power changes or reactor trip is accomplished by the movement of control rod clusters. The primary function of the reactor control system is to provide automatic control of the rod clusters during power operation of the reactor. The system uses input signals including neutron flux, coolant temperature and pressure, and plant turbine load. The chemical and volume control system (Section 9.2) serves as a secondary reactor control system by the addition and removal of varying amounts of boric acid solution. There is no provision for a direct continuous visual display of primary coolant boron concentration. When the reactor is critical, the best indication of reactivity status in the core is the position of the control group in relation to plant power and average coolant temperature. There is a direct, predictable, and reproducible relationship between control rod position and power, and it is this relationship that establishes the lower insertion limit calculated by the rod insertion limit monitor. There are two alarm setpoints to alert the operator to take corrective action in the event a control bank approaches or reaches its lower limit. Any unexpected change in the position of the control group when under automatic control or a change in coolant temperature when under manual control provides a direct and immediate indication of a change in the reactivity status of the reactor. In addition, periodic samples of Chapter 7, Page 66 of 109 Revision 20, 2006 OAG10000215_0978 IP2 FSAR UPDATE coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion. The reactor control system is designed to enable the reactor to follow load reductions automatically when the plant output is above 15-percent of nominal power. Control rod insertion may be performed automatically when plant output is above this value. Control rod insertion and withdrawal may be performed manually at any time. The system as originally designed enabled the plant to accept a generation step load increase of 10-percent and a ramp increase of 5-percent per minute within the load range of 15 to 100-percent without reactor trip subject to possible xenon limitations. The elimination of the automatic rod withdrawal function could require the use of manual rod control to have the reactor respond to the turbine load change and to restore the coolant average temperature to the programmed value during these load increase transients. Similar step and ramp load reductions are possible within the range of 100 to 15-percent of nominal power with automatic control rod insertion operational. The operator is able to select any single bank of rods (shutdown or control) for manual operation. Using a single switch, he may not select more than one bank from these two groups. During reactor startup with the rod control bank selector switch in manual, the control banks can be moved only in their normal sequence with some overlap as one bank reaches its full withdrawal position and the next bank begins to withdraw. Power supplied to the rod banks is controlled so that no more than two banks can be withdrawn simultaneously. The control system is capable of restoring coolant average temperature to within the programmed temperature dead band following a load reduction. The reactor can be placed under automatic control in the power range between 15-percent of load and full load for the following design transients:
- 1. 1 O-percent step reduction in load without turbine bypass. 2. 5-percent per minute unloading.
- 3. 25-to-50-percent change in load at 200%/minute maximum turbine unloading rate from approximately 100-percent load with steam dump (load change capability depends on full power Tavg; see Section 7.3.3.1).
A programmed pressurizer water level as a function of load is provided in conjunction with the programmed coolant average temperature to minimize the requirements of the chemical and volume control system and waste disposal system resulting from coolant density changes during loading and unloading from full power to zero power. Following a reactor and turbine trip, sensible heat stored in the reactor coolant is removed without the actuation of steam-generator safety valves by means of controlled steam bypass to the condenser and by the injection of feedwater to the steam generators. Reactor coolant system temperature is reduced to the no-load condition. This no-load coolant temperature is maintained by steam bypass to the condensers to remove residual heat. Chapter 7, Page 67 of 109 Revision 20, 2006 OAG10000215_0979 IP2 FSAR UPDATE The control system was originally designed to operate as a stable system over the full range of automatic control throughout core life without requiring operator adjustment of setpoints other than normal calibration procedures. 7.3.2 System Design A block diagram of the reactor control system is shown in Figure 7.3-1. 7.3.2.1 Rod Control There were originally 61 total rod cluster control assemblies of which 53 are full-length and 8 were part-length rods. The part-length rods have been since removed. The full-length rods are divided into (1) a shutdown group comprised of two shutdown banks of eight rod clusters each and two shutdown banks of four rod clusters each, and (2) a control group comprised of four control banks containing eight, four, eight, and nine rod clusters. Figure 3.2-2 shows the locations of the full-length rods in the core. The four banks of the control group are the only rods that can be manipulated under automatic control. The banks are divided into subgroups to obtain smaller incremental reactivity changes. All rod cluster control assemblies in a subgroup are electrically paralleled to step simultaneously. Position indication for each rod cluster control assembly type is the same. There are two types of drive mechanism for the rod cluster control assemblies, those for the control and shutdown groups and those for the part-length rod group since removed. 7.3.2.1.1 Control Group Rod Control The automatic rod control system maintains a group programmed reactor coolant average temperature with adjustments inward of control group rod position for equilibrium plant conditions. The system is capable of restoring programmed average temperature following a scheduled or transient reduction in load. The coolant average temperature increases linearly from zero power to the full-power conditions. Wherein, the plant is being operated on a T avg program of 547°F to 562°F. Compensation for fuel depletion and/or xenon transients is periodically made with adjustments of boron concentration. The control system has the ability to readjust the control group rod in the inward direction in response to changes in coolant average temperature resulting from changes in boron concentration. The average coolant temperature is determined by using the hot-leg and the cold-leg temperature measurements in each reactor coolant loop. The average of the four loop average temperatures is the main control signal. This signal is sent to the control group rod programmer through a proportional plus rate compensation unit. The control group rod programmer commands the direction and speed of control group rod motion. A compensated pressurizer pressure signal and a power-load mismatch signal are also employed as control signals to improve the plant performance. The power-load mismatch channel takes the difference between nuclear power (average of all four power range channels) and a signal of turbine load (turbine inlet pressure), and passes it through a high-pass filter so that only a rapid change in flux or power causes rod motion. The power-load mismatch compensation serves to speed up system response and to reduce transient peaks. Chapter 7, Page 68 of 109 Revision 20, 2006 OAG10000215_0980 IP2 FSAR UPDATE The rod control group is divided into four banks comprised of eight, four, eight, and nine rod cluster controls, respectively, to follow load changes over the full range of power operation. Each rod control bank is driven by a sequencing, variable speed rod drive control unit. The rods in each control bank are divided into two subgroups, and the subgroups are moved sequentially one step at a time. The sequence of motion is reversible; that is, a withdrawal sequence is the reverse of the insertion sequence. Any reactor trip signal causes the rods to insert by gravity into the core. Manual control is provided to move a control bank in or out at a preselected fixed speed. Proper sequencing of the rod cluster control assembly is ensured first, by fixed programming equipment in the rod control system, and second, through administrative control of the reactor plant operator. Startup of the plant is accomplished by first manually withdrawing the shutdown rods to the full-out position. This action requires that the operator select the SHUTDOWN BANK position on a control board mounted selector switch and then position the IN-HOLD-OUT level (which is spring return to the HOLD position) to the OUT position. Rod cluster control assemblies are then withdrawn under manual control of the operator by first selecting the MANUAL position on the control board mounted selector switch and then positioning the IN-HOLD-OUT lever to the OUT position. A hinged mechanical interlock is also installed on top of the In-Out-Hold rod control lever that requires operator action to lift the interlock away from the rod control lever prior to rod withdrawal. The hinged mechanical interlock does not inhibit rod insertion. In the MANUAL selector switch position, the rods are withdrawn (or inserted) in a predetermined programmed sequence by the automatic programming equipment. The predetermined programmed sequence is set so that as the first bank out (control bank C-2) reaches a preset position near the top of the core, the second bank out (control bank C-3) begins to move out simultaneously with the first bank. When control bank C-2 reaches the top of the core, it stops, and control bank C-3 continues until it reaches a preset position near the top of the core where control bank C-4 motion begins. This withdrawal sequence continues until the plant reaches the desired power level. The programmed insertion sequence is the opposite of the withdrawal sequence, i.e., the last control bank out is the first control bank in. A permissive interlock limits automatic control to reactor power levels above 15-percent. In the AUTOMATIC position, the rods can only be inserted in a predetermined programmed sequence by the automatic programming equipment. With the simplicity of the rod sequence program, the minimal amount of operator selection, and two separate position indications available to the operator, there is very little possibility that rearrangement of the control rod sequencing could be made. 7.3.2.1.2 Shutdown Rod Group Control The shutdown group of control rods together with the control group are capable of shutting the reactor down. They are used in conjunction with the adjustment of chemical shim and the control group to provide shutdown margin of at least 1-percent following reactor trip with the most reactive control rod in the fully withdrawn position for all normal operating conditions. The shutdown banks are manually controlled during normal operation and are moved at a constant speed with staggered stepping of the subgroups within the banks. Any reactor trip Chapter 7, Page 69 of 109 Revision 20, 2006 OAG10000215_0981 IP2 FSAR UPDATE signal causes them to insert by gravity into the core. They are fully withdrawn during power operation and are withdrawn first during startup. Criticality is always approached with the control group after withdrawal of the shutdown banks. Four shutdown banks with a total of 24 clusters are provided. 7.3.2.1.3 Part-Length Rod Control Eight part-length rods were provided in the reactor in the original operating configuration in addition to the normal control rods. The function of these rods, which had neutron absorber material in only the bottom one quarter of the length (3-ft), was intended to shape the axial power distribution and thus stabilize axial xenon oscillations. In addition, they would flatten the axial power distribution and thus reduce hot-channel factors. The part-length rods were intended for operation only by manual control by the operator from the control console. They were moved together as a bank to make the upper and lower ion chamber readings approach a prescribed relationship within a prescribed allowable region of travel. However, subsequent to the initial plant operation, the part-length control rods were physically removed from the reactor. Their associated rod position indication system has been removed from the central control room. 7.3.2.1.4 Interlocks The rod control group is interlocked with measurements of turbine-generator load and reactor power to prevent automatic control below 15-percent of nominal power. The manual controls are further interlocked with measurements of nuclear flux, i1T, and rod drop indication to prevent approach to an overpower condition. 7.3.2.1.5 Rod Drive Performance The control banks are driven by a sequencing, variable speed rod drive programmer. In the control bank of rod cluster control assemblies, control subgroups (each containing a small number of rod cluster control assemblies) are moved sequentially in a cycle such that all subgroups are maintained within one step of each other. The sequence of motion is reversible, that is, withdrawal sequence is the reverse of the insertion sequence. The sequencing speed is proportional to the control signal from the reactor coolant system. This provides control group speed control proportional to the demand signal from the control system. A solid-state control system provides power to the rod drive mechanism coils from the output of two paralleled motor-generator sets. Two reactor trip breakers are placed in series with the output of the motor-generator sets. To permit online testing, a bypass breaker is provided across each of the two breakers. 7.3.2.1.6 Rod Cluster Control Assembly Position Indication Two separate systems are provided to sense and display control rod position as described below: 1. Analog System -An analog signal is produced for each individual rod by a linear position transmitter. An electrical coil stack is located above the stepping mechanisms of the control rod magnetic jacks, external to the pressure housing, but concentric with the rod Chapter 7, Page 70 of 109 Revision 20, 2006 OAG10000215_0982 IP2 FSAR UPDATE travel. When the associated control rod is at the bottom of the core, the magnetic coupling between the primary and secondary coil winding of the detector is small and there is a small voltage induced in the secondary. As the control rod is raised by the magnetic jacks, the relatively high permeability of the lift rod causes an increase in magnetic coupling. Thus, an analog signal proportional to rod position is obtained. Direct, continuous readout of every control rod is presented to the operator on individual indicators. A deviation monitor alarm is actuated if an individual rod position deviates from its group position by a preselected distance. Lights are provided for rod bottom positions for each rod. The lights are operated by bistable devices in the analog system. 2. Digital System -The digital system counts pulses generated in the rod drive control system. One counter is associated with each subgroup of control and shutdown rods. Readout of the digital system is in the form of electromechanical add-subtract counters reading the number of steps or rod withdrawal with one display for each subgroup. These readouts are mounted on the control panel. The digital and analog systems are separate systems; each serves as backup for the other. Operating procedures require the reactor operator to compare the digital and analog readings upon recognition of any apparent malfunction. Therefore, a single failure in rod position indication does not in itself lead the operator to take erroneous action in the operation of the reactor. 7.3.2.1.7 Part-Length Rod Position Indication Deleted 7.3.2.2 Full-Length Rod Drive Power Supply The full-length control rod drive power supply concept using a single scram bus system has been successfully employed on all Westinghouse PWR plants. Potential fault conditions with a single scram bus system are discussed in this section. The unique characteristics of the type mechanism with its relatively large power requirements make this system with the redundant series trip breakers particularly desirable. The solid-state rod control system is operated from two parallel connected 438-kVA generators that provide 260-V line-to-line, three-phase, four-wire power to the rod control circuits through two series connected reactor trip breakers. This AC power is distributed from the trip breakers to a line-up of identical solid-state power cabinets using a single overhead run of enclosed bus duct that is bolted to and therefore composes part of the power cabinet arrangement. Alternating current from the motor-generator sets is converted to a profiled direct current by the power cabinet and is then distributed to the mechanism coils. Each complete rod control system includes a single 70-V DC power supply that is used for holding the mechanisms in position during maintenance of normal power supply. Chapter 7, Page 71 of 109 Revision 20, 2006 OAG10000215_0983 IP2 FSAR UPDATE This 70-V supply, which receives its input from the AC power source down-stream of the reactor trip breakers, is distributed to each power cabinet and permits holding mechanisms in groups of four by manually positioning switches located in the power cabinets. The 50-A output capacity limits the holding capability to six rods cold or eleven rods hot. 7.3.2.2.1 Reactor Trip Current to the mechanisms is interrupted by opening either of the reactor trip breakers. The 70-V DC maintenance supply will also be interrupted as this supply receives its input power through the reactor trip breakers. 7.3.2.2.2 Trip Breaker Arrangement The trip breakers are arranged in the reactor trip switchgear in individual metal-enclosed compartments. The 1000-A bus work, making up the connections between scram breakers, is separated by metal barriers to prevent the possibility that any conducting object could short circuit, or bypass, scram breaker contacts. 7.3.2.2.3 Maintenance Holding Supply The 70-V DC holding supply and associated switches have been provided to avoid the need for bringing a separate DC power source to the rod control system during maintenance on the power cabinet circuits. This source is adequate for holding a maximum of six mechanisms cold or eleven mechanisms hot and will satisfy all maintenance holding requirements. 7.3.2.2.4 Control System Construction The rod control system is assembled in enclosed steel cabinets. Three-phase power is distributed to the equipment through a steel-enclosed bus duct bolted to the cabinets. Direct current power connections to the individual mechanisms are routed to the reactor head area from the solid-state cabinets through insulated cables, enclosed junction boxes, enclosed reactor containment penetrations, and sealed connectors. In view of this type of construction, any accidental connection of either an AC or DC power source, either internal or external to the cabinets, is not considered credible. 7.3.2.2.5 Alternating Current Power Connections The three-phase four-wire supply voltage required to energize the equipment is 260-V line, 58.3-Hz, 438-kVA capacity, zig-zag connected. It is unlikely that any power supply, and in particular one as unusual as this four-wire power source, could be accidentally connected, in phase, in the required configuration. Also, it should be noted that this requires multiple connections, not single connections. The closest outside sources available in the plant are 480-V auxiliary power sources and 208-V lighting sources. Connection of either a 480 or 208 volt, 60-Hz source to the single AC bus supplying the Rod Control System will cause currents to flow between the sources due to an out-of-phase condition. These currents will flow until the generator accelerates to a speed synchronous with the 60-Hz out-of-phase source, a time sufficient to trip the generator breakers. The phase currents for an unlimited capacity outside source, an outside source with a capacity equivalent to the normal generator kVA, and for either one or two M-G Sets in service, are tabulated below: Chapter 7, Page 72 of 109 Revision 20, 2006 OAG10000215_0984 IP2 FSAR UPDATE Out-of-Phase Currents (Amperes) One M-G Set Two M-G Sets In Service In Service Unlimited Capacity 25,000 50,000 4S0-V 400-kVA Capacity 12,500 25,000 Unlimited Capacity 16,000 32,000 20S-V 400-kVA Capacity S,OOO 16,000 All of the foregoing currents are sufficiently high to trip out the generator breakers on either overcurrent or reverse current. This trip-out is detectable by annunciation in the control room. If the outside power source trips, the connection is of no concern. Each solid-state power cabinet is tied to the main AC bus through three fused disconnect switches: one for the stationary gripper coil circuits, one for the movable gripper coil circuits, and one for the lift coil circuits. Reference voltages to operate the control circuits for all three coil circuits must be in phase with the supply to all coil circuits for proper operation of the system. If the outside power source were brought in to an individual cabinet, nine normal source connections would have to be disconnected and the outside source would have to be tied in phase to the proper nine points plus one neutral point to allow the movement of the rods. This is not considered credible. The connection of a single-phase AC source (i.e., one line to neutral) is also considered improbable. This would again require a high-capacity source that would have to be connected in phase with the nonsynchronous motor-generator set supply. Again, more than one connection is needed to achieve this condition. Each power cabinet contains three alarm circuits (stationary, movable, and lift) that would annunciate the condition to the operator. In addition, calculations show that a single phase source of 20S-V, 260-V, or 4S0-V will not supply enough current to hold the rods. Therefore, a jumper across two trip circuit breaker contacts in series, which results in a single phase remaining closed would not provide sufficient current to hold up the rods. The normal source generators are connected in a zig-zag winding configuration to eliminate the effects of direct current saturation of the machines resulting from the direct currents that flow in the half-wave bridge rectifier circuits. If this connection were not used, the generator core would saturate and loss of generating action would occur. This condition would also occur in a transformer. An outside source not having the zig-zag configuration would have to have a large capacity (>400 kVA) to avoid the loss of transformer action from saturation. Most of the components in the equipment are applied with a 100-percent safety factor. Therefore, the possibility exists that the system will operate at 4S0-V with a source of sufficient capacity. The system will definitely operate at 20S-V with a source of sufficient capacity. The connection of an outside source of AC power to one rod control system would first require a need for this source. No such need exists since two power sources (motor-generator sets) are Chapter 7, Page 73 of 109 Revision 20, 2006 OAG10000215_09S5 IP2 FSAR UPDATE already provided to supply the system. If the source were connected in spite of the need, extreme measures would have to be taken by the intruder to complete the connection. The outside source would have to be a large capacity (400 kVA). The currents that flow would require the routing of large conductors or bus bars, not the usual clip leads. Then, the disassembly of switchgear or the enclosed bus duct would be required to expose the single alternating current bus. Large bolted cable or bus bar terminations would have to be completed. A total of four conductors would have to be connected in phase with a synchronous source. To expect that a connection could be completed with the equipment either energized or deenergized in view of the obstacles that would prevent such a connection is incredible. However, even if the connection were completed, the outside source connection would be detectable by the operator through the tripping of the generator breakers. 7.3.2.2.6 Direct Current Power Connections An external DC source could, if connected inside the Power Cabinet, hold the rods in position. This would require a minimum supply voltage of 50-V. Since the holding current for each mechanism coil is 4 amperes, the DC capacity would have to be approximately 180 amperes to hold all rods. Achieving this situation would require several acts bringing in a power source which is not required for any type of operation in the Rod Control System, preferentially connecting it into the system at the correct points, and actuating specific holding switches so as to interconnect all rods. Closure of twelve switches, in four separate cabinets would be required to hold all rods. One switch could hold as many as four rods. The application of a DC voltage to an individual rod external to the Power Cabinet would affect only a single rod; connection with other rods in the group would be prevented by the blocking diodes in the power circuits. Should an external DC source be connected to the system, the system is provided with features to permit its detection. Each Power Cabinet contains circuitry, which compares the actual currents in the stationary and movable gripper coils with the reference signals from the step sequencing unit (Slave Cycler). In taking a single step, the current to the stationary gripper coil will be profiled from the holding value to the maximum, to zero, and return to the holding level after the completion of the step. Correspondingly, the movable gripper coil must change from zero to maximum and return to zero. The presence of an external DC source on either the stationary or movable coils would prevent the related currents from returning to zero. This situation would be instantaneously annunciated by way of the comparison circuit. Therefore, any rod motion would actuate an alarm indicating the presence of an external DC source. In addition, an external DC source would prevent rods from stepping. Thus, an external source could be detected by the rod position indication system indicating failure of the rod(s) to move. Connection of an external DC power source to the output lines of the 70-V DC power supply can be detected by opening the three-phase primary input of the supply and checking the output with a built-in indicating lamp. 7.3.3 Evaluation Summary In view of the preceding discussion, the postulated connection of an external power source (either AC or dc) or the occurrence of short circuits that could prevent dropping of the rods is not considered credible. Specifically: Chapter 7, Page 74 of 109 Revision 20, 2006 OAG10000215_0986 IP2 FSAR UPDATE 1. The need for an outside power source has been eliminated by incorporating in holding sources as part of the rod control system and by providing two generator sets. 2. The equipment is contained within enclosed steel cabinets precluding the possibility of an accidental connection of either AC or DC power in the cabinets.
- 3. Alternating current power distribution is accomplished using a steel-enclosed bus duct. The high-capacity (400-kVA)
AC power source is unique and not readily available. Multiple connections are required.
- 4. Direct current power is distributed to the individual mechanisms through insulated cables and enclosed electrical connections precluding the accidental connection of an outside DC source external to the cabinets.
The high-capacity DC source required to hold rods is not readily available in the rod control system, would require multiple connections, and would require deliberate positioning of switches within the enclosed cabinets.
- 5. Provisions are made in the system to permit the detection of an external DC source that could preclude a rod release. The total capacity of the system including the overload capability of each motor-generator set is such that a single set out of service does not cause limitations in rod motion during normal plant operation.
In order to minimize reactor trip as a result of a unit malfunction, the power system is normally operated with both units in service. 7.3.3.1 Turbine Bypass A turbine bypass system is provided to accommodate a reactor trip with turbine trip and in conjunction with automatic reactor control can accommodate a load rejection without reactor and turbine trip. The maximum load rejection that can be accommodated without reactor and turbine trip depends on the full load Tavg. A maximum of 25% load rejection can be accommodated for the minimum acceptable full load Tavg of 550.5°F. As the full load Tavg is increased, larger load rejections can be accommodated until for full load Tavg values of 5580F or higher a maximum load rejection of 50% can be accommodated. The turbine bypass system removes steam to reduce the transient imposed upon the reactor coolant system so that the control rods can be positioned to reduce the reactor power to a new equilibrium value without allowing overtemperature and overpressure conditions in the reactor coolant system. A turbine bypass is actuated by the coincidence of compensated coolant average temperature higher than the programmed value by a preset value and turbine load decrease greater than a preset value. All the turbine bypass valves open immediately upon receiving the bypass signal. The bypass valves are modulated by the compensated coolant average temperature signal after they are open. The turbine bypass reduces proportionally as the control rods act to reduce the coolant average temperature. The artificial load is therefore removed as the coolant average temperature is restored to its programmed equilibrium value. The turbine bypass steam capacity is 40-percent of full-load steam flow at full-load steam pressure. The bypass flows to the main condenser. Chapter 7, Page 75 of 109 Revision 20, 2006 OAG10000215_0987 7.3.3.2 Part-Length Power Supply Deleted 7.3.3.3 Feedwater Control IP2 FSAR UPDATE Each steam generator is equipped with a three-element feedwater controller that maintains a programmed water level as a function of load on the secondary side of the steam generator. The three-element feedwater controller continuously compares actual feedwater flow with steam flow compensated by steam pressure with a water level setpoint to regulate the feedwater valve opening. The individual steam generators are operated in parallel, both on the feedwater and on the steam side. Continued delivery of feedwater to the steam generators is required as a sink for the heat stored and generated in the primary coolant following a reactor trip and turbine trip. A low-low steam generator water level initiates a reactor trip and also generates an increased level demand signal for the feedwater control system. The main feedwater valves move to the fully open position in response to this level demand. This provides an additional heat sink for the reduction of reactor coolant temperature to the no-load average temperature value. The feedwater regulating valves close on high steam-generator water level, safety injection, or a reactor trip coincident with low Tavg. In the latter case, the low flow feedwater bypass valve closure may be delayed by means of an installed timer to allow main feedwater to moderate the cooler auxiliary feedwater before it enters steam generators. Manual override of the feedwater control systems is also provided. 7.3.3.4 Pressure Control The reactor coolant system pressure is controlled by electrical immersion heaters located near the bottom of the pressurizer, and spray in the steam region. A portion of the heater groups are proportional heaters and are used for pressure variation control and to compensate for ambient heat losses. The remaining (backup) heaters are turned on either when the pressurizer pressure is below a preset value or when the pressurizer level exceeds the programmed level setpoint by a preset amount. A small continuous spray flow is maintained when required to reduce boron stratification in the pressurizer and/or control the thermal gradient in the surge line. Heaters are operated as required to compensate for the spray and control pressure. A spray nozzle is located at the top of the pressurizer. Spray is initiated when the pressure controller signal is above a preset setpoint. Spray rate increases proportionally with increasing pressure until it reaches the maximum spray capacity. Steam condensed by spray reduces the pressurizer pressure. A small continuous spray is normally maintained to reduce thermal stresses and thermal shock when the spray valves open and to help maintain uniform water chemistry and temperature in the pressurizer. Two power relief valves are designed to limit system pressure to 2335 psig for large load reduction transients. The relief valves are operated on the actual pressure signal. A separate interlock (set at approximately 2300 psig) is provided for each so that if a pressure channel indicates abnormally low, the valve activation is blocked. The logic for each is thus basically two out of two. Chapter 7, Page 76 of 109 Revision 20, 2006 OAG10000215_0988 IP2 FSAR UPDATE 7.3.3.5 Overpressurization Protection System This system uses a two-out-of-three actuation logic on high reactor coolant pressure, when reactor coolant temperature is less than a predetermined arming temperature, to open the power-operated relief valves automatically. This relief prevents the reactor coolant system from exceeding pressure limits given in 10 CFR 50, Appendix G. Three spring-loaded safety valves are sized to limit system pressure to 2750 psia following a complete loss of load without direct reactor trip or turbine bypass. (See Section 4.3.4.) 7.3.4 System Design Evaluation 7.3.4.1 Plant Stability Automatic Rod Control is only used once the plant has reached stable conditions. This allows for inward rod motion during the early stages of a plant transient without the need for operator action to limit Reactor Coolant System temperature increase. Operator action is required following the transient to restore reactor coolant average temperature to the programmed setpoint. 7.3.4.2 Step-Load Changes Without Turbine Bypass A typical reactor power control requirement is to accept a 10-percent step-load decrease, without a plant trip, over the 15 to 100-percent power range for automatic control. The design must necessarily be based on conservative conditions, and a greater transient capability is expected for actual operating conditions. The function of the control system is to minimize the reactor coolant average temperature increase during the transient within an acceptable value. Excessive pressurizer pressure variations are prevented by using spray and heaters in the pressurizer. Operator action is required following the transient to restore reactor coolant average temperature to the programmed setpoint. 7.3.4.3 Loading and Unloading Ramp unloading is provided over the 15 to 100-percent power range under automatic control. Loading is performed under manual operator control only. The coolant average temperature is increasing during loading, and there is a continuous insurge to the pressurizer resulting from coolant expansion. The sprays limit the resulting pressure increase. Conversely, as the coolant average temperature is decreasing during unloading, there is a continuous outsurge from the pressurizer resulting from coolant contraction. The heaters limit the resulting system pressure decrease. The pressurizer level is programmed such that the water level has an acceptable margin above the low-level heater cutout setpoint during the loading and unloading transients. Operator action is required to restore reactor coolant average temperature to the programmed setpoint. 7.3.4.4 Loss of Load With Turbine Bypass The reactor coolant system is designed to accept -25 to 50-percent (depending on full power Tavg; see Section 7.3.1 and 7.3.3.1) loss of load accomplished as a turbine runback at a Chapter 7, Page 77 of 109 Revision 20, 2006 OAG10000215_0989 IP2 FSAR UPDATE maximum rate of 200%/minute. No reactor trip or turbine trip will be actuated. The automatic turbine bypass system is able to accommodate this abnormal load rejection and to reduce the transient imposed upon the reactor coolant system. The reactor power is reduced at a rate consistent with the capability of the rod control system. The reducing of the reactor power is automatic down to 15-percent of full power. Manual control is used when the power is below this value. The bypass is removed as fast as the control rods are capable of inserting negative reactivity. The pressurizer relief valves might be actuated for the most adverse conditions, for example, the most negative Doppler coefficient, and the minimum incremental rod worth. The relief capacity of the power-operated relief valves is sized large enough to limit the system pressure to prevent the actuation of high-pressure reactor trip for the most adverse conditions. 7.3.4.5 Turbine-Generator Trip With Reactor Trip Turbine-generator unit trip is accomplished by reactor trip. With a secondary-system design pressure of 1100 psia, the plant is operated with a programmed average temperature as a function of load, with the full-load average temperature higher than the saturation temperature corresponding to the steam-generator safety valve setpoint. This, together with the fact that the thermal capacity in the reactor coolant system is greater than that of the secondary system, requires a heat sink to remove heat stored in the reactor coolant to prevent the actuation of steam-generator safety valves for turbine and reactor trip from full power. This heat sink is provided by the combination of controlled release of steam to the condenser and by makeup of auxiliary feedwater to the steam generators. The turbine bypass system is controlled from the reactor coolant average temperature signal whose reference setpoint is reset upon trip to the no-load value. Turbine bypass actuation must be rapid to prevent generator safety valve actuation. With the bypass valves open, the coolant average temperature starts to reduce quickly to the no-load setpoint. A direct feedback of reactor coolant average temperature acts proportionally to close the valves to minimize the total amount of steam bypassed. Following turbine trip, the steam voids in the steam generators will collapse, and the opened feedwater valves will provide sufficient feedwater flow to restore water level in the downcomer. The feedwater flow is cut off when the reactor coolant average temperature decreases below a preset temperature value or when the steam-generator water level reaches a preset high setpoint. Additional auxiliary feedwater makeup is then controlled manually to restore and maintain the steam-generator level while maintaining the reactor coolant at the no-load temperature. Residual heat removal (manually selected) is maintained by the steam-generator pressure controller, which controls the amount of turbine bypass to the condensers. This controller operates the same bypass valves to the condensers that are controlled by coolant average temperature during the initial transient following turbine and reactor trip. The pressurizer pressure and level fall during the transient resulting from the coolant contraction. If heaters become uncovered following the trip, the chemical and volume control system will provide full charging flow to restore water level in the pressurizer. Heaters are then turned on to heat pressurizer water and restore pressurizer pressure to normal. Chapter 7, Page 78 of 109 Revision 20, 2006 OAG10000215_0990 IP2 FSAR UPDATE The turbine bypass and feedwater control systems are designed to prevent the coolant average temperature from falling below the programmed no-load temperature following the trip to ensure adequate reactivity shutdown margin. 7.3 FIGURES Figure No. Title Figure 7.3-1 Simplified Block Diagram Of Reactor Control Systems Figure 7.3-2 Deleted 7.4 NUCLEAR INSTRUMENTATION 7.4.1 Design Bases 7.4.1.1 Fission Process Monitors and Controls Criterion: Means shall be provided for monitoring or otherwise measuring and maintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations in reactivity of the core. (GDC 13) The nuclear instrumentation system is provided to monitor the reactor power from source range through the intermediate range and power range up to 120-percent full power. The system provides indication, control, and alarm signals for reactor operation and protection. The operational status of the reactor is monitored from the central control room. When the reactor is subcritical (i.e., during cold or hot shutdown, refueling, and approach to criticality), the relative status (neutron source multiplication) is continuously monitored and indicated by proportional counters located in instrument wells in the primary shield adjacent to the reactor vessel. Two source-detector channels are provided for supplying information on multiplication while the reactor is subcritical. A reactor trip is actuated from either channel if the neutron flux level becomes excessive. This system is checked prior to operations in which criticality may be approached. This is accomplished by the use of an incore source to provide a meaningful count rate even at the refueling shutdown condition. Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate, is slow enough to give ample time to start corrective action (boron dilution stop and/or emergency boron injection) to prevent the core from becoming critical (as discussed in Sections 14.1.5.2.3 and 14.1.5.3). A third channel is provided for use under conditions requiring alternate shutdown system operation. Means for showing the relative reactivity status of the reactor are as follows: 1. Rod position.
- 2. Source, intermediate, and power range detector signals. 3. Boron concentration.
- 4. RCS average temperature.
The position of the control banks is directly related to the reactivity status of the reactor when at power, and any unexpected change in the position of the control banks under automatic control or change in the RCS average temperature (Calculated from hot-leg and cold-leg temperatures) under manual or automatic control provides a direct and immediate indication of a change in the reactivity status of the reactor. Periodic samples of the coolant boron concentration are taken. Chapter 7, Page 79 of 109 Revision 20, 2006 OAG10000215_0991 IP2 FSAR UPDATE The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion. High nuclear flux protection is provided both in the power and intermediate ranges by reactor trips actuated from either range if the neutron flux level exceeds trip setpoints. When the reactor is critical, the best indication of the reactivity status in the core (in relation to the power level and average coolant temperature) is the control room display of the rod control group position. 7.4.2 System Design The three instrumentation ranges are provided with overlap between adjacent ranges so that continuous readings will be available during transition from one range to another as indicated in Figure 7.4-1. The sensitivities of the neutron detectors are also shown in Figure 7.4-1. The nuclear instrumentation system diagram is shown in Figure 7.4-2. 7.4.2.1 Detectors The system consists of six detector assemblies located in instrument wells around the reactor as shown in Figure 7.4-3. The six assemblies provide the following instrumentation:
- 1. Power Range. This range consists of four independent long uncompensated ionization chamber assemblies.
Each assembly is made up of two sensitive lengths. One sensitive length covers the upper half of the core, and the other length covers the lower half of the core. The arrangement provides in effect a total of eight separate ionization chambers approximately one-half the core height. The eight uncompensated (guard-ring) ionization chambers sense thermal neutrons in the range from 2.5 x 10 3 to 2.5 X 10 10 neutrons/cm 2-sec. Each has a nominal sensitivity of 1.7 x 10-13 amperes per neutron/cm 2-sec. The four long ionization chamber assemblies are located in vertical instrument wells adjacent to the four "corners" of the core. The assembly is manually positioned in the assembly holders and is electrically isolated from the holder by means of insulated standoff rings. 2. Startup Range (Intermediate and Source). There are two separate assemblies. Each assembly covers two ranges. Each assembly contains one compensated ionization detector (intermediate range) and one proportional counter (source range). A third source range assembly is also provided for use under alternate safe-shutdown conditions. The source range neutron detectors are integral cable proportional counter assemblies. The proportional counter is filled with Boron Trifluoride (BF3) gas enriched to greater than 90% in the B 10 isotope, with a thermal neutron sensitivity of approximately 13 counts/neutron cm2 at an operating voltage of 2000 volts. The detectors sense thermal neutrons in the range from 10-1 to 5 x 10 4 Chapter 7, Page 80 of 109 Revision 20, 2006 OAG10000215_0992 7.4.2.1.1 IP2 FSAR UPDATE neutrons/cm 2 -sec, to produce a pulse rate between 10 0 and 5 x 10 5 counts/sec. The range of the source range channel is 10 0 to 10 6 counts/sec. The neutron detectors are positioned in detector assembly containers by means of a linear, high-density moderator insulator. The detector and insulator units are packaged in a housing that is inserted into the guide thimbles. The detector assembly is electrically isolated from the guide thimble by means of insulated standoff rings. The intermediate-range neutron detectors are compensated ionization chambers that sense thermal neutrons in the range from 2.5 x 10 2 to 2.5 x 10 10 neutrons/cm 2-sec and have a nominal sensitivity of 4 x 10-14 amperes per neutron/cm 2 -sec. They produce a corresponding direct current of 10-11 to 10-3 A. These detectors are located in the same detector assemblies as the proportional counters for the source range channels. The electronic equipment for each of the source, intermediate, and power range channels is contained in a draw-out panel mounted adjacent to the main control board. Power Range Channels There are three sets of power range measurements. Each set uses four individual currents as follows: 1. Four currents directly from the lower sections of the long ionization chambers.
- 2. Four currents directly from the upper sections.
- 3. Four total currents of items 1 and 2, equivalent to the average of each section. For each of the four currents in items 1 and 2, the current measurement is indicated directly by a microammeter, and isolated signals are available for control console indication and recording.
Analog signals proportional to individual currents are transmitted through buffer amplifiers to the over-temperature and overpower L1 T channels and provide automatic reset of the trip point for these protection functions. The total current, equivalent to the average, is then applied through a linear amplifier to the bistable trip circuits. The amplifiers are equipped with gain and bias controls for adjustment to the actual output corresponding to 1 OO-percent rated reactor power. Each of the four amplifiers also provides amplified isolated signals to the main control board for indication and for use in the reactor control system. Each set of bistable trip outputs is operated as a two-out-of-four coincidence to initiate a reactor trip. Bistable trip outputs are provided at low-and high-power setpoints depending on the operating power. To provide more protection during startup operation, the low-range power bistable is used. This trip is manually blocked after a permissive condition is obtained by two-out-of-four power range channels. The power trip bistable is always active. The four amplifier signals corresponding to item 3 above are supplied to circuits that compare a referenced channel output with the corresponding signal from the other channels. Alarms are provided to present deviations that might be indicative of quadrant flux asymmetries. Chapter 7, Page 81 of 109 Revision 20, 2006 OAG10000215_0993 IP2 FSAR UPDATE Signals derived from the power range instruments are also supplied to the plant computer. These signals are used to monitor radial and axial flux tilt in the following manner: 1. Radial flux tilt is determined by comparing the signals obtained from the upper sections of the ionization chambers. The signals obtained from the lower sections are also compared to each other in the same manner. The value of the deviation is supplied to the operator by means of a visual display. The existence of a radial flux tilt can be verified by the use of incore instrumentation.
- 2. Axial flux tilt is determined by comparing the sum and/or average of the upper sections of the ionization chambers to the sum and/or average of the signals from the lower sections.
