ML20024F083
| ML20024F083 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 08/29/1983 |
| From: | Counsil W NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES |
| To: | Youngblood B Office of Nuclear Reactor Regulation |
| References | |
| B10878, NUDOCS 8309080207 | |
| Download: ML20024F083 (153) | |
Text
{{#Wiki_filter:ggg Genera! Offices
- Seldon Street. Ber!!n. Connecticut w ca econoa aae o is w-
~ P.O. 80X 270
.Y2 m m viv a u.m cow -
HARTFORD CONNECTICUT 06141-0270 (203) 666-6911 g
- . . . co.
August 29,1983 Docket No. 50-423 B10878 Director of Nuclear Reactor Regulation Mr. B. J. Youngblood, Chief Licensing Branch No.1 Division of Licensing U. S. Nuclear Regulatory Commission Washington, D. C. 20555
Reference:
(1) B. 3. Youngblood to W. G. Counsil, Request for Additional Information for Millstone Nuclear Power Station, Unit No. 3, dated May 31,1983. (2) W. G. Counsil to B. 3. Youngblood, Millstone Nuclear Power Station, Unit No. 3: Transmittal of Amendment 3, dated August 29,1983. (3) B. J. Youngblood to W. G. Counsil, Request for Additional Information for Millstone Nuclear Power Station, Unit No. 3, dated June 29,1983. (4) B. J. Youngblood to W. G. Counsil, Request for Additional Information for Millstone Nuclear Power Station, Unit No. 3, dated May 3,1983.
Dear Mr. Youngblood:
Millstone Nuclear Power Station, Unit No. 3 Response to Selected Requests for Additional Information Attachment I lists and contains the remaining responses to questions contained in Reference (1), that are not being forwarded by the Reference (2) amendment. Additionally, some responses to Reference (3) are included in this transmittal in advance of the September 27, 1983 due date. Both these sets of responses are provided as they will be transmitted with Amendment 4 to the FSAR which will be furwarded on or before October 1,1983 for insertion into your FSAR sets. With the transmittal of Amendment 4 you will have received responses to all requests for additional information forwarded in References (1), (3) and (4). Attachment 2 includes the appropriate FSAR changes that will be necessary as a result of the responses in Attachment 1. These are being provided in numerical order and will be submitted as part of Amendment 4 on or before October 1, 1983. h g2WeMMh A e @
.s- - a _,
4 If you have any concerns related to commitments contained herein or any questions related to our responses, please contact our Licensing representative directly. Very truly yours, NORTHEAST NUCLEAR ENERGY COMPANY, ET AL By NORTHEAST NUCLEAR ENERGY COMPANY, Their Agent
.L / '
W. G. Counsil Senior Vice President 4 STATE OF CONNECTICUT )
) ss. Berlin COUNTY OF HARTFORD )
Then personally appeared before me W. G. Counsil, who being duly sworn, did state that he is Senior Vice President, Northeast Nuclear Energy Company, an Applicant herein, that he is authorized to execute and file the foregoing information in the name and on behalf of the Applicants herein and that the statements contained in said information are true and correct to the best of his knowledge and belief. , WhF G - 00 ' Notary /Publi , My Commission Expires March 31',1988
, . - - . --- - , - -
- _ --- .-- ,.-,g -
-. , _ - . , , . , - - .p-r- r - -w-wr---.-,-w., -. - , , - ,,- . . ,,x.,e
ATTACHMENT 1 A. Revisions to responses to questions previously sent in Reference 2 280.15 281.4 430.51 B. Remaining responses to those questions contained in Reference 1 that were not forwarded by Reference 2 430.61 440.9 440.44 430.63 440.10 440.45 430.66 440.11 440.46 430.69 440.12 440.47 430.73 440.13 440.48 430.76 440.14 440.49 430.77 440.15 .440.50 430.85 440.16 440.51 430.87 440.17 440.52 430.90 440.18 440.54 430.99 440.19 440.55 430.100 440.20 440.58 430.102 440.21 440.59 430.104 440.22 440.60 430.105 440.23 440.61 430.107 440.24 440.63 430.108 440.25 440.65 430.109 440.26 440.68 430.111 440.28 440.70 430.113 440.29 440.71 430.114 440.31 450.3 430.117 440.32 450.4 430.118 440.33 492.1 430.119 440.34 492.2 430.124 440.35 492.3 430.128 440.36 492.4 430.131 440.37 492.5 430.133 440.38 492.6 430.136 440.39 430.144 440.40 430.148 440.41 430.149 440.43 C. Responses to questions contained in Reference 3 sent in advance of the September 27, 1983 due date 640.10 640.13 640.16 640.17 640.20
HNPS-3 FSAR NRC Letter: May 3, 1983 Question No. Q280.15 It is our position that you comply with Section C.S.q(c) of BTP CHEB 9.5-1, in that a fixed emergency lighting system consisting of sealcd beam units with individual (8-hour minimum) battery power supplies should be installed in all areas required for safe shutdown operations, including access and egress routes. Verify that you will comply with our position and specify the foot-candles provided at the floor level of access routes and at operational areas.