The operator will be informed by a computer alarm if the deviation exceeds a preset value of 20-percent full power. A visual display is provided by four meters located on the flight panel, each of which indicates individual detector axial flux tilt. 3. Delta flux is determined by comparing the difference in signals between the upper and lower power range detectors. The program outputs two types of alarm messages. Above a preset power level (90-percent), an alarm message is printed out immediately upon discovering a delta flux alarm. Below this power level, an alarm message is printed if the delta flux has exceeded its allowable limits for a preset cumulative amount of time in the past 24 hr. The overpower trip will be set so that, for operating limit reactor conditions concurrent with the maximum instrumentation and bistable setpoint error, the maximum reactor overpower condition will be limited to 118-percent, as discussed in Chapter 14. This limit is accomplished by the use of solid-state instrumentation and long ionization chambers, which permit an integration of the flux external to the core over the total length of the core, thereby reducing the influence of axial flux distribution changes resulting from control rod motion. The ion chamber current of each detector is measured by sensitive meters with an accuracy of O.OS-percent. A shunt assembly and switch in parallel with each meter allows the selection of one of four meter ranges. The available ranges are 0 to 100, 0 to 500,0 to 1000, and 0 to 5000 /-LA. The shunt assemblies are designed in such a manner that they will not disconnect the detector current to the summing assembly upon meter failure or during switching. An isolation amplifier provides an analog signal proportional to ion chamber current for recording, data logging, and delta flux indication. A test calibration unit provides necessary switches and signals for checking and calibrating the power range channels. The linear amplifier accepts the output currents from each of the two chamber sections and derives a nuclear power signal proportional to the summed direct currents. This unit amplifies the currents, and converts the normal current signal to a voltage signal suitable for operation of associated components such as bistables and isolation amplifiers. Multiple power supplies furnish necessary positive and negative voltages for the individual channels and detector power. Mounted on the front panel of each power range channel drawer are the ion chamber current meters, shunt selector switches with appropriate positions, and the nuclear power indicator (0 to 120-percent full power). Chapter 7, Page 82 of 109 Revision 20, 2006 OAGI000021 5_0994 IP2 FSAR UPDATE The isolated nuclear power signals are available for recording by the nuclear instrumentation system recorder. An isolated nuclear power signal is available for recording overpower conditions up to 200-percent full power. Alarm signals for dropped-rod -rod stop, overpower -rod stop, over-power reactor trip, and channel test are annunciated on the main control board. Control signals sent to the reactor control and protection system include dropped-rod -rod stop, overpower -rod stop, overpower -reactor trip, and permissive circuit signals. These are described in Section 7.2. 7.4.2.1.2 I ntermediate-Range Channels There are two intermediate range channels that use two compensated ionization chambers. Direct current from the ion chambers is transmitted through triaxial cables to transistor logarithmic current amplifiers in the nuclear instrumentation equipment. The logarithmic amplifier derives a signal proportional to the logarithm of the current as received from the output of the compensated ion chamber. The output of the logarithmic amplifier provides an input to the level bistables for reactor protection purposes and source range cutoff. The bistable trip units are similar to those in the other ranges. The trip outputs can be manually blocked after receiving a permissive signal from the power range channels. On decreasing power, the intermediate-range trips for reactor protection are automatically inserted when the power range permissive signal is not present. To prevent inadvertent and unnecessary reactor trips during power reductions prior to shutdown, operating procedures allow these trips to be manually bypassed until they have reset to the untripped condition and the reset has been verified. Low-voltage power supplies contained in each drawer furnish the necessary positive and negative voltages for the channel electronic equipment. Two medium-voltage power supplies, one in each channel, furnish compensating voltage to the two compensated ion chambers. The high voltage for the compensated ion chambers is supplied by separate power supplies also located in the intermediate-range drawers. On the front panel of the intermediate range channel cabinet and on the control board are mounted a neutron (log N) flux level indicator calibrated in terms of ion chamber current (10-11 to 10-3 A). Isolated neutron flux level signals are available for recording and startup rate computation. The startup rate for each channel is indicated at the main control board in terms of decades per minute over the range of -0.5 to 5.0 decades/min. Channel test, intermediate channel above source range cutoff point, intermediate range trips not armed, block rod withdrawal, and reactor trip signals are alarmed on the main control board annunciator. The latter signal is sent to the reactor protection system. 7.4.2.1.3 Source Range Channels There are two source range channels using boron-10-lined proportional counters. Neutron flux, as measured in the primary shield area, produces current pulses in the detectors. These preamplified pulses are applied to transistor amplifiers and discriminators located in the central control room. Triaxial cable is used for all interconnections from the detector assemblies to the Chapter 7, Page 83 of 109 Revision 20, 2006 OAG10000215_0995 IP2 FSAR UPDATE instrumentation in the central control room. The preamplifiers are located outside the reactor containment. These channels indicate the source range neutron flux and startup rate and provide high flux level reactor trip and alarm signals to the reactor control and protection system. The reactor trip signal is manually blocked when a permissive signal from the intermediate range is available. They are also used at shutdown to provide audible alarms in the reactor containment and central control room of any inadvertent increase in reactivity. An audible count rate signal is used during initial phases of startup and is audible in both the reactor containment and central control room. Amplifiers are used to obtain a high-level signal prior to the elimination of noise and gamma pulses by the discriminator. The discriminator output is shaped for use by the log integrator. The log integrator derives an analog signal, proportional to the logarithm of the number of pulses per unit time, as received from the output of the previous unit. This unit performs log integration of the pulse rate to determine the count rate; a linear amplifier amplifies the log integrator output for indication, recording, control, and rate computation through isolation amplifiers. Each source range contains two bistable trip units. Both units trip on high flux level, but one is used during shutdown to alarm reactivity changes and the other provides overpower protection during shutdown and startup. The shutdown alarm unit is blocked manually prior to startup or can serve as a startup alarm. When the input to either unit is below its setpoint, the bistable is in its normal position and assumes a "fully-on" status. When an input from the log amplifier reaches or exceeds the setpoint, the unit reverses its condition and goes "fully-off." The output of the reactor trip unit controls relays in the reactor protection system. Power supplies furnish the positive and negative voltages for the transistor circuits and alarm lights and the adjustable high voltage for the neutron detector. A test calibration unit can insert selected test or calibration signals into the preamplifier channel input or the log amplifier input. A set of precalibrated level signals are provided to perform channel tests and calibrations. An alarm is registered on the main control board annunciator whenever a channel is being tested or calibrated. A trip bypass switch is also provided to prevent a reactor trip during channel test under certain reactor conditions. The neutron detector high-voltage cutoff assembly receives a trip signal when a one-of-two matrix controlled by intermediate-range channel flux level bistables and manual block condition are present and disconnects the voltage from the source range channel high-voltage power supply to prevent operation of the boron-10-lined counter outside its design range. In addition, a high-voltage manual control switch is installed to prevent inadvertent energization of the source range high voltage while at power. The position of the switch is administratively controlled to ensure that the source range high voltage is energized upon a reactor trip or normal shutdown when the detector current is less than 10-10 amps. Mounted on the front panel of the source range channel is a neutron flux level indicator calibrated in terms of count rate level (1 to 10 6 cps). Mounted on the control board is a neutron count rate level indicator (1 to 10 6 cps). Isolated neutron flux signals are available for recording by the nuclear instrumentation system recorder and startup rate computation. The startup rate for each channel is indicated at the main control board in terms of decades per minute over the range of -0.5 to +5.0 decades/min. The isolation network for these signals prevents any Chapter 7, Page 84 of 109 Revision 20, 2006 OAG10000215_0996 IP2 FSAR UPDATE electrical malfunction in the external circuitry from affecting the signal being supplied to the flux level bistables. The signals for channel test, high neutron flux at shutdown, and source reactor trip are alarmed on the main control board annunciator. In addition, there are annunciators for the following source range conditions: "Source Range High Shutdown Flux Alarm Blocked", "NIS Channel Test", "Source Range Loss of Detector Voltage", and "NIS Trip Bypass". 7.4.2.2 Auxiliary Equipment 7.4.2.2.1 Comparator Channel The comparator channel compares the four nuclear power signals of the power range channels with one another. A local alarm on the channel is actuated when any two channels deviate from one another by a preset adjustable amount. During full-power operation, the comparator serves to sense and annunciate channel failures and/or deviations. 7.4.2.2.2 Dropped Rod Protection As backup to the primary protection for the dropped rod cluster control accident, the rod bottom signal, an independent detection means is provided using the out-of-core power range nuclear channels. The dropped-rod sensing unit contains a difference amplifier, which compares the instantaneous nuclear power signal with an adjustable power lag signal and responds with a trip signal to the bistable amplifier when the difference exceeds a preset adjustable amount. Above a given power level the signal initiates protective action in the form of a turbine load cutback. Bypass switches have been installed, which are normally in the DEFEAT position, so as to bypass the run back of this signal. 7.4.2.2.3 Audio Count Rate Channel The audio count channel provides audible source range information during refueling operations in both the central control room and the reactor containment. In addition, this channel signal is fed to a scaler-timer assembly, which produces a visual display of the count rate for an adjustable sampling period. 7.4.2.2.4 Recorders One large, two-pen strip-chart recorder is mounted on the main control board for recording the complete range of the source and intermediate channels. It is also possible to record any two power range channels as linear signals. Variable chart speeds are provided with controls for changing the span and zero during intermediate-range operation. The switching of inputs to the recorders does not cause any spurious signals that would initiate false alarms or reactor trips. Four 2-pen recorders are provided, one for each power range, to record the flux level from each of the eight sections comprising the four long ion chambers. 7.4.2.2.5 Power Supply The nuclear instrumentation system is powered by four 120-V independent vital instrument AC bus circuits (see Chapter 8). Chapter 7, Page 85 of 109 Revision 20, 2006 OAG10000215_0997 7.4.3 System Evaluation 7.4.3.1 Loss of Power IP2 FSAR UPDATE Loss of nuclear instrumentation power would result in the initiation of all reactor trips associated with the channel power failure. In addition, all trips that were blocked prior to loss would be unblocked and initiated. 7.4.3.2 Reliability and Redundancy The requirements established for the reactor protection system apply to the nuclear instrumentation. All channel functions are independent of every other channel. 7.4.3.3 Safety Factors The relation of the power range channels to the reactor protection system has been described in Section 7.2. To maintain the desired accuracy in trip action, the total error from drift in the power range channels will be held to .:!:.1-percent at full power. Routine tests and recalibration will ensure that this degree of deviation is not exceeded. Bistable trip setpoints of the power range channels will also be held to an accuracy of +/-.1-percent of full power. The accuracy and stability of the equipment have been verified by vendor tests. 7.4.3.4 Overpower Trip Setpoint The overpower trip setpoint for the Indian Point Unit 2 reactor is ::; 107.4-percent of rated thermal power. This trip point was selected to provide adequate assurance that spurious reactor trips will not occur in normal operation. Figure No. Figure 7.4-1 Figure 7.4-2 Figure 7.4-3 Title TABLE 7.4-1 DELETED TABLE 7.4-2 DELETED 7.4 FIGURES Neutron Detectors And Range Of Operation Nuclear Instrumentation System Plan View Indicating Detector Location Relative To Core 7.5 PROCESS INSTRUMENTATION 7.5.1 Design Bases The nonnuclear process instrumentation measures temperatures, pressures, flows, and levels in the reactor coolant system, steam system, reactor containment, and auxiliary systems. Process variables required on a continuous basis for the startup, operation, and shutdown of Chapter 7, Page 86 of 109 Revision 20, 2006 OAG10000215_0998 IP2 FSAR UPDATE the unit are indicated and controlled from the control room. Essential parameters are also recorded. The quantity and types of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operating range of the plant. Certain controls that require a minimum of operator attention, or are only in use intermittently, are located on local control panels near the equipment to be controlled. The monitoring of the alarms of such control systems are provided in the control room. Table 7.5-1 includes a list of important process instrumentation, indication, and safeguards functions. 7.5.2 System Design Much of the process instrumentation provided in the plant has been described in the reactor control and protection and nuclear instrumentation system. The most important instrumentation used to monitor and control the plant has been described in the above systems descriptions. The remaining portion of the process instrumentation is generally shown on the respective systems process flow diagrams. Condensate pots and wet legs are used to prevent process temperatures from actually reaching the transmitters. 7.5.2.1 Engineered Safety Features The following instrumentation ensures coverage of the effective operation of the engineered safety features. Compliance with the requirements of Regulatory Guide 1.97 is referenced in Section 7.1.5. 7.5.2.1.1 Containment Pressure The containment pressure is transmitted to the main control board for postaccident monitoring. Six (-5 to +75 psig) transmitters are installed outside the containment for protection against potential missile damage. The pressure is indicated (all six channels) on the main control board. The six channels monitoring containment pressure initiate containment spray, phase B containment isolation, containment ventilation isolation, and steam line isolation, as well as reflecting the effectiveness of engineered safety features. As part of the TMI Action Plan modifications for Indian Point Unit 2, (NUREG-0737), a continuous indication of containment pressure is provided in the central control room by two recorder indicator units covering a range of -10 to 150 psig. 7.5.2.1.2 Containment Water Level Redundant containment water level indicators, one in each sump (LT-939 in the recirculation sump and L T-941 in the containment sump) are relied upon to show that water has been delivered to the containment following a loss-of-coolant accident, and subsequently show that sufficient water has been collected by the sump to permit recirculation to the reactor and/or to the spray headers and to show that water is below the flood level to protect electrical equipment from submergence. These transmitters are mounted inside the containment and have been environmentally qualified. The level indications in the central control room are as follows: Chapter 7, Page 87 of 109 Revision 20, 2006 OAG10000215_0999 IP2 FSAR UPDATE For the containment sump: two "thermal type" detectors (L T-940 and L T-941) provide a seriel)()f five lights each energized from level is exceeded; q@@ differential pressure "bubbler type" tr$lQ§mitt@r(tJiH$$Q4)prqYi9@§ a series of five lights each energized from the associated instrument as a preset level is exceeded; and one differential pressure transmitter (L T-3300) provides a calibrated sump level span that is continuously indicated. An audible alarm is also provided for increasing sump level (see Section 6.7.1.2.13). For the recirculation sump: two magnetic switch/float type detectors (L T-938 and L T-939) provide a series of five lights each energized from the associated instrument as a preset level is exceeded; and one differential pressure transmitter (L T-3301) provides a calibrated sump level span that is continuously indicated (see Section 6.7.1.2.14). Refer to Section 6.2 for further description of the two sumps serving the internal and external recirculation loops. In addition, a differential-pressure-Ievel transmitter has been installed in the reactor cavity pit (see Section 6.7.1.2.15). 7.5.2.1.3 Containment Hydrogen Concentration As part of the TMI Action Plan modifications for Indian Point Unit 2, (NUREG-0737), a continuous indication of hydrogen concentration in the containment atmosphere is provided in the central control room. The containment hydrogen/oxygen monitor system is described in Section 6.8.2.3. 7.5.2.1.4 Refueling Water Storage Tank Level Refueling water storage tank level measurement is provided by: 1. A local level indicator at the tank, and 2. Two separate, redundant transmitting channels, which provide level indication and level alarms in the central control room for the initiation of the changeover to the postaccident recirculation phase. In the case of a large-break loss-of-coolant accident (LBLOCA) and full operation of all safeguards and spray pumps, the RWST level alarms will annunciate after approximately 20 minutes. At this time, the operator is required to proceed with the changeover sequence. The tank level indicator is available for confirmation. Information on the level of water in both the recirculation and containment sumps is also available to the operator during this period via the sump level instrumentation. In view of the information provided to the operator, together with the procedure, which he is required to follow, no single instrument failure would cause him to follow a course of action that could in any way jeopardize core cooling. The water in the storage tank is protected from freezing by a thermostat that turns the heating medium on and off. Instrument lines are freeze protected. 7.5.2.1.5 Condensate Water Storage Tank Level An additional channel has been added to the original water level indication channel. The added level channel includes an alarm switch to actuate the low-level alarm in the central control room. In addition, there is a low-temperature alarm to indicate heat tracing failure or a low instrument ambient temperature. The instrument lines are freeze protected. Chapter 7, Page 88 of 109 Revision 20, 2006 OAG10000215_1000 7.5.2.1.6 IP2 FSAR UPDATE Safety Injection Pumps Discharge Pressure These channels show that the safety injection pumps are operating. The transmitters are outside the containment. 7.5.2.1.7 Accumulator Level Each of the safety injection system accumulator tanks contains two differential-pressure-type liquid level transmitters providing the electrical signal for separate channel level indicators and high-and low-level alarms in the central control room. 7.5.2.1.8 Pump Energization All pump motor power feed breakers indicate that they have closed by energizing indicating lights on the control board. 7.5.2.1.9 Valve Position All engineered safety features valves have position indication on the control board to show proper positioning of the valves. Air-operated and solenoid-operated valves are selected so as to move in a preferred direction on the loss of air or power. Motor-operated valves remain in the position at time of loss of power to the motor. Acoustic sensors installed on the code safety valves discharge lines provide indication in the central control room of the "flow" or "nonflow" condition of line safety valves. The power-operated relief valves have a direct valve position indication in the central control room. The acoustic monitoring system was installed to comply with the requirements of NUREG-0578. 7.5.2.1.10 Residual Heat Exchangers Combined exit flow is indicated and combined inlet and combined exit temperatures are recorded on the control board to monitor the operation of the residual heat exchangers. A high pressure is annunciated on the auxiliary coolant system panel in the central control room. 7.5.2.1.11 Fan Coolers The service water discharge flow is indicated in the control room. The flow transmitters are located inside the containment. The temperature of each of the five fan coolers' service water is indicated locally. A control room alarm is actuated if the flow is low during safety injection. In addition, the exit flow is monitored for radiation and alarmed in the control room if high radiation should occur. There are redundant radiation monitors, and the faulty cooler can be identified by manually sampling the flow from each unit in turn and using these monitors. 7.5.2.1.12 Bus Undervoltage The normal 480-V feeds to the safeguard buses are tripped upon sustained undervoltage. An alarm and indicator light are also provided in the control room to alert the operator in advance of attaining the actual undervoltage trip level. Each bus is monitored by two undervoltage relays (set at approximately 88-percent). Two-out-of-two logic will activate an agastat relay (set at approximately 150 sec), which in turn trips its respective 480-V feeder breaker. This trip has Chapter 7, Page 89 of 109 Revision 20, 2006 OAG10000215_1001 IP2 FSAR UPDATE been added to provide additional Class A/Class 1 E protection of the safeguards loads against degraded voltage conditions. Two separate Asea Brown Boveri (ABB) type 27N high accuracy relays are used for each bus. A separate category alarm and lights on a panel in the central control room alert the operator when any 480-V bus voltage falls to approximately 94-percent. These may actuate during load-sequencing operations, but they are primarily intended to alert the operator to sustained degraded voltages that result from problems on the offsite power system. A separate Westinghouse type CP relay is used for each bus. These alarm circuits and relays are subject to an actuation operability test each 31 days and a channel calibration each 24 months. In the unlikely event of a sustained degraded voltage coincident with a safety injection signal for approximately 10 +/-2 sec, the 480-V feed breaker to the safeguards bus will trip. 7.5.2.1.12.1 Station Auxiliary Transformer Load Tap Changer SI Signal The Load Tap Changer (LTC) is used to maintain the nominal voltage level on the Station Auxiliary Transformer's (SAT's) 6.9 KV buses by automatically raising or lowering the SAT secondary winding taps in response to voltage variations on the 6.9 KV buses. During a SI event the SI signal will raise the LTC tap position increasing the voltage towards a pre-selected voltage in anticipation of the increased loads from the fast transfer of the loads held by the four 6.9 KV in-house buses to the SAT, thus reducing the severity of a degraded voltage condition on the 480V and 6.9KV buses. 7.5.2.1.13 Reactor Coolant Pump Seal Injection The seal injection flow rate to each reactor coolant pump is indicated locally by a i1P gauge. A flow transmitter in parallel with each of the i1P gauges provides remote flow indication in the central control room. The system does not provide an alarm or initiate any safety action. 7.5.2.1.14 Reactor Vessel Level A reactor vessel level indication system has been installed to assist the operator in determining the presence of voids in the reactor vessel. The reactor vessel level indication system, which is mainly part of the inadequate core cooling instrumentation (Section 4.2.11), indicates the water level from the bottom to the top of the reactor vessel and under different coolant flow conditions with and without reactor coolant pumps operating. The system is described in Section 4.2.11. 7.5.2.1.15 Subcooling Margin Monitoring System The subcooling margin monitoring system has been installed in accordance with the requirements of NUREG-0578 and NUREG-0737. The system provides indication for aiding the operator in diagnosing early symptoms of inadequate core cooling during transients and accidents and determining whether or not safety injection can be terminated. The system has two independent, redundant channels, each providing indication in the control room. The inputs of one subcooling margin monitoring channel (reactor coolant system pressure, hot-leg temperature, cold-leg temperature) are provided by a wide-range reactor coolant system pressure transmitter in reactor coolant loop 21, and the reactor coolant system cold-and hot-leg resistance temperature detectors in loops 21 and 23. The redundant channel receives pressure input from a transmitter in loop 24, and temperature input from detectors in loops 22 and 24. Chapter 7, Page 90 of 109 Revision 20, 2006 OAG10000215_1002 IP2 FSAR UPDATE The system is energized from Class 1 E power supplies. The subcooling margin monitors are located in the central control room along with its associated signal conditioning equipment. 7.5.2.1.16 Reactor Coolant System Pressure RCS pressure is monitored on three of the four primary loops. Signals from PT 402 and PT 403 on loops 21 and 24 provide wide range pressure indication in the Central Control Room and independent, redundant interlock signals to the RHR isolation valves (730 and 731) to prevent opening them at high RCS pressures. RCS pressure for PT 402 and PT 403 is transmitted through a filled capillary system to transmitters located outside containment in the Pipe Penetration Area. The sensing lines are connected to the pressure sensor bellows to capillary lines extending through the penetrations, to hydraulic isolators, which are located outside of containment. The capillary lines are routed through separate penetrations as shown on Figure 7.5-1. Signals from PT 413, PT 433 and PT 443 on loops 21, 23 and 24 provide input to the Overpressure Protection System (Section 7.3.3.5). 7.5.2.1.17 Pressurizer Relief Tank Temperature Temperature in the pressurizer relief tank may be used as an indication of pressurizer relief valve position, backing up the acoustic monitors. A temperature indicator is provided in the control room. 7.5.2.1.18 Alarms Visual and/or audible alarms are provided to call attention to abnormal conditions. The audible alarms are of the individual acknowledgment type; that is, the operator must recognize and silence the audible alarm for each alarm point. For most control systems, the sensing device and circuits for the alarms are independent, or isolated from, the control devices. In addition to the above, the following local instrumentation is available:
- 1. Containment spray test lines total flow. 2. Safety injection test line pressure and flow. 7.5.3 System Evaluation Redundant instrumentation has been provided for all inputs to the protection systems and vital control circuits.
Where wide process variable ranges and precise control are required, both wide-range and narrow-range instrumentation are provided. Instrumentation components are selected from standard commercially available products. Chapter 7, Page 91 of 109 Revision 20, 2006 OAG10000215_1003 IP2 FSAR UPDATE All electrical and electronic instrumentation required for safe and reliable operation is supplied from four redundant instrumentation buses. Chapter 7, Page 92 of 109 Revision 20, 2006 OAG10000215_1004 o >> G) o o o o N --" 1(J1 --" o o (J1 IP2 FSAR UPDATE TABLE 7.5-1 Process Instrumentation, Indication, and Safeguards Functions Transmitters/ Parameter Sensors Reactor coolant 8 RTDs temperature Pressurizer pressure 4 transmitters Pressurizer level 3 i1P transmitters Steam flow 8 i1P transmitters Feedwater flow 8 i1P transmitters Steam pressure 12 transmitters Steam generator level 12 i1P transmitters Reactor coolant flow 12 i1P transmitters Containment pressure 6 transmitters Steam Header pressure 2 transmitters Notes: 1. CB is control board. 2. Ext. is external. Prot/Safeguards Read-Out1 Power? Use CB meter Ext. i1T trips Tavg permissives CB meter Ext. Hi/low pressure trips, SIS CB meter Ext. Hi Level trip CB meter Ext. Mismatch trip, SIS CB meter Ext. Mismatch trip CB meter Ext. SIS CB meter Ext. Mismatch trip Low level trip CB meter Ext. Low flow trip 1 each 3 (top level), one shared, 3 pairs 3 (top level), one shared, 3 pairs 1 pair each 1 pair each 1 each 1 pair each 1 high pressure each, 1 low pressure shared/loop CB meter Ext. SIS (2/3), Spray (2/3+2/3) 3 shared Blind Ext. Setpoint programs and 1 each turbine power permissives Chapter 7, Page 93 of 109 Revision 20, 2006 Figure No. Figure 7.5-1 Title IP2 FSAR UPDATE 7.5 FIGURES Reactor Coolant Wide Range Pressure Instrument System -Flow Diagram 7.6 INCORE INSTRUMENTATION 7.6.1 Design Basis The incore instrumentation is designed to yield information on the neutron flux distribution and fuel assembly outlet temperatures at selected core locations. Using the information obtained from the incore instrumentation system, it is possible to confirm the reactor core design parameters and calculated hot-channel factors. The system provides means for acquiring data and performs no operational plant control. The incore thermocouples are also designed to provide information for diagnosing the onset of inadequate core cooling and for mitigating its effects. 7.6.2 System Design The incore instrumentation system consists of thermocouples, positioned to measure fuel assembly coolant outlet temperature at preselected locations, and flux thimbles, which run the length of selected fuel assemblies to measure the neutron flux distribution within the reactor core. The experimental data obtained from the incore temperature and flux distribution instrumentation system, in conjunction with previously determined analytical information, can be used to determine the fission power distribution in the core at any time throughout core life. This method is more accurate than using calculational techniques alone. Once the fission power distribution has been established, the maximum power output is primarily determined by thermal power distribution and the thermal and hydraulic limitations determine the maximum core capability. The incore instrumentation provides information that may be used to calculate the coolant enthalpy distribution, the fuel burnup distribution, and an estimate of the coolant flow distribution. Both radial and azimuthal symmetry of power may be evaluated by combining the detector and thermocouple information from the one quadrant with similar data obtained from the other three quadrants. 7.6.2.1 Thermocouples Chromel-alumel thermocouples are threaded into guide tubes that penetrate the reactor vessel head through seal assemblies and terminate at the exit flow end of the fuel assemblies. The thermocouples are provided with two primary seals, a conseal and swage-type seal from conduit to head. The thermocouples are enclosed in stainless steel sheaths within the above tubes to allow replacement if necessary. Thermocouple readings are recorded in the control room. The support of the thermocouple guide tubes in the upper core support assembly is described in Chapter 3. A total of 65 thermocouples are installed at preselected core locations to provide core exit temperature data up to 2300° F. There are two microprocessors, one to process data for 34 thermocouples and the other for the remaining
- 31. Two display units are provided on the central control room accident assessment panels. Each presents a graphic core location map with an Chapter 7, Page 94 of 109 Revision 20, 2006 OAG10000215_1006 IP2 FSAR UPDATE alphanumeric display of core exit temperatures.
Temperature signals from the microprocessors are sent to the plant computer. Microprocessors, display units and cables are separated into two redundant channels. Thermocouples, cables, microprocessors and display units are seismically designed. Cables and components inside the containment and in the electrical penetration area are environmentally qualified. The two channels receive power from redundant instrument busses. 7.6.2.2 Movable Miniature Neutron Flux Detectors Six fission chamber detectors (employing U 3 0 8 , which is gO-percent enriched in U-235) can be remotely positioned in retractable guide thimbles to provide flux mapping of the core. Maximum chamber dimensions are 0.188-in. in diameter and 2.10-in. in length. The stainless steel detector shell is welded to the leading end of the helical-wrap drive cable and the stainless steel sheathed coaxial cable. Each detector is designed to have a minimum thermal neutron sensitivity of 1.5 x 10-17 A/nv and a maximum gamma sensitivity of 3 x 10-14 A/rad-hr. Operating thermal neutron flux range for these probes is 1 x 10 11 to 5 X 10 13 nv. Other miniature detectors, such as gamma ionization chambers and boron-lined neutron detectors, can also be used in the system. The basic system for the insertion of these detectors is shown in Figures 7.6-1 through 7.6-3. Retractable thimbles into which the miniature detectors are driven are pushed into the reactor core through conduits that extend from the bottom of the reactor vessel down through the concrete shield area and then up to a thimble seal zone. The thimbles are closed at the leading ends, are dry inside, and serve as the pressure barrier between the reactor water pressure and the atmosphere. Mechanical seals between the retractable thimbles and the conduits are provided at the seal line. The thimbles are seismic Class I, and the supports for the flux mapping frame support assembly are seismically designed. During reactor operation, the retractable thimbles are stationary. They are extracted downward from the core during refueling to avoid interference within the core. A space above the seal line is provided for the retraction operation. The drive system for the insertion of the miniature detectors consists basically of six drive assemblies, six path group selector assemblies and six rotary selector assemblies, as shown in Figures 7.6-1 and 7.6-2. The drive system pushes hollow helical-wrap drive cables into the core with the miniature detectors attached to the leading ends of the cables and small-diameter sheathed coaxial cables threaded through the hollow centers back to the ends of the drive cables. Each drive assembly generally consists of a gear motor that pushes a helical-wrap drive cable and detector through a selective thimble path by means of a special drive box and includes a storage device that accommodates the total drive length. Further information on mechanical design and support is described in Chapter 3. The control and readout system for the movable miniature neutron flux detectors provides means for inserting the miniature neutron detectors into the reactor core and withdrawing the detectors at a selected speed while plotting a level of induced radioactivity versus detector position. The control system consists of two sections, one physically mounted with the drive units, and the other contained in the control room. Limit switches in each drive conduit provide means for prerecording detector and cable positioning in preparation for a flux mapping operation. One group path selector is provided for each drive unit to route the detector into one of the flux thimble groups. A rotary transfer assembly is a transfer device that is used to route a detector into anyone of up to ten selectable paths. Ten manually operated isolation valves allow free passage of the detector Chapter 7, Page 95 of 109 Revision 20, 2006 OAG10000215_1007 IP2 FSAR UPDATE and drive wire when open, and when closed prevent leakage from the core in case of a thimble rupture. A path common to each group of flux thimbles is provided to permit cross calibration of the detectors. The central control room contains the necessary equipment for control, position indication, and flux recording. Panels are provided to indicate the core position of the detectors and for plotting the flux level versus the detector position. Additional panels are provided for such features as drive motor controls, core path selector switches, plotting, and gain controls. A "flux-mapping" consists, briefly, of selecting (by panel switches) flux thimbles in given fuel assemblies at various core quadrant locations. The detectors are driven or inserted to the top of the core and stopped automatically. An X-Y plot (position vs. flux level) is initiated with the slow withdrawal of the detectors through the core from top to a point below the bottom. In a similar manner other core locations are selected and plotted. Each detector provides axial flux distribution data along the center of a fuel assembly. Various radial positions of detectors are then compared to obtain a flux map for a region of the core. 7.6.3 System Evaluation The thimbles are distributed nearly uniformly over the core with about the same number of thimbles in each quadrant. The number and location of thimbles have been chosen to permit the measurement of local-to-average peaking factors to an accuracy of +/-.10-percent (95-percent confidence). Measured nuclear peaking factors are increased to allow for possible instrument error. The departure from nucleate boiling ratio calculated with the measured hot-channel factor is compared to the departure from nucleate boiling ratio calculated from the design nuclear channel factors. If the measured power peaking is larger than expected, reduced power capability will be indicated. 7.6.4 System Operation A minimum of 2 thimbles per quadrant and sufficient movable in-core detectors shall be operable during re-calibration of the excore axial offset detection system. 7.6 FIGURES Figure 7.6-2 Figure 7.6-3 Details, 7.7 OPERATING CONTROL STATIONS 7.7.1 Station Layout The principal criterion of control station design and layout is that all controls, instrumentation displays, and alarms required for the safe operation and shutdown of the plant are readily available to the operators in the central control room. Chapter 7, Page 96 of 109 Revision 20, 2006 OAG10000215_1008 IP2 FSAR UPDATE During other than normal operating conditions, other operators will be available to assist the control room operator. Plant Drawing 209812 [Formerly UFSAR Figure 1.2-7 Sheet 1], shows the central control room arrangements for the unit. The control board is divided into relative areas to show the location of control components and information display pertaining to various subsystems. Early control room reviews performed in 1980 and 1981 resulted in implementation of several changes including:
- 1. Installation of battery-operated emergency lighting fixtures to provide for continuously available emergency lighting.
- 2. Installation of several new multipoint recorders and relocation of some recorders to be adjacent to the flight panel. 3. Revised flash rate of supervisory annunciators from one to two flashes per second. 4. Relocation of annunciators to provide a more functional grouping and a more systems oriented display. In response to NRC's Generic Letter 82-33 and the requirements of Supplement 1 to NUREG-0737, Requirements for Emergency Response Capability, a detailed control room design review was conducted (Reference 1). The purposes of this review were: to review and evaluate the control room workspace, instrumentation, controls and other equipment from a human factors engineering point of view; to identify human engineering observations and human engineering discrepancies; and to establish a plan for implementing corrective action. The review was conducted by a multi-disciplined team having qualifications consistent with the guidelines of NUREG-0700.
The team conducted the review through the following major activities:
- 1. Operating experience review. 2. Function and task analysis.
- 3. Control room survey. 4. Verification of task performance capabilities.
- 5. Validation of control room as an integrated system. Numerous changes were made in the central control room to implement human engineering enhancements.
Among the changes made were: 1. Improved panel demarcation and annunciator tile/panel device labeling.
- 2. Replacement, relocation and provision of additional indicators for a number of parameters.
- 3. Removal of retired indicators/controls.
Improvements to communications between the control room and other plant areas. The detailed control room design review was reviewed by the NRC as documented in their SER dated January 12, 1989 (Reference
- 3) and found acceptable.
Chapter 7, Page 97 of 109 Revision 20, 2006 OAG10000215_1009 IP2 FSAR UPDATE 7.7.2 Information Display And Recording 7.7.2.1 Operational Information Alarms and annunciators in the central control room provide the operators with warning of abnormal plant conditions that might lead to the damage of components, fuel, or other unsafe conditions. Other displays and recorders are provided for indication of routine plant operating conditions and for the maintenance of records. Consideration is given to the fact that certain systems normally require more attention from the operator. The control system, therefore, is centrally located on the three-section board. On the left section of the control board, individual indicators present a direct, continuous readout of every control rod position. Fault detectors in the rod drive control system are used to alert the operator should an abnormal condition exist for any individual or group of control rods. Displayed in this same area are limit lights for each control rod group and all nuclear instrumentation information required to start up and operate the reactor. Control rods are manipulated from the left section. Variables associated with the operation of the secondary side of the station are displayed and controlled from the control board. These variables include steam pressure and temperature, feedwater flow and temperature, electrical load, and other signals involved in the plant control system. The control board also contains provisions for indications and control of the reactor coolant system. Redundant indication is incorporated in the system design since pressure and temperature variables of the reactor coolant system are used to initiate safety features. Control and display equipment for station auxiliary systems are also located here. The engineered safety features systems are controlled and monitored from a vertical panel to the left of the control board. Valve position indicating lights are provided as a means of verifying the proper operation of the control and isolation valves following initiation of the engineered safety features. Control switches located on this panel allow manual operation or test of individual units. Also located on this section are the control switches, indicating lights, and meters for fans and pumps required for emergency conditions. Also mounted on this section are auxiliary electrical system controls required for manual switching between the various power sources described in Section 8.2.2. Controls and indications for Containment Purge and Exhaust, Primary Auxiliary Building and Fuel Service Building ventilation systems are located on CCR panel SL. Controls and indications for the containment isolation valves, and the isolation valve seal-water system are located on a CCR panel SN. Radiation monitoring information is indicated immediately behind and to the left of the main control board. Audible reactor building alarms are initiated from the radiation monitoring system and from the source range nuclear instrumentation. Audible alarms will be sounded in appropriate areas throughout the station if high-radiation conditions are present. As a result of considerations arising from experience at TMI, the instrument panels in the control room were modified to receive monitors and recorders associated with the following:
- 1. Reactor coolant system hot-leg temperature.
- 2. Main steam line radiation monitors.
Chapter 7, Page 98 of 109 Revision 20, 2006 OAG10000215_1010 IP2 FSAR UPDATE 3. High-range containment radiation monitors.
- 4. High-range noble gas monitors.
- 5. Containment sump level indication.
- 6. Hydrogen and oxygen containment air analyzers.
- 7. Containment high-range pressure indication.
- 8. Reactor vent valve position indication.
- 9. Reactor vent temperature monitor. 10. Reactor vessel level indication.
- 11. Power-operated relief valve block valve position indication.
- 12. Subcooling monitor system indications.
- 13. Wide range hot-leg temperature indication A plant process computer system is installed with color graphic displays in the central control room that monitors operating plant data as well as easily accessible sets of key plant safety parameters.
It also provides data links with the technical support center, the emergency operations facility and the Alternate emergency operations facility. It has the capability of long term data storage and retrieval. 7.7.2.2 Safety Parameter Information A system for monitoring safety parameter information is provided in accordance with the requirements of NUREG-0737, Supplement
- 1. It is an operator aid and not a safety-grade system and performs no safety function.
The operation and potential failure of the plant computer system will not degrade the performance of safety systems. The plant computer system consists of a data acquisition system, redundant computer systems with associated peripherals, and color displays. The data acquisition system receives digital and analog signals required to monitor critical safety functions, which are: -Reactivity control -Reactor core cooling -Reactor coolant system heat sink -Reactor coolant system integrity -Containment conditions -Reactor coolant system inventory control Several parameters (measures of plant status or performance) are monitored for each critical safety function, and each parameter is measured by signals input from one or more plant sensors. The data acquisition system samples each input 10 times per second. The redundant computer systems receive, process, analyze, and store the data and provide outputs to the system displays. The computer performs data acquisition and processing, and drives the displays. The backup computer acquires data in parallel with the primary computer and periodically performs data processing and calculation functions for intracomputer verification. The loss of any critical component in the primary system triggers a switchover to the backup system, which then provides all primary system functions. The plant computer display system consists of seven-color graphic displays. The displays are located in the Central Control Room, Technical Support Center, Emergency Operations Facility, and Alternate Emergency Operations Facility. Chapter 7, Page 99 of 109 Revision 20, 2006 OAG10000215_1011 IP2 FSAR UPDATE Types of primary displays available are the plant mode, thirty-minute trend, and critical safety function status tree. Also available are a display of emergency core cooling inventories and a display of availability of emergency core cooling inventories and a display of availability of emergency power. The system, which originally consisted of ten secondary displays, has provision for future expansion as warranted. 7.7.3 Emergency Shutdown Control The central control room, its equipment, and furnishings have been designed so that the likelihood of conditions that could render the control room inaccessible even for a short time is extremely small. A criterion of the station design and layout is that all controls, instrumentation displays, and alarms required for the safe operation and shutdown of the plant are readily available to the operators in the central control room. It is design policy that the functional capacity of the central control room shall be maintained at all times inclusive of accident conditions, such as a maximum credible accident or a design basis event. The following features are incorporated in the design to ensure that this criterion is met: 1. Structural and finish materials for the central control room and the cable-spreading room below were selected on the basis of fire-resistant characteristics. Structural floors are concrete reinforced. Interior partitions are metal paneling joints. The control room ceiling covering is fire-retardant egg crate diffusers. Door frames and doors are metallic.
- 2. The central control room is equipped with portable fire extinguishers.
The extinguishers carry the Underwriters' Laboratory label of approval.
- 3. The cable-spreading room has a smoke detection system and a manually operated Halon system. The smoke detection system actuates an alarm in the control room. The cable tunnel has heat-sensitive devices, which actuate alarms in the control room and a water spray deluge system for fire extinguishing.
- 4. The control room ventilation consists of a system having a large percentage of recirculated air. The fresh air intake can be diverted to charcoal filters to remove airborne activity if monitors indicate that such action is appropriate.
- 5. Control cables used throughout the installation have been selected on the basis of flame testing described in Chapter 8 and have superior flame-retardant capability.
Each conductor has a flame-retardant glass braid over the insulation. In addition, electrical circuits are limited in the control room to those associated with lighting, instrumentation, and control. Lighting circuits operate on 120-V; instrumentation and control circuits operate at either 120-V ac, 125-V DC, or at millivolt level. All 120-V and 125-V circuits are protected against both overload and short circuits by either fuses or circuit breakers. The power levels on the millivolt circuits are so low that the probability of fire hazard due to short circuits is very low. 6. All control and indication is transmitted into the control room ensuring that no combustible process fluids are carried into the room. Chapter 7, Page 100 of 109 Revision 20, 2006 OAG10000215_1012 IP2 FSAR UPDATE 7. Cables that penetrate the control room floor pass through firestops to minimize fume and flame transmission from possible fire sources external to the control room. 8. All internal wiring in switchboards and instrument racks is type SIS cross-linked polyethylene, which has excellent resistance to the propagation of flame. As a result of the design criterion discussed above, the amount of combustible material in the control room is of such small quantity that a fire of the magnitude that would require the evacuation of the control room is not credible. As a further measure to ensure safety, provisions have been made so that plant operators can shut down and maintain the plant in a safe condition by means of controls located outside the control room. During such a period of control room inaccessibility, the reactor will be tripped and the plant maintained in a hot shutdown condition. If the period extends for a long time, the reactor coolant system can be borated to maintain shutdown as xenon decays. In the unlikely event that the control room becomes inaccessible or the controls and/or instrumentation becomes nonfunctional due to a fire, the plant is equipped with an alternate safe shutdown system (ASSS) as discussed in Section 8.3, which provides the capability to safely shutdown and maintain the plant in a safe shutdown condition. Abnormal operating procedures are in effect, to be used in their entirety or in part, to safely shutdown the plant in the event of inaccessibility of the control room. These procedures would be implemented based upon loss of normal and preferred alternate methods of control. These procedures do not include all the available normal methods of control described below. The functions for which local control provisions have been made are listed below along with a brief description of the type of alternate controls and their location in the plant. Transfer to these local controls is annunciated in the central control room. 7.7.3.1 Reactor Trip If the central control room should be evacuated suddenly without any action by the operators, the reactor can be manually tripped by any of the following:
- 1. Operation of the Reactor Trip Breakers' local trip button. 2. Tripping the Control Rod Drive MG Set breakers.
- 3. Tripping/opening of anyone of the MG Set power supply sources. Following evacuation of the central control room, the following systems and equipment are provided to maintain the plant in a safe shutdown condition from outside the central control room: 1. Residual heat removal. 2. Reactivity control, i.e., boron injection to compensate for fission product decay. 3. Pressurizer pressure and level control. 4. Electrical systems as required to supply the above systems. 5. Other equipment, as described.
Chapter 7, Page 101 of 109 Revision 20, 2006 OAG10000215_1013 7.7.3.1.1 Residual Heat Removal IP2 FSAR UPDATE Following a normal plant shutdown, an automatic steam dump control system bypasses steam to the condenser and maintains the reactor coolant temperature at its no-load value. This implies the continued operation of the steam dump system, condensate circuit, condenser cooling water, feed pumps, and steam-generator instrumentation. Failure to maintain water supply to the steam generators would result in steam-generator dry-out after some 2400 sec and loss of the secondary system for decay heat removal. Redundancy and full protection where necessary is built into the system to ensure the continued operation of the steam-generator units. If the automatic steam dump control system is not available, independently controlled relief valves on each steam generator maintain the steam pressure. These relief valves are further backed up by coded safety valves on each steam generator. Numerous calculations have shown that with the steam generator safety valves operating alone, the reactor coolant system maintains itself close to the nominal no-load condition. The steam relief facility is adequately protected by redundancy and local protection. For decay heat removal, it is only necessary to maintain the control on one steam generator. For the continued use of the steam generators for decay heat removal, it is necessary to provide a source of water, a means of delivering that water and, finally, instrumentation for pressure and level indication. The normal source of water supply is the secondary feed circuit; this implies satisfactory operation of the condenser, air ejector, condenser cooling circuit, etc. In addition to the normal feed circuit, the plant may fall back on: 1. The condensate storage tank. 2. The city water storage tank. 3. The city water supply. Feedwater can be supplied to the steam generators by the two motor-driven auxiliary feedwater pumps or by the steam-driven auxiliary feedwater pump, these pumps and associated valves having local controls. 7.7.3.1.2 Reactivity Control Following a normal plant shutdown to hot shutdown condition, soluble poison is added to the primary system to maintain subcriticality. For boron addition, the chemical and volume control system is used. Routine boration requires the use of the following:
- 1. Charging pumps and volume control tank with associated piping. 2. Boric acid transfer pumps with tanks and associated piping. (Not included in abnormal operating instructions on control room inaccessibility).
- 3. Letdown station, nonregenerative heat exchanger and associated equipment, component cooling, and service water systems. Compressed air for manual valve operation could be adopted if necessary.
It is worthy of note that with the reactor held at hot shutdown conditions, the boration of the plant is not required immediately after shutdown. The xenon transient does not decay to the equilibrium level until about 20 hr for 100-percent power shutdown. However, for other power levels, this Chapter 7, Page 102 of 109 Revision 20, 2006 OAG10000215_1014 IP2 FSAR UPDATE decay time can be lower, that is, as much as 5 hr for a 10-percent power shutdown. A further period would elapse before the 1-percent reactivity shutdown margin provided by the full-length control rods has been cancelled. This delay would provide useful time for emergency measures. 7.7.3.1.3 Pressurizer Pressure and Level Control Following a reactor trip, the primary temperature will automatically be reduced to the no-load temperature condition as dictated by the steam-generator temperature conditions. This reduction in the primary water temperature reduces the primary water volume, and if continued pressure control is to be maintained, primary water makeup is required. The pressurizer level is controlled in normal circumstances by the chemical and volume control system. This implies the charging pump duty referred to for boration plus a guaranteed borated water supply. The facility for boration is provided as described above; it is only necessary to supply water for makeup. Water may readily be obtained from normal sources, that is, the volume control tank. 7.7.3.2 Startup of Other Equipment The containment air recirculation fan coolers should be continued in operation to remove heat generated within the containment building. If they have stopped, at least one should be restarted within 5 min with the others started later as required. Similarly the nuclear service water pumps are to be checked and at least one of them restarted if none are already operating. The fan coolers and the service water pump remote controls are located in the switchgear room. Offsite or onsite emergency power should be available to supply the above systems and equipment for the hot shutdown condition. 7.7.3.3 Indications and Controls Provided Outside the Central Control Room The specific indications and controls provided outside the central control room for the above capabilities are summarized in the following sections. 7.7.3.3.1
- 1. 2. 3. 4. Indications Level indication for the individual steam generators.
One set for local control of steam generator level is visible from the auxiliary feedwater pump area; another set is visible from the main feedwater control valve area. Pressure indication for the individual steam generators, visible from the auxiliary feedwater pump area. Pressurizer level and pressure indicators. One set is visible from the auxiliary feedwater pump area, and one set is in the primary auxiliary building in the vicinity of the charging pump local control point. All instruments at the auxiliary feedwater pumps are grouped on a local gauge board. Level indicators for steam generators 21 and 22 are located in the primary auxiliary building in the vicinity of the charging pumps. Chapter 7, Page 103 of 109 Revision 20, 2006 OAG10000215_1015 7.7.3.3.2 Controls IP2 FSAR UPDATE Local stop/start motor controls with a local/remote selector switch are provided at each of the following motors. The selector switch will transfer the control of the switchgear from the central control room to "local" at the motor. Placing the local selector switch in the local operating position will give an annunciator alarm in the central control room and will turn out the motor control position lights on the central control room panel. 1. Auxiliary motor-driven feedwater pumps. 2. Charging pumps. 3. Boric acid transfer pumps. (Not included in administrative operating instructions on control room inaccessibility). Local stop/start motor controls with a local/remote selector switch are provided for each of the following motors. These controls are grouped at one point in the switchgear room convenient for operation. The selector switch will transfer the control of the switchgear from the central control room to this local point. Placing the selector switch to local operation will give an annunciator alarm in the central control room and will turn out the motor control position lights on the central control room panel. 1. Service water pumps. 2. Containment air recirculation fans. 3. Central control room air-handling unit, including control for the air inlet dampers. Alternative motor control points are not required for the following:
- 1. 2. 7.7.3.3.3 Component cooling water pumps. (Automatically restarted on a blackout once the diesel generators are operating.)
Instrument air compressors and cooling pumps. (These will start automatically on low pressures in the air and water services once the diesel automatically energizes the bus and the motor control centers are manually energized. The control point is local to the compressors. The compressors must be initially re-energized after the motor control centers are reset.) Speed Control Speed control is provided locally for the following:
- 1. 2. 7.7.3.3.4 Auxiliary turbine-driven feedwater pump. Charging pumps. Valve Control Local valve control is provided at the following:
- 1. Main feedwater regulators.
- 2. Auxiliary feedwater control valves.(These valves are located local to the auxiliary feedwater pumps.) 3. Atmospheric dump (auto control normally at hot shutdown).
- 4. All other valves requiring operation during hot standby can be locally operated at the valve. Chapter 7, Page 104 of 109 Revision 20, 2006 OAG10000215_1016
- 5. 7.7.3.3.5 IP2 FSAR UPDATE Letdown orifice isolation valves local to the charging pumps. Local control (e.g., "close-remote-open" selector switches) and indication (e.g., valve "open" position indicating lights) are provided for the regenerative heat exchanger letdown outlet flow control orifice isolation valves and the letdown inlet stop valve. Pressurizer Heater Control Stop and start buttons with selector switch and position lamp are provided locally at the charging pumps for Pressurizer Backup Heater Group 21. 7.7.3.3.6 Lighting Emergency lighting is provided in all operating areas. In addition, fixed battery pack emergency lighting units with at least an 8-hr battery power supply have been installed in areas needed for operation of safe-shutdown equipment and in access and egress routes to and from these areas in accordance with the requirements of 10 CFR 50, Appendix R. 7.7.3.3.7 Central Control Room Emergency Lighting The emergency lighting in the central control room (CCR) consists of a combination of AC and DC lighting.
These lights are strategically located to illuminate the instrument panels, flight panel, supervisory control panels, and the operator's desk. The normal voltage supply for CCR lighting is the AC lighting panels. The CCR emergency lighting is normally deenergized. If the CCR normal AC lighting failed, the CCR emergency AC or emergency DC lighting would illuminate. The CCR DC emergency lighting is supplied from Unit 2 Battery #21, whereas, the CCR AC emergency lighting is supplied from the Unit 1 M-G Sets. In addition, dual-lamp battery pack emergency lighting fixtures and remote-mounted battery pack emergency lighting fixture spotlights are located in the CCR, to provide additional illumination for the supervisory panel, flight panel, and accident assessment panel. 7.7.4 Communications Plant communications are conducted via telephone, radio, and Public Address (paging) systems. The plant telephone and radio communications systems include two (2) PBX electronic switches, backup phone lines and a UHF radio system. A third PBX electronic switch is located at the Buchanan Service Center (EOF). The public address system for Indian Point Unit 2 consists of "Page" and "Party" communications, which are common to both the primary (nuclear) and secondary (conventional) portions of Units 1 and 2. The "Page" and "Party" communications are also monitored at a speaker panel located in the CCR. Two radio channels are available at the Indian Point Unit 2 control room. These radio channels are as follows: 1. Central radio channel -Provides the central control room with radio communication to the Con Edison system operator.
- 2. Indian Point area radio -Provides the central control room with radio communication to the emergency operation facilities, offsite monitoring teams, and the site security forces. Chapter 7, Page 105 of 109 Revision 20, 2006 OAG10000215_1017 IP2 FSAR UPDATE If the control room were to become inaccessible, safe shutdown communications would be conducted with the use of portable radios. This in-house radio system is also provided for communicating with in-plant personnel throughout the plant. 7.7.4.1 Central Control Room Communication Facilities The central control room is provided with telephone-radio-page/party communication consoles and page/party handset stations.
The consoles have automatic pushbutton dialers which are capable of storing telephone numbers and which will automatically dial a selected number at the touch of a button. Dedicated point private lines, PBX extensions, direct outside auxiliary lines, and hotlines are assigned to these pushbuttons. A State/County Radiological Emergency Communication System (RECS) hotline is available. The NRC Emergency Notification System (ENS) hotline is available in a separate location. A separate printer and its telephone modem is also available for meteorological data reception. 7.7.4.2 Radio Communication The two radio channels are available at the radio/page/party line consoles in the central control room. The station-type transceivers for the radio channels are located in the elevator machine room of Indian Point Unit 1. Wired audio/control pairs connect the station-type transceivers with the communication consoles in the central control room for remote operation. 7.7.4.3 Page/Party Line Communication "Page" or "Party" line communication can be initiated in the CCR from either communication consoles or from handset stations. An emergency alarm switch is provided in the CCR to connect and actuate the existing alarm oscillators to the "Page" system for the "Evacuation," "Fire," or "Air Raid" alert signals. Another switch is provided on the central control room desk, which allows all outdoor speakers of the Indian Point 2 plant to be turned off at night. 7.7.4.4 Emergency Backup Power for Communications The plant radio and telephone communications systems are automatically supplied from a back-up power source, upon failure of the normal power source. In addition, each PBX is provided with two (2) battery chargers (rectifiers) and a back-up battery capable of eight (8) hours of operation. The page/party system is powered from the DC system (through an inverter) with backup power from the emergency bus. 7.7.4.Sln-house Radio System An in-house radio system provides communications between the Technical Support Center, the I&C office, and in-plant personnel. Field units are low-wattage, hand-held units, which are not to Chapter 7, Page 106 of 109 Revision 20, 2006 OAG1000021S_1018 IP2 FSAR UPDATE be used in areas containing equipment, which is potentially sensitive to radio-frequency interference. REFERENCES FOR SECTION 7.7 1. Letter from J.D. O'Toole, Con Edison, to Hugh L. Thompson, NRC,
Subject:
Indian Point Unit 2 Detailed Control Room Design Review Final Summary Report, dated June 30, 1986. 2. Letter from S. Bram, Con Edison, to Document Control Desk, NRC,
Subject:
Safety Assessment System/Safety Parameter Display System (SAS/SPDS) Safety Analysis Report, Revision 1, dated April 30, 1988. 3. Letter from M. M. Siosson, NRC, to S. B. Bram, Con Edison,
Subject:
Safety Evaluation Report -Detailed Control Room Design Review Summary Report For Indian Point Nuclear Generating Unit No.2 (TAC 56131), dated January 12, 1989. 7.7 FIGURES I Figure No. I Title 7.8 LIMITING SAFETY SYSTEM SETTINGS AND LIMITING CONDITIONS FOR OPERATION Table 7.2-1 lists the reactor protection, engineered safety features, and other plant protection actuation systems. Table 7.2-2 lists associated plant interlocks and permissive circuits. Settings for these functions for safe plant operation are given in the facility Technical Specifications or Technical Requirements Manual. 7.9 SURVEILLANCE REQUIREMENTS Channel surveillance action (i.e., test, calibration, or check function) to be taken during the operation of the plant and the minimum frequencies (each refueling, shift, or month) for the indicated instrument channels are included in the Technical Specifications or Technical Requirements Manual. The instrumentation channels that are covered include, for example, nuclear, reactor coolant temperature and flow, pressurizer pressure and level, and auxiliary process channels or components necessary to ensure that facility operation is maintained within the safe limits. The frequencies of periodic tests and checks of related systems and/or system components are also included in the Technical Specifications or Technical Requirements Manual. 7.10 ANTICIPATED TRANSIENT WITHOUT SCRAM MITIGATION SYSTEM ACTUATION CIRCUITRY In response to NRC requirements, Indian Point Unit 2 has been modified to incorporate features to protect against anticipated transients without scram (A TWS). These provisions are the ATWS mitigation system actuation circuitry (AMSAC), described in this section. Chapter 7, Page 107 of 109 Revision 20, 2006 OAG10000215_1019 7.10.1 Design Bases IP2 FSAR UPDATE The Indian Point Unit 2 AMSAC provides a means, diverse from the reactor protection system, to trip the turbine, start the auxiliary feedwater pumps, and initiate closure of the steam generator blowdown isolation valves. It was designed to meet the requirements of 10CFR50.62. The NRC Staff has concluded 1 that the design is acceptable and is in compliance with the A TWS Rule, 10CFR50.62, paragraph (c) (1). The Indian Point Unit 2 AMSAC design is based on a modified Logic 1 option as described in Reference
- 2. The plant specific modification involves the deletion of permissive and time delay circuits, which is conservative compared to the generic design. AMSAC utilizes signals from existing steam generator narrow-range level transmitters associated with other systems. It actuates immediately on a predetermined level in any three steam generators.
The logic power supplies for the AMSAC system components are independent from the power supplies for the reactor protection system. AMSAC is capable of performing its intended function without off-site power. Alarm and/or annunciation is provided for AMSAC actuation, bypass or removal from service, and deviations such as loss of power or partial trip. 7.10.2 System Design AMSAC receives signals from one steam generator narrow-range level transmitter per steam generator. Bistables give trip signals on level below the setpoint, which is between 5 and 8-percent of the transmitter span. Either of two relay logic channels provides AMSAC actuation on low level in any three steam generators. AMSAC was designed and components selected to provide diversity from the reactor protection system. Electrical isolation from both protection and control systems is also provided. Power is supplied to the relay logic channels, which are energized to trip, from separate class 1 E 125-VDC battery-backed distribution panels. A two-position bypass switch, four test pushbuttons, and a status-indicating light are provided for each logic channel, allowing surveillance testing a maintenance to be performed during reactor operation. Bypassing either channel actuates an annunciator. While one channel is bypassed for testing, the other remains capable of performing its mitigation function. The AMSAC system does not affect either manual or automatic actuation of turbine trip or auxiliary feedwater initiation. These circuits are self-latching such that their actions will go to completion if initiated, and subsequent operator action is required to reset them. REFERENCES FOR SECTION 7.10 1. Letter from Donald S. Brinkman, NRC, to Stephen B. Bram, Con Edison, subject: Indian Point Unit 2 ATWS RULE (10CFR50.62) (TAC NO. 59103), dated May 16, 1989. Chapter 7, Page 108 of 109 Revision 20, 2006 OAG10000215_1020
- 2. WCAP-10858-P-A, Rev. 1 IP2 FSAR UPDATE Chapter 7, Page 109 of 109 Revision 20, 2006 OAG10000215_1021 90 (!) U) 80 a... I w 70 a:: :J 60 (J) (J) w a: 50 a... I-z 40 w ::::E z 30 ..... <;:: I-z 20 0 u 10 *40.6 PSIG BASED ON MAY 21, 1981 NRC STAFF SER AND CONSOLIDATED EDISON RESPONSE OF SEPTEMBER 4, 1981 (REFERENCE
- 11) TO THAT SER. 47 PSIG REMAINS THE CONTAINMENT DESIGN BASIS AND PROVIDES ADDITIONAL MARGIN ENVIRONMENTAL CONDITIONS FOR EQUIPMENT TESTING PRESSURE VS TIME 60 PSIG TEST CO NO[TIO NS /47 PSIG INDIAN ?OiN, 2 CONDITIONS 10 SEC TIME 20 PSIG I I 10,000 I DAY HOUR SEes. 5 PSIG INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.1-1 ENVIRONMENTAL CONDITIONS FOR EQUIPMENT TESTING -PRESSURE vs TIME MIC. No. 1999MC3869 I REV. No. 17 A OAGI0000215_1022 400
- 350 ::J .-<{ 300 -a: w 250-w .-200 .-z 150 z .:.... <{ 100 .-z 8 50 ! *281°F BASED ON THE MAY 21, 1981 NRC STAFF SER AND CONSOLIDATED EDISON RESPONSE OF SEPTEMBER 4, 1981 (REFERENCE
- 11) TO THAT SER (BASED ON 40.6 PSIG AND SATURATED CONDITIONS)
ENVIRONMENTAL CON:JITIONS FOR EQUIPMEN'T TESTING TEMPERATURE VS TIME 286 -F TEST CONDITIONS
- 271"F INJIAN' POINT 2 CONDITIONS 10 SEC TIME I 10.000 I DAY HOUR SECS. INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.1-2 ENVIRONMENTAL CONDITIONS FOR EQUIPMENT-TEMPERATURE vs TIME MIC. No. 1999MC3870 I REV. No. 17 A OAGI0000215 1023 n:: (J) o << n:: w ..:( n:: hJ (J) o o ..:( 10 1 10 5 -C> u w n: .--. o 10 1 (J DY' TIME AFTER RELEASE -HRS. to" <<I YR) INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.1-3 INSTANTANEOUS GAMMA DOSE RATE INSIDE THE CONTAINMENT AS A FUNCTION OF TIME AFTER RELEASE -TID-14844 MODEL MIC. No. 1999MC3871 REV. No. 17 A OAGI0000215_1024 10 9 lJ) 0 4: 0: I hJ lO e -lJ) a 0 4: 4: (!) 0 W t-4: 1:)1 -.J J :=E J U U 4: lOG I I I -I I I T I 10-1 10 0 10 1 10 2 10 3 10" (lOY) (I WK) (IMOI (I YR I TIME AFTER RELEASE -HRS. INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.1-4 INTEGRATED GAMMA DOSE RATE INSIDE THE CONTAINMENT AS A FUNCTION OF TIME AFTER RELEASE -TID-14844 MODEL MIC. No. 1999MC3872 1 REV. No. 17A OAGI0000215_1025 ate L t m i Jv rte p rat u red ta-
/'"""'.. LL Q) Q) 2440 asia 640 3 620 _ psia Q) "-::::l -+-' o Q) CL E 600 Q) I-Q) Q) o "-g; 580 <C Q) "-o o 560 Nominal Full Power Operating Tavg (549°F -572°F, 2250 psia) x 540 -t-'---'---'--r-----..,-;--------,--.l..-----.,..-.l..-----r-----'---i .6 .8 Core Power INDIAN POINT UNIT No. 2 CORE AVERAGE TEMPERATURE vs FRACTION OF NOMINAL POWER UFSAR FIGURE 7.2-19 REV. No. 19 OAGI0000215_1026 PROCESS SENSORS OR ( P!) PENETRATIOM ... ASSEM81..Y CONTAINMENT "II----J Ipo.------# t----*H!p __ \r---'" WALL .... t---A*C POWER PROTECTION PROTECTION PROTECTION PROTECTION AKALOG PROTECTION RACKS RACK ., RACK .2 RACK .3 RACK .-4 eM .1 CM .2 CH .3 CM .4 J I I I _-I--REACTOR TRIP BISTABLES 1----. I I L _______ .., 1 L ________ --, I UV TRJP COlL LOGIC RELAY COILS LOGIC RELAY CONTACTS (MATRIX' I I L.. acnc RACKS-LOGIC CH ** 2 UV TR[P COIL. CONTROL..,..;----f/f ROD POWER SUPPL Y I-r L-_-_ .. TR IP BREAKER .1 ._-HCONTRO RODS TR IP BREAl<ER .z INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.2-23 DESIGN PHILOSOPHY TO ACHIEVE ISOLATION BETWEEN CHANNELS MIC. No. 1999MC390 1 REV. No. 17 A OAGI0000215_1027 JX %1 A'I ST ST-l 'FEACT'OR TIP I BLOCK AUTO SHUNT TRIP r I I l..J '----r-I \. TO ALL REACTOR M-G SETS I "..------1 ) TR I P TRIP AND l' l' BYPASS BREAK:R T 52A ".... ) 52 52 ) TRIP CIRCUITS .... RTB BVB ___ ________ """ Jt-------il RPS LOGIC TRAIN "A" " l' l' I---------------lfl ) 1 .... I AUTO .... .... .... ,L--_--.-__ ----.JI r-----l,SHUNT .... "" 0 L Tp Y I----------Jyw Y TRIP COlL ROD DRIVE POWER BUS INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.2-30 REACTOR TRIP BREAKER ACTUATION SCHEMATIC MIC. No. 1999MC3874 I REV. No. 17 A OAGI0000215_1028 Reactor Cor e Sa e t y Lim i ----ve temperature del ta-T Se poin ---Overpower de t a -T Se poi n t 80 \ \ 1860 psia 2000 psia 2250 psia 2440 psi 70 \ "-\ \ X \ \ ,....-.". ! \ Lt... 60 \ \ 0-. \ \ (l) \ \ -0 \ \ ------\ \ I-Nominal High-Tavg \ \ I 0 Operating Point, \ \ 2250 psia \ \ (l) 50 \ \ -0 \ \ \ \ \ \ \ \ \ \ \ 40 \ \ \ \ \ \ \ \ 30 \, 560 570 580 590 600 610 620 Tavg (deg INDIAN POINT UNIT No. 2 ILLUSTRATION OF OVERPOWER and OVERTEMPERATURE T TRIPS HIGH TEMPERATURE OPERATION UFSAR FIGURE 7.2-33,sht.1 REV. No. 19 OAGI0000215_1029 Reactor Cor e S f e t y Lim it ----Over temperature del ta Set oi n ---Overpower el ta-T Se poin 80 ----l. ---l \ \ ,-----.l... __ \ \ \-\ \ \ \ 70 \ \ \ \ \ \ \ \ \ \ \ \ X \ \ \ \ \ \ .---.. \ \ \ \ \ LL. 60 \ \ \ \ 01 \ , \ Q) \ \ \ \ ---\ \ \ \ I-Nominal Low-Tavg \ \ \ \ I \ \ \ \ 0 Operating Point, \ \ \ \ ::!::: 50 2250 psia \ Q) \ \ \ -0 , \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ 40 \ \ \ \ \ \ \ \ \ <i2 \ 0 o \ "0\ -0 \ \ % \ \ \ \ \ \ \ \ 30 \ 540 560 580 600 620 Tavg (deg INDIAN POINT UNIT No. 2 ILLUSTRATION OF OVERPOWER and OVERTEMPERATURE T TRIPS LOW TEMPERATURE OPERATION UFSAR FIGURE 7.2-33,sht. REV. No. 19 OAGI0000215_1030 NOTES: r. TEMPERATURES ARE MEASURED AT STEAM CJENERATOR'S INLET AND OUTLET. 2. PRESSURE IS MEASURED AT THE PRESSURIZER. J COLD LEG T COLD LEG T COLD LEG T COLD LEG
- THOTILEG iTHOTtLEG
- T HOT , LEG AVERAGE AVERAGE AVERAGE TEMPERATURE TEMPERATURE TEMPERATURE UNIT UNIT . UNIT J THOTtLEG AVERAGE TEMPERATURE UNIT LOOP I LOOP 2 LOOP 3 LOOP .. I AVERAGING foe---P -P UNIT PRESSURE SIGNAL REf' NUCLEAR f'LUX T COMPENSATiON UNIT NUCLEAR ---tDI CO .. PENSATION UNIT Ave f'LUX SIGNAL TO PRlssuRIZER CONTROL GROUP CONTROL LEVEL PR08RAMWER SIGNAL SPEED AND DIRECTION LEAD-LAG L '_EAD-LAO "TL SEQUENTIAL COMPENSATION COMPENSATION r--TEMPERATURE CONTROL UNIT UNIT UNIT CONTROL UNIT (AUTO .. ATIC CONTROLl 1 T IIU RODS IN RODS OUT , {CONTROL (CONTROL T I'U AVERAGE GROUP) GROUP' STEAM DUMP CONTROL ....... ----'--'------1 TE .. PERATURE PROGRA .... ER PERMISSIVE CIRCUIT STEAM DUMP CUTOUT STEAM DUMP VALVES f STEAM GENERATOR PRESSURE CONTROL CONTROL ROO DRIVE MECHANiS .. S TURBIJE LOAD SIGNAL MANUAL ROD CONTROL PERMISSIVE CIRCUITS ROD INTERLOCKS) r-CONTROL ROD _ POWER SUPPLY PERMISSIVE CIRCUITS (ROD INTERLOCKSl CONTROL ROD ACTUATORS
..J -< z ! ell IL -0:: .... 0:: o .... o <I( W 0:: REACTOR TRIP BREAKER I r-REACTOR TR IP BREAKER Z INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.3-1 SIMPLIFIED BLOCK DIAGRAM OF REACTOR CONTROL SYSTEMS MIC. No. 1999MC3876 I REV. No. 17 A OAGI0000215_1031 10 12 .... z 0 --10 II I-<< 2.5X10 10 u 0 10 10 ..J a:: 0 I-9 u 10 w I-w 10 8 D . u 10 7 w (J) N" :::!! 6 u 10 " (J) z 105 0 a:: S.OXIO 4-l-=> 4 lLJ 10 z 2.SX10 3 z 3 -10 x 2.SXIO 2 => ..J 10 2 u... z 0 10 I a:: l-=> lIJ 0 z 10 a:: 10 -I w ::x: I-10 -2 .1... -3 10-3 AMPS* -r-4.2SX 10 AMPS a:: lLJ 0 a.. lLJ I-<< 1.7XI0-6 AMPS ..... Q DETECTOR SENSITIVITY lIJ J 1.7XI0-13 AMP/N/CM2/SEC.
- E a:: (EACH SECTION OF LONG lIJ ION CHAMBER) l-I 10 6 z -I CPS r-lLJ u a: => 0 (J) -I 1 _L.. 10-11 AMPERES DETECTOR SENSITIVITY 4XIO-14AMP/N/CM2/sEC.
10 0 COUNTS PER SECOND DETECTOR SENSITIVITY ro CPS/N/CM2/SEC. INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.4-1 NEUTRON DETECTORS AND RANGE OF OPERATION MIC. No. 1999MC3877 1 REV. No. 17 A OAGI0000215_1032 POWER RANGE UPPER LOWER TO REMOTE INDICATION SO AND RECORDING TO REACTOR PROTECTION TO REMOTE INDICATION AND CONTROL RECORDING ALARM ON DEVIATION INTERMEDIATE RANGE 12 CHANNELSI SOURCE RANGE 12 CHANNELSI COMPENSATED ION CHAMBER Ie------I NC TO REMOTE INDICATION AND RECORDING TO REACTOR PROTECTION DROPPED PERMISSIVE ROD 70r-POWER ALARM ROD DROP BLOCK ROD WITHDRAWAL R T } BLOCKED * * -BY P-IO AND BLOCK ROD MANUAL WITHDRAWAL ACTION TO SOURCE RANGE CUT OFF (SOURCE RANGE TRIP BLOCK PERMISSIVE) TO REMOTE INDICATION.RATE AND RECORDING LOW HIGH RANGE RANGE R.T. [BLOCKED] BY P-IO AND MANUAL ACTION T POST AMP AND DISCRIMINATOR FROM THER CHANNEL LOG INTEGRATOR F (LOG BLOCKED BY P-6 NC R.T. AND MANUAL ACTION TO HIGH SHUTDOWN FLUX ALARM TO REMOTE INDICATlON.RATE AND RECORDING (TYPICAL FOR ONE CHANNEll INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.4-2 NUCLEAR INSTRUMENTATION SYSTEM MIC. No. 1999MC3878 REV. No. 17 A OAGI0000215_1033 PROPORTIONAL COUNTER COMPENSATED ION IZATION CHAMBER LONG ION CHAMBER PROPORTIONAL*O COUNTER LONG ION CHAMBER o FLAT CORE o o LONG ION CHAMBER CORNER OSPARE WELL LONG ION CHAMBER PROPORTIONAL COUNTER COMPENSATED IONIZATION CHAMBER
- PART OF THE ALTERNATE SAFE-SHUTDOWN SYSTEM INSTRUMENTATION.
INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.4-3 PLAN VIEW INDICATING DETECTOR LOCATION RELATIVE TO CORE MIC. No. 1999MC3879 REV. No. 17 A OAGI0000215_1034 OAGI0000215_1035 VESSEL SEAL REACTOR VESSEL SEAL TABLE INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.6-1 TYPICAL ARRANGEMENT OF MOVABLE MINIATURE NEUTRON FLUX DETECTOR SYSTEM MIC. No. 1999MC3880 REV. No. 17 A OAGI0000215_1036
U PLATFORM TRANSFER DEII'I CES EttCLOSURE ACCESS REACTOR CAWTY ---1--...,-- ___ _ r--WITHDRAW LIWIT SWITCHES CRANE WALL , / r-FIVE -PATH TRANSFER :JEVICES fi ,-WYE UN-ITS I TEN'-PATH TRANSFER DEweES PATH INDICATOR SWI";CHES ISOLATION" VALVES SEAL LIN'£: TO REACTOR ELE'I'ATION INDIAN POINT UNIT No. 2 UFSAR FIGURE 7.6-2 ARRANGEMENT OF INCORE FLUX DETECTOR MIC. No. 1999MC3881 REV. No. 17 A OAGI0000215_1037 MIXING DEVICE ......, , I , ... I , THERMOCOUPLE CONDUIT , I . I I I ---::::;:u.--L-L---L.....L..-..L-L., SU PPORT THERMOCOUPLE INSTALLATION o MIXING DEVICE COLUMN ""- .... (--rCAO">' .... -.c. MI CONNECTOR ASSEMBLY (4/1 OR 5/1) " :" I " (' ___ Q t ) \ TjC CONNECTOR THERMOCOUPLE CONNECTOR TO MI CABLE CONNECTOR ASSEMBLY ---.... 11: , ....... .... ..!... INDIAN POINT UNIT No. 2 " " ' . " " ... '-'\. ' UFSAR FIGURE 7.6-3 INCORE INSTRUMENTATION DETAILS MIC. No. 1999MC3882 REV. No. 17A OAGI0000215_1038 8.1 DESIGN BASES IP2 FSAR UPDATE CHAPTER 8 ELECTRICAL SYSTEMS The main generator supplies electrical power at 22-kV through an isolated-phase bus to two half-sized 20.3/345-kV main power transformers. Power required for station auxiliaries during normal operation is split between a 22/6.9-kV unit auxiliary transformer connected to the isolated phase bus and a 138/6.9-kV station auxiliary transformer. This practice provides significant diversity of normal supply power to the redundant safeguards power trains. Following any turbine trip when there are no electrical faults, which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. Upon generator trip, other than a generator over-frequency trip, auxiliaries fed from the unit transformer are "dead-fast" transferred to the station transformer. Provisions for standby (13.8-kV system) and emergency power (diesels) have been included to ensure further the continuity of electrical power for critical loads. The function of the auxiliary electrical system is to provide reliable power to those auxiliaries required during any normal or emergency mode of plant operation. Sufficient independence and isolation between the various sources of electrical power is provided in order to guard against concurrent loss of all auxiliary power. 8.1.1 Principal Design Criteria 8.1.1.1 Performance Standards Criterion: Those systems and components of reactor facilities, which are essential to the prevention or to the mitigation of the consequences of nuclear accidents, which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condition, high wind or heavy ice. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design. (GDC 2) All electrical systems and components vital to plant safety, including the emergency diesel generators, are seismic Class I and are designed so that their integrity is not impaired by the design-basis earthquake, certain wind storms, floods, or disturbances on the external electrical system. Power, control and instrument cabling, motors, and other electrical equipment required for operating the engineered safety features are suitably protected against the effects of a design-basis event or severe external environmental phenomena to ensure a high degree of confidence in their operability in the event that their use is required. Chapter 8, Page 1 of 29 Revision 20 OAG10000215_1039 8.1.1.2 Emergency Power IP2 FSAR UPDATE Criterion: An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single component. (GDC 39 and GDC 24) Emergency power systems are provided with adequate independency, redundancy, capacity, and testability to supply the required engineered safety features and protection systems. The plant is supplied with emergency power sources as follows: 1. Three independent emergency diesel generators, located in the Diesel Generator Building adjacent to the Primary Auxiliary Building, supply emergency power to the engineered safety features buses in the event of a loss of AC auxiliary power. There are no automatic bus ties associated with these buses. Each diesel generator is started automatically on a safety injection signal or upon the occurrence of an undervoltage condition on any vital 480-V switchgear bus. The system is sufficiently redundant such that any two diesels have adequate capacity to supply the engineered safety features for the design basis accident concurrent with a loss of offsite power. One diesel is adequate to provide power for a safe and orderly plant shutdown in the event of a of-offsite electrical power. 2. Emergency power for vital instrumentation and control and for emergency lighting is supplied from the 125 VDC system via four independent DC channels. The station batteries supply emergency power to the instrumentation and control systems when their associated battery chargers are not available. 8.1.2 1980 Review of 10 CFR 50 Appendix A GDC 17 and GDC 18 Our August 11,1980 response to the NRC's February 11,1980 Confirmatory Order included a study of how the plant complied with 10 CFR 50 regulations in effect at that time. The following paragraphs provide a discussion of the extent to which the Indian Point Unit 2 design complies with Criteria 17 and 18 of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants." 8.1.2.1 10 CFR 50 Appendix A General Design Criterion 17 -Electric Power Systems An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents. The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. Chapter 8, Page 2 of 29 Revision 20 OAG10000215_1040 IP2 FSAR UPDATE Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that the core cooling, containment integrity, and other vital safety functions are maintained. Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. Independent alternate power systems are provided with adequate capacity and testability to supply the required engineered safety features and protection systems. The plant is supplied with normal, standby, and emergency power sources as follows: 1. The normal source of auxiliary power for 6.9-kV buses 1, 2, 3, and 4 during plant operation is the unit auxiliary transformer, which is connected to the main generator via the iso-phase bus. 2. The normal source of auxiliary power for 6.9-kV buses 5 and 6 and standby power required during plant startup, shutdown, and after reactor trip is the station auxiliary transformer, which is supplied from the Con Edison 13S-kV system by either of two separate overhead lines from the Buchanan substation approximately 0.5 mile from the plant. Alternate feeds from the Buchanan kV system are also available for immediate manual connection to the auxiliary buses. In addition, three gas turbines with blackstart (no auxiliary power) capability are available. These gas turbines may also be used to "bootstrap" the unit back to power operation following a loss of the Con Edison grid. The capacities of these gas turbine generators require that the station load be reduced to a minimum during startup. 3. Three diesel-generator sets supply emergency power to the engineered safety features buses in the event of a loss of AC auxiliary power. There are no automatic bus ties associated with these buses. The three gas turbines discussed in item 2 may also serve to supply emergency shutdown power. 4. Power for vital instrumentation and controls and for emergency lighting is supplied from the four 125-V DC systems. The station batteries supply emergency power to the instrumentation and control systems when their associated battery chargers are not available. Chapter S, Page 3 of 29 Revision 20 OAG10000215_1041 IP2 FSAR UPDATE The emergency diesel-generator sets are located in the Diesel Generator Building adjacent to the Primary Auxiliary Building and supply emergency power to separate 4S0-V switchgear buses. Each set will be started automatically on a safety injection signal or upon the occurrence of an undervoltage condition on any 4S0-V switchgear bus. Any two diesels have adequate capacity to supply the required engineered safety features for the design basis accident concurrent with a loss of offsite power. One diesel is adequate to provide power for a safe and orderly plant shutdown in the event of loss-of-offsite electrical power. All electrical systems and components vital to plant safety, including the emergency diesel generators, are seismic Class I and are designed so that their integrity is not impaired by the design-basis earthquake, certain wind storms, floods, or disturbances on the external electrical system. Power, control and instrument cabling, motors, and other electrical equipment required for operating the engineered safety features are suitably protected against the effects of a design-basis event or severe external environmental phenomena to ensure a high degree of confidence in their operability in the event that their use is required. The electrical system equipment is arranged so that no single contingency can inactivate enough safeguards equipment to jeopardize plant . The 4S0-V ment is four buses train . Buses 2A and 3A are .... '" .. ;,;;;;;, ... "" The plant auxiliary equipment is arranged electrically so that redundant or similar equipment receive power from different sources. The charging pumps are supplied from 4S0-V buses 3A, SA, and 6A. The six service water pumps and the five containment fans are similarly supplied from the four 4S0-V switchgear buses. The two service water pumps, one safety injection pump, and the emergency diesel associated with buses 2A and 3A can be connected to either bus 2A or 3A. Safeguards motor-operated valves are supplied from motor control centers 26A/26AA and 26B/26BB, which are supplied from buses SA and 6A, respectively. The 13S-kV outside source of power and the 13S-kV/6.9-kV station auxiliary transformer are adequate to run all of the plant auxiliary loads. The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries. Two diesel generators have enough capacity to start and run a fully loaded set of engineered safeguards equipment. The safeguards equipment with any two of the three power trains can adequately cool the core for any loss-of-coolant incident and maintain the containment pressure within the design value. The 12S-V DC power supplies consist of four separate systems, each having its own battery, battery charger, and power panel. Under normal conditions, each battery charger supplies its DC loads, while maintaining its associated battery at full charge. The battery provides power to the DC loads when the battery charger is not available. DC control power for the 4S0-V ESF Switchgear and the emergency diesel generators is supplied via automatic transfer switches. Should normal battery voltage fall below a specified level, the associated transfer switch(es) transfer control power from the preferred source to the alternate source. This design eliminates any transfer of load between redundant DC systems 21 and 22, which power the reactor protection and safeguards logics and ensures that adequate DC power is available for starting the emergency diesel generators and for other emergency uses. Chapter S, Page 4 of 29 Revision 20 OAGI000021 S_1 042 IP2 FSAR UPDATE The plant turbine generator is the main source of 6.9-kV auxiliary electrical power during "online" plant operation. Power to the auxiliaries is supplied by a 22/6.9-kV two-winding unit auxiliary transformer that is connected to the isophase bus from the generator. The 6.9-kV system is arranged as six buses. Under normal conditions, two buses (5 and 6) receive power from the 13S-kV system via bus main breakers and the 13S-6.9-kV station auxiliary transformer. Buses 1, 2, 3, and 4 receive power from the main generator via bus main breakers and the unit auxiliary transformer. Buses 1 and 2 can be tied to bus 5, and buses 3 and 4 can be tied to bus 6 via bus tie breakers when the turbine-generator is shutdown. Buses 2, 3, 5, and 6 each serve one of the four 6900-4S0-V station service transformers. Normal and offsite power to the 4S0-V switchgear buses is supplied through these station service transformers. The 4S0-V system is arranged as four ESF switchgear buses. Each 4S0-V switchgear bus supplies several 4S0-V motor control center buses for power distribution throughout the station. The 4S0-V switchgear buses are supplied from the 6.9-kV buses as follows: 2A from 2, 3A from 3, 5A from 5, and 6A from 6. Tie breakers are provided between 4S0-V switchgear buses 2A and 3A, 2A and 5A, and 3A and 6A. These tie breakers are racked out under administrative control when the RCS temperature exceeds 350°F. The required safeguards equipment circuits are supplied from the 4S0-V ESF switchgear buses. The normal source of power for buses 5A and 6A is the 13S-kV system (via the station auxiliary transformer, 6.9-kV buses 5 and 6, and station service transformers); no transfer is required in the event of a unit trip. Buses 2A and 3A will receive power from the 13S-kV system in the event of a unit trip via a "dead fast" transfer of buses 2 and 3 to buses 5 and 6, respectively. One emergency diesel-generator set supplies emergency power to bus 5A, one to bus 6A, and the third to buses 2A and 3A. Each set will be started automatically on a safety injection signal (see Section 7.2) or upon undervoltage on any 4S0-V switchgear bus. Power for the safeguards valve motors is supplied from four motor control centers (26A/26AA and 26B/26BB), which in turn are supplied from the 4S0-V ESF Switchgear. Motor Control Centers 26A and 26B are provided protection by 4S0-V circuit breakers. These circuit breakers are on different 4S0-V switchgear buses, and the bus associated with each circuit breaker has a dedicated emergency diesel generator MCC's 26AA and 26BB are supplied from MCC's 26A and 26B, respectively. Two independent sources of DC control power are available to the breakers on each 4S0-V switchgear bus via automatic normal power seeking transfer switches. The preferred and alternate sources of DC control power for the breakers are detailed under Section S.2.2.3. Power for instrumentation and control is provided by four 11S-V AC Instrument Supply Systems. Each system consists of one inverter, one manual bypass switch, two 11S-V AC buses, and associated interconnections. The four inverters are dedicated, one to each system. Each inverter receives power from a different DC Power Panel (DC Power Panel 21 supplies Inverter 21. DC Power Panel 22 supplies Inverter 22, etc.) In the event an inverter, is taken out of service, a backup supply from the 4S0-V system is available to supply the 11S-V AC loads. Failure of a single inverter or its static transfer to switch will not cause the loss of a basic protective system or prevent the actuation of the minimum safeguards devices. Chapter S, Page 5 of 29 Revision 20 OAG10000215_1043 IP2 FSAR UPDATE Several sources of offsite power are available to Indian Point Unit 2. These consist of two kV overhead supplies from the Buchanan 13S-kV substation, three separate underground feeders from the Buchanan 13.S-kV substation, and three 13.S-kV gas turbines (one of which is located on-site). The 13.S-kV line is rated 19.5 MVA at 13-kV. The 13.S/6.9-kV transformer is rated 20 MVA. The maximum engineered safety feature and safe shutdown loads are 9.2 MVA. No safety or emergency power is required from these sources for the retired Indian Point Unit 1. The Buchanan 13S-kV substation supply to Indian Point Unit 2 has two connections to the Millwood 13S-kV substation, a connection to the Peekskill Refuse Burning Generating Station and a connection via auto-transformer to the Buchanan North 345-kV substation. The Indian Point Unit 2 345-kV connection to the system goes to the Buchanan North 345-kV substation, which has connections to Ramapo and Eastview 345-kV substations. System stability studies show that the system is stable for the loss of any generating unit including Indian Point Unit 2. Each 13S-kV overhead tie line can provide offsite power to Indian Point 2 via the station auxiliary transformer. The loss of this transformer would interrupt the 13S-kV supply to the station. For this reason, an alternate 13.S/6.9-kV supply is provided. Additional sources of offsite power from the 13.S-kV distribution system at Buchanan and an independent power supply from the onsite gas turbine (Unit 1) installation are available to 6.9-kV buses 5 and 6 through supply breakers GT-25 and GT-26. The transfer from the normal to the reserve supply (or vice versa) must be accomplished manually. Three (3) gas turbine generators are directly available to the Indian Point site. One gas turbine generator is more than adequate to provide an additional contingency of backup electrical power for maintaining the plant in a safe shutdown condition. Gas turbine Unit 1 is located adjacent to the Unit 1 turbine building. The position indication and controls for breakers GT-25 and GT-26 are located on a panel in the Central Control Room. Gas turbine Units 2 and 3 are located at the Buchanan substation. Either of these gas turbines can supply power to the Unit 2 auxiliary electrical system through the Buchanan 13.S-kV distribution system connections or through the 13S-kV tie lines. Each of these circuits is designed to be available in sufficient time following a loss of all onsite AC power supplies and other offsite electric power circuits, to ensure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The 13S-kV system is designed to be available instantaneously following a coolant accident to ensure that core cooling, containment integrity, and other vital safety functions are maintained. This is accomplished by a "dead-fast" transfer scheme that uses stored energy breakers to transfer the auxiliaries on the four 6.9-kV buses supplied by the unit auxiliary transformer to the station auxiliary transformer, which is supplied from the 13S-kV system. However, when buses 5 and 6 are supplied from the alternate 13.S-kV supply, the "dead fast" transfer scheme is defeated by manual action to protect the 13.S-kV-6.9-kV transformer. The diversity and redundancy inherent in the combination of onsite/offsite electrical systems minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of onsite power sources. Chapter S, Page 6 of 29 Revision 20 OAG10000215_1044 IP2 FSAR UPDATE The electrical power sources and systems have been evaluated as meeting the requirements of 10 CFR 50.63 (the Station Blackout Rule) (References 3,4,5,6,7,8 and 9). The adequacy of the station electric distribution system voltages was reviewed (as requested by the NRC in Reference
- 1) for expected normal operating voltage ranges and potential degradations of both the offsite power system and the unit's main electrical generator.
The offsite power sources were analyzed under the extremes of load and offsite voltage conditions and credited the automatic load tap changers. To protect safeguards equipment from degraded voltage conditions, which could impair their operation, separate sets of undervoltage relays on each 480-V ESF switchgear bus will alarm to alert the operator that voltage has fallen below approximately 94-percent on any bus and will trip the normal (offsite or main electrical generator) supply breakers to any bus if voltage remains below approximately 88-percent for 180 +/- 30 sec. In addition, the 480-V supply breaker to the ESF Switchgear buses will trip upon sustained (10 +/- 2 sec) degraded voltage conditions coincident with a safety injection signal. By Reference 2, the NRC concluded that the Indian Point Nuclear Station Unit 2 design is acceptable with respect to the adequacy of station electrical distribution system voltages. 8.1.2.2 10 CFR 50 Appendix A General Design Criterion 18 -Inspection and Testing of Electric Power Systems Electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The systems shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems as a whole and, under conditions as close to design as practical, the full operation sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system. At each refueling interval the 480-V emergency power system is tested to verify that it and vital equipment control systems will respond as designed. The test is initiated by simulating a loss of normal AC station service power. Testing and surveillance of the station batteries is accomplished as follows: 1. Every month the voltage of each cell, the specific gravity and temperature of a pilot cell in each battery, and each battery voltage are measured and recorded.
- 2. Every three months each battery is subjected to a 24-hr equalizing charge, and the specific gravity of each cell, the temperature reading of every fifth cell, the height of electrolyte, and the amount of water added are measured and recorded.
- 3. Each time data are recorded, the new data are compared with the old to detect signs of abuse or deterioration.
- 4. At each refueling interval, each battery is subjected to a load test and a visual inspection of the plates. Chapter 8, Page 7 of 29 Revision 20 OAG10000215_1045 IP2 FSAR UPDATE Functional testing is performed in the automatic transfer switches that provide DC control power to the circuit breakers of 480-V Switchgear, Buses 2A, 3A, 5A, and 6A and the emergency diesel-generator control panels. This testing demonstrates that: (a) Each automatic transfer switch will transfer from its preferred source to its alternate source when the preferred source is unavailable or its voltage falls below a predetermined value, (b) The preferred and alternate sources of each transfer switch are available to supply DC control power to the breakers and for control of the emergency diesel-generators, and (c) Each transfer switch will automatically transfer back to its preferred source when the voltage of the preferred source is re-established to an acceptable level. The safety injection system is tested: 1. To verify that the various valves and pumps associated with the engineered safeguards system will respond and perform their required safety functions.