Response
Refer to the revised Fire Protection Evaluation Report, Appendix A, Section: D-5 (General Guidelines for Plant Protection - Lighting and Communications) and the responses to NRC Questions 430.60, 430.62, 430.63, 430.65, and 430.66. J t Revision 1 Q280.15-1 September 1983 I
m IMPS-3 FSAR liRC Letter: May 3, 1933 Question No. Q281.4 (6.1.2) In order for the staff to estimate the rate of combustible gas generation vs. time due to exposure of organic cable insulation to DBA conditions inside containment, provide the approximate total quantity (weight and volume) of organic cable insulation material used inside containment, including uncovered cable and cable in closed metal conduit or closed cable trays. We will give credit for beta radiation shielding for cable in closed conduit or trays if information is provided as to the respective quantities of cable in closed conduits or trays vs. uncovered cable.
Response
The weight and volume of cable jacketing and insulation'with.in the containment structure is estimated as follows: Weight Volume Location (lb) (fta) Enclosed conduit 23,600 270 Covered cable trays
- and uncovered cable 94,300 1,080
- Partially enclosed Revision 1 Q281.4-1 September 1983
MNPS-3 FSAR NRC Letter: May 3, 19S3 Question No. Q430.51 (SRP Sections 8.3.1 and 8.3.2) Identify all - electrical equipment, both safety and nonsafety, that may become submerged as n result of a LOCA. For all such equipment that is .not designed and qualifie? for service in such an environment, provide analysis to determine the following:
- 1. The safety significance of the failure of this electrical equipment (e.g. spurious actuation or loss of actuation function) as a result of flooding.
- 2. The effectu on Class IE power scurces serving this equipment as a result of such submergence.
- 3. Any proposed design changes resulting from this analysis.
Response
There is no safety or non-safety related electrical equipment. which is required post-LOCA or whose failure positicn will affect station shutdown capability, located inside the containment that may become submerged. The following safety related equipment is connected to a Class 1E power supply, is located inside the containment, may become submerged as a result of a LOCA, and is not designed and qualified for submergence: Group One 3SIL*MV8808A 3SIL*MV8808B 3SIL*MV8808C 3SIL*MV8808D Group Two 3CCP*SOV179A 3CCP*SOV179B Each of the circuits for Group One equipment is deenergized during normal plant operation. Each of the circuits for Group Two equipment is provided with two series connected interrupting devices which meet the requirements of Regulatory Guide 1.75 for an isolation device. There is non-safety related electrical equipment connected to Class 1E power supplies,' located inside the containment, which may become submerged as a result of a LCCA and which are not designed and qualified for submergence. Each of the circuits for this equipment is provided with two series connected interrupting devices which meet the requirements of Regulatory Guide 1.75 for an isolation device. Revision 1 Q430.51-1 September 1983
I v
! DIPS-3 FSAR ,
11RC Letter: !!ay 10,1933 Question Q440.60 With the flow rate indicated in Figure 15.6-3I, how long will it take to fill the faulted steam generator to the main steam line inlet? Discuss the effects of. steam generator overfill on the integrity of
, steam piping and supports.
Response
Extrapolatdon of the analysis results indicates that the faulted j' .- steam generator would not' fill with water until approximately one hour following the accident initiation for the design basis event with no credit taken for operator action. Hence, there is sufficient time to complete the recovery sequence before the water level rises into the main steamline, therefore, this event will not result in any impact on the steam piping and supports. b
~
, /:
,..~
~'
p , E/ /
~
4 6
\
Q430.60-1 N'
j- . 7 t - ;' ly .- .