- 2. To ensure that each diesel generator will start automatically and assume the required load, within 60 sec after the initial start signal by simulating loss of all normal alternating current station service power supplies and simultaneously simulating a safety injection signal. This test is performed at each refueling interval.
- 3. To verify that the required bus load shedding takes place. 4. To verify the restoration of particular vital equipment to operation.
Environmental qualification of electrical equipment important to safety is addressed in Section 7.1. REFERENCES FOR SECTION 8.1 1. Letter from William Gammill, U.S. Nuclear Regulatory Commission, to all Power Reactor Licensees (except Humboldt Bay),
Subject:
Adequacy of Station Electric Distribution Systems Voltages, dated August 8, 1979. 2. Letter from Steven A. Varga, U.S. Nuclear Regulatory Commission, to John D. O'Toole, Con Edison,
Subject:
Adequacy of Station Electric Distribution System Voltages, dated October 18, 1982. 3. Letter from Francis J. Williams, U.S. Nuclear Regulatory Commission, to Steven B. Bram, Con Edison,
Subject:
Supplemental Safety Evaluation of Indian Point Nuclear Generating Unit No.2, Response to the Station Blackout Rule (TAC No. M68556), dated June 4, 1992. 4. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated April 14,1989. Chapter 8, Page 8 of 29 Revision 20 OAG10000215_1046 IP2 FSAR UPDATE 5. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated March 27,1990. 6. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated October 22, 1993. 7. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated November 30,1993. 8. Letter from Francis J. Williams, U.S. Nuclear Regulatory Commission, to Stephen B. Bram, Con Edison,
Subject:
Safety Evaluation of the Indian Point Nuclear Generating Unit No.2, Response to the Station Blackout Rule (TAC No. M68556), dated November 21, 1991. 9. Letter from Con Edison to the Nuclear Regulatory Commission,
Subject:
Station Blackout Rule, dated December 23, 1991. 8.2 ELECTRICAL SYSTEM DESIGN 8.2.1 Network Interconnections Con Edison's external transmission system provides two basic functions for the nuclear generating station: (1) it provides auxiliary power as required for startup and normal shutdown and (2) it transmits the output power of the station. Electrical energy generated at 22-kV is raised to 345-kV by the two main transformers. Power is delivered to the system via a 345-kV overhead tie line routed between the main transformers and the 345-kV North Ring Bus at Buchanan Substation. The North Ring Bus is configured with three circuit breakers rated 362-kV, 3000A, 40/63kA. Two of these breakers have synchronizing capability to connect the main generator to the system. The North Ring Bus is also connected to Ramapo and Eastview Substations via overhead transmission circuits and to the Buchanan 138-kV Substation via a 335/138-kV auto-transformer. The electrical one-line diagram for the Indian Point Station is presented in Plant Drawing 250907 [Formerly UFSAR Figure 8.2-1]. Standby power is supplied to the station from the Buchanan 138-kV Substation, which has two connections to the Millwood 138-kV Substation, one connection to the Peekskill Refuse Burner, and one connection to the Buchanan 345-kV Substation via an auto-transformer. In addition, gas turbine power can be provided to Indian Point Unit 2 from any of the three gas turbines. Several power flow paths exist to connect gas turbine power to the plant, either thru various switching arrangements of 13.8-kV and 6.9-kV underground feeders, or thru combinations of 13.8-kV underground feeders, transformations up through the Buchanan 138-kV, and thru either of the two 138-kV overhead feeders. Maximum flexibility of routing is provided by inter-ties at the Buchanan substation (138-kV and 13.8-kV buses) and at the Indian Point site (138-kV site switchyard and gas turbine substation 6.9-kV bus tie). One of these gas turbine-generators is located at the Indian Point site and two are located at the Buchanan Substation. A single-line diagram showing the connections.of.thE!.IllC3in.gE!nerator.t().thE!.po\l\ler.systE!lll.grid and standby power source is shown Chapter 8, Page 9 of 29 Revision 20 OAG10000215_1047 8.2.1.1 Reliability Assurance IP2 FSAR UPDATE Three external sources of standby power are available to Indian Point Unit 2. They are the 138-kV tie from the Buchanan 345-kV substation, the 138-kV Buchanan-Millwood ties, and the gas turbine generators. Loss of any two of these sources will not affect the third. Substantial flexibility and alternate paths exist within each source. The 138-kV supply from the Buchanan substation with its connections to the Con Edison 345-kV system provides a dependable source of station auxiliary power. Upon loss of 345/138-kV transformer supply at Buchanan, two 138-kV ties are designed to provide additional auxiliary power from the Millwood 138-kV substation. A further guarantee of reliable auxiliary power, independent of transmission system connections, is provided by the three gas turbine generators, one installed at the plant site and two (2) at Buchanan. At least one gas turbine generator (GT-1, GT-2 or GT-3) and associated switchgear and breakers shall be operable at all times. A minimum of 94,870 gallons of fuel for the operable gas turbine shall be available at all times. If these requirements cannot be met, then, within the next seven (7) days, either the inoperable condition shall be corrected or an alternate independent power system shall be established. Additionally, if these requirements cannot be satisfied, the reactor shall be placed in the hot shutdown condition utilizing normal operating procedures. If these requirements cannot be met within an additional 48 hours, the reactor shall be placed in the cold shutdown condition utilizing normal operating procedures. These requirements for the gas turbines ensure that the gas turbines can provide an alternate backup power source in case of loss of onsite emergency power and concurrent loss of offsite power as well as required auxiliary power for alternate safe shutdown systems equipment. The fuel supply for gas turbines consists of two onsite 30,000-gal fuel oil tanks and a 200,000-gal storage tank located at the Buchanan substation site. A minimum of 94,870 gal of fuel is maintained available and dedicated for the required gas turbine. This minimum fuel inventory ensures that one gas turbine will be capable of supplying the maximum electrical load for the Indian Point Unit 2 alternate safe shutdown power supply system (i.e., 1600kW) for at least 3 days. Commercial oil supplies and trucking facilities exist to ensure deliveries of additional fuel within one day's notice. In the event of the loss of the Indian Point Unit 2 138-kV supply (the primary preferred offsite supply), the Indian Point Unit 2 13.8/6.9-kV supply is manually connected to 6.9-kV buses 5 and 6. The capacity of this supply is limited and is not capable of supplying full plant load. However, the 13.8-6.9-kV supply is capable of supplying the normal load on buses 5 and 6 and is also capable of supplying all 480-V safeguards and safe shutdown loads. The "dead-fast" transfer of 6.9-kV buses 1, 2, 3, and 4 is prevented by manual action when buses 5 and 6 are supplied from the 13.8/6.9-kV supply. 8.2.2 Station Distribution System The auxiliary electrical system is designed to provide a simple arrangement of buses requiring a minimum of switching to restore power to a bus in the event that the normal supply is lost. The basic components of the station electrical system are shown on the electrical one-line diagrams (See Plant Drawings 208377, 231592, 208088, 9321-3004, 249956, 9321-3005, 208507, 249955, 208241, 9321-3006, 248513, 208500, 208502, 208503, 9321-3008, and UFSAR Figure 8.2-4 [Formerly UFSAR Figures 8.2-3, and 8.2-5 through 8.2-16]), which include Chapter 8, Page 10 of 29 Revision 20 OAG10000215_1048 IP2 FSAR UPDATE the main generator, the 345-kV, the 6.9-kV, the 480-V, the 118-V AC instrument, and the 125-V DC systems. 8.2.2.1 Unit Auxiliary, Station Auxiliary, and Station Service Transformers The plant turbine generator is a main source of 6.9-kV auxiliary electrical power during "online" plant operation. Power to the auxiliaries on 6.9-kV Buses 1 thru 4 is supplied by a 22/6.9-kV two-winding unit auxiliary transformer that is connected to the main generator via the iso-phase bus. Power to the auxiliaries on 6.9-kV buses 5 and 6 during "on line" plant operation is supplied by a 13.8/6.9-kV two-winding station auxiliary transformer connected to an offsite supply. Power to the 480-V buses is supplied from four 6900/480-V, air-insulated, dry-type station service transformers. These transformers were designed and constructed in accordance with ANSI C57.11, as the applicable standard of record at the time of fabrication. During engineered safeguards loading and operation, these transformers are loaded within their rating. Manufacturer shop tests of the transformers were conducted in accordance with the American Standard Test Code C 57.12.90. This series of tests consisted of the following:
- 1. Resistance measurements of all windings.
- 2. Ratio tests. 3. Polarity and phase relation tests. 4. No-load losses. 5. Exciting current. 6. Impedance and load loss. 7. Temperature test. 8. Applied potential tests. 9. Induced potential tests. The normal source of power to buses 5 and 6 and auxiliary power required during plant startup, shutdown, and after a unit trip is supplied from the 138-kV switchyard.
After a unit trip, the auxiliary loads on 6.9-kV Buses 1 through 4 are transferred from the unit auxiliary transformer to the station auxiliary transformer by automatic relay transfer scheme using stored energy breakers. The transfer is monitored by synchrocheck relays (Device 25). The 138-kV system is the normal supply for two of the three power trains of the auxiliary loads associated with plant engineered safeguards. 8.2.2.2 6.9-kV System The 6.9-kV system is arranged as six buses. During normal plant operation, two buses (5 and 6) receive power from the 138-kV system by bus main breakers and the 138/6.9-kV station auxiliary transformer, while buses 1, 2, 3, and 4 receive power from the main generator by bus main breakers and the unit auxiliary transformer. On a generator trip, other than a generator over-frequency trip, a "dead-fast" transfer scheme ties buses 1 and 2 to bus 5, and bus 3 and 4 to bus 6, by bus tie breakers. In the case of a generator over-frequency trip, the transfer is blocked by an over-frequency transfer interrupt circuit provided for bus protection of out of phase transfer. Plant Drawing 225097 [Formerly UFSAR Figure 7.2-4] is the logic diagram of the transfer scheme. Buses 2, 3, 5, and 6 each serve one 6900/480-V station service transformer. Chapter 8, Page 11 of 29 Revision 20 OAG10000215_1049 8.2.2.3 480-Volt System IP2 FSAR UPDATE The 480-V system arranged as ESF Switchgear buses 2A, 3A, 5A, and 6A and numerous motor control center buses. The 480-V switchgear buses are supplied from the 6.9-kV buses as follows: 2A from 2, 3A from 3, 5A from 5, and 6A from 6 (buses 2A and 3A are within the same power train). Tie breakers are provided between 480-V Switchgear buses 2A and 3A, 2A and 5A, and 3A and 6A. The required safeguards equipment circuits are supplied from the 480-V Switchgear buses. The normal source of power for buses 5A and 6A is the 138-kV system (via the station auxiliary transformer, 6.9-kV buses 5 and 6, and station service transformers); since the normal source of power to these buses is not the main generator, no transfer is required in the event of a unit trip. Buses 2A and 3A are supplied from buses 5 and 6, respectively, via a "dead-fast" transfer of the 6.9-kV buses in the event of a unit trip. One emergency diesel-generator set provides emergency power to bus 5A, one to 6A, and the other to buses 2A and 3A. Each set will automatically start on a safety injection signal or upon undervoltage on any 480-V switchgear bus. Power for the safeguards valve motors is supplied from four motor control centers (MCC's 26A, 26AA, 26B, and 26BB). Motor Control Centers 26A and 26B are supplied through separate circuit breakers on different 480-V switchgear buses. Each of these 480-V switchgear buses has a dedicated emergency diesel-generator set. Motor Control Centers 26AA and 26BB are sub fed from MCC's 26A and 26B, respectively. Loads required for safe shutdown and accident mitigation are supplied from the 480-V switchgear buses and from certain 480-V motor control centers. Other loads are segregated onto other motor control centers. In the event of loss-of-offsite power, loads are stripped from the 480-V buses, the diesel generators are started, and required loads are added in sequence, as described in section 8.2.3.4. All four 480-V switchgear buses are safety-related and supply power to ESF systems and equipment. Therefore, two independent sources of DC control power are provided for control of 480-V breakers, protective circuits and other devices. This is accomplished by automatic transfer switches located near each switchgear. A transfer from the preferred source to the alternate source occurs when the voltage of the preferred source falls below a predetermined value (100-V DC), provided the voltage of the alternate source is above a predetermined value (112.5-V DC). When the preferred source is restored to 112.5-V DC or higher, the transfer switch will transfer back to the preferred source. With only one source energized, the transfer switch seeks the energized source. Lights indicate the available energized source. Thus, the DC supply for the protection and control of the ESF Switchgear is maintained in the event of a loss of one DC source. The preferred and alternate sources of DC control power for the breakers are: Transfer Switch EDD1 EDD2 EDD3 EDD4 Associated Bus Preferred Source 6A DC PP#24 2A DC PP#22 3A DC PP#23 5A DC PP #21 Chapter 8, Page 12 of 29 Revision 20 Alternate Source DC PP#22 DC PP#24 DC PP #21 DC PP#23 OAG10000215_1050 8.2.2.4125-V DC Systems IP2 FSAR UPDATE There are four separate safety-related 125-V DC systems serving the various DC loads throughout the station. Each system consists of one battery, one battery charger, one main power panel and one or more DC distribution panels (sub panels). The systems are similarly arranged, however equipment capacities are not necessarily the same. Each battery charger is supplied from a different 480-V switchgear bus. Under normal and emergency conditions, the battery charger supplies the DC loads and float charges the battery. The battery provides power to the DC loads under the following conditions: (a) When the load exceeds the capacity of the battery charger, such as during DC motor starting or simultaneous breaker operation. (b) When the battery charger is not available, such as a battery charger failure or loss of input voltage. Bus ties between the main power panels (DC Power Panel 21 and DC Power Panel 22) permit battery and battery charger maintenance. 8.2.2.5 118-V AC Instrument Supply Systems There are four independent safety-related 118-V AC instrument supply systems serving the various instrumentation and control systems throughout the station. Each system consists of one solid-state inverter with an internal static transfer switch one manual switch and two 118-V AC instrument buses All four inverters are supplied from different 125-V DC power panels. Each inverter has an alternate input power source (120-V AC nominal), which is used to synchronize the inverter output to the auxiliary electrical system and to provide power to the vital 118-V AC loads in the unlikely event of an inverter failure. The alternate input power source to the inverters is provided by step-down transformers connected to the inverter's static transfer switch. These transformers are supplied from safety-related 480-V MCCs. These feeds are electrically separated from the feeds to the associated battery charger. In the event that an inverter or static transfer switch is out of service, each 118-V AC system has a manual transfer switch mounted in a separate enclosure that can bypass the static transfer switch and provide backup power from the step-down transformers directly to the 118-V AC buses. To ensure that a single failure of an emergency diesel-generator will not result in the unavailibility of more than one 118-V AC system, the normal and backup supplies for three of the instrument buses 21, 22, and 24 are unitized (i.e. fed from the associated emergency diesel-generator). Instrument bus 23 is fed from emergency diesel generators 21 and 22, providing diverse sources to prevent loss of this bus due to loss of a single emergency diesel-generator. Voltage drop calculations demonstrate that equipment supplied from Buses 21 and 21A are operable with the postulated minimum voltage at Inverter 21. This is typical of all instrument buses. 8.2.2.6 Evaluation of Layout and Load Distribution Electrical distribution system equipment is located to minimize the exposure of vital circuits to physical damage as a result of accidents or natural phenomena. To a certain extent the Generator Building is protected from tornados and major tornado generated major missiles Chapter 8, Page 13 of 29 Revision 20 OAG10000215_1051 IP2 FSAR UPDATE because it is situated between large buildings as shown in the site plot plan (Plant Drawing 9321-1002 [Formerly UFSAR Figure 1.2-3]). The diesel-generator installation is considered redundant to other lines of power supply. As described in Section 8.1, there are alternate power supplies. In the case of a tornado, reliance is placed on power supply redundancy and not solely on the diesel installation. Station Auxiliary, Unit Auxiliary, and the main transformers are located outdoors and are spaced to minimize their exposure to fire, water, and other physical damage. Surge arresters are installed near the high-voltage terminals of the main and standby transformers to protect the windings from lightning and switching transients, which can cause transformers to fail. All oil-filled transformers are provided with automatic deluge systems to extinguish oil fires quickly and prevent the spread of fire. The 6.9-kV buses are housed in two metal-clad switchgear units. The enclosures for switchgear 21 and 22 are located at elevation 15 ft in the turbine building. Each breaker is mounted in a separate compartment. Switchgear 21 and 22 have a solid top with cable penetrations and some openings on the side. The cable openings at the top are sealed to minimize bus exposure to fire, water, and other physical damage. An overcurrent condition on any of the 6.9-kV buses actuates the associated bus protection lockout relays, which isolate the bus by tripping and locking out both the normal supply breaker and the 6.9-kV tie breaker for that bus. The 480-V buses are housed in two metal-enclosed switchgear units located at the 15-ft elevation of the Indian Point Unit 2 control building. The switchgear structure provides protection to minimize exposure from mechanical, fire, and water damage. Buses 5A and 2A are contained in switchgear enclosure 21; Buses 6A and 3A constitute switchgear enclosure
- 22. The switchgear contains the buses, the bus supply breakers, the tie breakers, the load (feeder) breakers, the station service transformers, and the potential transformers for synchronizing and under-voltage relay protection.
The normal 480-V switchgear supply breakers 52/2A, 52/3A, 52/5A, and 52/6A are tripped under the following conditions:
- 1. Safety injection or unit trip, and loss of voltage (-46-percent) on bus 5A or 6A. 2. Actuation of manual trip push buttons on each breaker. 3. Actuation of control switches in the Central Control Room. 4. Actuation of control switches in the Diesel-Generator Building.
- 5. Individual breaker overcurrent protection.
- 6. Degraded voltage (-88-percent) for 180 +/- 30 seconds on each respective bus. 7. Degraded voltage (-88-percent) coincident with a safety-injection signal for 10 +/- 2 seconds. The "short time" undervoltage relays provide input signals to the sequencing logic and emergency diesel generator start circuitry.
Their setpoints (-46-percent) are designed to provide a fast trip response under complete loss-of-power ("dead bus") conditions. The trip of the normal 480-V supply breakers to the safeguards buses upon sustained under voltage is actuated by two undervoltage relays (set at percent) on each bus. Two out of two logic will operate an Agastat timing relay (set at 180 +/- 30 sec), which in turn trips its respective 480-V supply breaker. This function was added to provide additional protection to the safeguards loads against degraded-voltage conditions. Tripping the 480-V supply breakers to the safeguards buses, upon sustained degraded-voltage conditions coincident with a safety-Chapter 8, Page 14 of 29 Revision 20 OAG10000215_1052 IP2 FSAR UPDATE injection signal for 10 +/- 2 sec, protects the motors in addition to providing an alternate power supply to establish a correct voltage. A separate category alarm and bullet lights in the central control room will alert the operator when any 4S0-V switchgear bus voltage falls to 94-percent. These may operate during load sequencing operations but they are primarily intended to alert the operator to sustained degraded voltages that result from problems on the offsite power system. Remote manual and automatic control of the 4S0-V switchgear breakers and associated relays requires 125-V DC control power. Automatic transfer switches are provided to increase the reliability and availability of DC control power for operation of the 4S0-V switchgear under normal conditions and during safeguards actuation. The original plant design provided for transfer between 125-V DC Systems 21 and 22 for each switchgear's DC control power. To improve the reliability of the system and eliminate any potential for transfer-related common-mode failures of DC systems 21 and 22, the transfer schemes were changed to utilize DC systems 23 and 24, which were added after the plant was commissioned. The NRC reviewed this plant change in their safety evaluation report dated 5/2/S0, and determined that it met the requirements of Regulatory Guide 1.6 and was therefore acceptable (Reference 1). See Section S.2.2.3 for the preferred and alternate sources of DC control power for the 4S0-V switchgear breakers. Control power for the operation of equipment supplied from each 4S0-V switchgear bus is arranged to match the preferred and alternate sources of DC control power to the 4S0-V switchgear breakers. For example, for the equipment supplied from Switchgear Bus 2A, the preferred source of control power is 125-V DC System 22 and the alternate source of control power is 125-V DC System 24. Four ASCO transfer switches, one per bus, provide DC control power to the 4S0-V switchgear. Each transfer switch is mounted in a separate enclosure near its respective switchgear breakers. A similar improved design is provided for the DC control power supplies to the control panels associated with each of the three emergency diesel generators located in the diesel building. DC system 21 is the preferred source and DC System 23 is the alternate source for Generator 21; DC System 23 is the preferred source and DC System 22 is the alternate source for Diesel-Generator 22; DC System 24 is the preferred source and DC System 22 is the alternate source for Diesel-Generator
- 23. Each 4S0-V switchgear breaker, with the exception of the Rod Power Supply M-G Set input breakers (52/MG1, 52/MG2) and the reactor trip breakers (52/RTA, 52/RTB, 52/BYA, 52/BYB), is equipped with a Westinghouse "Amptector 1A" solid-state overcurrent trip unit to protect the auxiliary equipment supplied by the breaker (including cables) and the associated switchgear.
The settings of the solid-state overcurrent trip unit are based on the supplied load. The state trip unit is provided with an instantaneous and/or short-time setting(s) to protect against fault conditions, and long-time setting to protect against over-load conditions. Each circuit breaker is tripped on overcurrent conditions (overload or short circuit) by the combined operations of three components:
- 1. Sensors 2. Amptector solid-state trip unit Chapter S, Page 15 of 29 Revision 20 OAG10000215_1053
- 3. Actuator IP2 FSAR UPDATE All necessary tripping energy (for a breaker trip on an overcurrent condition only) is derived from the load current flowing through the sensors; no separate power source is required.
The tripping characteristics for a specific breaker rating, as established by the sensor rating, are determined by the continuously variable settings of the Amptector static trip unit. This unit supplies a pulse of tripping current (when preselected conditions of current magnitude and duration are exceeded) to the actuator, which produces a mechanical force to trip the breaker. If an overcurrent condition occurs on one of the 4S0-V switchgear buses while the bus is supplied from the normal source, lockout relays trip (if required) and prevent the closing of the alternate supply breakers (diesels and bus ties) associated with the bus. These relays must be manually reset after the overcurrent condition is cleared to allow these breakers to close. The 4S0-V motor control centers are located in the areas of electrical load concentration. In general, those associated with the turbine generator auxiliary system are located below the turbine generator operating floor level, and those associated with the nuclear steam supply system are located in the primary auxiliary building. Nonsegregated, metal-enclosed 6.9-kV buses are used for all major bus runs where large blocks of current are carried. The routing of this metal-enclosed bus minimizes its exposure to fire, water, and other physical damage. The application and routing of control, instrumentation, and power cables minimize their exposure to damage from any source. All cables are designed using conservative margins with respect to their current carrying capacities, insulation properties, and mechanical construction. Cable insulation in the reactor building has sheathing selected to minimize the harmful effects of radiation, heat, and humidity. All cables are fire resistant. Chapter S, Page 16 of 29 Revision 20 OAG10000215_1054 IP2 FSAR UPDATE The conductors of instrumentation cables are shielded to minimize induced voltages and twisted to minimize magnetic interference. Wire and cables related to engineered safeguards and reactor protection systems are routed and installed to maintain the integrity of their respective redundant channels and to protect them from physical damage. Cable loading of trays and consequently heat dissipation of cable throughout the plant has been carefully studied and controlled to ensure that there is no overloading. The criteria for electrical loading were developed using IPCEA (now ICEA) Standard P-46-426, manufacturer recommendations, and good engineering practice. Derating factors for cables in trays without maintained spacing are taken from Table VIII of the IPCEA publication. Derating factors for the maximum ambient temperature existing in any area of the plant are also taken from the I PCEA publication. These factors are applied against ampacities selected from appropriate tables in other portions of the standard. For physical loading of trays, the followin criteria are followed: for 6.9-kV power, one horizontal row of cables is allowed in a for power, two horizontal rows of cables are allowed; for instrumentatio rcent of the of a tray is the maximum fi During initial plant construction, a computer program monitored the loading and prevented the routing of anything greater than this amount. For instrumentation cables, four basic channels are routed through the plant. These channels include cables for systems of 65-V or less. Cables assigned to these four channels are in their respective channels throughout the run. Certain other cables such as thermocouple cable, public address system cable, and instrument power supplies are run in the four instrument channels. Control cables are separated into two basic channels with a third channel provided as needed for redundant circuits. These groups of cables are set up for systems more than 65-V and less than 600-V and include multiconductor control cable or other cable as required. Cables assigned to these two channels for separation are in their respective channels and are so designated from the beginning of the cable to the final termination. These cables include: 1. Motor-operated valves -two channels for the redundant valves. 2. Solenoid valves -two channels where required for redundant valves and safeguards. Otherwise not separated.
- 3. Detector drives -run in any channel as convenient.
- 4. Motor controls -except safeguards, run in any channel as convenient.
- 5. Small power cables -run in any channel as convenient.
- 6. Safeguard control cables -run in two channels as required.
- 7. Safeguard power cables -separated into sufficient channels to provide minimum functions, e.g., three channels are provided for the containment fan cooler motors. In response to the NRC's February 11, 1980 Confirmatory Order, Consolidated Edison's August 11, 1980 letter to the NRC identified differences in cable raceway separation between Indian Point Units 2 and 3. Consolidated Edison determined, evaluated, and provided justification for each design difference between Indian Point Units 2 and 3 in submittals to the NRC (References 2, 3) demonstrating that a single failure would not preclude a safety function from Cha pter 8 f Page 17 of 29 Revision 20 OAG10000215_1055 IP2 FSAR UPDATE being performed.
The NRC reviewed these design differences and corresponding justifications and determined the Unit 2 design to be acceptable in their safety evaluation report (Reference 4). Physical channeling is accomplished by either separate trays or trays with and in some cases by separate conduit. The safeguard channeling and control train development, and cable tray separations are shown in Plant Drawings 208376 and 208761 [Formerly UFSAR Figures 8.2-17 and 8.2-18]. In general, redundant circuits are separated horizontally rathE!rthan vertically. When physical conditions preventthis,h()riz:()nt(:ilbarriE!rs(i:e.,tr(:insite or $O$§t metal barriers) separate O$§lVY power trays from instrument trays. To ensure that only fire retardant cables are used throughout the plant, a careful study of cable insulation systems was undertaken early in the design of the plant. Insulation systems that appeared to have superior flame retardant capability were selected and manufacturers were invited to submit cable samples for testing. An extensive flame testing program was conducted including ASTM vertical flame and Con Edison vertical flame and bonfire tests. A report summarizing the testing was prepared by Con Edison. These tests were used as one of the means of qualifying cables, and the specifications were written on the basis of the results. The following tests were made to determine the flame retardant qualities of the covering and insulations of various types of cables for Indian Point Unit 2: 1. Standard Vertical Flame Test -made in accordance with ASTM-D-470-59T, "Tests for Rubber and Thermoplastic Insulated Wire and Cable." 2. Five-Minute Vertical Flame Test -made with cable held in vertical position and 1750°F flame applied for 5 min. 3. Bonfire Test -consisted of exposing bundles of three or six cables to flame produced by igniting transformer oil in a 12-in. pail for 5 min. The cable bundles were supported horizontally over the center of the pail with the lowest cable 3 in. above the top of the pail. The time required to ignite the cable and the time the cable continued to flame after the fire was extinguished were noted. On the basis of these tests, cables were selected for the reactor containment vessel penetration. New cables are selected to conform with IEEE 383-1974. The design and use of fire stops, seals and barriers to meet 10 CFR 50.48 criteria for the prevention of flame propagation where cable and and floors is found in the document under separate cover entitled, In areas where missile protection could not be provided (such as near the reactor coolant system), redundant instrument impulse lines and cables are run by separate routes. These lines are kept as far apart as physically possible or are protected by heavy (0.24 in.) metal plates interposed where inherent missile protection could not be provided by spacing. In 1989, the NRC approved changes to the design basis with respect to dynamic effects of postulated primary loop ruptures, as discussed in Section 4.1.2.4. Chapter 8, Page 18 of 29 Revision 20 OAG10000215_1056 IP2 FSAR UPDATE In those areas where the compressed instrument air system is near the essential 480-V switchgear, the following provisions have been incorporated to shield this essential switchgear and cabling from potential missiles or pipe whip: 1. The compressed instrument air lines in the vicinity of the switchgear are supported at the piping bends. This will resist any step loading of PA (which could occur in the event of an instantaneous circumferential rupture) without occurrence of a "plastic hinge." The possibility of pipe whip is eliminated.
- 2. A guard cover is supplied around the air compressor flywheel.
This cover is designed to absorb the translational kinetic energy associated with a compressor flywheel missile. 3. A guard barrier is supplied adjacent to the compression chamber of the air compressor. This barrier is designed to absorb the kinetic energy associated with a compression chamber segment. These provisions ensure that no missile or whipping pipe originating from postulated failures in the compressed instrument air system will strike the essential switchgear. 8.2.3 Emergency Power 8.2.3.1 Source Descriptions The three sources of offsite emergency power are: (1) the Con Edison 345-kV system (2) Con Edison's 138-kV system and (3) the licensee's gas turbines. The emergency diesel-generator sets provide three sources of onsite emergency power. Each set is an Alco Model 16-251-E engine coupled to a Westinghouse 900 rpm, 3-phase, 60-cycle, 480-V generator. The units have a capability of 1750 kW (continuous), 2300 kW for 1/2 hour in any 24 hour period, and 2100 kW for 2 hours in any 24 hour period. There is a sequential limitation whereby it is unacceptable to operate EDG's for two hours at 2100 kW followed by operating at 2300 kW for a half hour. Any other combination of the above ratings is acceptable. Any two units, backups to the normal standby AC are capable of sequentially starting and supplying the power requirement of one complete set of safeguards equipment. The units are installed in a seismic Class I structure located near the Primary Auxiliary Building. Each emergency diesel is automatically started by two redundant air motors, each unit having a complete 53-fe air storage tank and compressor system powered by a 480-V motor. The piping and the electrical services are arranged so that manual transfer between units is possible. The capability exists to cross-connect a single EDG air compressor to more than one (1) EDG air receiver, via manual air tie valves. However, to ensure that the operability of two (2) of the three (3) EDGs is maintained for minimum safeguards in the event of a single failure, administrative controls are in-place to require an operator to be stationed within the EDG Building, whenever any of the starting air tie valves are opened. Each air receiver has sufficient storage for four normal starts. However, the diesel will consume only enough air for one automatic start during any particular power failure. This is because of the engine control system, which is designed to shut down and lock out any engine that did not start during the initial try. The emergency units are capable of starting and load sequencing within 10 sec after the initial start signal. The units have the capability of being fully loaded within 30 sec after the start of load sequencing. Cha pter 8 f Page 19 of 29 Revision 20 OAG10000215_1057 IP2 FSAR UPDATE To ensure rapid start, the units are equipped with water jacket and lube-oil heating. A prelube pump circulates the oil when a unit is not running. The units are located in heated rooms. Audible and visual alarms are located in the control room and in the diesel generator building. Alarms on the electrical annunciator panels in the control room are: 1. Diesel-generator trouble. 2. Diesel-generator oil storage tank low level. 3. 21 Diesel-Generator Trouble. 4. 22 Diesel-Generator Trouble. 5. 23 Diesel-Generator Trouble 6. Diesel-Generator Service Water Flow Low The activation of the emergency diesel generator trouble alarm in the control room will be caused by the initiation of any of the following alarms in the diesel generator building:
- 1. Low oil pressure.
- 2. Differential fuel strainer, secondary.
- 3. Overcrank.
- 4. High differential lube-oil strainer.
- 5. High water temperature.
- 6. High differential pressure lube-oil filter. 7. High-high jacket water temperature.
S. Deleted. 9. Overspeed.
- 10. Overcurrent.
- 11. Low fuel oil level, day tank. 12. Reverse power. 13. Low start air pressure.
- 14. Exciter field shutdown.
- 15. High/Low lube-oil temperature.
- 16. High differential pressure primary filter. 17. Deleted. The diesel-generator oil storage tank low level alarm will be energized on a low level in anyone of the three fuel-oil storage tanks. The alarms "21 Diesel-Generator Trouble", "22 Diesel-Generator Trouble", and "23 Generator Trouble" located on Panel SG in the Central Control Room will be activated respectively by the following conditions at each EDG local control panel: 1. Loss of DC control power. 2. Engine control switch position (Off or Manual). 3. Breaker control switch position pulled-out
[Note -the breaker control switch in the CCR will activate the "Safeguards Equipment Locked Open" alarm (Window 1-S on Panel SB-1) in the CCRl 4. Engine stop solenoid energized.
- 5. Day tank level low, primary and backup fuel pump fails to start. 6. For 23 diesel-generator trouble only, loss of voltage on EDG 23 auxiliary load main feed. Chapter S, Page 20 of 29 Revision 20 OAG1000021S_10SS IP2 FSAR UPDATE There are six electrical contacts, each of which when activated will energize a diesel-generator lockout relay. This lockout relay will, in turn, cause a diesel to shut down if it is operating or will prevent the diesel from responding to an automatic emergency start signal. These contacts are activated by one of the following conditions:
- 1. Activation of the diesel emergency stop push-button in the diesel-generator building.
- 2. Activation of the overcurrent relay. A phase-to-phase fault or excessive loads on the diesel generator will operate this relay. 3. Activation of the reverse power relay. 4. Activation of the overcrank relay. If a diesel engine fails to attain speed within 13 sec, this relay will be energized.
- 5. Activation of the overspeed relay. When the mechanical governor senses 1070 rpm, this relay will be energized.
- 6. Activation of the low oil pressure relay. This relay is energized by the coincident sensing of lube-oil pressure below 60 psi by two of the three oil pressure switches for each diesel. An oil pressure timer is set to allow 20 sec to pass before tripping the diesel engine lockout relay. This circuit is designed to provide sufficient time for the oil pressure to build up following an engine start. A safety injection signal will prevent the first three conditions from energizing the diesel engine lockout relay and tripping the diesel generator.
Activation of anyone of the latter three relays will cause a diesel to stop even when a safety injection signal is present. Shutdown permits corrective action to be taken before the engine is damaged, and the diesel generator can then be returned to normal operation. Once any of these six electrical contacts has been activated causing the diesel engine lockout relay to energize, the lockout relay must be manually reset locally before the diesel can be started. 8.2.3.2 Emergency Fuel Supply Each of the three emergency diesel generators has its own 175-gal fuel-oil day tank plus an underground bulk storage supply tank and uses diesel oil Specification Number 2. Each day tank is located within the diesel-generator building and supplies its respective engine-mounted fuel-oil pump. The day tank is automatically filled during engine operation from its separate underground storage tank located outside adjacent to the diesel-generator building. Each storage tank has a capacity of 7700 gal and is provided with a motor-driven transfer pump mounted in a manhole opening above oil level. Each pump can be aligned to discharge into the common normal or emergency makeup line to all three diesel-generator fuel-oil day tanks. If a low level is detected in the day tank for diesel generator 21, transfer pump 21 will automatically start to refill the tank to approximately 158 gal. If pump 21 fails to refill the day tank, transfer pump 22 will receive an automatic starting signal as a backup to the primary pump. In a similar manner, transfer pump 22 receives an automatic starting signal on low level in the day tank for diesel 22 and is backed up by transfer pump 23. Transfer pump 23 starts on low level in the day tank for diesel generator 23 and is backed up by transfer pump 21. Chapter 8, Page 21 of 29 Revision 20 OAG10000215_1059 IP2 FSAR UPDATE Each diesel oil transfer pump stops automatically when 15.5-in. of oil remains in the associated underground tank which equates to a maximum of approximately 7000-gal of available fuel oil per tank. A minimum fuel storage of 19,000 gal (i.e., approximately 6340 gal per tank) is maintained in the three underground storage tanks. The 19,000 gal of storage ensures that two diesels can operate for at least 73 hours at the maximum load profile permitted by the diesels' ratings. If one of the three storage tanks is not available, there is sufficient fuel oil to run two diesels at the maximum load profile for at least 45 hours. Similarly, if three diesels are available, there is sufficient fuel oil in the three storage tanks for at least 45 hours of operation at the maximum load profile. These values are based on the use of No. 2 diesel fuel oil at the lowest density of 6.87 Ib/gal and engine fuel oil consumption rates based on operating at each load rating. For heavier oil, the time would be increased proportionally to the ratio of 6.87 Ib/gal and the actual fuel density. An upper limit of 7.39 Ib/gal is common for No.2 diesel oil. Additional fuel oil suitable for the diesel engines is stored on the site for gas turbine GT-1 and at Buchanan substation for gas turbines GT-2 and GT-3. A minimum additional storage of 29,000 gal is maintained in the storage tanks dedicated for diesel-generator use. This storage is sufficient for operation of two diesels for at least 111 hours at the maximum load profile permitted by the diesels' ratings. As previously mentioned (Section 8.2.1), commercial oil supplies and trucking facilities exist to ensure deliveries on one day's notice. The basis for the minimum total required fuel oil quantity of 48,000 gallons is to provide for operation of two diesel generators for 7 days. The specified minimum quantity of fuel oil is based on operation of two diesel generators for 7 days at the maximum load profile permitted by the diesel generator rating. Each diesel is rated for operation for 0.5 hours of operation out of any 24 hours at 2300 kW plus 2.0 hours of operation out of any 24 hours at 2100 kW with the remaining 21.5 hours of operation of any twenty four hours at 1750 kW. Operation of the diesel generators at the maximum load profile ratings bounds the postulated accident load profile. If one EDG storage tank or transfer pump is unavailable, the remaining tanks or pumps with the additional 29,000 gallons of fuel oil can operate two diesels at the maximum load profile permitted by the diesel generator rating for at least 160 hours. 8.2.3.3 Emergency Diesel Generator Separation The emergency diesel generators are located in a sheet metal, steel-framed building immediately South of the Primary Auxiliary Building. The diesel generators are arranged parallel to each other on 13-ft centers, with approximately 10ft of clear space between engine components. The engine foundations are surrounded by a 1 foot-high concrete curb containing sufficient volume to hold all the lube-oil or fuel released from a single engine in the event of an inadvertent spill or line break. Diesel generator separation and fire protection features necessary to meetth E3 cr it E3r ia ()f 1 9 CFR 50.48 are described in the document under separate cover entitled, A control panel, which contains relays and metering equipment for all three diesel generators is located on the west end of the building. The panels are compartmentalized with controls for each engine separated from each other. The compartmentalized design minimizes the potential spread of fire to other electrical components. A reinforced-concrete wall separates the diesel generators from the control panel. Chapter 8, Page 22 of 29 Revision 20 OAG10000215_1060 IP2 FSAR UPDATE Based on the engine manufacturer's case histories of engine failures, missile protection between machines is not considered necessary. Field case histories disclose a complete absence of damage to the engine environs as a result of engine component failure. Engine failures, usually the result of extreme operating conditions, can be classified as follows: 1. Stuck valve. A valve sticks open and is struck by the piston. The damaged valve, and possibly part of the piston, enters the exhaust manifold, damages the charger, and passes harmlessly up the stack. There is no record of a damaged piston generating a missile external to the engine. 2. Piston seizure. A piston seizure causes bending and eventual fracture of the connecting rod. All damaged parts remain inside the engine block. 3. Turbo-charger failure. A turbo-charger wheel fouls the casing as a result of overspeed or overheat. The robust double-walled casing contains all parts. 4. Engine overspeed. The engine's normal operating speed is 900 rpm. Overspeed trips shut off the fuel at each individual fuel injection pump. No cast iron is used in the engine block or base so even if the overspeed trip failed, the engine structure, which is not brittle by nature, would contain any fracture parts. Isolated cases of crank shaft fractures have not resulted in flying missiles.
- 5. Cylinder head failure. Cylinder heads are secured to the block by high-tensile studs. No cap gaskets are used between the head and cylinder liners. This prestressed design, which does not allow slackness to develop, has resulted in an assembly that has not had any incidents of heads flying off, even when failed pistons have pounded the heads. There are also cases on record of improperly timed engines resulting in excessively high firing pressures, over 2000 psi (normal pressure 1600 to 1700 psi), in which the heads have always remained intact. Operating experience with the Alco engine indicates that internal missiles do not escape from the engine. Alco does not have any evidence of blades coming through the turbo casing. Valves from the engine have broken and been exhausted through the turbo and caused damage to the turbo, but are contained within the casing. There is no evidence of connecting rods escaping from the engine. To generate any flying parts, the generator would have to be in an overspeed condition beyond what is normally possible with a diesel engine. The construction of the stator windings and stator barrel frame would have to be penetrated by a rotor part in order to escape. The rugged construction of each complements its ability to contain flying objects. Chapter 8, Page 23 of 29 Revision 20 OAG10000215_1061 IP2 FSAR UPDATE Since the engine has overspeed trips and would not operate much beyond this speed because the valves would hang up, it is concluded that the generator would never reach any critical speeds. 8.2.3.4 Loading Description Each emergency diesel-generator unit is started on the occurrence of either of the following incidents:
- 1. Initiation of a safety-injection signal. 2. Undervoltage on any 480-V switchgear bus. On safety injection or undervoltage on any bus, the engines run at idle and can be connected to deenergized buses by the operator from the control room. Upon blackout (loss of power to bus SA or 6A) plus unit trip (with no SI), the emergency diesel-generators will be automatically connected to de-energized buses and sequentially loaded, but will continue to idle for live buses. Upon the activation of a safety injection (SI) signal and blackout (loss of power to bus SA or 6A) plus unit trip, automatic load sequencing is initiated as follows: 1. All 480-V switchgear feeder breakers, except those supplying motor control centers 26A/26AA, 268/2688, 26C, and 211 are tripped on undervoltage and all automatically operated non-safeguard feeder breakers are locked out. All engineered safeguards motors are supplied from the 480-V system.) 2. The emergency diesel generators are connected to their respective buses. [Note -An alarm (safeguards equipment locked open) will be energized in the Central Control Room if any control switch for the EDG breakers is in the "pull-out" position.]
- 3. Required engineered safeguards are sequentially started. The list of loads is shown in Table 8.2-2. 4. The operators may energize Motor Control Centers 24A, 27 A, and 29A (which feed equipment required for safe shutdown and accident mitigation) and their loads as required.
In an August 11, 1980 response to the NRC's February 11, 1980 Confirmatory Order, Consolidated Edison determined and evaluated the design differences between Indian Point Units 2 and 3 for automatic starting and sequential loading of the emergency diesel generators (EDGs). Whereas the Unit 3 EDGs are automatically connected to supply the 480-V emergency busses on an undervoltage signal, the Unit 2 EDGs will only supply the 480-V emergency busses on a 480-V bus undervoltage signal coincident with a safety injection or a unit trip signal. Each EDG receives automatic starting and sequential loading signals from both control logic Trains. The additional coincidence logic does not preclude manual starting and loading of the EDGs by the operators, and in the absence of a safety injection or unit trip signal, the steam generator water inventory and the steam-driven auxiliary feedwater pump provide sufficient time for such operator action. Consolidated Edison presented each design difference and justification to the NRC (References 2, 3). The NRC reviewed these design differences and Chapter 8, Page 24 of 29 Revision 20 OAGI000021 S_1 062 IP2 FSAR UPDATE corresponding justifications and determined the Unit 2 design to be acceptable in their safety evaluation report (Reference 4). Load sequencing for the emergency diesel generators during the safety-injection phase of a loss-of-coolant accident is described in References 5 and 6. The logic diagrams for the starting of the emergency diesel-generators and the safeguards sequence are presented in Plant Drawings 225100 and 225101 [Formerly UFSAR Figures 7.2-7 and 7.2-8]. The recirculation phase is initiated manually by control switches on the supervisory panel in the control room as described in Section 6.2.2.1.4. Loading studies show that the loads on the emergency diesel generators are maintained within their ratings for large loss-of-coolant accidents (as described above), small-break coolant accidents, steamline breaks, steam generator tube ruptures, and spurious injection actuations. Studies have also shown that, in the event of loss of both offsite and gas turbine power, one emergency diesel generator can provide adequate power to bring the plant to cold shutdown. Tests performed on the emergency power system to verify proper response within the required time limit are detailed in the Technical Specifications. See Section 8.5, Tests and Inspections. 8.2.3.5 Batteries and Battery Chargers Each of the four battery installations is composed of 58 individual lead-calcium storage cells connected to provide a nominal terminal voltage of 125-V DC. Each battery is fed from a separate charger and each charger is fed from a separate AC power panel. Each battery bus is equipped with a sensitive-type undervoltage relay, which provides alarm/indication of an undervoltage condition. Ground alarms are also provided on each board. Improved status indication of the battery chargers and the direct current system has been provided by segregating the battery charger alarms into four ground alarms and by providing four DC bus trouble alarms, which include an input for low battery terminal voltage. Loads on each battery are shown on Plant Drawings 208501 and 9321-3008 [Formerly UFSAR figures 8.2-15 and 8.2-16]. Loads on the 118-V vital alternating current instrument buses are shown on Plant Drawings 208502 and 208503 [Formerly UFSAR figures 8.2-13 and 8.2-14]. Each battery has been sized to carry its expected shutdown loads for a period of 2 hr following a plant trip and a loss of all AC power. All equipment supplied by the batteries are maintained operable with minimum expected voltages at the battery terminals during the 2 hrs. Each of the four battery chargers has been sized to recharge its own discharged battery within 15 hrs while carrying its normal load. Seismic design considerations have been adequately included in the design of the battery racks. Stress analyses of these racks assumed worst case conditions of static and dynamic loads in the vertical, horizontal transverse, and horizontal longitudinal direction; stresses were all within allowable values. 8.2.3.6 Reliability Assurance The electrical system equipment is arranged such that no single accident or incident can inactivate enough safeguards equipment to jeopardize plant safety. The 480-V equipment is arranged on four buses. The 6.9-kV equipment is supplied from six buses. Chapter 8, Page 25 of 29 Revision 20 OAG10000215_1063 IP2 FSAR UPDATE The plant auxiliary equipment is arranged electrically so that redundant items receive power from different sources. The charging pumps are supplied from 480-V buses 3A, SA, and 6A. The six service water pumps and the five containment fans are divided among the four 480-V buses. Valves are supplied from motor control centers 26A/26AA and 268/2688, which are supplied from buses SA and 6A, respectively. The outside source of power is adequate to run all normal operating equipment. The 138/6.9-kV station auxiliary transformer can supply all the auxiliary loads. The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries. Two diesel generators have enough capacity to start and run a fully loaded set of engineered safeguards equipment. These safeguards can adequately cool the core for any loss-of-coolant incident and maintain the containment pressure within the design value. The power supplies to the diesel generators' auxiliary equipment are arranged so that each diesel generator will feed its own auxiliary equipment. A total loss of DC feed to the switchgear and associated equipment will not cause a loss of offsite power through an inadvertent tripping of the Indian Point Unit 2 light and power supply circuit breakers, because DC is required to trip a breaker. Loss of DC feed to protective relaying will cause an alarm condition rather than initiation of a protective action. If necessary, the light and power circuit breakers in the 8uchanan substation may be tripped manually at the breaker mechanisms. Each independent battery installation is maintained under continuous charge by its associated self-regulating battery charger so that the batteries will always be at full charge in anticipation of a loss-of-ac-power incident. This ensures that adequate DC power will be available for starting and loading the emergency diesel generators and for other emergency uses. The equipment arrangement in the Indian Point Unit 2 Central Control Room is discussed in Section 7.7. REFERENCES FOR SECTION 8.2 1. Letter (with attachments) from S. A. Varga, NRC, to W. J. Cahill, Jr., Con Edison, Safety Evaluation Indian Point Unit 2 -Proposed Modification of the 12SV DC 8attery System, Dated May 2, 1980 2. Letter from William J. Cahill, Consolidated Edison, to Harold R. Denton, NRC, "Confirmatory Order", dated May 9, 1980 3. Letter from John D. O'Toole, Consolidated Edison, to Steven A. Varga, NRC, "Confirmatory Order", dated May 27, 1982 4. Letter from Steven A. Varga, NRC, to John D. O'Toole, Consolidated Edison, "Confirmatory Order", dated December 1, 1982. Chapter 8, Page 26 of 29 Revision 20 OAGI000021 S_1 064 IP2 FSAR UPDATE 5. "Emergency Diesel Generator Loading Study for Indian Point Unit 2," WCAP-12655 (Non-Proprietary Class 3), Rev. June 2002. 6. Letter from Westinghouse to Entergy, IPP-03-187, "EDG Load Study Reconciliation," November 13, 2003. TABLE 8.2-1 Deleted TABLE 8.2-2 Diesel Generator Loads .................... 0{8> 24 .................. . ................. . 0.822 0.8.23 (BUS 2A-3A) 1. Auxiliary component cooling pumps (BUS 5A) 1 (BUS 6A) 1 2. Safety injection pumps 1 1 1 3. Residual heat removal pumps 1 1 4. Nuclear service water pumps 1 2 1 1 5. Containment air recirculation cooling fans 2 1 6. Auxiliary feedwater pumps 1 1 7. Spray pumps (if start signal present) 1 1 Figure No. Figure 8.2-1 Figure 8.2-2 Figure 8.2-3 Figure 8.2-4 Figure 8.2-5 Figure 8.2-6 Figure 8.2-7 Figure 8.2-7a Figure 8.2-8 Figure 8.2-9 Figure 8.2-9a Figure 8.2-10 Figure 8.2-11 Title TABLES 8.2-3 & 8.2-4 Deleted 8.2 FIGURES Electrical One-Line Diagram, Replaced with Plant Drawing 250907 Electrical Power System Diagram, Replaced with Plant Drawing 250907 Main One-Line Diagram, Replaced with Plant Drawing 208377 345-KV Installation at Buchanan 6900-V One-Line Diagram, Replaced with Plant Drawing 231592 480-V One-Line Diagram, Replaced with Plant Drawing 208088 Single Line Diagram 480-V Motor Control Centers 21, 22, 23,25, 25A, Replaced with Plant Drawing 9321-3004 Single Line Diagram -480-V Motor Control Centers 24 and 24A, Replaced with Plant Drawing 249956 Single Line Diagram -480-V Motor Control Centers 27 and 27A, Replaced with Plant Drawing 9321-3005 Single Line Diagram -480-V Motor Control Centers 28 and 210, Replaced with Plant Drawing 208507 Single Line Diagram -480-V Motor Control Centers 29 and 29A, Replaced with Plant Drawing 249955 Single Line Diagram -480-V Motor Control Centers 28A and 211, Replaced with Plant Drawing 208241 Single Line Diagram -480-V Motor Control Centers 26A and 26B, Replaced with Plant Drawing 9321-3006 Chapter 8, Page 27 of 29 Revision 20 OAG10000215_1065 Figure 8.2-11a Figure 8.2-12 Figure 8.2-13 Figure 8.2-14 Figure 8.2-15 Figure 8.2-16 Figure 8.2-17 Figure 8.2-18 IP2 FSAR UPDATE Single Line Diagram -480-V Motor Control Center 26C, Replaced with Plant Drawing 248513 Single Line Diagram -480-V Motor Control Centers 26AA and 26BB and 120-V AC Panels No.1 and 2, Replaced with Plant Drawing 208500 Single Line Diagram -118-VAC Instrument Buses No. 21 thru 24, Replaced with Plant Drawing 208502 Single Line Diagram -118-VAC Instrument Buses No. 21A thru 24A, Replaced with Plant Drawing 208503 Single Line Diagram -DC System Distribution Panels No. 21, 21A, 21 B, 22, and 22A, Replaced with Plant Drawing 208501 Single Line Diagram -DC System Power Panels No. 21 thru 24, Replaced with Plant Drawing 9321-3008 Single Line Diagram of Unit Safeguard Channeling and Control Train Development, Replaced with Plant Drawing 208376 Cable Tray Separations, Functions, and Routing, Replaced with Plant Drawing 208761 8.3 ALTERNATE SHUTDOWN SYSTEM The Indian Point Unit 2 alternate safe shutdown system provides the necessary functions to maintain the plant in a safe shutdown condition following a fire that damages the capability to power and control essential equipment from normal and emergency Indian Point Unit 2 sources. In the unlikely event of a major fire or other external event affecting redundant cabling or equipment in certain areas, electrical power could be disrupted to safe shutdown components and systems. However, following the unlikely loss of normal and preferred alternate power, additional independent and separate power supplies from the Indian Point Unit 1 440-V switchgear are provided for a number of safe shutdown components. A detailed description of the alternate safe shutdown system including its functions, components, and operation is provided in the document under separate cover entitled,
8.3 FIGURES I Figure No. I Title 8.4 MINIMUM OPERATING CONDITIONS The electrical system is designed such that no single contingency can inactivate enough safeguards equipment to jeopardize plant safety. The minimum operating conditions define those conditions of electrical power availability necessary (1) to provide for safe reactor operation and (2) to provide for the continuing availability of engineered safety features. The facility Technical Specifications, Section 3.8, include minimum operating conditions covering the following plant conditions:
- 1. Minimum electrical conditions for reactor criticality.
- 2. Minimum electrical conditions during power operation.
Chapter 8, Page 28 of 29 Revision 20 OAG10000215_1066 8.5 TESTS AND INSPECTIONS IP2 FSAR UPDATE Emergency Diesel generators are tested in accordance with technical specification requirements. The tests specified are designed to demonstrate that the emergency diesel generators will provide power for the operation of equipment. They also ensure that the emergency generator system controls and the control systems for safeguards equipment will function automatically in the event of a loss of all normal 480-V AC station service power. The testing frequency specified is often enough to identify and correct deficiencies in systems under test before they can result in a system failure. The fuel supply and starting circuits and controls are continuously monitored and any faults are alarm indicated. An abnormal condition in these systems would be signaled without having to place the emergency diesel generators on test. The Emergency Diesel Generators will be inspected in accordance with a licensee controlled maintenance program. The maintenance program will require inspection in accordance with the manufacturer's recommendation for this class of standby service. Changes to the maintenance program will be controlled under 10 CFR 50.59. Station batteries will deteriorate with time, but precipitous failure is extremely unlikely. The surveillance specified is that which has been demonstrated over the years to provide an indication of a cell becoming unserviceable long before it fails. The periodic equalizing charge will ensure that the ampere-hour capability of the batteries is maintained. The 'refueling interval' load test for each battery, together with the visual inspection of the plates, will assure the continued integrity of the batteries. The batteries are of the type that can be visually inspected, and this method of assuring the continued integrity of the battery is proven standard power plant practice. At monthly intervals, at least one gas turbine shall be started and synchronized to the power distribution system for a minimum of thirty (30) minutes with a minimum electric output of 2000kW. At weekly intervals, the minimum gas turbine fuel volume 94,870 gallons shall be verified to be available and shall be documented in the plant log. These tests and surveillances are designed to assure that at least one gas turbine will be available to provide power for operation of equipment, if required. Since the Indian Point 2 alternate safe-shutdown power supply system demands a maximum electrical load of approximately 1600 kW, the required minimum test load will demonstrate adequate capability. In addition, the required minimum gas turbine fuel oil storage volume of 94,870 gallons will conservatively assure at least three (3) days of operation of a gas turbine generator. The specified test frequencies for the gas turbine generator(s) and associated fuel supply will be adequate to identify and correct any mechanical or electrical deficiency before it can result in a component malfunction or failure. Chapter 8, Page 29 of 29 Revision 20 OAG10000215_1067 EASlVtEW I /r-----L.- ______ , MILLWOOD WEST 345KV ..... J--I18I------+-..V.g.---, ________ W97 RAMAPO I lBKV EAS'MEW lAOENTOWN ,-
'!!)--I I /' TM ( I : & 4 I : : L 1 I rt '>,1 I rh BUCHANAN rf, I J Y 345KV lj-l I I \ ',,-I I 1----, I I rf, I I T I L _______ __________
t' __ ..J W96 r-----------'-., I \:rz INDIAN POINT I L ____________ -1 INDIAN POINT UNIT No. 2 UFSAR FIGURE 8.2-4 345KV INSTALLATION AT BUCHANAN MIC. No. 1999MC3885 I REV. No. 17 A OAGI0000215_1068 2 21 20046:59:12 AM 250907-0-21.DWG 6 4 -3 Ul (t' o f-f-o (t' (l OcL'--,---J (t' o '5: f-w Ul (t' o U W o (t' (l '" (t' o i'" A 138KV MILLWOOD SUBSTATION 96952 I F96952 r F96952 M BUS F2 I SPLICE BOX "2E" GAS TURBINE 2 28MVA .... W BGT -2 B I SPLICE BOX "2C" C I r-____ -r ____ Js, ,L, ,-Js, I T I I v li,3J ( I 3, 8KV BUS 2B) (13,8KV *---t BUS 3B) D 13W94 R&J I GAS TURBINE 3 W BGT -3 t-----t'-Jo*c------J v 13W94M F2-5 BUCHANAN 13,8KV T (13,8KV BUS 2A) 13W84 ,'---,'---T3 F2-2 F2-3 T2 * . L I 38/ I 3 ,8KV '--r-T TRANSFORMER I T 7 13W94L IPI E I F I 1381 I 3, 8KV '--4 13W82 138/ I 3, SKV T TRANSFORMER 3 T TRANSFORMER 2 35MVA 46.7MVA 35MVA BK-I 7A G I H I I BUCHANAN 345KV NORTH RING 118 ,BK-3 * ,BK-2 13W92 J M +----+-------J ... ----1[8]1----- ... J--+-J ... ... y-+--I: IBT2r_:---J-- ........ J-+-----IF -7f---".
r_-----4------
-1 ....... -1 7 1---/ ? .. ----!GI---".Y--""-"Y
- . ---!GJ 7B 9B I I A 95332 13W93 BT3-4N B13-45 BT2-3N 8T2-3S BT I -2N 6T I -2S F96951 BUS BT2-6E R I -I RI-O TRANSFORMER TA5 345/138KV 234MVA BUCHANAN 138KV F3 FI BT 2-6 ,---, SPLICE '-----------------------------------------------.1'1",.
I BOX "2A" 13W92
- 95951/95093 PEEKSKILL REFUSE BURNING GEN STA, 138KV M F9695 I 96951 MILLWOOD SUBSTATION 138KV BT2-6W 95331 GAS TURBINE I 22,3MVA .........
OJ I GT ,----GI-I LOCKED B2-2 OPEN 13,8KV I 3 ,8KV '--r L&P BUS SECT I L&P BUS SECT 21
- SBI-I
- SBI-2 12RW3 12F03 .* 1 ** ---.. 1.. ,----63-3 13,8KV '-, L&P BUS SECT 3
- SBI-3 R 1-4 13,8KV '-, L&P BUS SECT 4 MAIN
- S61-4 TRANSFORMER 21 22/345KY 542MVA @ 55 DEGREE C, RISE '----------
..... ----jSBI-Tr_------------ .... M F7-9 W95 F9-1 I (' M W93 EASTVIEW SUBSTATION 345 KV MAIN TRANSFORMER 22 22/345KV 542MVA @ 55 DEGREE C, RISE +-_---., ____ .... ... __ ... / ... --_./ ... _ ... .... ** ST lP3 AUX Y l+/-3 Y Y TRANS, ,_ --GTI '-, SYN BUS WEST SECTION SYN BUS EAST SECTION UNIT AUX GENERATOR 2 ;¢;* TRANSFORMER ( ) 22KV, 1800RPM STATION AUX TRANSFORMER 138/6,9KV ,;;-;;;, 43MV A C, RISE (2) 2000 KVA TRANSFORMERS 13,8KV-480/277V ST5 EMERGENCY DIESEL GENERATOR 21 OJ BT4-5N BT4-55 BT5-6N ,----------IP3-------, I 6, 9KV BUS I I I I I 52GT , 52GT I /2F j IBT I I GAS TURBINE I I AUTO TRANSFORMER IP3 I I 13,8/6, 9KV APPENDIX I 20MVA "R" I DIESEL IP3 I L ___________________ SS5 6,9KV BUS 5 STATION SERVICE TRANSFORMER 5 6,9KV/480V 2,67 MVA BT5-68 BK5 GT2 GAS TURBINE AUTO-TRANSFORMER 13,8/6,9KV L'\ 20MVA -r UTI UT2 U13 UT4 6,9KV BUS I 6,9KV BUS 2 6,9KV BUS 3 6,9KV BUS 4 521 RWI SUB,STA 21RWI TRANSFORMER 6,9KV/480V 1250 KVA UTI ST5 S52 STATION SERVICE TRANSFORMER 2 6.9KV/480V 2,67 MVA IUT2 1 5T5 U13 ST6 SS3 S2 RW3 UT4 ST6 EMERGENCY STATION SERVICE SUB,STA 22RW3 GENERA TOR 22, I TRANSFORMER 3 =s TRANSFORMER I 750KW T 6, 9KV / 480V 6, 9KV I 480V ___ 2_, _67_M,VA ) g I 250 KVA MCC 121 22/6,9 KV ,<,I). 1439,2MVA 43MVA @ 55 DEGREE C, RISE EMERGENCY DIESEL GENERA TOR 23 OJ l)EG3 [] ST6 6.9KV BUS 6 SS6 '-, '7 L T2 SERVICE TRANSFORMER 6 6.9KV/480V 2,67 MVA I , 2, NOTES, FII-12 f' M Y94 RAMAPO SUBSTATION 345KV SEE REFERENCE DRAWINGS FOR ALL ADDITIONAL CONNECTIONS TO SWITCHGEAR AND CONTROL CENTERS -z w z l)EGI ) EG 2A ) EG 2B ) 3A 480V BUS 6A ---* DISTRIBUTION LOAD
- MOLDED CASE SWITCH A,: W CAT #RHFA-2100N T ,THIS SWITCH IS NOT TO BE USED] LTO OPEN ENERGIZED CIRCUIT J 2 -480V DWG,303257 SUBST,A MCC 29 MCC 29A ) i TRANSFORMER 21 480/ I 20V r 15KVA-I¢ i [J BATT, CHRGR 250A 21 125VDC POWER PNL 21 -) BATT _L 21 -*1500 AH ) MCC 9A ) 480V BUS 5A ) MCC 6A ) MCC 8 ) PENETRATION H69 MCC 26A MCC 28 I I MCC 26AA ;::::;::::::
TR A NSF 0 R MER 480/120V 15KVA-1125 23 ) TRANSFORMER I 480/208-120V "'I" I) SOLATRON TR# 23 N U-' oz >CL co OJ, -e--OJ U 0-' >z COCL OJ IOKVA INVERTER_ 21 120VAC DIST, PNL I Ul H o UJ H o BYPASS SWITCH 21 N E I 18VAC INST BUS 21 118VAC INST BUS 21A ) 2A T5A 480V BUS 2A ) MCC I ) MCC 3 ) MCC 4A ) MCC 8A ) MCC 10 MCC 21 ) MCC 23 MCC 24 I MCC 24A MCC 28A BATT , CHRGR 250A 22 I I I I MCC 210 I IP3 480V BUS 2A 125VDC POWER PNL 22 TRANSFORMER 24 480/120V 15KVA-I¢ ) BOLTED AND SOLATRON 0J 0J _L BATT, A"; -=-22 I
- 1800 AH TR# 24 E >-INVERTER IOKVA 22 N BYPASS SWITCH 22 u-' oz >0. co N' -f-UJ H o -UJ H o UJ H o I I 8VAC INST BUS 22 I 18VAC INST BUS 22A ) 2A T3A ) 480V BUS 3A ) MCC I I ) MCC 6C ) MCC 5 MCC 21 I E Mec 26C MCC 25 I BATT , CHRGR 250A 23 125VDC POWER PNL 23 ) I) X -BATT -=-23 *495 AH _ INVERTER I OKVA , 23 N BYPASS SWITCH 23 UJ H o MCC 25A I I 8VAC INST. BUS 23 I 18VAC INST, BUS 23A ) MCC 2 MCC 22 TRANSFORMER 480/208-120V 45KVA ) 3A T6A ) MCC 6B ) MCC 7A MCC 266 I) MCC MCC 26BB 27A I BATT , CHRGR 250A 24 MCC 27 125VDC POWER PNL 24 1 2 I I) 22 ) I) BATT. I) 1 BOL TEO AND BY-PASS -24 << 120VAC 015T. ?NL 2 SOLATRON TR# 22 -*495 AH =;';';';;;"'=;;';";'-0..;.;;;"';;' I NV E R T E R E 24 IOKVA u (\J 0-' >z COCL N BYPASS SWITCH 24 N UJ H o \ 3,
- STATED CAPACITY IS THE NOMINAL FOR 8 HOUR DISCHARGE TO 1,75 V PER CELL FINAL, FOR MORE DETAILED VERSION REFERENCE DWGS, I 4 I 0 I 86, I 4 I 0 I 87. AND I 360936 " }(211 REFERENCE DRAWINGS, 480VAC SWITCHGEAR BUSES I-LINE"" "" ,A208088 MAIN AC I -LINE, , , , , , , , ' , , , , , , , , , , , , , , , ,A208377 118 VAC INSTRUMENTATION BUS I-LINE"" ,A208502 6,9 KV I -LI NE 00 00 00 00 , 00 00 00 00 00 00 00 00 ,A23 I 592 125 VDC POWER PANELS I-LINE""""", ,9321-F-3008 THIS DRAWING CONTAINS ITEMS WHICH MUST BE CONTROLLED WITHIN CON EDISON AS, fA --i I 18VAC INST BUS 24 I 18VAC INST BUS 24A COMPUTER GENERATED DRAWING NOT TO BE HAND REVISED TITLE: ELECTRICAL DISTRIBUTION STATION R REVIEWER E V.MYERS 6/27/03 V 11----1 S THIS REVISION IS NON-CLASS PER THE QAPO, UPDATED DRAWING PER CR-IP2-2002-I 1039 RELEASED FOR RECORD 1----1 F, HOFFMAN G, BLENKLE 9/12/91 AND TRANSMISSION SYSTEM f2.:rlO INDIAN POINT -UFSAR FIG, NO, 8,2-1 & 8,2-2 U I o N ENG A I B I C I D I E I PIN 69901-AF 6/27/03 F SL/VM I
____ DATE
- ORVIN. SCALE NO. ENG ENG. _ I' REVIEW APPROVALS "BOWE/WATKINS NONE A250907-21 DZ G I H I I , ,
OAGI0000215_1070 2/21/20045:2555 AM 231592-0-18,DWG 6 5 4 3 2 IA 1[\ 52 HOP 21 \/ --A 2 52 CWP 26 B 6,9KV BUS 3 3 4 z 0 52 H t;j SS3 oll. 49) wU) 50 (!l I TIMC \/ . 3-CT'S 1[\ 52 RCP 23 5 3 -C T ' S 2500-5 1[\ 52 un-* ST6 6 11\ 2-PT'S B (jfr 7200-X\ 120V k 'C -6A C 7 3-CT' S 2500-5 52 un \/ o 8 3-CT' S 2500 -5 :::: 52 UT4 \/ 9 1\ 52 RCP 22 E 6,9KV BUS 4 10 1\ 52 CP 23 \/ I I 52 CWP 24 \/ F 12 o 52 is wHOP 2 w 22 49 817; 50 (!l I n-1c: d \/ /""",1 13 3-CT' t;: 2500-54-::: 52 UT4-* ST6 14 G --14 6,9KV BUS 6 15 ______ -, 2-PT'S 7200-120V 1\ 52 ST6 * \/ H 16 1[\ 52 CWP 22 17 52 SS6 \/ I 17A 3-CT'S<>-2000-5<-52 GT26
- TO DIFF. \/ RELAYS 3-CT'S 200-5 3-CT'S
\20 c;j 300-5 3-CT'S 800-5 3-CT'S 1200-5 f-I 3-CT'S 3-CT'S 800-5 3-CT'S 400 -5 :---1--=-----, 3-CT'S 200 - -::= 3-CT'S 1 c;j 200-5 CO I CL :: = 3-CT'S ---1-_1200-5 H 27-4 3-CT'S :;;: 2500-5 3-CT'S 200-5 3-CT'S 300-5 3-CT'S _2500-5 :;1=== 3 :'::::: /4-9' ¢c CO CL I is <:::: 3 I 49 50 :;F:' r----(2 7 -1200-5:,:
- r-----, I 49 \ 50 I I I is I 49 ) 50
- ;p.-T CV-7 1 ...----1 27-6 I-3 :':> AMS 3-CT'S 5 \ 200-5 5;'; co 51N\ 57 co A 50 BL (51 I-¢B CO I-N 51N 50N ¢ CO TS I -¢B f--49) << 50 -.J BL I 7 51 ) 50 CO I N ) OCO TS I zo HW W Oll. wU) U) 03 -.JO U-.J 5 I ) 50 o [Z] SH A CO TS I HC-252 BL ;0 co I 51N 50N TS I A A [1] SJ HC-252 A [1] SA HC-252 SPEED ¥--¥CHANGER .... SWITCH HC-252 SUB, STA 22RW3 TRANS. 6900-480V I 250KVA DWG 245622 1000 1000 400 HEATER DRAIN CIRC.WATER PUMP NO.21 PUMP NO.26 932 I -3 I I 4 23 I 67 I NOTES: SHT 9 STA.SERVICE TRANS.NO.3 6900-480V 208088 6000 REACTOR COOLANT PUMP NO.23 9321-3114 SHT 7 I ,52=75DH500 ACB 1200A SOLENOID, .=2000A SOLENOID, *=1200A STORED ENERGY 2.IT] =LOCATED ON CONTROL ROOM PANEL 3.EQUIPMENT NOT MARKED LOCATED AT SWGR 4.86UTI TRIP & LOCKOUT BKR'S 52/UTI & 52/UTIST5 86UT2 TRIP & LOCKOUT BKR'S 52/UT2 & 52/UT2ST5 86UT3 TRIP & LOCKOUT BKR'S 52/UT3 & 52/UT3ST6 86UT4 TRIP & LOCKOUT BKR'S 52/UT4 & 52/UT4ST6 86ST5 TRIP & LOCKOUT BKR'S 52/ST5,52/UTIST5,52/UT2ST5,52/GT25 86ST6 TRIP & LOCKOUT BKR'S 52/ST6,52/UT3ST6,52/UT4ST6,52/GT26 62UTI ,62UT2,62UT3,62UT4,62ST5,62ST6,BKR.FAILURE TIMER 5.ALL BUSES-6900V. ,3)Zl,60HZ., 1200A., EXCEPT AS NOTED. 6.THIS DRAWING SUPERSEDES W'HSE DWG.540F922.
IT] SH 7.FOR MORE DETAILED VERSION REFERENCE DWGS. I 4 I 0 I 86, I 4 I 0 187 AND I 360936 HC-252 18A 3-CT'S 2000-5, ...... :r 1[\ 52 GT25
- 3-CT'S 2500-5 f-:p.-o 6,9KV BUS 5 18 1\ 52 SS5 19 1[\ 52 CWP 25 \ / 3-CT'S \V 200-5 3-CT' S , 300-5 _ '\ [Z] SH 51 50 A Co TS I HC-252 ( 5 I 50 CO I ( 49 50 BL I ( 5 I 50 CO I ( 51 N 50N :)CO TS I I . I-.J W ICL liS I:;;: -.J t zo HW W on. wU) U) 03 -.JO U-.J A [1] SJ 20 II" 3-CT'S 4000-5 52 ST5
- 3-CT'S <[;;: 2500-5 1-AUX. _, CT )ZlB:': =4,8-2 3 51 ST5 CO -, 1 I 1 51N I-_I ST5 1 co r-I I I I I 86 ST5 ) AWL SPEED HC-252 I @ CHANGER I MG-6 SWITCH I TO-53 A 21 81-3 YcV-7 f---' I KF, Y @ MG-6 .1 27-XI 27-X2 MG-6 /\ MG-6 B i\ 2-PT'S A l: 7200-.._--I -AUX, CT ¢B:;:> 5-1 -, 1 I 3 (51 \"'UT4 CO 51 50 BL CO I 49 50 BL I CO I I r;: 49) .J t BL I 5 I ) 50 CO I zo HW W oll. wU) U) 03 -.JO U-.J BL I 51 ) 50 CO I (27-1 27N K 27-4 62A -
X 27-4 MG-6 X2 27-4 X3 SG CV-7 1 27-6 MG-6 62 TIMING I-AUX. )ZlB 3 (51 \2,T61--, CO 1 I BL ;0 zo HW W oll. wU) U) 03 -.JO U-.J 5 I ) 50 Co o TS 27-27N 27-X3 27-SG \f{ 120V TIMING (j) RELAY /"""".1 1 1(51N I-_ I\UT3; -l I I I /"""".1 I 51N 50N CO 51N 50N CO 6 CO N ) ¢ CO TIMING RELAY 27-4 TIMING 62 RELAY 27-4 27-6 RELAY 62X MG-6 -I 1 lsi N \ST6 CO I -co /""",1 51N 50N :)CO TS I [1] SH A HC-252 TIMING RELAY 62 27-62X -MG-6 6A 1 '---Co ( UT3 WL 86 UT4 WL TS I A TS I [1]sc A TS I [1] SJ SJ [1] 62X MG-6 TS A A [1] SC HC-252 o o o A [l]SA HC-252 HC-252 SPEED HC-252 CHANGER HC-252 I -4) 1 KF ( ------_fs6X\ -\CV 1200A BLS FI v IA IT] FC KA-241 } TO SYN. SW. DWG.#208377 [1]SH HC-252 ,---__ +-__________ ---j VS IT] SH v IT] FC KA-241 v SYN.SW. DWG,#540F921 I A IT] SH HV-252 21 2-PT'S 7200-120V 22 3-CT'S 2500-5 ::: 52 UT2-* ST5 TO-53 <<U) 00 gO) " TO-53 [1]SH HC-252 6000 3000 A UN'XYuYLNS. A REACTOR COOLANT PUMP NO,22 9321 -31 14 SHT I I CONDENSATE PUMP NO.23 9321 -31 14 SHT 12 22 6,9KV-2000A BUS TO 87UT DWG.#208377 6,9KV BUS 2 23 52 SS2 24 1[\ 52 CWP 23 ,-------<e-,,-_ Z 0 o 50 U) I LO LJ I I 25 52 CP 22 \/ 26 1[\ 52 RCP 24 \V ¥--¥ SWITCH 1000 400 CIRC,WATER PUMP NO.24 231670 2000A BUS 27 1000 HEATER DRAIN PUMP NO.22 9321 -31 14 SHT 14 [1]SH HC-252 A 3-CT'S 2500-5 52 UT2 3-CT'S 1200-5 _ 3-CT'S 3-CT'S A MC ,dH 51 I, 50 1 -.J 3-CT 'S 400-5 '\ 3-CT'S 800-5 6A B :J) 2-PT' S B A A 7200-Iy \ 120V \/ 81 -2 MG-6 X I 81 T -6A .L 27-I 2A 27N 2/7--""2 I CV-7 i TIMING RELAY 27-2 MG-6 X I 27-2 MG-6 X2 27-2 X3 SG 27-2 TIMING 62 RELAY := 300-5 200-5 ---1---------, --1-----'
- 3:1=: 51 50/ CO [Z] SH A TS I HC-252 W CO I 0: 49 50 BL I 51 50 CO I 51N 50N TS I 10 I:;;: -.J t zo HW W oll. W{J) (J) 03 -.JO U-.J A [1] SJ HC-252 I 49 50 BL I 51 50 A CO I [l]sc HC-252 49 50 BL I ;0 co I 51N 50N :)CO [1] SA A TS I HC-252 3-CT'S 1200-5 I-AUX. CT 5-1 3 51 UT2 1--, CO 1 I /""",1 1 51 NI-l UT2 1 co (U 8 T 6 2) YwL TO-53 f<'-
81 -4) MG-6 XI 81-T2 ) << ou) 00 DO) " vvvv TO SYN. SW. { DWG.#208377 STA AUX.TRANS, 138-6,9KV "----{25 -2l"'C-,,-Vh. E --..... [1] SH C"\ [1] SH HC-252 [1]} FB-6 [l]SH HC-252 A [1] KP-241 FCR T @MG-6 v [1]SH HV-252 VS 28 1,\ 52 UTI 3-CT'S 2500-5 29 3-CT'S 2500 -::.5!--__ I, 52 UTI-* ST5 30 } SYN. SW, ___ -+__ DWG.#208377 6,9KV BUS 1 30 2-PT'S 7200-120V 31 1[\ 52 RCP 21 SPEED CHANGER SWITCH 1000 400 CIRC. WATER PUMP NO.22 231669 TO 87ST DWG. #208377 32 1[\ 52 CP 21 STA.SERVICE TRANS,NO.6 6900-480V 208088 --33 1[\ 52 CWP 21 W -.J 0) << U MG-6 o I 2 H ( ou) bj i§ °H TMC -.J I I U . 200-5 50 I-.J W 3-CT'S :;: 1200-5 3-CT'S 1200-5 _ :':= 3-CT'S 3-CT'S (51 400-5 3 -C T 'S -----, C I 0 800-5 : I=: -, . I I ' I 49' I CL liS I :;;: I-AUX. CT 5-I 3 51 UT I 1--, CO 1 I 1 51 N I-UTI 11 co 86 UTI WL I 27-5 CV-7 27-5 XI 27-5 62 MG-6 2-PT'S B 7200-120V BA(\ J I 81-1 KF 81-1 XI MG-6 27N .1 I ( 2 1 7 A-\ 2/7--""1 0 (27-I CV-7 62A TIMING RELAY 27-1 MG-6 27-1 X2 MG-6 27-1 49 50 BL I ;0 co I 51N 50N :)CO TS I 6 9 50 BL BL 51N 50N 'co :)' TS 51 50 I CO I 51N 50N TS -.J t 0 zw HW ll. OU) W u)3 00 -.J-.J U o TIMING 27-5 RELAY 62X \I SG 27-1 62 TIMING 27-I RELAY 62X [1] SA A [1] SC A A [1] SJ HC-252 --------'"' HC-252 HC-252 TO-53 MG-6 6000 3000 34 52 21 8..W \1 I W -.J 0) << u W -.J 0) << u @r--------------- -__ 2000A BUS 27-2 MG-6 62X -SPEED CHANGER n SWITCH '¥---¥ 1200A BUS '--/ MG-6 REACTOR COOLANT THIS DRAWING CONTAINS ITEMS WHICH MUST BE CONTROLLED WITHIN CON EDISON AS PUMP NO.21 9321 -31 13 SHT 7 CONDENSATE PUMP NO.21 9321 -31 13 SPEED n h CHANGER L .J SWITCH 1000 400 CIRC. WATER PUMP NO.21 231666 SUB, 21 RI TRAN 6900-1250f DWG 24 AUTO-TRANSF GAS TURBINE GENERATOR NO, I I 3800-6900V 250907 STA,SERVICE TRANS. NO.5 6900-480V 208088 A 1000 400 CIRC. WATER PUMP NO.25 231668 B A RECORD OF THE ORIGINAL WITH INITIALS/SIGNATURES IS MAINTAINED IN CENTRAL ENGINEERING DOCUMENTATION FILE. THE LAST PENCILED REVISION WAS 01 THE ORIGINAL TRACING FOR THIS DRAWING WAS PREPARED BY WESTINGHOUSE C STA,SERVICE TRANS.NO.2 6900-480V 208088 o 1000 400 CIRC,WATER PUMP NO.23 231667 3000 CONDENSATE PUMP NO.22 9321 -31 13 SHT I I E 6000 REACTOR COOLANT PUMP NO.24 9321 -31 13 SHT 10 R V.MYERS E 6/27/03 THIS REV IS NON-CLASS V AS PER QAPD I !----"D=ES'----IUPDA TED DwG AS PER CR-IP2-2002-11039 S RELEASED FOR RECORD I PIN 69901-AF SL/VM o N ENG 6/27/03 F "CLASS A" ITEMS SHT 8,8A PER QAPD COMPUTER GENERATED DRAWING NOT TO BE HAND REVISE REPRODUCED REPRODUCED TITLE: 6900 VOLT AC ONE LINE STATION f----bLDIu:A"'"GRltA""-M _______ ----1 INDIAN PO G H I OAGI0000215_1072 OAGI0000215_1073 2 21 2004 6:57:54 AM 249956-0-15.dw 6 5 4 3 2 >-0 CD<< o 0-' W H<< "-" ::J'" UU UU 0:;: A 1M za W<< cow , CO a ::J(,) c-Z H zz Ha <<::J :;:c-A 2BL o " . 0J 15 KVA. LL Ul Z << '" f-Ul W 'H ::J << . <<Hl')r'"-- -'DCD' f-HW[l) HX:2:"<t Z::JWO ::J<<---C\] 2BR , <<C< 00) co'" , 22.4 KVA x Ul ::J W << H Z OLLH<< H(f)-.JZ f-ZHO:: <<<<xo f-Ct::::JZ UJf-<:(--- 0J U U , ::J LL 2DL >-0 CD" o 0-' W H" "-" ::J0J UU UU 0:;: 2F << o " '"" I CH" OJ Ul " ::JZOJ 0)<<-LLn W , UlCO-' <<Z-' IH' OOOJ Ulon HUD' B 480V MOTOR CONTROL CENTER 24 2H n OJI U) Z "" LL'" c-n z' w-' >-' , LL-0'" Dr.., "'D' 2K n OJ* OJI U) Z "" LL'" c-n z' w-' >-' , LL-0'" 0<') DCD' B -< o m (TURB. GEN. BLDG. EL. 15'-0/1) 2M n <'). 0JI U) Z <<" LLOJ >-n z, w-' >-' , OOJ 0<') O:D' 3B OJ I U) e-" Ul OJ ::J << n I , X -' W,,-' OJ , -' --'ZOJ <<<<C') 3LLD' 3D OJ I U) e-" Ul OJ ::J << n I , X -' W<O-' N' -' -'ZOJ <<<<C') 3LLD' 3F " o " '"" I "en OJ en " ::JZOJ IT]<<-LLto W , Ul(')-' <<Z-' IH' oOOJ UlOC') HUD' 3H n ". OJI U) Z "" LL'" c-n z' W-' >-' , LL-0'" 0<') DCD' C 3K n m* 0JI U) Z <<" LLOJ >-n Z, W-' >-' , OOJ 0<') O:D' C 0: o m 3M >-0 0)<< o 0-' W H<< "-" ::JOJ UU uu 0:;: 4B I v <<
- co o " a oa c-W <<c--' ::JW,"" ('>>co wzo aHO o wwo (')-', <<UUl c-H -'O)OJ >UH 4F << o " 4H << o " o 4K E 480V SWITCHGEAR 21 ( PARTIAl) << o " A208088 ,-----------, I BUS 2A (AG9i I I 22B I I T' I ) 1200A i I I L_____ IEWF61) r+, SPLICE BOX IECEI8) IA 2G 15 2-750 MCM / PHASE U.V TRIP NON-LOAD BREAK ISO. SWITCH AM << o " o " >: U " o m '"" , OJ 56 " o to 89/NCC24A MCC 24 COMPTS IEBCIOi I I I I I I " To cD << To cD I 2DLI L ____ ..'::::J 480/240-120V rrrn 30KVA 1 5H 5M
'"" I illUl OJ U) " ::JZ'" OJ<< -LLto W , u)(')-' <<Z-' IH' DO'" U)OC') HUD' OJ I u) >-" Ul OJ ::J << n I , X -' W--' OJ' -' -'ZOJ <<<<to 3LLD' OJ I u) >-" Ul OJ ::J << n I , X -' WOJ-' OJ' -' --'ZOJ <<<<to 3LLD' o OJ I U) f-" Ul OJ ::J << n I , X -' Wto-, OJ' -' --'ZOJ <<<<to 3LLD' SPLICE BOX IEWD85) FUSE BOX I EWE68) I EBB7I 3KVA TRANSF 480V / 120V 30.60HZ lEOH8) 15A E I I I I I I 2E F 3A T G 480V MOTOR CONTROL CENTER 24A ,-ITURB. GEN. EL. 15'-0") 3C 3L T 4 I I I I 4A I 0J I " 4C 4E T T I I I I I I H 4J T I 60LI 25 KVA I 3MI I 5HI L ____ ..'::::J 6BL << o OJ 5 KVA 1.0 U_ ::J> DO '" Ul-al Ul >DC c.:w e-0" 'W ill I << o ill ROD CONT. CAB OJ OJ >-a "'w w(') f-O' f-<< <-0 [fl<< ° 0-' W H<< "-" ::J0J UU uu 0:;: SOLA TRANSF. CAB. /IC2/1 o:o)u W<<H LLUD U) Z Z-'H <<0 o:o:z f-f-o ZH cr: if) zoo..0J 00: U U DCO 000:::(0 OLL << W 0' << Ul v W 0: << CL U) 75 0: HOJ -<OJ Hl' zo WUl >:en ::JW 0:0: (I)>: zo HU 6H <<' OI <0'" <') , " U >: o cD C') ill U U , ::J LL 154.42 KVA LLUl UlW ZH DC"
- f-H(') -' ZHW HX;': <<::JW THIS REVISION IS NON-CLASS PER THE OAPD. W 0' << Ul 6M << , 0'" <0'" to ' '" U " U " o cD C') U , ::J LL 154.42 KVA LLUl UlW ZH <<"'-0-' f-H<< -'" ZHC< HXO <<::JZ R E V UPDATED DWG. AS PER MOD, PROC. SNX-91-06681-M.