~
a'; -
, MIIPS-3 FSAR.
s
+
j 'k! ~ 11RC Letter: May 31, 1983
, i Question Q430.61 (Section 9.5.2)
The description of the intraplant and interplant (plant to offsite)
- communication systems is inadequate. Provide a detailed description for each: communication system listed in Section 9.5.2.2 of the FSAR.
The detailed description shall include an identification and description of each system's power source, a description of each system's components (headsets, handsets, switchboards, amplifiers, consoles, handheld radios, etc.), location of major components (power sources, consoles, etc), and interfaces between the various systems.
Response
The response to this question will be submitted at a later date. > t
.c -
h. i; - l e s . 1 t y t' s y t i
- ? ~
/,9 7 .j, -
i p r 5
~ ::# '
' Q430.61-1
,. y' /
,f. ,
,(-, , ,-, ,
--f' ( . .f
MNPS-3 FSAR NRC Letter: May 31, 1953 Question Q430.63 (Section 9.5.3) Expand the lighting section of the FSAR to include a discussion of how lighting will be provided for those areas listed in requests 430.60 and 430.62 and illuminated by the emergency de lighting system only, in the event of a sustained loss of offsite ac power (in excess of 8 hours and up to 7 days), or provide the rationale why lighting is not required in these areas. Include in your discussion what, if any, other areas would require lighting during a sustained loss of ac power, and how it would be provided.
Response
Refer ,to revised FSAR Section 9.5.3.2 and the responses to NRC - Questions 430.60, 430.62, 430.65, 430.66, and 280.15. This question assumes use of a de lighting system only, in the event of a sustained loss of offsite ac power. This assumption does not take into account the availability of the essential.ac lighting system powered from Class 1E motor control centers and automatically energized upon loss of offsite ac power via the emergency generators. The de lighti.pg system powered by 8-hour battery packs automatically energized upon loss of normal ac power and the essential ac lighting system provides adequate lighting for the subject areas. Q430.63-1
m-MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.66 (Section 9.5.3) You state in Section 9.5.3.2 of the FSAR that the normal de and essential de lighting systems provide silhouette level lighting and light at approximately 3 foot candles, which is more than adequate for csergency operation. The staff disagrees with these statements. The staff has determined that a minimum of 10 foot candles at the work station is required to adequately control, monitor, and/or maintain safety related equipment during accident and transient conditions. For those safety related areas listed in requests 430.60 and 430.61 and illuminated by the de lighting systems only verify that-the minimum of 10 foot candles at the work station is being met. Also verify that the 10 foot candles minimum at the work station is being met by those safety related areas illuminated by the ac emergency system. Modify your design as necessary.
Response
Refer to revised FSAR Section 9.5.3.2 and the responses to NRC Questions 430.60, 430.61, 430.62, 430.63, and 280.15. A minimum of 10 foot-candles is 'vailable at the main control board and at the auxiliary shutdown panel from either the de or the essential ac lighting system. i J Q430.66-1
- < c v r w
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.69 (Section 9.5.4) The diesel generator structures are designed to seismic and tornado criteria and are isolated from one another by a reinforced concrete wall barrier. Describe the barrier (including openings) in more detail and its capability to withstand the effects of internally generated missiles resulting from a crankcase explosion, failure of one or all of the starting air receivers, or failure of any high or moderate energy line and initial flooding from the cooling system so that the assumed effects will not result in loss of an additional generator.
Response
For a description of this concrete wall, refer to FSAR Section 3.5.1.4. This wall is adequate to withstand the effects of the tornado generated missiles listed in FSAR Table 3.5-13 which are more severe than the postulated internally generated missiles resulting from an accident within either of the diesel generator cubicles. There are no penetrations in this wall which would permit a missile from one diesel generator cubicle to pass through and damage equipment in the adjacent diesel generator cubicle. Refer to the response to NRC Question 410.17 for a discussion of ficoding from the cooling system. P Q430.69-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.73 (Section 3.2, 9.5.4, 9.5.5, 9.5.6, 9.5.7, and 9.5.8) The FSAR text and Table 3.2-1 indicates that the components and piping systems for the diesel generator auxiliaries (fuel oil system, cooling water, lubrication, air starting, and intake and combustion system) that are mounted on the auxiliary skids are designed seismic Category I and are ASME Section III, Class 3 quality to the extent possible. The engine mounted components and piping and certain other components listed in the various sections of 9.5 are designed and manufactured to DEMA standards and/or manufacturer's standards and are seismic Category I. This is not in accordance with Regulatory Guide 1.26 which requires the entire diesel generator auxiliary systems be designed to ASME Section III, Class 3 or Quality Group C. You also state that the figures in Section 9.5 show where quality group' classification changes are. The figures do not provide this information. Provide the following: (a) the industry standards that were used in the design, manufacture, and inspection of the engine mounted piping and components, (b) show on the appropriate P&ID's where the Quality Group Classification changes from Quality Group C, and where the Seismic Category I portions of the system are located. Sections 9.5.4 through 9.5.8 define certain pumps, filters, strainers, valves, and subsystems in the diesel generator auxiliary systems as Quality Group D or not applicable with regards to Quality Group Classification. It is our position that all components and piping in the diesel generator auxiliary systems be designed to Seismic Category I, ASME Section III, Class 3 requirements. Comply with this position or justify noncompliance. Response: - The response to this question will be submitted at a later date. Q430.73-1 s
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.76 (Section 9.5.4, 9.5.5, 9.5.6, 9.5.7, 9.5.8) You state in the FSAR that protection from high and moderate energy pipe breaks is discussed in Section 3.6.1. Section 3.6.1 only identifies the fuel oil system as a moderate energy system and does not provide any analysis for that system. This is unacceptable. Identify all high and moderate energy lines and systems that will be installed in the diesel generator room. Discuss the measures that will be taken in the design of the diesel generator facility to protect the safety related system, piping, and components from the effects of high and moderate energy line failure to assure availability of the diesel generator when needed. (See request 430.110 for additional concerns on high energy line breaks with regard to the air start system.)
Response
The response to this question will be submitted at a later date. p Q430.76-1
y MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.77 (Section 9.5.4) In the FSAR, you state the primary fire protection system for the diesel generator fuel oil storage vaults is a CO 2 system. The CO2 is a non-safety related system, and is not qualified for seismic events. The system is seismically supported. Show that spurious actuation of the CO 2 fire protection system will not affect diesel generator availability and operability.
Response
The response to this question will be submitted at a later date. Q430.77-1 1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.85 (Section 9.5.4) In Section 9.5.4 provide a detailed description and operation of the fuel oil system. Specifically the filling of the day tanks from the fuel oil storage tanks, the operation of the high and low level control switches on the day tanks and the sequence of events for filling the day tanks, including selection of primary and secondary (standby) transfer pumps. You state that one of the transfer pumps
.on each storage tank can be powered from either Train A or Train B, and that selection of the power source is manual. From the information available and potential combination of transfer pump alignments it appears that an unacceptable system operating arrangement could result. In order to adequately evaluate this system provide: ,
- 1. A detail description and operation of 'the fuel oil system including controls, their function and operation, and other instrumentation provided
- 2. Discuss the sequence of events, operator action and procedures used in filling the fuel oil day tanks including selection of primary and. secondary transfer pumps. In ,
addition discuss the mode of operation of the transfer pumps
- 3. A detail description of the electrical circuitry (including interlocks), special design. features and potential
, combinations of pump cross connections achievable, required operator actions, and procedures used to accomplish those potential combinations. These electrical features should be discussed in the appropriate section of Chapter 8.
- 4. Show for all accident and transient conditions, including those discussed in Section 9.5.4.3 of the FSAR that postulated combinations of pump selection and electrical circuits will not violate the independence criteria of GDC-17 as the result of operator action, operating
. procedures, and interlocks.
Response
Refer to the responses to NRC Questions 430.32, 430.82, an: 430.83,
.and FSAR Section 7.3.1.1.5 for the response to this question.
Q430.85-1
~
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.87 (Section 9.5.4) i Figure 9.5-2 of the FSAR shows a fuel oil accumulator tank on the diesel engine fuel oil system. The accumulator tank is located on the engine skid and is connected in parallel with the fuel oil headers. Provide a description of the tank, its capacity and its purpose.