DMD 208088-8N-OO. I DES S M.E. r 04/24101 o N Er<; ISSUED FOR RECORD. PIN 06681-91 MPH lET F D' , o , o L ____ .'..:..'J 3 0'(') HZN -<HOJ -' f-O,,-ZO" wu::J >: ::JD O'wO' f-UlW Z-'<< HU3 I ( I ) 1 LOCATIONS W 0: << U) W DC << (I) L ____ .'..:..'J TRANSF. 24 480/120V rrrn 15KVA I OJ OJ DC W f-DC Wa) >0 zo HC') , ULL H' <<01 f-to U)O< W DC << Ul SYMBOLS DISCONNECT SWITCH SHAWMUT FUSE TYPE A0T CLASS J TIME DELAY CLASS 0 CURRENT LIMITING BREAKER THERMAL MAG. ELEMENT FUSE NOT INSTALLED SHAWMUT FUSE TYPE A4J CLASS J CURRENT LIMITING FUSE FULL VOLTAGE NON-REVERSING STARTER. NUMBER INDICATES NEMA SIZE. (R) INOIC. REVERSING. ,---, I I I I I 2DL I L ___ =-.l MDTOR & HDRSEPDWER MCC 24 COMPT. 2DL ITYPICAL) CONTROL 1241 TURB.GEN.BLDG. 1271 TRANSFORMER YARD '1281 DIESEL GEN. REFERENCE DWGS: 9321-F-3004 9321-F-3005 9321-F-3006 9321-F-3183 A208500 A208507 A20824I A249955 ONE LINE DIAGRAM 4S0V NCe'S 21. 22. 23. 25 & 25A ONE LINE DIAGRAM 480V MCe'S 27 ONE LINE DIAGRAM 4S0V NCe'S 26A & 26B WIRING DIAGRAM MCC 24 ONE LINE DIAGRAM 4S0V NCe'S 26AA & 26BB ONE LINE DIAGRAM 480V NCe'S 28. 29. 210 ONE LINE DIAGRAM 4S0V NCe'S 28A & 21 I ONE LINE DIAGRAM 480V NCe'S 29 & 29A L T FULL VOLTAGE NON-REVERSING STARTER LOCATED AT NEARBY EQUIPMENT BUSSMAN TYPE OTS LEGEND: CSECTIDN U COMPARTMENT IE r--RIGHT SIDE lOR L-LEFTi IER THIS DRAWING CONTAINS ITEMS WHICH MUST BE CONTROLLED WITHIN CON EDISON AS 1/ CLASS A 1/ ITEMS PER C1-240-1 COMPUTER GENERATED DRAWING NOT TO BE HAND REVISED TITLE: ONE LINE DIAGRAM STATION ET E. TY B, SCHALL 07-01-91 R.SAYA --'&'--'=-24-'-'A'---- ____ I NDI AN POI NT DESIGN DISC. Er<; -UFSAR FIGURE No.8. 2-7 A I __ ____ __ ____ ______ DATE I-.. DRWN. SCALE PEC'O NO. REVIEW APPROVALS BV K.FOLEY NONE A249956-15 G H I E , . , #2 DZ
OAGI0000215_1075 OAGI0000215_1076 I o >> G) o o o o N --" (J1 --" o -....J -....J 480V MOTOR CONTROL CENTER 29 J 'I OAGI0000215 1078 1'J' OAGI0000215_1079 OAGI0000215_1080
-OJ -n -o --ZOH(j)H<fTlJJ --z o Z en -i---=ro I n _ o rv " >> '1 '1 " UJ I " Z G) CD r en Z A r en ., I o ., ., " >> z I o SAMPLI NG ROOM EXHAUST FAN A209534 SPARE GROSS FAILED FUEL DETECTOR ISOLATION VALVE M.O.V. 5154 A208849 SPARE I FLOW CONTROLLER HC-1309 ON SOV CONTROL PANEL"D" A208563 H 2 02 GAS ANALYZER REMOTE CONTROL PANEL (120 VAC SUPPLY LOCAL PANEL CH # 21 A208840 H 2 0 2 GAS ANALYZER REMOTE CONTROL PANEL (HEAT TRACING CH # 21 A208840 H 2 02 GAS ANALYZER REMOTE CONTROL PANEL (HEAT TRACING CH # 21 A208840 SAMPLING PANEL 2 FOR SOV 3426 & 3428 A209505, B209516 SPARE SAMPLING PANEL 2 RAOIATION MONITORING A209505 SAMPLING PANEL 2 FOR ANNUNCIATOR A209503, A209505 SAMPLING PANEL 2 WASTE TANK PUMP 2 LOW LEVEL TRIP CKT A209505, A208615 CHEM. ANAL. MONIT'G PANEL A209540 SAMPLING ROOM DAMPER A209534 P.A.8. FLOOO ALARM & NPO SHACK A228599 SAMPLE DRAIN PUMP LSP # 2 A227568 RADIATION MONITOR R49 SKID A208532 B235290 '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A ----.----elD ----ew ---eC>> ---e", ---eo ----.= '--./ ---e CD ru 20A 0 < ------'--./ >> 20A n __ .-0 '--./ " H 20A (f) ,--, H RHR LOW FLOW __ _ INDICATOR FI-5963 " I 1120AI1 1 1 B241345 '" '-/ L __ -.J '" 20A en -u >> _---.-z '"' o SPARE '--./ '" ITl 20A , 1--1 SURVEILLANCE "1120AJI ---.::1 RHR PUMP #21 & 22 INSTRUMENT I I en '--./ IV 8242983 L __ -.J '" 20A en SPARE TO B.A.S.T. 21 &22 LEVEL INDIC, SYSTEM POWER BOX DWG, NO, 314893 SPARE SPARE SPARE SPARE SPARE SPARE H 2 02 GAS ANALYZER REMOTE CONTROL PANEL (CH # 21 A208840 SPARE SPARE H 2 02 GAS ANALYZER REMOTE CONTROL PANEL (CH # 21 A208840 SPARE SPACE SPACE SPACE SPACE SPACE SPACE -u m :0 --I I m c5 r >> (f) (f) >> o -u-i Om (f) '"' o ----.-'--./ C>> 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A ---4!::l
.:5 H2/02 ANALYZER (CHANNEL 21 U '-A208836) SPACE FAN 21 COIL SAMPLE C> VALVE M.O.V. SWN51-IA A208392 FAN 23 COIL SAMPLE C> VALVE M.O.V. SWN51-3A A208392 SPARE FAN 22 COIL SAMPLE C> VALVE M.O.V. SWN51-2A A208393 FAN 24 COIL SAMPLE t> VALVE M.O,V. SWN51-4A A208393 FAN 25 COIL SAMPLE C> VALVE M.O.V. SWN51-5A A208393 FAN 2 I COOLER C> OUTBOARD DICHARGE VALVE M.O.V. SWN71-IB A208393 FAN 24 COIL C> OUTBOARD INLET VALVE M.O.V. SWN41-4B A208393 * * -------'tv---
'--./ ---7:>-t 15A '--./ ---7)-< ::J " FAN 21 COIL C> OUTBOARD DICHARGE VALVE SWN44-IB A208393 '--./ ---7)-< ZJ :0 FAN 22 COOLER C> OUTBOARD DISCHARGE VALVE M.O.V. SWN71-2B A208394 FAN 22 COIL " fTl ,-C> OUTBOARD INLET VALVE M.O.V. SWN41-2B A208394 '1 fTl " < FAN 22 COIL C> OUTBOARD DISCHARGE VALVE M.O.V. SWN44-2B A208394 , ° FAN 23 COOLER C> OUTBOARO DISCHARGE VALVE M.O.V. SWN71-3B A208394 , '--./ ---7)-< " " FAN 23 COIL C> OUTBOARD INLET VALVE M.O.V. SWN41-3B A208394 FAN 23 COIL C> OUTBOARD DISCHARGE VALVE M.O.V. SWN44-36 A208394 FAN 24 COOLER C> OUTBOARD DISCHARGE VALVE M.O.V. SWN71-4B A208395 FAN 21 COIL C> OUTBOARD INLET VALVE M.O.V. SWN41-IB A208395 FAN 24 COIL C> OUTBOARD DISCHARGE VALVE M.O.V. SWN44-4B A208395 FAN 25 COOLER C> OUTBOARD DISCHARGE VALVE M.O.V. SWN71-5B A208395 FAN 25 COIL C> OUTBOARD INLET VALVE M.O.V. SWN41-5B A208395 FAN 25 COIL OUTBOARD C> DISCHARGE VALVE M.O.V. SWN44-56 A208395 RESIDUAL HEAT REMOVAL C> MINIFLOW TEST LINE VALVE, M.O.V. 743 A208833 CHARGING LINE C> ISOLATION VALVE M.O.V. 226 A208833 CHARGING LINE C> ISOLATION VALVE M.O.V. 227 A208833 CONTAINMENT SPRAY C> ISOLATION VALVE (LINE #15IM.O.V.869B A208833 '--./ ---7)-< Rl " '--./ ---7)-< f;j " '--./ ---7)-< " " '--./ ---7:>-t i:j " '--./ ---7)-< c:'i " C> SUPPLY ISOLATION VALVE :::: f------I\;- ---7' , r R,C, PUMP 23 SEAL INJECTION CD-M.D. V. 4927 (,J "--/ 7./. I\) A208833 C> SUPPLY ISOLATION VALVE ? f------I\;- ---7' , r R,C,PUMP 22 SEAL INJECTION M.D. V. 250B --J '--.../ 7/"", w A208833 HIGH HEAD S.I. PUMP 21 t> DISCHAGE VALVE M.O.V. 850A, LINE #P6 A208832 R.C. PUMP 21 SEAL INJECTION C> SUPPLY ISOLATION VALVE :::: I 1\ ---7'
- 3: M.O.V. 4925 w v--I\) A208832 R.C. PUMP 24 SEAL INJECTION C> SUPPLY ISOLATION VALVE ? f------I\;-
---7" 3: M.O.V. 2500 --J "--.../ 7/", w o o o o o o A208832 RESIDUAL HEAT REMOVAL SAMPLE VALVE LINE #294 M.O.V. 959 A208844 WATER FLUSH FOR R.C.S. SAMPLE LINE M.O,V. 4395 A208844 SAMPLE RETURN TO V.C, SUMP PUMP M.O.V. 5132 A208844 R.C, SYSTEM HOT LEG LOOP #3 SAMPLE VALVE M.O.V. 9556 A208844 R.C. SYSTEM SAMPLE ISOLA TION VALVE LINE #59 M.O.V. 956F A208844 RECIRCULATION PUMP 21 & 22 SAMPLE LINE #595 M.O.V. 990B A208844 '--./ ---7)-< :<: " '--./ ---7)-< 16 .po. CXJ o < :::;:: o H o :::0 n o Z H :::0 o , n ITl Z H ITl :::0 ru 0' CD CD I :::;:: (;In ":'n , '1 , W o o '" FLOW CONTROLLER HC-1308 ON SOV CONTROL PANEL "A" A208556, A208557 FLOW METER FZ-1249 ON SOV CONTROL PANEL "A" A208556, A208557 H 2 0 2 GAS ANALYZER REMOTE CONTROL PANEL (120VAC SUPPLY LOCAL PNL. CH # II A208838 H 2 02 GAS ANALYZER REMOTE CONTROL PANEL (HEAT TRACING CH # II A208838 H2D2 GAS ANALYZER REMOTE CONTROL PANEL (HEAT TRACING CH # II A208838 SPARE SOY 3432, 3433 3434 & CR2, CR3, CR4 RELAY CKTS A209504, A209514 '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A '--./ 20A I ----40----e", --.. w ---4" ---.u; ---.'" SOY 3424,3425,3427 3429,3430,343 I & 5290 -------- A209504, A209517 '-/ 20A HRSS TANK LEVEL & PRESS. INDICATORS PQ 3401-P PQ3401 & CRI RELAY CKT. A209504, A209514 SAMPLING PANEL I FOR ANNUNCIATOR A209502, A209504 SPARE "CANBERRA" SYS. ISOTOPIC ANALYZER COLLIMATOR CONTROLLER A3 I 2090 SAMPLE DRAIN PUMP LSP # I A227568 NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 SERVICE WATER FLOW TRANSMITTERS A228372 NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 BORON ANALYZER (EP021 A227562 NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 WALL SW. & RECEPTACLE t A209800 _ HIGH RANGE PLANT VENT. MONITOR R-27 (SAMPLE DETECTOR 1989M00927, 208532 NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 1--1 '--./ 20A '--./ 20A '--./ 20A '--./ 20A ---e'"
40=
ru o ----40-< '--./ w 20A '--./ 20A >> n o H (f) ---eo; H '--./ 20A U ----40->> '--./ '" Z 20A fTl , ----4-'--./ "
- 20A '--./ 20A '--./ 20A '--./ 20A ----40-C>> en ___ .--u '" en 01 REC IR. AIR ",,<---!-I
UNIT #2 I DAMPER SOV' S I I en '--./ -IP2--S-228336 L __ ::E: 20A en NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 ,--, (JJ rv '--./ 20A --'1;5 RECIR. A IR , " ---. [;:l UNIT #22 DAMPER SOV'S ,,'-/ IP2--S-228337 L __ -.J '" 20A en (JJ NOBLE GAS EFFLUENT MONITOR HEAT TRACE A208553 ,--, rv '--./ 20A ___ .ID " RECIR, A IR ---ti UNIT #23 DAMPER SOV' S I I en '--./ IP2--S-228338 L __ ::E 20A en H2D2 GAS ANALYZER REMOTE CONTROL PANEL (CH # II A208838 SPARE (JJ rv ---e" '" '--./ 20A --'!::l '--./ 20A 01 HIGH HEAD S.I. PUMP 23 C> DISCHARGE VALVE M.O.V. 850B LINE #16 A208831 I C> SUPPLY ISOLATION VALVE 0 I 1\ ", >> R,C, PUMP 21 SEAL INJECTION M. O. V. 250A --..J'-------- v---'--../ /' N A20883I R,C, PUMP 24 SEAL INJECTION 0--C> SUPPLY ISOLATION VALVE ::: _ ---",--,>> M.O. v. 4928 w'-------- v--CN A20883I CONTAINMENT SPRAY C> ISOLATION VALVE (LINE #511 M.O,V. A208831 869A R.C. PUMP 23 SEAL INJECTION C> SUPPLY ISOLATION VALVE 0 ----7' OJ M. O. V. 250C -...J'-------- v--'--..../ 7 r rD A20883I R.C. PUMP 22 SEAL INJECTION C> SUPPLY ISOLATION VALVE :::: I 1\ ,,"-OJ M.D. V. 4926 w'-------- V--W A20883I RESIDUAL HEAT REMOVAL C> MINIFLOW TEST LINE VALVE M.O.V. 1870 A208832 CHARGING LINE t> ISOLATION VALVE M.O.V. 205 A208832 RESIOUAL HEAT REMOVAL C> SAMPLE VALVE M,O.V, 958, LINE #294 A208832 FAN 21 COOLER C> INBOARD DISCHARGE VALVE #SWN71-IA A208390 FAN 24CRF COIL C> INBOARD INLET VALVE #SWN-41-4A A208390 FAN 21 COIL C> INBOARD OISCHARGE VALVE #SWN44-IA A208390 FAN 22 COOLER C> INBOARD DISCHARGE VALVE #SWN71-2A A208390 FAN 22 COIL INBOARD C> INLET VALVE #SWN41-2A A208390 FAN 22 COIL C> INBOARD DISCHARGE VALVE M.O.V. SWN44-2A A208390 FAN 23 COOLER C> INBOARD DISCHARGE VALVE SWN71-3A A208391 FAN 23 COIL INBOARD t> INLET VALVE SWN41-3A A20839I FAN 23 COIL C> INBOARD DISCHARGE VALVE SWN44-3A A20839I FAN 24 COOLER C> INBOARD DISCHARGE VALVE SWN71-4A A208391 FAN 21CRF COIL C> INBOARD INLET VALVE #SWN-41-IA A208391 FAN 24 COIL C> INBOARD DISCHARGE VALVE SWN44-4A A20839I FAN 25 COOLER C> INBOARD DISCHARGE VALVE SWN71-5A A208392 FAN 25 COIL INBOARD C> INLET VALVE #SWN41-5A A208392 FAN 25 COIL C> INBOARD DISCHARGE VALVE SWN44-5A A208392 R,C. SYSTEM HOT LEG LOOP #1 SAMPLE
- VALVE M.O. V. 955A A208530 R,C. SYSTEM
- ISOLATION VALVE LINE #59 M,O.V, 956E A208530 RECIRCULATION PUMP 21 * & 22 SAMPLE VL V LINE #595 M.O.V. 990A A208530 WATER FLUSH
- R,C.S, SAMPLE LINE VLV M,O.V. 4394 A208530 SAMPLE RETURN TO V.C.
- SUMP PUMP M.D. V. 4399 A208530 GROSS FAILED
- FUEL DETECTOR VLV M.O.V. 5153 A208530 SPARE SPARE f------I\;-
'--./ ---7>-'= ;0 0---f------I\;- '--./ ---7 r iD ;0 0---f------I\;- '--./ ---7)-< f;j ;0 0---f------I\;- '--./ ---7)-< " " f------I\;- '--./ ---7>-i:j " ,--, t------:;;: 'io: RECIR. A IR i';; UNIT #24 DAMPER SOV' S I I en '--./ IP2--S-228339 I I >C 20A I I Zi RECIR, A IR _rv__ ___. '" UNIT #25 DAMPER SOV' S I I '--./ '" IP2--S-22840 L __ -.J 20A H2D2 GAS ANALYZER REMOTE CONTROL PANEL (CH # II A208838 HZ0 2 ANALYZER '-/ CHANNEL I 20A U,-A20884C) SPACE SPACE * * ---tv---'--./ ---7 >-15A .po. CXJ o < '?>n OJO Z fTlH ,:::0 fTlO ::, '.On ((J1Tl 'z °H ,
- 0 ru 0' >> >> OJ n o :::;:: n SPACE SPACE SPACE SPACE SPACE 1\)1\)1\)1\)
I\) I\) I\) I\) '.(l (Jl(J1OOOOOOW (JlO'CP():)():l())())CPI\) COI\)>DW I\) I\) I\) I\) I O-..J-..JI\)O'(Jl.l:>.GJ"'Tl , eN o o '" ::s::::s::::s::-::s::::s::::s:::s::o .* OI\)OOOOZ DOOOnnnnrrl . < <<I\)}:> 1\)1\)1\)1\), 0'00'O'0'O'H H}:> OJOJJ>l>Z HZJ>OOJ\JJ>>>>rrl Z'l H "'TJ00'{J)rrlfTlrrlfTlO D* -lXXXXH ::s: :s::. --l --l --l --l >> >> I n fTl fTl fTl fTl G"") -i-O"'lJ:;OJ)::OJ);;O H'..Q zzzzz>> O'.{)I\)'>>}:>J>:J>3: ZOl0' '1111 OJUJ " ::tJco :£::*::£::*cp fTl -""""",0 TJfTle'oooo< eXID en-j 3: ifTlfTl n " x n oz-j C>>fTl (f) -j r " >> Z ID G1 :;,: ;J> ()\ fTl,r >> o ;0 en en en ;0 en z n en o '" G) z o en (f) * *
- I n H " n " r o n " Z Cl " , " o Cl r r Cl " -j -< " Cl Z N 3: I '" o o *
- I n H " n " r o n " Z en " , " o en r r en " -j -< " en Z N 3: I '" , '" w
- o H ;0 o " r o o " Z en " , " o en r r en " "" -< " "' Z N 3: I '" , ID u; o SPARE CANBERRA SYSTEM ISOTOPIC ANALYZER A3 I 2090 SPARE SPARE SPARE o OH .:Z (00
- H '1<0 >>>> C\H oen "'UJ u; 00 wo z -j " o r '1 " o 3: 1IJ >> '" 'D r H Z G) 'D Z r 'I< ID
- OH .:Z (;)0
- H '1<0 >>>> C\H 0"' -D1IJ u; 00 IDO Z -j " o r '1 " o 3: 1IJ >> '" 'D r H Z G) 'D Z r C> 'l(l)H O':Z ", 0 H en-o >>0>> or"" TO"' UJUJ Den Z'" enD* . "0 en* z< >>"" zo o OJ IDCl H" ZJ> 00 Hr 00 *n " rCl ",,0 (1)-(;)H """ enI en zn '0 "z en"" 0" r 3:Cl OZ -jn OH ";0 n Ir OCl ;00 UJ enz 'DC 03: ,;eCl en" ,,>> r UJ H Z o H n >> "" Cl ----II f------I\;-
'--./ ---7>-c'5 n JJZTJ --l o fTlCC I Z <:s:r fTl --l fTl fTl I ::0 >> JJ::Q ::s:: H (f)>< p Z HID ,-3: Z r fTl G') H --l 0 Z < --l 0 G1 fTl Hen " 'D n r fTl >>Z 0 Z --10 >> fTl fTl Z 0 -j UJ' ;0 J) >> UJ en -j H< H NCl o Cl;o Z UJ "Z , (0 H ZUJ 0"" H>> OJ) >>-j ""en Cl" UJ UJ>> Clr Clr ZO OH """ ClO CD A " UJ >> ;0 en 3: o r o en o o >> UJ en -j -< " en o ;0 >> " o e "" n H " n CD " " UJ "" >> ;0 "" en " "" -< 10 en e Z H "" (f) -< :<': OJ o , (f) ":' n G) , '1 r:,ru 80' "'>> I H N , N o , N o N o ru o o I o I
- OAGI0000215_1082 OAGI0000215 1083
," ---,-----OAGI0000215_1084 II [ Ii . I [ I II I! [ I , I I [ I : I I I ' I I I' OAGI0000215_1085 I! I I I II I . I
,..-----_ .. --------_ .. -_ .. -_ .. -_ .. -_ .. ----------_ .. --------_ .. -_ .. -_ .. -_ .. -_ .. ----------_ .. --------_ .. -_ .. -_ .. -.., , , , , , , , r-----...I
IS:::: I , , , , , , , L _____ ... , , , , ;L al,,, , , , , , , , , , , --r--r------::tJ )-----!-_ ... _--------------------------
r--, , , , , ,
, , , , , , , .' , , , , , , ,.. .. _--_...1 , , , , , I I I c':" I':{,' I z-" , c 1.._----.., : .............. _ .. __ .. __ .................... _ .. __ .. __ .................... _ .. .. __ .................... _ .. __ .. __ .................... _ .. __ .. __ .................... ..1 OAGI0000215_1086 3/9/2004 7:57:30 PM 208761-0-3,dwg 4 3 2 1 929 De 1 (HIINNEL./ (ONT-fOL/ TKIII'" ,Powe,e TRAIN SePA-flmON !J*SICtNArIONS II (Wi-IITF-) 1Y (YELLOW) CONTROL TRAIN A (ONTl?OL T1?AIN B (/?w) ( Wl/ITE) FUNCTION flo V()Li A.C. INSTRUMeNT BUS f'E£bS AND ANALOu 1 /)161TflL Sl4NAL OUTPOT!. ASSOCIfITEIJ WITI/ 120 YOLT A.C.INSTROMENT f50SES ! 21, 22,23 IN R*rp*C71VELY I IZSV()LT D C. AND ! I i SMALL fbW£.e F**LJ5 OIlT*b WITH J2S VOLT lJ.(. 21 ANlJ RESPECTIVELY
- I :
- IN liIE ORJ&IIIAL ,PLANT ' DcSI('N ()NlY TiNO . reAlTEl?lts 2/ 22) tXlSTE[) /lND JeFDUNMNT (TRAIN A _ AND
- 8)
ARE SENTTO MENT IN f'OWE/( THIS 'pERMITS THe 3RD ASSOCIATEb WITH 4!JO Val T B:JSES 2A liN/) JA iO M£ET SlN4LE I I JI ,]3\ F'HYS/cIIL !fOUT/llt. b*51(:,NATIONS
- 5) FoR ,PROTECTION SYSTEM CIIANNEL / ,fOUT/Ne" ASSOCIAT/()NS A,fE FIXE/:J (I IN J"/,ff IN :U, ETC.) S?ECiFJC EKUf>TlONS (e.g. Ii (IIANNEL I .f{J()T*}j IN A Pc,]'3 OR. 74 ) MOST BE APP,e()IIE/)
BY e,E. AN/) WiLl ONLY BE !'ERM/TTE/) f'ooe NON-.s/JFflY (NON -1£) FIJNCTJONS ItLL PoRTIONS Or Ii PARTICVUJIe INST.fOMeNT SHALl ROUT*/) IN TIIG SliM. QlANNEL , Ll A THIR/j 1J !(OunNt4 msrs FO/? SRECTED ORCUIT!!; 3 5E?MAT/ON I 41>0 VOLT M.U.. POWER ,-,AIN SA ANb ASSOC/IiTE/) i I 120VOlT A.C. (/VI.C,(, (ONTRcl i SMALL I CtJN1/eOL rs (RED) 480 yoa M.C'. pow('/( 31/ 480 V ),I.a. POWEe , (oNnoi. \I I I " \I II i ;(/ FIXE/) ASSOCIIiTION (i..e. SA IN XI) FOR ALL IE CIRCUIT'S. 5I'eCiFIC exCEPTIONS (e'9' A NON IE M.a. POWe,e feeD fRoM 81JS SA /fOOTe?;> IN K2 M()ST Be API',eo va BY E. e, (BWE) f------'-(ONn?OL T,ff!IN C I ,! 12S VOLT D.C. CCw1:eol. AND I 9VJALl powo? fEEbS AS50-> Ot9TED WITH 125 VOL:r }J,e. I BATT*e"! 23 (liaMb AFT£e i i f'UlNT I )( Sf) ",AID V-7'2 I""" I : 125 VoLT D.( CON'TeOL AND CONn?OL T.eAIN b (YIiJ.l.OW)
- SMALL S I DIIT*D WITH 125 )lOLrlJC, , BATTERY 24 (1I/;2J*b IJnu
- RANT STIIU-UP)
I IIEIIVY PoWeR t!;US SA (I?ED) ( 480 VOLT t 125 V()LT D,C )8US 2A (W141Tl) 81J5 {eWE} 48() VOLT IIc/iV'I '/25 C 4 (ASSOCIAT£l) WITI/ /PI/s sA) 'loa II*AY'I POWER Ii!S()ClATe'b C:3 (4550CIATrD WITII f;tl<:; WITH ..,SeW sus i c. '" (ASSOCIA1£j) wml 8U5 ell) '2.1;. 4130 {/OLT 8USES ZA ! c S WITI/ BIiS 31.) 81i7TCRY zz ANIJ 480 yOLT I 80S 6A .f[SP* C.TIVEL Y I SEE No rE Y.,. 1--________________ +-________________ ---1 ____________________ . __ 0 __ , 4/V'TZoi.. raL : 46 1..':>
- ROUTIN6S DATE'l; WITH h.c. CONTROL FUDS FOR DIESELS '21) 22 , loS RESPEC.TlVeLY THROOuH THE C.ONr:eot rUNNEL F(n) F (22) F(Z'S) ,c(z4) fI II J' * " II
- II ,I " " e/ a 23 l1 i L-________________________________________ ____________________________________
! I A .. -fDLD' I B I c I o NOT£5 : I. 10 AN!) I< Z ME TflE KEY EM" 480 VOLT SMAU PoWeR 1201l0LT M.a. })eSI6NAi/ON5. TII*SE b*SIc,NAnoN5 IIAVE /sUN AJUJ.I*R E'lPAN1Je-/) IN THE ,e4-lEWA.y 5YSTEM TO PRoVI/)c .4bbITlONAI. /fOOTlNt, Of' FUNCTIONAL. ROUTIN6':l hDI\PTI\BLE WITI-I \(1 E)(CEPT A') \.IOTm XI (REO) KIA (1(£0) KI8 KIAA iCSVOC 1/ I LOC',IC '" C OI{TKOL KID POWF-IC (R£f) ) ROUTINE:. A":lSOC.IA1ED \Nil\-! K2D e:,tiTT[ R'( 22 11:5 V DC-1('" LOa, Ie < <t COIITP,/)L I(ZD (WHITE) --ROUTING t..'=f.)OC.lto..1 E.C WITI1 BI>.ITER,( It5 1/ DC, /(1 K31J ( 8LLJE) ADtlPT to.. \N \11-1 K Z 1(2A (mLOW) /(28 (Yt/..LO'ItJ) (m_LOW) If'S V Dt K 2 loc,lC OAJL'f ttl/) (Y£LLOW) GENERlrL D*Slblll/nONS USED IN MOST OF THE-PUtNf7[NbFoR MOST FUllmONS .. j)-/)400 -EXISTS FOR Tille/) TViIN S*PAeATION IN oe/61Nlil.. PLANT MSl6N R()UTlN4 e,ETVVUN DIESEL. AND c.oNn-ot.. BI)II./)INf#
- i/f J)-hzoo -exlsiS TeAIN .:
IN PlANT iJEsI6N ROOTINt. 8ETW**N f'.A.d. f CONTAINMENr FOR Me.,. Zo;A" M.G.. 'Zr..B POWER AN/) (oNr.eoL !lSsoc/ArE/:) WITH /V!oToe CoNTKOL CENTeRS i?(PAIi /iND 2(,& ,fESPEcnVELY WHICH WeRE AJJLJEb As OF "TIIR*! MILG !5LAN/j" PLIiNT MODIFlclrrloNS
- 8A TTfKY ZI f. 22 LOGIC 5/c:,A/A L SAND CONTfOL POWfR. (KI
!(ESPfCTIVUY Jill) IJ£W /?OilTIN{;S (Of( le5VOLT DL B4TTUI£S 21 TIIIwll6H 21 RESPECTIVELY FOI{ CI/fCliiT5 WHICH weRE ADDtO AS P).I(T or: I' T?iREf MILE 1'5J.AND" PI.AIJT MODlrtCATIOAJ'5 5££ /0107£5 .3 4 Z. 'CltfCVIT TYI't:" IJESIMAT/ONS USED TO FUNcnONALLY mE PURPOsE OF A O,eCtJlT, TflESE ME ftjl'*LY FUNCTIONAL lJEscRlPTIONS AN/:J SIIOUt./) Nor B* CONPUSEb WITI1 I'J./YS/Uit. ,fOUTlNu LIST TIiSU OR ClRC.UIT TYI'E IJESI6NIlT/ONS -FROM CABLE SO/*7JULc BAiTERY 21 BATTERY ZZ I L06f( Ti:/l1N A i04IC TRAIN 8 I 480V PoWER' T1?AIN SA 4BOV. f'tJW*i! TRAIN 2A/3A 4130 VOLf SYSTEM a/ANNetIZlliION OF Latrlc SI6NAL1; fJA TrO? 'I 21 I AuTOMIiTlC /. TRNISFU. SVV (TYPICIIL) I 5A -1117"0 £1 I I 2.!> oS "" , ,., T DIESeL ZI I-,--------, -I3ATTER_Y 2'2 2A 2Z I I 2'; h/eSeL 22 Z! , I 2?J I 31'1 480 VOLT SYSTEM CIfANNEUZIrTlON OF D.C, (ONT,eOI. POWER I I E I F 4-BOV POWER 'TRAIN 81lTTEKY Z4 z Z I I z4 b/efEL 23 -1 G NOTcS CONTINUE]::, : 4. IN THE O,f/6INAL PLANT DES/6N 5EPARATION WAS sa uP ON Ii ,I It CIRClJI T EY CRWI T &'ISIS RI1THER THAN A (JNI TIlE}) FI XE./:J "/3tJS TO ffOUTIN4 CHANNeL" ASSOCIATION (e.g. CI -= ,sVS Sf!) SIN{,LE 15 MeT FOf( THES* CAUS BECAUSE OF TilE OF RU;UNJ)ANT T1?AIN A ANl; e L061( IrND ({JNT!?oL SlqNAL$ To EAUI CUS (t..e LOSS OF ONE WY MAY FAIL ,4. CONTAINMENT SPRAY p()MP ON ONe BUS ANl; AN 51 PiJMP /5tJs euT FROM ONe TilE lWO D,C.SYfTEMS WIU, STILL Be AVAILI!8l! TO EOTII 8USES. IN Ail MODIACAnONS THE "(jNITIUb ,. 8US/ RO!JrlN4 MSOOA nONS AS SHOWN ON THE TII8Le ARE EKC.*pTlDlVS WILL BE pe!!MITiEb Fa!:. NON -IE eQUIPMENT WHUE NECE5S/rI?Y TO MAINTAIN THE PLANT CRIT*RIII OF MJNIMIZJN4 PIIYSICAL C.e05S0VEI?S IN THE CA8t..* RAC.E-WAY SYSTEM. 5. AS e,y TilE PLANT 0[':>141'1 AND MOOIFICA110N':> ALL CLltS? I E CIRCUITS (POWER, (Ol-\1ROL At-ID I NSTRUMEIHATIO\,\ ) WERE ROUTED 1M OR CONDUIT,;) CONI/EN lENT TO T[RM I NATION POINTS. THIS WII':> AC.C.OMPU':>HED BY CAe,LE IN ANY ,)l\tH.'f 6RADE AND ,1.5 5UC!-l TREtlTED A.t:) "ASSOClt>.TE.D CIRCUIT", 1\.lEREFOR.E f,\O "1RII'i WA';, PERMIT1tO ANO ONCE II NON IE. CIRCLIIT WA.S A.SSIGMED TO A. R.OUTINe:. C\-lI>,""E.L IT MU<:>T REMI>.INW \\-.\'1-\/;1 THROU61-10IJT Tfl( WHOLE RlIN_ Ed CAlilciean ISOii energy REVISIONS " 'T/Y/S PcII' iT , CUUS/l' PElf ')100 PlI'eJ C. 80-Z-21 roR INFORWlTltJN PM 9rJ()49-SC) 2/4 In !?Jj!IiC 1:(1-p!!. > tl .\ 1.'1 Jz:/'/h ;. 1 ISflEV C LA:,5 "A" f>:::, PEP. CI*240 -I., ADDED NOT[ ." b MOD. pp,oc. £5(" 1lO-2-2.1 REL.fOR ltiro. -50 AlA TIfIS /GEIIISION /05 4 PER C'J.24()*/ ()PJ)ATE.l) TtJ 5t*W WP£t:. OF f / Mal), PR,()C. ' "'*5tJ;-etJ_2-21 kELEAS*D Ft!Ie 1/5 CONf!31RVCr!.!l ? AI. -50 6-13-84-jilL VI 4118/99 03 THIS REVISION IS NON-CLASS /&.ALLCABLES IN RN:.F:WAY5 '=>HALL ME'E'TTHClATE5T CON EDISON SPECIFICATION E'0-13 AND BE qUALIFIED TO IEEE 383. COMMERCIAL fjRADE CABLE AND IMC CONDUIT 15 ONLY PERM ITTED FOR OTHER SERVICE'5 NOT AS:OC;IATED WITH PLANT PROCEs':> 'SYSTEMS(M.O. FACILITY, PLANT OFFICE:> ETC.) . PER CI-240-1 UPDATED DRAWING TO INCLUDE UFSAR FIGURE No. IN TITLE PIN 69911-NP RELEASED FOR RECORD DLAl4/18/99 ALL TERM I NAL BLOCKS INSTAL L tD SHALL 81: CPUALI FII:D TO IEE'E 523 AND 344 TO A5SUR E TH Eli<. AVAI LABILITt FOR FUTURE (LA';:>':> >)/l,'I/CLA5'::l "I 1:" TE'RMINA.11 ON'::>. 1/ _ '\ lob 106/1 10521 4" (()/IJDUITS (Dd 1'-4" I I-NU(L, f(lA)O FWlI I 11.1 I JI I J2. I 1(2. lol'NS TP.. FIINO)O L CONOUITS fiz3)O I K2A I 10 =<:> I J3 I J4 rAANSIT* I C! lIe21'41 ( , 0 I 1<1 I 1<2. I I C3 ILc4 I I J4 WiD 400 I -I C 5 II C", I Mil. ,PIPING P I. '0 TYPICAL SECTION Cf\BLE TUNNEL TRAIN "A" I /(1 D 1 I K:,D I I (IAA , TRAIN" B" I K40 I I KZD I , KZI>BI ., co KW, 'J ,,,-: ,;.. \ I I'COVI.C-J \f-460 V AC IZOVAC \-4BDVAC (2 11 tf,fl " p ,t r. , Ji TYPICAL SECTION ON EL. 98-0 I K' I I D I THIS DRAWING CONTAINS ITEMS WHICH MUST BE CONTROllED WITHIN (ON AS: .. CLASS A" ITEMS PER (1-240-1 7YP}CA l CjECTION CAf3Lt SPRfADI1J4 KOOM INCHES Q , 2 , 4
- I ..!... H STRATUS ENGINEERING A 208761-3 CONSOLIDATED EDISON CO. OF NEW YORK, INC. i!CfI(,JJlmONS
-OUT(.INE FIGURE No. 8.2-18 NON!; "
- "'" JAe 'J:IL MECH, -, 'TRueT, RECORDED " ........ ." GENERAL CHIEf DfBlO. '/, y ENOINUAING ENO'ltEER
", j/ d' MECHANICAL PLUIJT ENGINUIIING ENOINUjIl/ en PVJ'IT STR!,ICT, ....I eM!.. 1-="::::::- ___ -----C ENGINEElllllItG T 10 STJlUCT, > INGINEEfil o STATIOJrj EL.lll. G. -A. 11: :,1 ElECTI'llCAL INOINIIII .. r ENGINEERING T. O. ' * -.. Q. EIiIIOINEER C OPf""'TIOIIIS I
9.0 INTRODUCTION
IP2 FSAR UPDATE CHAPTER 9 AUXILIARY AND EMERGENCY SYSTEMS The auxiliary and emergency systems are supporting systems required to ensure the safe operation or servicing of the reactor coolant system (detailed in Chapter 4). In some cases the dependable operation of several systems is required to protect the reactor coolant system by controlling system conditions within specified operating limits. Certain systems are required to operate under emergency conditions. This section considers systems in which component malfunctions, inadvertent interruptions of system operation, or a partial system failure may lead to a hazardous or unsafe condition. The extent of information provided for each system is proportional to the relative contribution of, or reliance placed upon, each system with respect to the overall plant operational safety. The following systems are considered under this category: Chemical and Volume Control System This system provides for boron injection, chemical additions for corrosion control, reactor coolant cleanup and degasification, reactor coolant makeup, reprocessing of primary letdown from the reactor coolant system, and reactor coolant pump seal-water injection. Auxiliary Coolant System This system provides for transferring heat from the reactor coolant during shutdown, stored spent fuel, and other components to the service water system and consists of the following three loops: 1. The residual heat removal loop removes residual and sensible heat from the core and reduces the temperature of the reactor coolant system during the second phase of plant cooldown.
- 2. The spent fuel pit loop removes decay heat from the spent fuel pit. 3. The component cooling loop removes residual and sensible heat from the reactor coolant system via the residual heat removal loop during plant shutdown, cools the spent fuel pit water and the letdown flow to the chemical and volume control system during power operation and provides cooling to dissipate waste heat from various primary and safety-related plant components.
Sampling System This system provides the equipment necessary to obtain liquid and gaseous samples from the reactor plant systems. Facility Service Systems These systems include fire protection, service water, and auxiliary building ventilation. Chapter 9, Page 1 of 99 Revision 20, 2006 OAG10000215_1088 IP2 FSAR UPDATE Reactor Components Handling System This system provides for handling fuel assemblies, control rod assemblies, core structural components, and material irradiation specimens. Equipment and Decontamination Processes These procedures provide for the removal of radioactive deposits from system surfaces. Primary Auxiliary Building Ventilation System This system maintains ambient operation temperatures and provides purging of the auxiliary building to the plant vent. Control Room Ventilation System This system maintains the required environment in the control room. 9.1 GENERAL DESIGN CRITERIA 9.1.1 Applicable Criteria The criteria, which apply primarily to other systems discussed in other sections are listed and cross-referenced because details of directly related systems and equipment are given in this section. Those criteria, which are specific to one of the auxiliary and emergency systems are listed and discussed in the appropriate system design-basis section. 9.1.2 Related Criteria 9.1.2.1 Reactivity Control System Malfunction Criterion: The reactor protection systems shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits. (GDC 31) As described in Chapter 7 and justified in Chapter 14, the reactor protection systems are designed to limit reactivity transients to maintain DNBR at or above the applicable safety analysis ON BR limit due to any single malfunction in the deboration controls. 9.1.2.2 Engineered Safety Features Performance Capability Criterion: Engineered safety features such as the emergency core cooling system and the containment heat removal system shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public. (GDC 41) Each of the auxiliary cooling systems, which serves an emergency function provides sufficient capability in the emergency operational mode to accommodate any single failure of an active Chapter 9, Page 2 of 99 Revision 20, 2006 OAG10000215_1089 IP2 FSAR UPDATE component and still function in a manner to avoid undue risk to the health and safety of the public. 9.1.2.3 Containment Heat Removal Systems Criterion: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure this system shall perform its required function, assuming failure of any single active component. (GDC 52) Each of the auxiliary cooling systems that serves an emergency function to prevent exceeding containment design pressure, provides sufficient capability in the emergency operational mode to accommodate any single failure of an active component and still perform its required function. 9.2 CHEMICAL AND VOLUME CONTROL SYSTEM The chemical and volume control system (1) adjusts the concentration of boric acid for nuclear reactivity control, (2) maintains the proper water inventory in the reactor coolant system, (3) provides the required seal water flow for the reactor coolant pump shaft seals, (4) maintains the proper concentration of corrosion inhibiting chemicals in the reactor coolant, and (5) maintains the reactor coolant and corrosion product activities within design levels. The system is also used to fill and hydrostatically test the reactor coolant system. This system has provisions for supplying the following chemicals:
- 1. Chemicals to regenerate the deborating demineralizers.
- 2. Hydrogen to the volume control tank. 3. Nitrogen as required for purging the volume control tank. 4. Hydrazine and lithium hydroxide, as required, via the chemical mixing tank to the charging pumps suction. During normal plant operation, reactor coolant letdown from the intermediate leg of loop 21 flows through the shell side of the regenerative heat exchanger where its temperature is reduced by transferring heat to the charging fluid. The coolant then flows through a letdown orifice, which regulates flow and reduces the coolant pressure.