Response
The response to this question will be submitted at a later date. O e 4 b 8 Q430.87-1
m MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.90 (Section 9.5.5) Section 9.5.5 indicates that the function of the diesel generator cooling water system is to dissipate the heat transferred through the: 1) engine water jacket, 2) lube oil cooler; 3) engine air water coolers, governor lube oil cooler, and provides a partial tabulation of the design characteristics of the equipment. Provide information on the individual component heat removal rates (btr/hr) , flow ~ (lbs/hr) and temperature differential (*F), and the total heat removal rate required. Also provide the design margin (excess heat removal capacity) including in the design of major components and subsystems.
Response
Refer to revised FSAR Tables 9.5-3 and 9.5-4 for the response to this question. v h Q430.90-1
HUPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.99 (Section 9.5.5) Recent Licensee event reports have shown that tube leaks are being experienced in the heat exchangers of diesel engine jacket cooling water systems with resultant engine failure to start on demand. Provide a discussion of the means used to detect tube leakage and corrective measures that will be taken. Include jacket water leakage into the lube oil system (standby mode), lube oil leakage into the jacket water. (operating mode), jacket water leakage into the engine air intake and governor systems (operating or standby mode). Provide the permissable inleakage or outleakage in each of these conditions which can be. tolerated without degrading engine performance or causing engine failure. The discussion should also include-the effects of jacket water / service water systems leakage.
Response
Refer to revised FSAR Section 9.5.5.2 for the response to this question. Q430.99-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.100 (SRP Section 9.5.5) You state in Section 9.5.5.3 that valves are provided to isolate components of the cooling water system which are not required during diesel operation under emergency or faulted plant conditions. You do not identify the cooling water components to be isolated under these conditions. Provide the following:
- 1. A list of components to be isolated
- 2. The procedures that will be used to isolate the components
- 3. The time period in which the components must be isolated, if applicable, as well as the effects on diesel engine operation if the components are not isolated
- 4. The Quality Group Classification and Seismic Category of the component and its connected piping
Response
The response to this question will be submitted at a later date. Q430.100-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.102 (SRP Section 9.5.6) Provide a discussion of the measures that have been taken in the design of the standby diesel generator air starting system to t preclude the fouling of the air start valve or filter with moisture and contaminants such as oil carryover and rust.
Response
Refer to the response to NRC Question 430.105. Q430.102-1 f
, . - - . - -,. ,- --, , , , , , .-nn.n-e.~ --,,-r,. w. _,-ar.., - -
- v. . - ,
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.104 (SRP Section 9.5.6) Expand your description of the diesel engine starting system. The FSAR text should provide a detail system description of what is shown on Figure 9.5-3. The FSAR text should also describe:
- 1. Components, their design characteristics, and their function
- 2. Instrumentation, controls, sensors and alarms
- 3. A diesel engine starting sequence In describing the' diesel engine starting . sequence including the number of air start valves used and whether one or both air start systems are used.
Response
- 1. A description of starting air components and their function is given in revised FSAR Section 9.5.6.2.
- 2. A description of the instrumentation, controls, sensors and alarms is described in the response to NRC Question 430.103.
- 3. A description of the diesel engine starting sequence.is given in revised FSAR Section 9.5.6.2.
I l' l l ( i Q430.104-1 l
MNPS-3 FSAR NRC Letter May 31, 1983 Question Q430.105 (SRP Section 9.5.6) A study by the University of Dayton (NUREG/CR-0660) has shown that accumulation of water in the starting air system has been one of the most frequent causes of diesel engine failure to start on demand. Condensation of entrained moisture in compressed air lines leading to control and starting air valves, air start motors, and condensation of moisture on the working surfaces of these components has caused rust, scale, and water itself to build o 3.ad score and. jam the internal working parts of these vital components thereby preventing starting of the diesel generators. In the event of loss of offsite power the diesel generators must function since they are vital to the safe shutdown of the reactor (s). . Failure of the diesel engines to start from the effects of moisture condensation in air starting systems and from other causes have lowered their operational reliability to substantially less than the desired reliability of 0.99 as specified in Branch Technical Position ICSB (PSB) 2, Diesel Generator Reliability Testing and Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units as Onsite Electric Power Systems at Nuclear Power Plants. In an effort toward improving diesel engine starting reliability we require that compressed air starting system designs include air dryers for the removal- of entrained moisture. The two air dryers most commonly used are the dessicant and refrigerant types. Of these two types,- the refrigerant type is the one most suited for this application and therefore is preferred. Starting air should be dried to a dew -point of not more than 50*F when installed in a normally controlled 70*F environment, otherwise the starting air dew point sh'ould be controlled to at least 10*F less than the lowest expected ambient temperature. Revise your design of the diesel engine air starting system accordingly, describe this feature of your design. Also expand your FSAR ~to discuss the procedures that will be followed to ensure the dryers are working properly and the frequency of checking / testing.