The cooled, low-pressure water leaves the reactor containment and enters the primary auxiliary building where it undergoes a second temperature reduction in the tube side of the non regenerative heat exchanger followed by a second pressure reduction by the low-pressure letdown valve (this valve essentially controls backpressure on the orifices and prevents flashing there). After passing through one of the mixed-bed demineralizers, where ionic impurities are removed, the fluid flows through the reactor coolant filter, and enters the volume control tank through a spray nozzle. The coolant flows from the volume control tank to the charging pumps that raise the pressure above that in the reactor coolant system. The high-pressure water flows from the primary auxiliary building to the reactor containment along two parallel paths. One path returns directly to the reactor coolant system through the tube side of the regenerative heat exchanger to the cold leg of loop 21. The second path injects water into the seals of the reactor coolant pumps. A portion of this seal-water is injected into the reactor coolant system through the reactor coolant pumps labyrinth seals. The remainder of this seal-water flow returns to the volume control tank through the seal-water filter and the seal-water heat exchanger. Chapter 9, Page 3 of 99 Revision 20, 2006 OAG10000215_1090 IP2 FSAR UPDATE Concentrated boric acid, used for chemical shim or shutdown operations, is mixed in the batching tank. A transfer pump is used to transfer the batch to the boric acid storage tanks, which maintain a large inventory of concentrated boric acid solution. Small quantities of boric acid solution are metered from the discharge of the operating boric acid transfer pump for mixing with primary water in the blender to provide makeup for normal leakage or for increasing the boron concentration in the reactor coolant system. A chemical mixing tank (primary auxiliary building ft elevation) is provided to supply small quantities of hydrazine and lithium hydroxide to the charging pump suction. However, this will generally be accomplished through the letdown relief valve exhaust line. This line has a sample header in the sampling room into which the chemicals can be added. Equipment for processing reactor coolant for reuse of boric acid and reactor makeup water is no longer used and has been partially removed. 9.2.1 Design Bases 9.2.1.1 Redundancy of Reactivity Control Criterion: Two independent reactivity control systems, preferably of different principles, shall be provided. (GDC 27) In addition to the reactivity control achieved by the rod cluster control as detailed in Chapter 7, reactivity control is provided by the chemical and volume control system, which regulates the concentration of boric acid solution neutron absorber in the reactor coolant system. The system is designed to prevent, under anticipated system malfunction, uncontrolled or inadvertent reactivity changes, which might cause system parameters to exceed design limits. 9.2.1.2 Reactivity Hold-Down Capability Criterion: The reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies and limiting any subsequent return to power such that there will be no undue risk to the health and safety of the public. (GDC 30) Normal reactivity shutdown capability is provided by control rods, with boric acid injection used to compensate for the long term xenon decay transient and for plant cooldown. Any time that the plant is at power, the quantity of boric acid retained in the boric acid tanks and ready for injection will always exceed that quantity required for the normal cold shutdown. This quantity will always exceed the quantity of boric acid required to bring the reactor to hot shutdown and to compensate for subsequent xenon decay. The boric acid solution is transferred from the boric acid tanks by boric acid pumps to the suction of the charging pumps, which inject boric acid into the reactor coolant. Any charging pump and boric acid transfer pump can be operated from diesel-generator power on offsite power. Boric acid can be injected by one charging pump and one boric acid transfer pump to shut the reactor down even with no rods inserted. Additional boric acid can be injected to compensate for xenon decay although xenon decay below the equilibrium operating level will not begin until approximately 12-15 hr after shutdown. Additional boric acid is employed if it is desired to bring the reactor to cold shutdown conditions. In addition, borated makeup water can Chapter 9, Page 4 of 99 Revision 20, 2006 OAG10000215_1091 IP2 FSAR UPDATE be supplied to the primary system from the refueling water storage tank in the event that availability of the boric acid transfer pumps is lost. On the basis of the above, the injection of boric acid is shown to afford backup reactivity shutdown capability, independent of control rod clusters, which normally serve this function in the short term situation. Shutdown for long term and reduced temperature conditions can be accomplished with boric acid injection using redundant components. 9.2.1.3 Reactivity Hot Shutdown Capability Criterion: The reactivity control system provided shall be capable of making and holding the core subcritical from any hot standby or hot operating condition. (GDC 28) The reactivity control systems provided are capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes. The maximum excess reactivity expected for the core occurs for the cold, clean condition at the beginning-of-life of the initial core. The full length rod cluster control assemblies are divided into two categories comprising a control group and shutdown groups. The control group, used in combination with chemical shim provides control of the reactivity changes of the core throughout the life of the core at power conditions. This group of rod cluster control assemblies is used to compensate for short-term reactivity changes at power that might be produced due to variations in reactor power requirements or in coolant temperature. The chemical shim control is used to compensate for the more slowly occurring changes in reactivity throughout core life such as those due to fuel depletion and fission product buildup and decay. 9.2.1.4 Reactivity Shutdown Capability Criterion: One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margin should assure subcriticality with the most reactive control rod fully withdrawn. (GDC 29) The reactor core, together with the reactor control protection system is designed so that the minimum allowable DNBR remains at or above the applicable safety analysis DNBR limit and there is no fuel melting during normal operation including anticipated transients. The shutdown groups of rod cluster control assemblies are provided to supplement the control group of rod cluster control assemblies to make the reactor at least 1-percent subcritical (keff = 0.99) following trip from any credible operating condition to the hot, zero power condition assuming the most reactive rod cluster control assembly remains in the fully withdrawn position. Sufficient shutdown capability is also provided to maintain the core subcritical for the most severe anticipated cooldown transient associated with a single active failure, e.g., accidental opening of a steam bypass or relief valve. This is achieved with a combination of control rods and automatic boron addition via the safety injection system with the most reactive rod assumed to be fully withdrawn. Manually controlled boric acid addition is used to maintain the shutdown margin for the long-term conditions of xenon decay and plant cooldown. Chapter 9, Page 5 of 99 Revision 20, 2006 OAG10000215_1092 9.2.1.5 Codes and Classifications IP2 FSAR UPDATE All pressure retaining components (or compartments of components), which are exposed to reactor coolant comply with the code requirements as shown in Table 9.2-1. The tube side on both the regenerative and excess letdown heat exchangers are designed as ASME III, Class C. This designation is based on the applicable codes at the time of construction and on the following considerations: (1) each exchanger is connected to the primary coolant system by a 3 inch line (Regenerative Heat Exchanger) or a 1 inch line (Excess Letdown Heat Exchanger), and (2) each is located inside the reactor containment. Contaminated primary coolant escaping from the primary coolant system during a break in one of these lines is confined to the reactor containment building and no public hazard results as discussed in Section 14.3. 9.2.2 System Design and Operation The chemical and volume control system, shown in Plant Drawings 9321-2736, 208168, and 9321-2737 [Formerly UFSAR Figures 9.2-1 (Sheets 1 through 3)] provides a means for injection of control poison in the form of boric acid solution, chemical additions for corrosion control, and reactor coolant cleanup and degasification. This system also adds makeup water to the reactor coolant system, reprocesses water letdown from the reactor coolant system, and provides seal water injection to the reactor coolant pump seals. Overpressure protective devices are provided for system components whose design pressure and temperature are less than the reactor coolant system design limits. System discharges from overpressure protective devices (safety valves) and system leakages are directed to closed systems. Effluents removed from such closed systems are monitored and discharged under controlled conditions. System design enables post-operational testing to applicable code test pressures. Testing is based upon requirements set forth in ASME Section XI, as discussed in Section 1.12. During plant operation, reactor coolant is removed from the reactor coolant loop cold leg through the letdown line located on the suction side of the pump and is returned to the cold leg of the same loop on the discharge side of the pump via a charging line. An alternate charging connection is provided to the hot leg of another loop. An excess letdown line is also provided. Each of the connections to the reactor coolant system has an isolation valve located close to the loop piping. In addition, a check valve is located downstream of each charging line isolation valve. Reactor coolant entering the chemical and volume control system flows through the shell side of the regenerative heat exchanger where its temperature is reduced. The coolant then flows through a letdown orifice, which reduces the coolant pressure. The cooled, low-pressure water leaves the reactor containment and enters the auxiliary building where it undergoes a second temperature reduction in the tube side of the nonregenerative heat exchanger followed by a second pressure reduction by the low-pressure letdown valve. After passing through one of the mixed-bed demineralizers, where ionic impurities are removed, coolant flows through the reactor coolant filter and enters the volume control tank though a spray nozzle. Hydrogen is automatically supplied, as determined by pressure control, to the vapor space in the volume control tank, which is predominantly hydrogen and water vapor. The hydrogen Chapter 9, Page 6 of 99 Revision 20, 2006 OAG10000215_1093 IP2 FSAR UPDATE within this tank is, in turn, the supply source to the reactor coolant. Fission gases are periodically removed from the system by venting the volume control tank to the waste disposal system prior to a cold or refueling shutdown. From the volume control tanks the coolant flows to the charging pumps, which raise the pressure above that in the reactor coolant system. The coolant then enters the containment, passes through the tube side of the regenerative heat exchanger, and is returned to the reactor coolant system. The cation bed demineralizer, located downstream of the mixed-bed demineralizers, is used intermittently to control cesium activity in the coolant and also to remove excess lithium, which is formed from the B 10 (n,a) Li7 reaction. Boric acid is dissolved in hot water in the batching tank. The lower portion of the batching tank is jacketed to permit heating of the batching tank solution with low-pressure steam. A transfer pump is used to transfer the batch to the boric acid storage tank. During boric acid transfer from the batching tank when the reactor is critical the receiving storage tank is not aligned to the boric acid filter. The receiving storage tank is sampled after boric acid transfer is completed and before it is placed in service. Small quantities of boric acid solution are metered from the discharge of an operating boric acid transfer pump for blending with makeup water as makeup for normal leakage or for increasing the reactor coolant boron concentration during normal operation. Electric immersion heaters maintain the temperature of the boric acid tank solution high enough to prevent precipitation. During plant startup, normal operation, load reductions, and shutdowns, liquid effluents containing boric acid flow from the reactor coolant system through the letdown line and are collected in the holdup tanks. As liquid enters the holdup tanks, the nitrogen cover gas is displaced to the gas decay tanks in the waste disposal system through the waste vent header. The concentration of boric acid in the holdup tanks varies throughout core life from the refueling concentration to essentially zero at the end of the core cycle. A recirculation pump is provided to transfer liquid from one holdup tank to another. Liquid effluent in the holdup tanks is processed by demineralization or as radwaste. The deborating demineralizers can be used intermittently to remove boron from the reactor coolant near the end of the core life. When the deborating demineralizers are in operation, the letdown stream passes from the mixed-bed demineralizers and then through the deborating demineralizers and into the volume control tank after passing through the reactor coolant filter. During plant cooldown when the residual heat removal loop is operating and the letdown orifices are not in service, a flow path is provided to remove corrosion impurities and fission products. A portion of the flow leaving the residual heat exchangers passes through the non regenerative heat exchanger, mixed-bed demineralizers, reactor coolant filter and volume control tank. The fluid is then pumped, via the charging pump, through the tube side of the regenerative heat exchanger into the reactor coolant system. A booster pump is also provided in the crosstie. The pump and associated piping provide an additional capacity to provide reactor coolant system purification in a more timely manner. Chapter 9, Page 7 of 99 Revision 20, 2006 OAG10000215_1094 9.2.2.1 Design Parameters IP2 FSAR UPDATE Tables 9.2-2, 9.2-3, and 9.2-4 list the system design requirements for individual system components, and reactor coolant equilibrium activity concentration. Table 9.2-5 supplements Table 9.2-4. Reactor Coolant Activity Concentration The parameters used in the calculation of the reactor coolant fission product inventory, including pertinent information concerning the expected coolant cleanup flow rate and demineralizer effectiveness, are presented in Table 9.2-5. The results of the calculations are presented in Table 9.2-4. In these calculations the defective fuel rods are assumed to be present at initial core loading and are uniformly distributed throughout the core through the use of fission product escape rate coefficients. The fission product activity in the reactor coolant during operation with small cladding defects. [Note -Fuel rods containing pinholes or fine cracks.] In 1-percent of the fuel rods is computed using the following differential equations: For parent nuclides in the coolant: . ( J -'A. +Rll*+ N . dt 1 ill Bo -tB' Wl for daughter nuclides in the coolant: dN\\j ( B' ) --= Dv*N c -'A,. + R'll* + N w* + 'A,*N w* dt J j J ' IJ Bo _ tB' J 1 1 where: N = population of nuclide o = fraction of fuel rods having defective cladding R = purfication flow, coolant system volumes per sec Bo = initial boron concentration, ppm B' = boron concentration reduction rate by feed and bleed, ppm per sec 11 = removal efficiency of purification cycle for nuclide 'A, = radioactive decay constant v = escape rate coefficient for diffusion into coolant Subscript C refers to core Subscript w refers to coolant Subscript i refers to parent nuclide Subscript j refers to daughter nuclide Tritium is produced in the reactor from ternary fission in the fuel, irradiation of boron in the burnable poison rods and irradiation of boron, lithium, and deuterium in the coolant. The deuterium contribution is less than 0.1 Ci per year and may be neglected. The parameters used in the calculation of tritium production rate are presented in Table 9.2-6. Chapter 9, Page 8 of 99 Revision 20, 2006 OAG10000215_1095 9.2.2.2 Reactor Makeup Control IP2 FSAR UPDATE The reactor makeup control consists of a group of instruments arranged to provide a manually preselected makeup composition to the charging pump suction header or the volume control tank. The makeup control functions to maintain desired operating fluid inventory in the volume control tank and to adjust reactor coolant boron concentration for reactivity and shim control. Makeup for normal plant leakage is regulated by the reactor makeup control, which is set by the operator, to blend water from the primary water storage tank with concentrated boric acid to match the reactor coolant boron concentration. The makeup system also provides concentrated boric acid or primary water to change the boric acid concentration in the reactor coolant system. To maintain the reactor coolant volume constant, an equal amount of reactor coolant at existing reactor coolant boric acid concentration is letdown to the holdup tanks. Should the letdown line be out of service during operation, sufficient volume exists in the pressurizer to accept the amount of boric acid necessary to achieve cold shutdown. Makeup water to the reactor coolant system is provided by the chemical and volume control system from the following sources: 1. The primary water storage tank, which provides water for dilution when the reactor coolant boron concentration is to be reduced. 2. The boric acid tanks, which supply concentrated boric acid solution when reactor coolant boron concentration is to be increased.
- 3. The refueling water storage tank, which supplies borated water for emergency makeup. 4. The chemical mixing tank, which is used to inject small quantities of solution when additions of hydrazine or pH control chemical are necessary.
The reactor makeup control is operated from the control room by manually preselecting makeup composition to the charging pump suction header or the volume control tank in order to adjust the reactor coolant boron concentration for reactivity control. Makeup is provided to maintain the desired operating fluid inventory in the reactor coolant system. The operator can stop the makeup operation at any time in any operating mode by placing the Makeup Control switch to "STOP". One primary water makeup pump and one boric acid transfer pump are normally aligned for operation on demand from the reactor makeup control system. A portion of the high pressure charging flow is injected into the reactor coolant pumps between the thermal barrier and the shaft seal so that the seals are not exposed to high-temperature reactor coolant. Part of the flow is the shaft seal leakage flow and the remainder enters the reactor coolant system through a labyrinth seal on the pump shaft. Part of the shaft seal injection flow cools the lower radial bearing and part passes through the seals and is cooled in the seal water heat exchanger, filtered, and returned to the volume control tank. Chapter 9, Page 9 of 99 Revision 20, 2006 OAG10000215_1096 IP2 FSAR UPDATE An alternate source of flow for reactor coolant pump seal injection is provided, at the charging pump makeup header. It splits into four separate feed lines, one for each pump. Refer to Plant Drawing 9321-2736 [Formerly UFSAR Figure 9.2-1 (Sheet 1)]. Seal water injection to the reactor coolant system requires a continuous letdown of reactor coolant to maintain the desired inventory. In addition, bleed and feed of reactor coolant are required for removal of impurities and adjustment of boric acid in the reactor coolant. 9.2.2.2.1 Automatic Makeup The automatic makeup mode of operation of the reactor makeup control provides boric acid solution preset to match the boron concentration in the reactor coolant system. The automatic makeup compensates for minor leakage of reactor coolant without causing significant changes in the coolant boron concentration. Under normal plant operating conditions, the Makeup Mode Selector switch and makeup stop valves are set in the "AUTO" position and the Makeup Control switch in the "START" position. At a preset low-level in the volume control tank, the automatic makeup control action is initiated as follows:
- Starts both primary water makeup pumps (if not already running)
- Starts both boric acid transfer pumps (if not already running)
- Opens the concentrated boric acid control valve (FCV-110A)
- Opens the boric acid blender to charging pumps discharge control valve (FCV-11 OB)
- Opens the primary water makeup control valve (FCV-111A)
The flow controllers then blend the makeup stream according to the preset concentration. Makeup addition to the charging pump suction header causes the water level in the volume control tank to rise. At a preset high-level in the volume control tank, the automatic makeup control action is ceased. If the level in the volume control tank continues to decrease to a preset low-low level, the volume control tank outlet is isolated and the refueling water storage tank is aligned for RCS makeup as follows:
- Opens the RWST makeup to charging pumps suction stop valve (LCV-112B)
- Closes the volume control tank level control valve (LCV-112C) 9.2.2.2.2 Dilution The dilution mode of operation permits the addition of a preselected quantity of primary water makeup at a preselected flow rate to the reactor coolant system. To prepare for dilution, the operator sets the Makeup Mode Selector switch to "DILUTE", the primary water makeup flow controller setpoint to the desired flow rate, and the primary water makeup batch integrator to the desired quantity.
Placing the Makeup Control switch to "START" initiates the dilution control action as follows:
- Starts both primary water makeup pumps
- Opens the primary water makeup control valve (FCV-111A)
- Opens the boric acid blender discharge control valve (FCV-111 B) Chapter 9, Page 10 of 99 Revision 20, 2006 OAG10000215_1097 IP2 FSAR UPDATE Makeup water is added to the volume control tank and then goes to the charging pump suction header. If the primary water makeup flow deviates from the preset flow rate, an alarm indicates the deviation.
Excessive rise of the volume control tank water level is prevented by automatic actuation (by the tank level controller) of a three-way diversion valve, which routes the reactor coolant letdown flow to the holdup tanks. When the preset quantity of primary water makeup has been added, the dilution control action is ceased. 9.2.2.2.3 Boration The boration mode of operation permits the addition of a preselected quantity of concentrated boric acid solution at a preselected flow rate to the reactor coolant system. To prepare for boration, the operator sets the Makeup Mode Selector switch to "BORATE", the concentrated boric acid flow controller setpoint to the desired flow rate, and the concentrated boric acid batch integrator to the desired quantity. Placing the Makeup Control switch to "START" initiates the boration control action as follows:
- Starts both boric acid transfer pumps
- Opens the concentrated boric acid control valve (FCV-110A)
- Opens the boric acid blender to charging pumps discharge control valve (FCV-11 OB) The concentrated boric acid is added to the charging pump suction header. If the concentrated boric acid solution flow deviates from the preset flow rate, an alarm indicates the deviation.
The total quantity added in most cases is so small that it has only a minor effect on the volume control tank level. When the preset quantity of concentrated boric acid solution has been added, the boration control action is ceased. The capability to add boron to the reactor coolant is sufficient, using the normal makeup system, so that no limitation, due to boration, is imposed on the rate for cooldown of the reactor upon shutdown. 9.2.2.2.4 Alarm Functions The reactor makeup control is provided with alarm functions to call the operator's attention to the following conditions:
- 1. Deviation of primary water makeup flow rate from the control setpoint.
- 2. Deviation of concentrated boric acid flow rate from the control setpoint.
- 3. Low-level (makeup initiation point) in the volume control tank when the reactor makeup control selector is not set for the automatic or manual makeup control mode. 4. Low-Low Level in the Volume Control Tank. Concentrated boric acid is injected into the reactor coolant system by means of the charging pumps, which take suction from the boric acid storage tanks via the boric acid transfer pumps. The refueling water storage tank is also available to the charging pumps for injection of 2400 ppm borated water. Each operation is considered in turn: 1. Concentrated boric acid can be delivered to the suction of the charging pumps using the following paths; flow and tank level indications are available to the Cha pter 9, Page 11 of 99 Revision 20, 2006 OAG10000215_1098 IP2 FSAR UPDATE operator as needed for these operations (refer to Plant Drawing 9321-2736
[Formerly UFSAR Figure 9.2-1, Sheet 1)]: a. Through the blender and valve FCV-110B; for this operation the operator has flow indication available.
- b. Through path with manual valve 293; for this operation the operator has flow indication available.
- c. In the event that neither flow paths (a) nor (b) are available, the operator would use the emergency boration path through valve MOV-333. d. Refueling water storage tank is available to the charging pumps by closing LCV-112C and opening LCV-112B.
- 2. The charging pumps can deliver boric acid into the reactor coolant system via the following paths: a. Normal charging line via flow meter FT-128. b. Seal water supply line to the reactor pumps while bypassing the seal injection filters. If this path is used, flow indicators are available.
Facilities are provided to enable primary coolant samples to be taken from the following points:
- Pressurizer steam space
- Pressurizer liquid space
- Loop 1 hot leg, reactor coolant system
- Loop 3 hot leg, reactor coolant system
- Upstream of demineralizers (chemical and volume control system)
- Downstream of demineralizers (chemical and volume control system) The Technical Specifications for the plant require a boron content analysis to support shutdown margin determination.
Samples would normally be taken from either the loop 1 hot leg or the loop 3 hot leg for routine analysis; the sample will be analyzed for boron concentration. It is important to note, however, that the main indicator to the operator during power operation as to the requirement for boration or dilution is control rod position (see Section 14.1.5). During startup and refueling, the main indicator to the operator of abnormal conditions is the nuclear instrumentation system source range detectors. Abnormal dilution conditions are discussed in Section 14.1.5. As for power operation, it is considered that frequent boron analysis of the primary coolant is not essential for safe operation. For a cold shutdown, the operator borates the system prior to the start of cooldown. Boration is indicated by the flow indicators in the boric acid transfer pump discharge line. The prime indicator that sufficient boron has been added to the system is inventory from the boric acid storage tanks and reactor coolant system sample analysis. Chapter 9, Page 12 of 99 Revision 20, 2006 OAG10000215_1099 9.2.2.3 Charging Pump Control IP2 FSAR UPDATE Three positive displacement variable speed drive charging pumps are used to supply charging flow to the reactor coolant system. The speed of each pump can be controlled manually or automatically. During normal operation, only one charging pump is expected to be operating and the speed is modulated in accordance with pressurizer level. During load changes the pressurizer level setpoint is varied automatically to compensate partially for the expansion or contraction of the reactor coolant associated with the T avg changes. T avg compensates for power changes by varying the pressurizer level setpoints in conjunction with pressurizer level for charging pump control. The level setpoints are varied depending on the power level. If the pressurizer level increases, the speed of the pump decreases, likewise if the level decreases, the speed increases. If the charging pump on automatic control is unable to maintain the required charging rate, then a pressurizer low level alarm actuates and a second charging pump may be manually started. The speed of the second pump is manually regulated. If the speed of the charging pump on automatic control does not decrease and the second charging pump is operating at maximum speed, the third charging pump can be started and its speed manually regulated. If the speed of the charging pump on automatic control decreases to its minimum value, an alarm is actuated and the speed of the pumps on manual control is reduced. 9.2.2.4 Components A summary of principal component data is given in Table 9.2-3. 9.2.2.4.1 Regenerative Heat Exchanger (containment elevation 46-ft) The regenerative heat exchanger is designed to recover heat from the letdown flow by reheating the charging flow, to eliminate reactivity effects due to insertion of cold water, and to reduce thermal shock on the charging line penetrations to the reactor coolant loop piping. The coolant enters the shell side of the regenerative heat exchanger (U-tube multiple pass heat exchanger) where its temperature is reduced by transferring heat to the charging flow. In order to prevent flashing, this temperature should never be allowed to exceed the saturation temperature of the letdown steam at the pressure prevailing downstream of the letdown orifices. A resistance temperature detector on the outlet of the heat exchanger provides temperature indication in the control room and a high-temperature alarm. The unit is made of austenitic stainless steel and is of all-welded construction. The exchanger is designed to withstand 2000 step changes in shell-side fluid temperature from 100°F to 560°F during the design life of the unit. 9.2.2.4.2 First Stage Letdown Orifices and Control Valves (containment elevation 46-ft) Three letdown orifices are provided to admit a predetermined coolant flow to the letdown stream and reduce to letdown pressure. They consist of two 75-gpm and one 45-gpm orifices. Normally a 75-gpm orifice is in service. The 45-gpm orifice combined with the 75-gpm orifice results in a letdown flow of 120 gpm, which is a maximum for the chemical and volume control system (greater flow will result in channeling and hence inefficient operation in the Cha pter 9, Page 13 of 99 Revision 20, 2006 OAG10000215_1100 IP2 FSAR UPDATE demineralizers). The second 75-gpm orifice allows for even less flow restriction for letdown during operations when the system pressure is low (excess letdown and residual heat removal connections can also be used to maintain flow during times of low system pressure). This last orifice also provides a redundant backup for the first 75-gpm orifice. The selected orifice is placed in service from the control room by remote operation of its respective letdown flow control valve. These lights and switches are located on the flight panel in the central control room. An additional switch for the three valves labeled "close-remote," is provided on the containment isolation supervisory panel in the central control room. The three letdown flow control valves will close automatically on a phase A containment isolation signal. The switch on the containment isolation panel will allow the closing of these valves manually if required. Valve position is indicated on the isolation panel by dual-colored windows. Valve position for normal plant operations and valve position for containment isolation are provided. Orifice selection is controlled from the central control room or primary auxiliary building. Indications are also provided at this location when the valves are open. The primary auxiliary building switches will be used to control the rate of letdown when the control room is not available. The letdown inlet stop valve to the regenerative heat exchanger may also be controlled locally in the primary auxiliary building. When these switches are in use, either in the close or open position, all control from the central control room will be lost. This will be indicated in the central control room by the actuation of a category alarm (control transferred to local) and the loss of all indicating lights associated with these valves. 9.2.2.4.3 Letdown Relief Valve Relief valve No. 203 is provided to protect the piping downstream of the letdown flow control valves and up to the low-pressure letdown valve, PCV-135. Thus, this piping will be protected in the event that the letdown flow control valves fail in the open position allowing pressure to increase up to system pressure. The relief valve is set at 600 psig or below and discharges to the pressurizer relief tank. An orifice installed just up-stream of the relief valve provides sufficient differential pressure to prevent over-cycling of the valve. A resistance temperature detector is provided on the relief valve discharge piping. This temperature is indicated in the control room and a high-temperature alarm will indicate that the relief valve is leaking or has lifted. 9.2.2.4.4 Nonregenerative (letdown) Heat Exchanger (primary auxiliary building elevation 98-ft) The letdown stream enters the tube side of the nonregenerative heat exchanger. In passing through these U-tubes, it is cooled by the multipass flow of component cooling water in the shell side of the heat exchanger. Temperature and pressure control of the letdown flow is accomplished automatically by means of sensors located downstream of the heat exchanger. All surfaces in contact with the reactor coolant are austenitic stainless steel, and the shell is carbon steel. 9.2.2.4.5 Demineralizers (primary auxiliary building elevation 59-ft) All the demineralizers in this system have similar piping connections. Water enters the demineralizer at the top and flows past an impingement baffle, which prevents channels being cut in the resin bed by the water stream. After passing through the resin, the water flows through a screen and exits through the water outlet connection. This screen prevents loss of Chapter 9, Page 14 of 99 Revision 20, 2006 OAG10000215_1101 IP2 FSAR UPDATE resin through the water outlet connection. In order to allow resin replacement, a resin fill and a resin discharge connection are provided on the top and bottom of the demineralizer, respectively. A vent connection, located on the top of the demineralizer, is used during resin replacement and/or regeneration and backwashing operations. The vent screen will prevent loss of resin through this connection. Sampling connections are provided on the common inlet line to the demineralizers and on the common outlet line from the demineralizers to check on the performance of the demineralizers. When impurities begin to leak through the resin bed the demineralizer is considered exhausted. At this point it is necessary to replace or regenerate the spent resin. Regeneration will be done only with anion demineralizers; the resin beds of the cation and mixed-bed units will be replaced when depleted. (The deborating and boric acid evaporator condensate demineralizer are the only anion beds in the system.) Current procedures use only the resin replacement option. 9.2.2.4.5.1 Mixed-Bed Demineralizers Two flushable mixed-bed demineralizers maintain reactor coolant purity by removing fission and corrosion products. The resin bed is designed to reduce the concentration of ionic isotopes in the purification stream, except for cesium, tritium, and molybdenum, by a minimum factor of 10. Each demineralizer is sized to accommodate the maximum letdown flow. One demineralizer serves as a standby unit for use if the operating demineralizer becomes exhausted during operation. The demineralizer vessels are made of austenitic stainless steel and are provided with suitable connections to facilitate resin replacement when required. The vessels are equipped with a resin retention screen. 9.2.2.4.5.2 Cation Bed Demineralizer A flushable cation resin bed in the hydrogen form is located downstream of the mixed-bed demineralizers and is used intermittently to control the concentration of lithium-7, which builds up in the coolant from the B 1°(n,a) Li7 reaction. The demineralizer would be used intermittently to control cesium. The demineralizer is made of austenitic stainless steel and is provided with suitable connections to facilitate resin replacement when required. The vessel is equipped with a resin retention screen. 9.2.2.4.5.3 Chemical Control Demineralizers There are two anion demineralizers located downstream of the cation bed demineralizer, which can be used to remove boric acid from the reactor coolant system fluid. The anion deborating demineralizers are primarily used to remove boron from the reactor coolant system near the end of a core cycle, but can be used at any time. Each anion deborating demineralizer is sized to remove the quantity of boric acid that must be removed from the reactor coolant system to maintain full power operation near the end of core life should the holdup tanks be full. Cha pter 9, Page 15 of 99 Revision 20, 2006 OAG10000215_1102 IP2 FSAR UPDATE With a change in resin, either one of the two anion demineralizers could be reconfigured as a cation bed lithium control demineralizer. Either one would then be capable of removing lithium from the Reactor Coolant System, as does the normal cation bed demineralizer. Facilities are provided for regeneration. When regeneration is no longer feasible, the resin is flushed to the spent resin storage tank. 9.2.2.4.6 Resin Fill Tank The resin fill tank is used to charge fresh resin to the demineralizers. The line from the conical bottom of the tank is fitted with a dump valve and may be connected to anyone of the demineralizer fill lines. The demineralized water and resin slurry can be sluiced into the demineralizer by opening the dump valve. The tank is made of austenitic stainless steel. An additional valve at the resin fill tank is installed to reduce the need for personnel to go to the ion exchange gallery each time new resin is added, thereby reducing radiation exposure. 9.2.2.4.7 Reactor Coolant Filter (Primary Auxiliary Building elevation 98-ft) The reactor coolant filter will remove any resin fines or particulates larger than 25 microns. A range of smaller filter micron sizes are used in accordance with industry practice to reduce reactor coolant radiation activity and, consequently, reduce personnel exposure. When the local pressure indicators before and after the filter indicate excessive pressure drop or when the filter develops high radiation fields, the disposable filter element will be replaced. Vent and drain connections are provided for the replacement operation. The vessel is made of austenitic stainless steel. 9.2.2.4.8 Volume Control Tank The volume control tank collects the reactor coolant surge volume resulting from a change from zero power to full power that is not accommodated by the pressurizer. It also receives the excess coolant release caused by the dead band in the reactor control temperature instrumentation. A cover of hydrogen gas is maintained in the volume control tank to control the hydrogen concentration in the reactor coolant system. A spray nozzle is located inside the tank on the inlet line from the reactor coolant filter. This spray nozzle provides intimate contact to equilibrate the gas and liquid phases. A operated vent valve discharging to the waste disposal system permits removal of gaseous fission products, which are stripped from the reactor coolant and collected in this tank. The volume control tank also acts as a head tank for the charging pumps and a reservoir for the leakage from the reactor coolant pump controlled leakage seal. The tank is constructed of austenitic stainless steel. A bypass line, with hand-operated valve, is installed to enable water to be pumped from the holdup tanks to the volume control tank to allow faster filling of the primary system following a shutdown. 9.2.2.4.9 Charging Pumps Three charging pumps inject coolant into the reactor coolant system. The pumps are the variable speed positive displacement type, and all parts in contact with the reactor coolant are fabricated of austenitic stainless steel or other material of adequate corrosion resistance. These pumps have mechanical packing followed by a leakoff to collect reactor coolant before it can Chapter 9, Page 16 of 99 Revision 20, 2006 OAG10000215_1103 IP2 FSAR UPDATE leak to the outside atmosphere. Pump leakage is piped to the drain header for disposal. The pump design prevents lubricating oil from contaminating the charging flow, and the integral discharge valves act as check valves. Each pump is designed to provide the normal charging flow and the reactor coolant pump seal water supply during normal seal leakage. Each pump is designed to provide flow against a pressure equal to the sum of the reactor coolant system normal maximum pressure (existing when the pressurizer power-operated relief valve is operating) and the piping, valve and equipment pressure losses at the charging flows. During normal operation, S gpm seal injection enters each reactor coolant pump in the thermal barrier region where the flow splits, with 3 gpm flowing upward through the controlled leakage seal package and returning to the chemical and volume control system. The remaining 5 gpm passes through the thermal barrier heat exchanger and into the reactor coolant system where it constitutes a portion of the reactor coolant system water makeup. In the event that normal seal cooling is lost, the component cooling water system provides adequate seal cooling by supplying flow to the thermal barrier heat exchanger. Seal injection flow is indicated locally and in the central control room. An alternate power supply is provided for one of the charging pumps from the 13.S-kV normal offsite power through Unit 1 switchgear. If normal offsite power is not available, this pump can be energized using any of the three available gas turbines. Anyone of the three charging pumps can be used to hydrotest the reactor coolant system. A low-pressure tank (dampener) is installed in the suction line, and a high-pressure tank is installed in the discharge line on each charging pump in order to eliminate pulsation that could potentially cause cavitation at the charging pump suction or root weld cracks on the discharge piping. 9.2.2.4.10 Chemical Mixing Tank The primary use of the stainless steel chemical mixing tank is to prepare caustic solutions for pH control and hydrazine for oxygen scavenging. The capacity of the chemical mixing tank is more than sufficient to prepare a solution of pH control chemical for the reactor coolant system. 9.2.2.4.11 Excess Letdown Heat Exchanger The excess letdown heat exchanger cools reactor coolant letdown flow if letdown through the normal letdown path is blocked. The letdown stream flows through the tube side and component cooling water is circulated through the shell side. All surfaces in contact with reactor coolant are austenitic stainless steel and the shell is carbon steel. All tube joints are welded. The unit is designed to withstand 2000 step changes in the tube fluid temperature from SO°F to the cold-leg temperature. 9.2.2.4.12 Seal-Water Heat Exchanger The seal-water heat exchanger removes heat from two sources; reactor coolant pump water returning to the volume control tank and reactor coolant discharge from the excess letdown heat exchanger. Reactor coolant flows through the tubes and component cooling water Cha pter 9, Page 17 of 99 Revision 20, 2006 OAG10000215_1104 IP2 FSAR UPDATE is circulated through the shell side. The tubes are welded to the tube sheet. All surfaces in contact with reactor coolant are austenitic stainless steel and the shell is carbon steel. The unit is designed to cool the excess letdown flow and the seal water flow to the temperature normally maintained in the volume control tank if all the reactor coolant pump seals are leaking at the maximum design leakage rate. 9.2.2.4.13 Seal-Water Filter The filter collects particulates larger than 25 /-l from the reactor coolant pump seal-water return and from the excess letdown heat exchanger flow. The filter is designed to pass the sum of the excess letdown flow and the maximum design leakage from the reactor coolant pump floating ring seals. The vessel is constructed of austenitic stainless steel and is provided with connections for draining and venting. Disposable synthetic filter elements are used. 9.2.2.4.14 Seal-Water Injection Filters Two filters are provided in parallel, each sized for the injection flow. They collect particulates larger than 5 /-l from the water supplied to the reactor coolant pump seals. A seal injection filter is also provided for the alternate seal injection path. 9.2.2.4.15 Boric Acid Filter The boric acid filter collects particulates larger than 25 /-l from the boric acid solution being pumped to the charging pump suction line. The filter is designed to pass the design flow of two boric acid pumps operating simultaneously. The vessel is constructed of austenitic stainless steel and the filter elements are disposable synthetic cartridges. Provisions are available for venting and draining the filter. 9.2.2.4.16 Boric Acid Storage Tanks The boric acid storage tanks are sized to store sufficient boric acid solution for refueling and enough boric acid solution for a cold shutdown shortly after full power operation is achieved. In addition, sufficient boric acid solution is available for cold shutdown if the most reactive rod cluster control is not inserted. The requirements for the volume of boric acid in the tanks are contained in the Technical Requirements Manual. The concentration of boric acid solution in storage is maintained within Technical Requirements Manual limits. Periodic manual sampling and corrective actions are taken, if necessary, to ensure that these limits are maintained. Therefore, measured quantities of boric acid solution can be delivered to the reactor coolant to control the chemical poison concentration. A combination overflow and breather vent connection has a water loop seal to minimize vapor discharge during storage of the solution. The tank is constructed of austenitic stainless steel. Each tank is provided with a low-level alarm. It is, however, optional whether the operator chooses to operate normally above the low-level alarm in both tanks. Each tank is instrumented for level indication. Indication of level is provided locally and on supervisory panel "SF" in the control room. The low-level condition is audibly annunciated in the control room. Chapter 9, Page 18 of 99 Revision 20, 2006 OAG10000215_1105 9.2.2.4.17 IP2 FSAR UPDATE Boric Acid Storage Tank Heaters Each boric acid tank has two 100-percent capacity electric heaters, which are connected in parallel and controlled from a single controller and a single temperature sensing controller and a single temperature sensing device and are powered by a single source. The heaters maintain the boric acid solution temperature above the minimum required by the Technical Requirements Manual. 9.2.2.4.18 Batching Tank The batching tank is used to provide makeup to the boric acid storage tanks. The tank manway is provided with a removable screen to prevent entry of foreign particles. In addition, the tank is provided with an agitator to improve mixing during batching operations. The tank is constructed of austenitic stainless steel. The tank is provided with a steam jacket for heating the boric acid solution. The tank can also be used for sodium hydroxide addition for postaccident pH control inside containment. 9.2.2.4.19 Boric Acid Transfer Pumps Two 100-percent capacity pumps are used to circulate or transfer chemical solutions. Redundancy is thus provided for the pumps to permit maintenance during operation of the plant. The pumps circulate boric acid solution through the boric acid storage tanks and inject boric acid into the charging pump suction header. Although one pump is normally used for boric acid batching and transfer and the other for boric acid injection, either pump may function as standby for the other. The design capacity of each pump is equal to the normal letdown flow rate. The design head is sufficient, considering line and valve losses, to deliver rated flow to the charging pump suction header when volume control tank pressure is at the maximum operating value (relief valve setting). All parts in contact with the solutions are austenitic stainless steel or other adequate corrosion-resistant material. The transfer pumps are operated either automatically or manually from the main control room or from a local control center. The reactor makeup control operates one of the pumps automatically when boric acid solution is required for makeup or boration. 9.2.2.4.20 Boric Acid Blender The boric acid blender promotes thorough mixing of boric acid solution and reactor makeup water from the reactor coolant makeup circuit. The blender consists of a conventional pipe fitted with a perforated tube insert. All material is austenitic stainless steel. The blender decreases the pipe length required to homogenize the mixture for taking a representative local sample. 9.2.2.4.21 Valves Valves that perform a modulating function are equipped with either two sets of packing and an intermediate leakoff connection that discharges to the waste disposal system or a standard stuffing box suitable for the specified service. All other valves have stem leakage control. Globe valves are installed with flow over the seats when such an arrangement reduces the possibility of leakage. Basic material of construction is stainless steel for all valves except the batching tank steam jacket valves which are carbon steel. Cha pter 9, Page 19 of 99 Revision 20, 2006 OAG10000215_1106 IP2 FSAR UPDATE Isolation valves are provided at all connections to the reactor coolant system. Lines entering the reactor containment also have check valves inside the containment to prevent reverse flow from the containment. Relief valves are provided for lines and components that might be pressurized above design pressure by improper operation or component malfunction. Pressure relief for the tube side of the regenerative heat exchanger is provided by the auxiliary spray line lift check valve, which is designed to open when pressure under the seat exceeds reactor coolant pressure by 200 psi. 9.2.2.4.22 Piping All chemical and volume control system piping handling radioactive liquid is austenitic stainless steel. All piping joints and connections are welded, except where flanged connections are required to facilitate equipment removal for maintenance and hydrostatic testing. Piping, valves, equipment and line-mounted instrumentation, which normally contain concentrated boric acid solution, are heated by electrical tracing to ensure solubility of the boric acid. 9.2.2.4.23 Electrical Heat Tracing Piping containing concentrated boric acid is provided with double circuit (one circuit redundant) electrical heat tracing in conjunction with insulation to maintain the concentrated solution above the precipitation temperature. Alarms are provided. Exceptions are as follows: 1. Lines, which may transport concentrated boric acid but are subsequently flushed with reactor coolant or other liquid of low boric acid concentration during normal operation.
- 2. The boric acid storage tanks, which are provided with immersion heaters. 3. The batching tank, which is provided with a steam jacket. 4. The concentrates holding tank, which is provided with an immersion heater. 5. The boric acid transfer pumps, which are provided with strip heaters in enclosures.