Response
Refer to revised FSAR Section 9.5.6.4 for the response to this j question'. Q430.105-1
MNPS-3 FSAR NRC Letter: May 31,1983 Question Q430.107 (Section 9.5.6) Diesel generators in many cases utilize air pressure or air flow devices to control diesel generator operation and/or emergency trip functions such as air operated overspeed trips. The air for these controls is normally supplied from the emergency diesel generator air starting system. Provide the following:
- a. Expand your FSAR to discuss any diesel engine control functions supplied by the air starting system or any air system. The discussion should include the mode of operation for the control functions (air pressure and/or flow), a failure modes and effects analysis, and the necessary P&ID's to evaluate the system.
- b. Since air systems are not completely air tight, there is a potential for slight leakage from the system. The air starting system uses a non-seismic air compressor to maintain air pressure in the seismic Category I air receivers during the standby condition. In case of an accident, a seismic event, and/or loop, the air in the air receivers is .used to start the diesel engine. After the engine is started, the air starting system becomes nonessential to diesel generator operation unless the air system' supplies air to the engine controls. In this case the controls must rely on the air stored in the air receivers, since the air compressor may not be available to maintain system pressure and/or flow. If your air starting system is used to control engine operation, with the compressor not available, show that a sufficient quantity of air will remain in the air receivers, following a diesel engine start, to control engine operations for a minimum of seven days assuming a reasonable leakage rate. If the air starting system is not used for engine control describe the air control system provided and provide assurance that it can perform for a period of seven days or longer.
Response
Refer to revised FSAR Sections 9.5.6.3 and 9.5.6.5 for the response to this question. Q430.107-1
---,.._-.y , , _- ,,.
+y ,--c q. -++3 ,,,y .
HNPS-3 ESAR NRC Letter: May 31, 1983 Question Q430.108 (Section 9.5.6) It is stated in the FSAR that the air start system and engine (air over piston) is designed for an air start pressure of 425 psig. Most air starting systems provided by other manufacturers have an air starting system design pressure of no more than 250 psig. Provide a discussion as to why such a high pressure is needed to start the engine. Include in the discussion _the minimum pressure needed to start the engine.
Response
The air start system and engine is designed for an air starting pressure of 425 psig in accordance with the manufacturer's recommendations. For a discussion of the minimum air starting system pressure, refer to the response to NRC Question 430.111. f Q430.108-1
MNPS-3 FSAR NRC Letter: May 31,1983
. Question Q430.109 (Section 9.5.6)
The air starting ~ system for your plant is defined as a high energy system. A high energy line pipe break in the air starting system of one diesel generator, plus any single active failure in any auxiliary system of the other diesel generator -will result in loss of all onsite -ac power. This is unacceptable. Provide the following information.
- a. Assuming a pipe break at any location in the high energy
- - portion of the air start system, demonstrate that no damage
- from the resulting pipe whip,. jet impingement, or missiles
- -(air receivers, or engine mounted air tanks) will occur on either of the two diesel generators or their auxiliary systems.
- b. Section 9.5.6.3 states that the air receivers, valves, and piping to the engine are designed in accordance with ASME Section III Class 3 (Quality Grcup C) requirements to the extent possible. This is partially acceptable. We require the entire air starting system from the compressor discharge up to and including all engine mounted air start piping, valves and components be designed to Seismic Category I,
.ASME Section III Class 3 (Quality Group C) requirements.
Show that you comply with this position.