Emergency power is supplied to the heat tracing circuits and electric heaters on loss of offsite power. Each individual pipe tracing circuit has a local control cabinet containing operating, testing, and alarm devices. Failure of the operating circuit will result in a decrease in pipe temperature and will alarm in the control room. Test and connection of the redundant circuit can be readily accomplished. Likewise, failure of any operating device in the local control cabinet will result in alarm. 9.2.2.5 Recycle Process Boron is no longer recycled, consequently some components of the boron recycle system are no longer used, some have been removed (evaporator 22, gas stripper 22 and ion exchanger filter 22) and some (Boron Monitoring Tanks and pumps) have been retired and their inlet and outlet piping cut and capped. Heaters, pumps and level and temperature instrumentation Cha pter 9, Page 20 of 99 Revision 20, 2006 OAG10000215_1107 IP2 FSAR UPDATE associated with the monitor tanks have been disconnected. Reactor coolant system effluents collected in the holdup tanks are either processed through demineralizers or sent to the radwaste system for processing. The originally supplied gas stripper feed pumps have been replaced by holdup tank transfer pumps, which are used to transfer water to waste collection tanks in Unit 1. 9.2.2.5.1 Purpose The original purpose of the recycle portion of the chemical and volume control system is to accept and process all effluents, which could be readily reused as makeup to the reactor coolant system. Boron is no longer recycled, but portions of the boron recycle system are used to collect effluents and transfer them to the waste disposal system. Effluents are initially collected in the chemical and volume control system holdup tanks. Prior to the holdup tanks, particularly if the reactor is operating with defective fuel, the letdown from the reactor coolant system is passed through the mixed-bed demineralizers. Both forms of resin remove fission products and corrosion products. As fluid enters the holdup tanks, released gases (hydrogen and fission gases) mix with the nitrogen cover gas and are eventually drawn off to the waste gas system. Three eves holdup tank transfer pumps take suction from the holdup tanks and pump the fluid through the evaporator feed ion exchangers where lithium and fission products (primarily cesium isotopes) are removed. The resin is a hydrogen form cation resin. Two ion exchangers are employed in series. Series operation is recommended to ensure prevention of breakthrough of cesium in the event of evaporation with 1-percent fuel defects. From the feed ion exchangers, the fluid is returned to the holdup tanks. The eves holdup tank transfer pumps are also used to transfer the holdup tank contents to the waste disposal system. A holdup tank low pressure interlock will trip the eves holdup tank transfer pumps upon low pressure in the holdup tank. This interlock reduces the potential for creating a negative pressure condition in the holdup tanks during drain down of the tank. During operation of the recycle process, samples can be taken at various positions through the system to assess the performance of the individual system components. Local samples may be obtained before and after the evaporator feed ion exchangers. 9.2.2.5.2 Holdup Tanks Three holdup tanks contain radioactive liquid, which enters the tank from the letdown line. The liquid is released from the reactor coolant system during startup, shutdowns, load changes and from boron dilution to compensate for burn up. The contents of one tank are normally being processed while another tank is being filled. The third tank is normally kept empty to provide additional storage capacity when needed. The total liquid storage sizing basis for the holdup tanks is given in Table 9.2-3. The tanks are constructed of austenitic stainless steel. 9.2.2.5.3 Holdup Tank Recirculation Pump The recirculation pump is used to mix the contents of a holdup tank and to transfer the contents of a holdup tank to another. Cha pter 9, Page 21 of 99 Revision 20, 2006 OAG10000215_1108 IP2 FSAR UPDATE A holdup tank low pressure interlock will trip the holdup tank recirculation pump upon low pressure in the holdup tank. This interlock reduces the potential for creating a negative pressure condition. The wetted surface of this pump is constructed of austenitic stainless steel. 9.2.2.5.4 Holdup Tank Transfer Pump The three holdup tank transfer pumps originally supplied feed to the gas stripper boric acid evaporator trains from a holdup tank. They now are used to transfer water to waste collection tanks in unit 1. These centrifugal pumps are constructed of austenitic stainless steel. 9.2.2.5.5 Evaporator Feed (Cation) Ion Exchangers Four cation flushable demineralizers remove cations (primarily cesium and lithium) from the holdup tank effluent. The demineralizer vessels are constructed of austenitic stainless steel and contain a resin retention screen. 9.2.2.5.6 Ion Exchanger Filters These filters were originally provided to collect resin fines and particulates larger than 25 microns from the cation ion exchanger. They are no longer used. Filter 21 has been retired in place and filter 22 has been removed. 9.2.2.5.7 Gas Stripper Equipment Two gas strippers were originally provided to remove nitrogen, hydrogen, and fission gases from the evaporator feed. They are no longer used. Gas stripper 21 has been retired in place and gas stripper 22 has been removed. 9.2.2.5.8 Boric Acid Evaporator Equipment Two boric acid evaporators were originally provided to concentrate boric acid for reuse in the reactor coolant system. They are no longer used. Evaporator 21 has been retired in place and evaporator 22 has been removed. 9.2.2.5.9 Evaporator Condensate Demineralizers Two anion demineralizers were originally provided to remove any boric acid contained in the evaporator condensate. These demineralizers are valved out of service and no longer used. 9.2.2.5.10 Condensate Filters The filters were originally provided to collect resin fines and particulates larger than 25 microns from the boric acid evaporator condensate streams. These filters are no longer used. 9.2.2.5.11 Monitor Tanks The monitor tanks have been retired in place. Cha pter 9, Page 22 of 99 Revision 20, 2006 OAG10000215_1109 9.2.2.5.12 Monitor Tank Pumps IP2 FSAR UPDATE The monitor tank pumps have been retired in place. 9.2.2.5.13 Primary Water Storage Tank A single 165,000-gal primary water storage tank is provided to store the demineralized water used by the primary water makeup system shown in Plant Drawing9321-2724 [Formerly UFSAR Figure 9.2-2]. The storage tank is constructed of type 304 stainless steel. Chemical addition to the tank, if required, can be accomplished via a 3-in. blind flange connection located near the top of the tank, directly off the pressure-vacuum relief valve. This connection can be used to correct the reactor coolant system water chemistry. A local sample point is provided on the bottom of the tank in addition to a tank drain and a loop seal overflow. This loop seal will prevent the entrance of air. To ensure that this loop seal is filled with water a valved line is provided from the tank drain to the loop seal. Besides these lines into the primary water storage tank, there are also two feeds. One comes from the monitor tank pumps, which have been retired in place, and the second comes from the primary water makeup pump recirculation. Lines carrying heating steam to and from the tank also enter it near its bottom. All of these connections and lines entering the tank are heat traced to prevent them from freezing. A large inspection port is provided on the side of the tank. 9.2.2.5.13.1 Primary Water Storage Tank Level Measurement Level in the tank is measured and indicated locally and in the central control room. In addition, high level and low level are alarmed in the central control room. 9.2.2.5.13.2 Primary Water Storage Tank Temperature Control Temperature in the tank is indicated locally. An additional temperature measurement is made at the tank, on the suction line to the makeup pumps. The temperature element will sense a representative fluid temperature. This temperature measurement is used to control steam flow to the coils located at the bottom of the storage tank. The steam coils will maintain the water in the storage tank at a sufficiently high temperature to prevent freezing of the tank contents and large temperature changes in the primary water supplied to the shaft seals of the reactor coolant pumps by means of the blender. The walls of the tank are insulated and all lines connected to the tank and exposed to the environment are electrically heat traced to prevent freezing. In addition, the external instrument cabinet is heated and weatherproofed to help ensure a controlled temperature for the tank level instrumentation. Low temperature alarms alert the operator of any instrument heat trace failure or low temperatures in the instrument enclosure. 9.2.2.5.14 Primary Water Makeup Pumps Two primary water makeup pumps are provided and normally take their suction from the primary water storage tank. The pumps are constructed of type 316 austenitic stainless steel. Each can supply 150 gpm of water at a total dynamic head of 21 O-ft. Cha pter 9, Page 23 of 99 Revision 20, 2006 OAG10000215_1110 IP2 FSAR UPDATE Control of both pumps is provided from the central control room. No local control of the pump is provided. Normally one pump will be selected to run continuously; the second will be in auto. A limited flow recirculation line is provided and remains open in case makeup water is not required at a given time anywhere in the plant. An orifice in this line limits the recirculation flow. In addition to manual operation, these pumps are also automatically controlled by the chemical and volume control system. In the event that automatic makeup to or dilution of the reactor coolant system is required, the makeup control system will send a start signal to both primary water pumps. The pump in operation will continue to run and the second pump, if in auto, will start. When this automatic start signal is removed, the pumps will return to their original operating condition. When makeup is required, the water follows the path to the boric acid blender. In the event the pressure in the supply line to the blender falls, indicating insufficient water supply, an alarm will be annunciated in the central control room. Each pump is also provided with a discharge pressure gauge. Operation of the pumps without a suction head is prevented. 9.2.2.5.15 Concentrates Filter A disposable synthetic cartridge-type filter was provided in the original design to remove particulates larger than 25 microns from the evaporator concentrates. This filter is no longer used and has been retired in place. 9.2.2.5.16 Concentrates Holding Tank The concentrates holding tank was provided in the original design to hold the production of concentrates from one batch of boric acid evaporator operation. The tank is no longer used and has been retired in place. 9.2.2.5.17 Concentrates Holding Tank Transfer Pumps Two holding tank transfer pumps were provided in the original design to discharge boric acid solution from the concentrates holding tank to the boric acid storage tanks. These pumps are no longer used and have been retired in place. 9.2.3 System Design Evaluation 9.2.3.1 Availability and Reliability A high degree of functional reliability is ensured in this system by providing standby components where performance is vital to safety and by ensuring fail safe response to the most probable mode of failure. Special provisions include duplicate heat tracing with alarm protection of lines, valves, and components normally containing concentrated boric acid. The system has three high pressure charging pumps, each capable of supplying the normal reactor coolant pump seal and makeup flow. The electrical equipment of the chemical and volume control system is arranged so that multiple items receive their power form various 480-V buses (see Chapter 8). Each of the three charging pumps is powered from a separate 480-V bus. The two boric acid transfer pumps are Cha pter 9, Page 24 of 99 Revision 20, 2006 OAG10000215_1111 IP2 FSAR UPDATE also powered from separate 480-V buses. One charging pump and one boric acid transfer pump are capable of meeting cold shutdown requirements shortly after full power operation. In cases of loss of offsite power, a charging pump and a boric acid transfer pump can be placed on the emergency diesels, if necessary. 9.2.3.2 Control of Tritium The chemical and volume control system is used to control the concentration of tritium in the reactor coolant system. Essentially all of the tritium is in chemical combination with oxygen as form of water. Therefore, any leakage of coolant to the containment atmosphere carries tritium in the same proportion as it exists in the coolant. Thus, the level of tritium in the containment atmosphere, when it is sealed from outside air ventilation, is a function of tritium level in the reactor coolant, the cooling water temperature at the cooling coils, which determines the dewpoint temperature of the air, and the presence of leakage other than reactor coolant as a source of moisture in the containment air. There are two major considerations with regard to the presence of tritium: 1. Possible plant personnel hazard during access to the containment. Leakage of reactor coolant during operation with a closed containment causes an accumulation of tritium in the containment atmosphere. It is desirable to limit the accumulation to allow containment access. 2. Possible public hazard due to release of tritium to the environment. Neither of these considerations is limiting in this plant. The concentration of tritium in the reactor coolant is maintained at a level, which precludes personnel hazard during access to the containment. This is achieved by diverting the letdown flow to the Chemical and Volume Control System for processing via the Waste Disposal System. The Annual Effluent and Waste Disposal Report shows that tritium released to the environment in this manner is well below 10 CFR 20 limits and thus no public hazard would result. 9.2.3.3 Leakage Prevention Quality control of the material and the installation of the chemical and volume control valves and piping that are designated for radioactive service, is provided in order to eliminate leakage to the atmosphere. The components designated for radioactive service are provided with welded connections to prevent leakage to the atmosphere. However, flanged connections are provided in each charging pump suction and discharge, on each boric acid pump suction and discharge, on the relief valves inlet and outlet, on three-way valves, and on the flow meters to permit removal for maintenance. The positive displacement charging pumps stuffing boxes are provided with leakoffs to collect reactor coolant before it can leak to the atmosphere. All valves, with the exception of the control valves discussed below, which are larger than 2-in. and which are designated for radioactive service at an operating fluid temperature above 212°F, are provided with a stuffing box and capped lantern leakoff connections. Leakage to the atmosphere is essentially zero for these valves. All control valves are either provided with a stuffing box and leakoff connections, a Chapter 9, Page 25 of 99 Revision 20, 2006 OAG10000215_1112 IP2 FSAR UPDATE standard stuffing box suitable for the specified service, or are totally enclosed. Leakage to the atmosphere is essentially zero for these valves. Diaphragm valves are provided where the operating pressure and the operating temperature permit the use of these valves. Leakage to the atmosphere is essentially zero for these valves. 9.2.3.4 Incident Control The letdown line and the reactor coolant pumps seal water return line penetrate the reactor containment. The letdown line contains air-operated valves inside the reactor containment and two air-operated valves outside the reactor containment, which are automatically closed by the containment isolation signal. The reactor coolant pumps seal water return line contains one motor-operated isolation valve outside the reactor containment, which is automatically closed by the containment isolation signal. The four seal water injection lines to the reactor coolant pumps and the normal charging line are inflow lines penetrating the reactor containment. Each line contains at least one check valve inside the reactor containment to provide isolation of the reactor containment should a break occur in these lines outside the reactor containment. 9.2.3.5 Malfunction Analysis To evaluate system safety, failures or malfunctions were assumed concurrent with a coolant and the consequences analyzed and presented in Table 9.2-7. As a result of this evaluation, it is concluded that proper consideration has been given to safety in the design of the system. If a rupture were to take place between the reactor coolant loop and the first isolation valve or check valve, this incident would lead to an uncontrolled loss of reactor coolant. The analysis of loss-of-coolant accidents is discussed in Section 14.3. Should a rupture occur in the chemical and volume control system outside the containment, or at any point beyond the first check valve or remotely operated isolation valve, actuation of the valve would limit the release of coolant and ensure continued functioning of the normal means of heat dissipation from the core. For the general case of rupture outside the containment, the largest source of radioactive fluid subject to release is the contents of the volume control tank. The consequences of such a release are considered in Section 14.2. When the reactor is subcritical (i.e., during cold or hot shutdown, refueling, and approach to criticality), the relative reactivity status (neutron source multiplication) is continuously monitored and indicated by the nuclear instrumentation source range detectors, counters and count rate indicators. Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate, is slow enough to give ample time to start a corrective action (boron dilution stop and/or emergency boron injection) to prevent the core from becoming critical. The maximum dilution rate is based on the abnormal condition of three charging pumps operating at full speed delivering unborated makeup water to the reactor coolant system at a particular time during refueling when the boron concentration is at the maximum value and the water volume in the system is at a minimum. This analysis is referred to as the Boron Dilution Event analysis and is discussed in Section 14.1.5. Cha pter 9, Page 26 of 99 Revision 20, 2006 OAG10000215_1113 IP2 FSAR UPDATE At least two separate and independent flow paths are available for reactor coolant boration, i.e., either the charging line, or the reactor coolant pumps labyrinths. The malfunction or failure of one component will not result in the inability to borate the reactor coolant system. An alternate supply path is always available for emergency boration of the reactor coolant. As a backup to the boration system, the operator can align the refueling water storage tank outlet to the suction of the charging pumps. A third method involves depressurization of the primary system, if necessary, and the use of the safety injection pumps. On loss of seal injection water to the reactor coolant pump seals, seal water flow may be reestablished by manually starting a standby charging pump. Even if the seal water injection flow is not reestablished, the plant can be operated since the thermal barrier cooler has sufficient capacity to cool the reactor coolant flow, which pass through the thermal barrier cooler and sealleakoff from the pump volute. 9.2.3.6 Galvanic Corrosion The only types of materials, which are in contact with each other in borated water are stainless steels, Inconel, Stellite valve materials, and zircaloy fuel element cladding. These materials exhibit only and insignificant degree of galvanic corrosion when coupled to each other. As can be seen from tests, the effects of galvanic corrosion are insignificant to systems containing borated water. Boration during normal operation to compensate for power changes will be indicated to the operator from two sources: (1) the control rod movement, and (2) the flow indicators in the boric acid transfer pump discharge line. When the emergency boration path is used, two indications to the operator are available. The charging line flow indicator will indicate boric acid flow since the charging pump suction is aligned to the boric acid transfer pump suction for this mode of operation. The change in boric acid storage tank level is another indication of boric acid injection. 9.2.4 Minimum Operating Conditions Minimum operating conditions are specified in the Technical Requirements Manual. 9.2.5 Tests and Inspections The minimum frequencies for testing, calibrating and/or checking instrument channels for the chemical and volume control system are specified in the Technical Requirements Manual. Chapter 9, Page 27 of 99 Revision 20, 2006 OAG10000215_1114 IP2 FSAR UPDATE TABLE 9.2-1 Chemical and Volume Control System Code Requirements Component Regenerative heat exchanger Nonregenerative heat exchanger Mixed-bed demineralizers Reactor coolant filter Volume control tank Seal water heat exchanger Excess letdown heat exchanger Chemical mixing tank Deborating demineralizers Cation bed demineralizers Seal injection filters (normal seal injection path) Seal water injection filter (alternate seal injection path) Seal water filter Holdup tanks Boric acid filter Gas stripper package (Note 3) Boric acid evaporator package (Note 3) Evaporator condensate demineralizers (Note 4) Concentrates filter (Note 4) Evaporator feed (Cation) ion exchanger Ion exchanger filter (Note 3) Condensate filter (Note 4) Piping and valves Notes: ASME 111,1 Class C ASME III, Class C, tube side, ASM E VIII, shell side ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C, tube side, ASM E VIII, shell side ASME III, Class C, tube side, ASM E VIII, shell side ASME VIII ASME III, Class C ASME III, Class C ASME III, Class C ASME III Class 2 ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C ASME III, Class C USAS B31.12 1. ASME III -American Society of Mechanical Engineers, Boiler and Pressure Vessel Code, Section III, Nuclear Vessels. 2. USAS B31.1 -Code for Pressure Piping, and special nuclear cases where applicable.
- 3. Unit 21 is no longer used, Unit 22 has been physically removed. 4. No longer used. Cha pter 9, Page 28 of 99 Revision 20, 2006 OAG10000215_1115 IP2 FSAR UPDATE TABLE 9.2-2 Chemical and Volume Control System Letdown Requirements 1 Plant design life, years Normal seal water supply flow rate, gpm Normal seal water return flow rate, gpm Normal letdown flow rate, gpm Maximum letdown flow rate, gpm Normal charging pump flow (one pump), gpm Normal seal injection flow to reactor coolant pumps, gpm Normal charging line flow, gpm Notes: 1. Volumetric flow rates in gpm are based on 12rF and 15 psig. Cha pter 9, Page 29 of 99 Revision 20, 2006 40 32 12 75 120 87 32 55 OAG10000215_1116 o >> G) o o o o N --" 1U"1 --" --"
--" -....J IP2 FSAR UPDATE TABLE 9.2-3 (Sheet 1 of 2) Chemical and Volume Control System Principal Component Design Data Summary Heat exchangers Regenerative Non-regenerative (Letdown) Seal water Excess letdown Pumps Charging Boric acid Transfer Holdup tank recirculation Primary water makeup Monitor tank (Retired in place) Concentrates holding tank transfer (Retired in place) Holdup Tank Transfer Pump 22 Holdup Tank Transfer Pump 21 &23 Quantity 1 1 1 1 Quantity 3 2 1 2 1 2 Heat Transfer, Btu/hr 10.28x 10 6 14.8 x 10 6 2.17 x 10 6 4.75 x 10 6 :IyQ§ Pos.Displ. Centrifugal Centrifugal Centrifugal Centrifugal Centrifugal Design Letdown Flow, 1 b/hr 37,050 59,700 126,756 12,400 Capacity, gpm 98 75 500 150 25 25 Letdown, i1ToF 257 253 17 360 Head, ft or psi 2,500 psi 235-ft 100-ft 210-ft 63-ft 63-ft Chapter 9, Page 30 of 99 Revision 20, 2006 Design Pressure, psig, ShelllTube 2,485/2,735 150/600 150/150 150/2,485 Design Pressure, psig 3,200 150 75 150 150 150 Design Temperature, OF, Shell/Tube 650/650 250/400 250/250 250/650 Design Temperature, OF 250 250 200 Ambient 200 200 o >> G) o o o o N --" 1U"1 --" --" --" CD IP2 FSAR UPDATE TABLE 9.2-3 (Sheet 2 of 2) Chemical and Volume Control System Principal Component Design Data Summary Tanks Volume control Charging pump Stabilizer separator Pulsation dampener Boric acid Chemical mixing Batching Holdup Primary water storage Concentrates holding (Retired in Place) Monitor (Retired in Place) Resin fill Demineralizers Mixed-bed Cation bed Evaporator feed Evaporator condensate Deborating Notes: 1. Net Internal Volume Quantity 2 1 4 2 2 Quantity 1 3 3 2 1 1 3 1 1 Flushable Flushable Flushable Flushable Flushable IYQg Vertical Vertical Spherical Vertical Vertical Jacket Btm. Horizontal Vertical Open Resin Volume, ft3 30 12.0 12.0 12.0 30 Chapter 9, Page 31 of 99 Revision 20, 2006 Volume 400-fe 1 7,000 gal 1 5.0 gal 1 400 gal 1 8106-ft 3 1 165,000 gal 8-ft 3 1 Flow, gpm 120 42 12.5 12.5 120 Design pressure .. psig 75/15 75 2735 atmos. 150 atmos. 15 atmos. Design Pressure, psig 200 200 200 200 200 Design Temperature, OF 250 250 250 250 200 250 200 150 200 Design Temperature, OF 250 250 250 250 250 Activation Products Mn-54 Cr-51 Mn-56 Fe-55 Fe-59 Co-58 Co-60 uCilg 1.60E-03 5.50E-03 2.00E-02 2.00E-03 5.20E-04 1.56E-02 1.98E-03 IP2 FSAR UPDATE TABLE 9.2-4 Reactor Coolant System Activities (576°F) __ (Continuous Full Power Operation) Products uCilg Br-83 9.90E-02 Rb-86 Br-84 4.86E-02 Rb-88 Br-85 5.67E-03 Rb-89 1-127 (a) 1.53E-10 Sr-89 1-129 8.48E-08 Sr-90 1-130 7.08E-02 Sr-91 1-131 2.90E+00 Sr-92 1-132 3.02E+00 Y-90 1-133 4.65E+00 Y-91m 1-134 6.52E-01 Y-91 1-135 2.57E+00 Y-92 Cs-134 5.14E+00 Y-93 Cs-136 5.35E+00 Zr-95 Cs-137 2.62E+00 Nb-95 Cs-138 1.06E+00 Mo-99 Gaseous Fission Products uCilg Kr-83m 4.67E-01 Kr-85m 1.85E+00 Kr-85 1.36E+01 Kr-87 1.22E+00 Kr-88 3.49E+00 Kr-89 9.90E-02 Xe-131m 3.18E+00 Xe-133m 3.61 E+OO Xe-133 2.57E+02 Xe-135m 5.55E-01 Xe-135 8.94E+00 Xe-137 1.93E-01 Xe-138 6.94E-01 uCilg 4.55E-02 Tc-99m 4.36E+00 Ru-103 2.00E-01 Rh-103m 4.37E-03 Ru-106 2.85E-04 Rh-106 5.78E-03 Ag-110m 1.28E-03 Te-125m 8.09E-05 Te-127m 3.12E-03 Te-127 5.77E-04 Te-129m 1.12E-03 Te-129 3.86E-04 Te-131 m 6.55E-04 Te-131 6.56E-04 Te-132 8.22E-01 Te-134 Cha pter 9, Page 32 of 99 Revision 20, 2006 uCilg 7.62E-01 6.42E-04 6.38E-04 3.30E-04 3.30E-04 4.89E-03 1.15E-03 3.83E-03 1.57E-02 1.16E-02 1.50E-02 2.63E-02 1.42E-02 3.14E-01 3.13E-02 uCilg Ba-137m 2.48E+00 Ba-140 4.36E-03 La-140 1.46E-03 Ce-141 6.56E-04 Ce-143 5.24E-04 Pr-143 6.37E-04 Ce-144 4.92E-04 Pr-144 4.92E-04 OAG10000215_1119 IP2 FSAR UPDATE TABLE 9.2-5 Parameters Used in the Calculation of Reactor Coolant Fission Product Activities
- 1. Core thermal power, MWt 2. Fraction of fuel containing clad defects 3. Reactor coolant liquid volume, fe 4. Reactor coolant average temperature, of 5. Purification flow rate (normal), gpm 6. Effective cation demineralizer flow, gpm 7. Volume control tank volumes a. Vapor, fe b. Liquid, fe 8. Fission product escape rate coefficients:
- a. Noble gas isotopes, sec-1 b. Br, I and Cs isotopes, sec-1 c. Te isotopes, sec-1 d. Mo, Te, and Ag isotopes, sec-1 e. Sr and Ba isotopes, sec-1 f. Y, Zr, Nb, Ru, Rh, La, Ce and Pr isotopes, sec-1 9. Mixed-bed demineralizer decontamination factors: a. Noble gases and Cs-134, 136, and 137 3280.3 0.01 10,620 573 75 7 270 130 6.5 X 10-8 1.3 X 10-8 1.0 X 10-9 2.0 X 10-9 1.0x10-11 1.6x10-12 1.0 b. All other isotopes 10.0 10. Cation bed demineralizer decontamination factor for Cs-134, 137, and Rb-86 10.0 11. Volume control tank noble gas stripping fraction (closed system): Isotope Kr-83m Kr-85 Kr-85m Kr-87 Kr-88 Kr-89 Xe-131 m Xe-133 Xe-133m Xe-135 Xe-135m Xe-137 Xe-138 Stripping Fraction 7.9 x 10-1 7.5 x 10-5 6.1 x 10-1 8.5 x 10-1 7.1 X 10-1 9.9x 10-1 1.7 x 10-2 3.9 x 10-2 8.8 x 10-2 3.6 x 10-1 9.5 x 10-1 9.9x 10-1 9.6 x 10-1 Cha pter 9, Page 33 of 99 Revision 20, 2006 OAG10000215_1120 IP2 FSAR UPDATE TABLE 9.2-6 (Sheet 1 of 2) Tritium Production in the Reactor Coolant BASIC ASSUMPTIONS Plant Parameters:
- 1. Core thermal power, MWt 2. Coolant water volume, fe 3. Core volume, fe 4. Core volume fraction a. U0 2 b. Zr + SS c. H 2 0 5. Plant full power operating times a. I nitial cycle b. Equilibrium cycle 6. Boron concentrations (Peak hot full power equilibrium Xe) a. Initial cycle, ppm b. Equilibrium cycle, ppm 7. Burnable poison boron content (total -all rods), kg 8. Fraction of tritium in core (ternary fission + burnable boron) diffusing through cladding 9. Ternary fission yield, atoms/fission
- 10. Nuclear cross-sections and neutron fluxes B 10 (n,2ex) T (J; mb 1 MeV::; E::; 5 MeV = 31.95 (Spectrum weighted)
E> 5 MeV = 75 Li7 (n, nex) T (99.9-percent purity Li7) 3 MeV::; E::; 6 MeV = 39.1 (Spectrum weighted) E > 6 MeV = 0.4 Li 6 (n, ex) T (99.9-percent purity Li7) (J = 675 barns; 11. Cooling water flow: 7.5 x 10 5 gpm = 15 x 10 14 cm 3/yr Cha pter 9, Page 34 of 99 Revision 20, 2006 3216 12,600 1,152.5 0.3023 0.1035 0.5942 78 wk (18 months) 49 wk (11.3 months) 890 825 18.1 0.30 1 8 X 10-5 (nv; n/cm 2 -sec) 5.04 x 10 13 7.4 X 10 12 2.14 X 10 13 2.76 X 10 12 2.14 X 10 13 OAG10000215_1121 IP2 FSAR UPDATE TABLE 9.2-6 (Sheet 2 of 2) Tritium production in the Reactor Coolant CALCULATIONS (per year) I nitial Cycle Equilibrium Cycle A. Tritium from core (curies) B. C. 1. Ternary fission 2. B 10 (n, 2ex) T (in poison rods) 3. B 10 (n, ex) Li7 (n, nex) T (in poison rods) 4. Release fraction (0.30) 5. Total release to coolant Tritium from coolant (curies) 1. B 10 (n, 2ex) T 2. Li7 (n, nex) T (limit 2.2 ppm Li) 3. Li 6 (n, ex) T (purity of Li7 = 99.9-percent) 4. Release fraction (1.0) 5. Total release to coolant Total tritium in coolant (curies) 11,450 800 1,500 4,125 1,130 8.8 8.8 1,147.6 5,273 11,450 NA NA 3,440 780 8.8 8.8 797.6 4.238 Notes: 1. The assumption that 30-percent of the ternary produced tritium diffuses into the coolant is based on the analysis made of fuel retention in the Saxton and the Yankee clad fuel. This analysis indicated that the fuel retained 68-percent of the tritium produced in the fuel. Although data is not currently available on zircaloy-clad fuel operating at the specific power anticipated for these reactors, it is reasonably certain that a significant portion of the tritium released by the fuel will not diffuse through the zircaloy possibly because of the formation of zirconium tritide. Shippingport data indicates that less than 1-percent of ternary tritium produced is released to the coolant. Although this data cannot be used directly, it does indicate that zircaloy will reduce tritium diffusion. Chapter 9, Page 35 of 99 Revision 20, 2006 OAG10000215_1122 IP2 FSAR UPDATE TABLE 9.2-7 Malfunction Analysis of Chemical and Volume Control System Component Letdown line Normal and alternate charging lines Seal water return line Figure No. Figure 9.2-1 Sh. 1 Figure 9.2-1 Sh. 2 Figure 9.2-1 Sh. 3 Figure 9.2-1 Sh. 4 Figure 9.2-2 Title Failure Rupture in the line inside the reactor containment See above See above Comments and Consequences The remote air-operated valve located near the main coolant loop is closed on low pressurizer level to prevent supplementary loss of coolant through the letdown line rupture. The containment isolation valves in the letdown line outside the reactor containment and also the orifice block valves are automatically closed by the containment isolation signal initiated by the concurrent loss-of-coolant accident. The closure of that valve prevents any leakage of the reactor containment atmosphere outside the reactor containment. The check valves located near the main coolant loops prevent supplementary loss of coolant through the rupture. The check valves located at the boundary of the reactor containment prevent any leakage of the reactor containment atmosphere outside the reactor containment. The motor-operated isolation valve located outside the containment is manually closed or is automatically closed by the containment isolation signal initiated by the concurrent loss-of-coolant accident. The closure of that valve prevents any leakage of the reactor containment atmosphere outside the reactor containment. 9.2 FIGURES Chemical and Volume Control System -Flow Diagram, Sheet 1, Replaced with Plant Drawing 9321-2736 Chemical and Volume Control System -Flow Diagram, Sheet 2, Replaced with Plant Drawing 208168 Chemical and Volume Control System -Flow Diagram, Sheet 3, Replaced with Plant Drawing 9321-2737 Chemical and Volume Control System -Flow Diagram, Sheet 4, Replaced with Plant Drawing 235309 Primary Water Makeup System -Flow Diagram, Replaced with Plant Drawing 9321-2724 Cha pter 9, Page 36 of 99 Revision 20, 2006 OAG10000215_1123 IP2 FSAR UPDATE 9.3 AUXILIARY COOLANT SYSTEM 9.3.1 Design Basis The auxiliary coolant system consists of three loops as shown in Plant Drawings 227781, 9321-2720, and 251783 [Formerly UFSAR Figure 9.3-1, Sheets 1, 2, and 3] the component cooling loop, the residual heat removal loop, and the spent fuel pit cooling loop. 9.3.1.1 Performance Objectives 9.3.1.1.1 Component Cooling Loop The component cooling loop is designed to remove residual and sensible heat from the reactor coolant system via the residual heat removal loop during plant shutdown, cool the letdown flow to the chemical and volume control system during power operation, and to provide cooling to dissipate waste heat from various primary plant components. It also provides cooling for engineered safeguards and safe shutdown components. Active loop components, which are relied upon to perform the cooling function are redundant. Redundancy of components in the process cooling loop does not degrade the reliability of any system, which the process loop serves. The loop design provides for detection of radioactivity entering the loop from reactor coolant source and also provides means for isolation. 9.3.1.1.2 Residual Heat Removal Loop The residual heat removal loop is designed to remove residual and sensible heat from the core and reduce the temperature of the reactor coolant system during the second phase of plant cooldown. During the first phase of cool-down, the temperature of the reactor coolant system is reduced by transferring heat from the reactor coolant system to the steam and power conversion system. The loop design provides means to detect radioactivity migration to the ultimate heat sink environment and includes provisions, which permit adequate action for continued core cooling, when required, in the event radioactivity limits are exceeded. The loop design precludes any significant reduction in the overall design reactor shutdown margin when the loop is brought into operation for decay heat removal or for emergency core cooling by recirculation. The loop design includes provisions to enable periodic hydrostatic testing to applicable code test pressures. Loop components, whose design pressure and temperature are less than the reactor coolant system design limits, are provided with overpressure protective devices and redundant isolation means. Chapter 9, Page 37 of 99 Revision 20, 2006 OAG10000215_1124 9.3.1.1.3 IP2 FSAR UPDATE Spent Fuel Pit Cooling Loop The spent fuel pit cooling loop is designed to remove from the spent fuel pit the heat generated by stored spent fuel elements. The loop design consists of two pumps, a heat exchanger, a filter, a demineralizer, piping, and associated valves and instrumentation. Alternate cooling capability can be made available under anticipated malfunctions or failures (expected fault conditions). Loop piping is so arranged that the failure of any pipeline does not drain the spent fuel pit below the top of the stored fuel elements. The thermal design basis for the loop provides for all fuel pool rack locations to be filled at the end of a full core discharge. 9.3.1.2 Design Characteristics 9.3.1.2.1 Component Cooling Loop Normally one pump and two component heat exchangers are operated to provide cooling water for the components located in the auxiliary building and the reactor containment building. At elevated CCW supply temperatures two pumps may be required. The water is normally supplied to all components being cooled even though one of the components may be out of service. Cooling is provided by at least one component cooling pump during the recirculation phase of a loss-of-coolant accident. Makeup water is taken from the primary water treatment plant, as required, and delivered to the surge tank. A backup source of water is provided from the primary water makeup transfer pumps. The operation of the loop is monitored with the following instrumentation:
- 1. 2. 3. 9.3.1.2.2 A pressure indicator on the line between the component cooling pumps and the component cooling heat exchangers.
A temperature indicator, flow indicator, and radiation monitor in the outlet line from the heat exchangers. A temperature indicator on the main inlet line to the component cooling pumps. Residual Heat Removal Loop Two pumps and two residual heat exchangers perform the decay heat cooling functions for the reactor unit. After the reactor coolant system temperature and pressure have been reduced to approximately 350°F and below 365 psig (the upper limit to prevent RHR system overpressurization), respectively, decay heat cooling is initiated by aligning pumps to take suction from the reactor outlet line and discharge through the heat exchangers into the reactor inlet line. The normal plant cool down times to cold shutdown and refueling entry conditions using 95°F Service Water are given in table 9.3-3. If only one pump and one heat exchanger are available, reduction of reactor coolant temperature is accomplished at a lower rate. Cha pter 9, Page 38 of 99 Revision 20, 2006 OAG10000215_1125 IP2 FSAR UPDATE The equipment used for decay heat cooling is also used for emergency core cooling during of-coolant accident conditions. This is described in Chapter 6. 9.3.1.2.3 Spent Fuel Pit Cooling Loop The spent fuel pit contains spent fuel discharged from the reactor over its operating life. Spent fuel cooling loop performance has been analyzed for operation at a core power level of 102% of 3216 MWt and at service water temperatures up to 95°F. When a refueling load of approximately 88 freshly discharged assemblies (plus previously discharged assembles) are present, the pump and spent fuel heat exchanger will handle the load and maintain a bulk pit water temperature less than 140°F. When a full core of 193 assemblies is freshly discharged, the bulk pit water temperature is maintained below 180°F. Two criteria must be met before spent fuel can be discharged to the spent fuel pit: 1. In accordance with Technical Requirements Manual Section 3.9.A, spent fuel can not be discharged to the spent fuel pit until at least 84 hours after shutdown to satisfy the assumptions of the spent fuel handling accident analysis as discussed in Section 14.2.1. 2. An additional delay time limit prior to spent fuel discharge is administratively controlled by operating procedures to ensure that the total spent fuel heat load is within the capacity of the spent fuel cooling loop to satisfy the bulk pit water temperature limits discussed above. This is a variable time limit primarily dependant upon service water temperature, and cooling capacity without supplemental cooling. 9.3.1.3 Codes and Classifications All piping and components of the auxiliary coolant system are designed to the applicable codes and standards listed in Table 9.3-1. The component cooling loop water contains a corrosion inhibitor to protect the carbon steel piping. Austenitic stainless steel piping is used in the remaining piping systems that contain borated water without a corrosion inhibitor. 9.3.2 System Design and Operation 9.3.2.1 Component Cooling Loop Component cooling is provided for the following heat sources: 1. Residual heat exchangers (auxiliary coolant system). 2. Reactor coolant pumps (reactor coolant system). 3. Nonregenerative heat exchanger (chemical and volume control system). 4. Excess letdown heat exchanger (chemical and volume control system). 5. Seal-water heat exchanger (chemical and volume control system). 6. Sample heat exchangers (sampling system). 7. Waste gas compressors (waste disposal system). 8. Reactor vessel support pads. 9. Residual heat removal pumps (auxiliary coolant system). 10. Safety injection pumps (safety injection system). Cha pter 9, Page 39 of 99 Revision 20, 2006 OAG10000215_1126 IP2 FSAR UPDATE 11. Recirculation pumps (safety injection system). 12. Spent fuel pit heat exchanger (auxiliary coolant system). 13. Charging pumps (chemical and volume control system), fluid drive coolers and crankcase. At the reactor coolant pump, component cooling water removes heat from the bearing oil and the thermal barrier. Since the heat is transferred from the component cooling water to the service water, the component cooling loop serves as an intermediate system between the reactor coolant pump and service water cooling system. This double barrier arrangement reduces the probability of leakage of high pressure, potentially radioactive coolant directly to the service water system. The component cooling loop is monitored for radioactivity by a radiation monitor that samples the component cooling pump discharge downstream of the component cooling heat exchangers. During normal full power operation, one component cooling pump and two component cooling heat exchangers accommodate the heat removal loads. Two CCW pumps are in stand-by and both heat exchangers are utilized. At elevated CCW supply temperatures two CCW pumps may be required. Three pumps and two heat exchangers can be used to remove the residual and sensible heat during plant shutdown. If one of the pumps or one of the heat exchangers is not operative, safe shutdown of the plant is not affected; however, the time for cooldown is extended. The surge tank accommodates expansion, contraction and inleakage of water, and ensures a continuous component cooling water supply until a leaking cooling line can be isolated. Makeup to the surge tank is provided from the primary water makeup system. The surge tank is normally vented to the atmosphere. In the unlikely event that the radiation level in the component cooling loop reaches a preset level above the normal background, the radiation monitor in the component cooling loop annunciates in the control room and closes a valve in the surge tank vent line. Parameters for components in the component cooling loop are presented in Table 9.3-2. 9.3.2.2 Residual Heat Removal Loop The residual heat removal loop consists of heat exchangers, pumps, piping, and the necessary valves and instrumentation. During plant shutdown, coolant flows from the reactor coolant system to the residual heat removal pumps, through the tube side of the residual heat exchangers and back to the reactor coolant system. The inlet line to the residual heat removal loop starts at the hot leg of one reactor coolant loop and the return line connects to the safety injection system piping. The residual heat exchangers are also used to cool the water during the latter phase of safety injection system operation. These duties are defined in Section 6.2. The heat loads are transferred by the residual heat exchangers to the component cooling water. During plant shutdown, the cooldown rate of the reactor coolant is controlled by regulating the flow through the tube side of the residual heat exchangers. Two remote motor-operated control valves downstream of the residual heat exchangers are used to control flow. Instrumentation has been provided in the control room to monitor RHR and reactor coolant system level when the system is cooled and depressurized. These instruments are provided to monitor level during draindown to assure decay heat removal capability. A channel with an intermediate range of 240 inches measures differential pressure between the top of the pressurizer and the bottom of the hot leg. A wide range channel, capable of monitoring level from the bottom of the hot leg to top of the pressurizer, measures the pressures at those two points using redundant pressure transducer pairs. This wide range channel also has an optional Cha pter 9, Page 40 of 99 Revision 20, 2006 OAG10000215_1127 IP2 FSAR UPDATE third transducer pair, which may be installed on the reactor head vent line to monitor reactor water level during certain evolutions. Another level channel with a differential pressure sensor can also be used to monitor RCS level. A narrow range level channel using an ultrasonic transducer monitors level in hot leg 21. Wide and narrow range instrumentation is also provided to measure RHR system flow. Monitors are provided for RHR pump suction pressure and discharge pressure. RHR temperature sensors are located at the common discharge header of the RHR pumps and RHR Heat Exchanger outlet line. RCS temperature is monitored by core exit thermocouples whenever the reactor head and the instrumentation interface assembly are in place. The RHR pump monitors, along with the narrow range level and flow instrumentation assists the operators in avoiding air entrainment in the RHR pump suction line during periods when the reactor is shut down and water level has been lowered. Remotely-operated, double valving is provided to isolate the residual heat removal loop from the reactor coolant system. When reactor coolant system pressure exceeds the design pressure of the residual heat removal loop, interlocks between the reactor coolant system wide range pressure channels and the residual heat removal inlet valves prevent the valves from opening. A remotely-operated normally closed valve and two check valves isolate each line to the reactor coolant system cold legs from the residual heat removal loop during power operation. Parameters for components in the residual heat removal loop are presented in Table 9.3-3. 9.3.2.3 Spent Fuel Pit Cooling Loop The spent fuel pit cooling loop removes residual heat from fuel placed in the pit for long term storage. The loop can safely accommodate the heat load from all of the assemblies for which there is storage space available. The spent fuel pit is located outside the reactor containment and is not affected by any coolant accident in the containment. During refueling the water in the pit is connected to that in the refueling canal by the fuel transfer tube. Only a very small amount of interchange of water occurs as fuel assemblies are transferred. The spent fuel pit cooling loop consists of two pumps, a heat exchanger, filter, demineralizer, piping and associated valves and instrumentation. One of the pumps draws water from the pit, circulates it through the heat exchanger and returns it to the pit. Component cooling water cools the heat exchanger. Redundancy of this equipment is not required because of the large heat capacity of the pit and the slow heatup rate. The clarity and purity of the spent fuel pit water is maintained by passing approximately 5-percent of the loop flow through a filter and demineralizer. The spent fuel pit pump suction line, which is used to draw water from the pit, penetrates the spent fuel pit wall above the fuel assemblies. The penetration location prevents loss of water as a result of a possible suction line rupture. A separate pump is used to circulate refueling water storage tank water through the same demineralizer and filter for purification. Parameters for components in the spent fuel cooling loop are presented in Table 9.3-4. Chapter 9, Page 41 of 99 Revision 20, 2006 OAG10000215_1128}}