Response
For the purpose of pipe break and jet impingement analysis,.the emergency generator and its related auxiliaries are considered a single system. As such, a single failure is only required to be postulated in one system. The redundant emerrjency generator and its i auxiliaries are separated by a 2 foot thick concrete wall such that pipe break in one redundant system does not affect the other. See; the response to NRC Question 430.73 for a description of-emergency generator safety (quality group) classification. Q430.109-1
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.111 (Section 9.5.6) You state in Section 9.5.6.1 of the FSAR that each independent starting system is designed to be capable of starting the engine five times from an initial pressure of 425 psig without recharging the starting air tanks. The first two starts from each independent system provide for starting the engine and reaching synchronous speed and voltage within 10 seconds. Each system is also capable of starting the engine once and reaching synchronous speed and voltage within 10 seconds from a starting air tank pressure greater than 350 psig (low pressure alarm setting). Some information has been provided on system pressure alarms, compressor cut-in or cut-out. Provide the following: (a) Expand Section 9.5.6 of your FSAR .to clarify the statement regarding the capability of the air start system of five consecutive start attempts without recharging the air receivers. A successful diesel generator start is defined as the ability of the air start system to crank the diesel engine to the manufacturer's recommended RPM, to enable the generator to reach voltage and frequency and begin load sequencing in 10 seconds or less. With the receiver at rated pressure and without recharging provide a tabulation of receiver pressure and diesel engine starting times for each of the five consecutive starts. In addition describe the sequence of events when an emergency start signal exists. State whether the diesel engine cranks until all compressed air is exhausted, or cranking stops after a preset time to conserve the diesel starting air supply. Describe the electrical features of this system in Section 8.0 of the FSAR (in the appropriate subsection) f (b) Provide the pressures at which the following alarms actuate: low low pressure alarm, and high pressure alarm (c) Verify that the low pressure alarm setpoint indicates tc the operator that the compressor is not maintaining system pressure l and that at this setpoint the system pressure and capacity is ! sufficient to start within 10 seconds the diesel generator five (5) times
Response
l (a) A discussion on the capability of the air start system for l consecutive starts without recharging the air receiver is given ! in revised FSAR Section 9.5.6.1. l (b) Actuation of low low pressure alarm and high pressure alarm is ( given in revised FSAR Section 9.5.6.5. l (c) The ability of the diesel generator to start 5 times is based l upon an initial pressure of 425 psig. Refer to new FSAR Table l l Q430.111-1 i
IINPS-3 FSAR 9.5-11. Low-low pressure is alarmed at 350 psig. Refer to FSAR Section 8.3.1.1.3 for the electrical features of this system. , Q430.111-2
P UNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.113 (Section 9.5.7) Nhat measures have been taken to prevent entry of deleterious materials into the engine lubrication oil system due to operator 4 error during recharging of lubricatina oil or normal operation.
Response
Refer to revised FSAR Section 9.5.7.3 for the response to this question. 6 e e I i . f . Q430.113-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.114 (Section 9.5.7) Describe the instrumentation, controls, sensors and alarms provided for monitoring the diesel engine lubrication oil system and describe their function. Describe the testing necessary to maintain a highly reliable instrumentation, control, sensors, and alarm system and where the alarms are annunciated. Identify the temperature, pressure, and level sensors which alert the operator when these parameters exceed the ranges recommended by the engine manufacturer and describe any operator action required during alarm conditions to prevent harmful effects to the diesel engine. Discuss systems interlocks provided. Revise your FSAR accordingly. Response: -
- 1. Refer to revised FSAR Section 9.5.7.5 for a description of the instrumentation, control, sensors and their functions.
- 2. Refer to FSAR Chapter 16 and Section 8.3.1.1.3 Items 2 and 3 for testing.
- 3. Refer to revised FSAR Section 9.5.7.5 for location of alarms.
- 4. Refer to revised FSAR Section 9.5.7.5 for identification of instrumentation.
- 5. Millstone 3 operating procedures address actions to be taken in response to alarm conditions. These actions are consistent with the engine manufacturer's guidelines and prevent harmful effects to the diesel engine.
l 6. Refer to revised FSAR Section 9.5.7.5 and FSAR Section l 8.3.1.1.3 for interlocks that trip engine on low lube oil l pressure or on high lube oil temperature. l l l Q430.114-1 i
1 i l MNPS-3 FSAR I 1 NRC Letter: May 31, 1983 Question Q430.117 (Section 9.5.7) Several fires have occurred at some operating plants in the area of the diesel engine exhaust manifold and inside the turbocharger housing which have resulted in equipment unavailability. The fires were started from lube oil leaking and accumulating on the engine exhaust manifold and accumulating and igniting inside the turbocharger housing. Accumulation of lube oil in these areas, on some. engines, is apparently caused from an excessively long.prelube period, generally longer than five minutes, prior to manual starting of a diesel generator. This condition does not occur on an emergency start since the prelube period is minimal. Provide the following informationi 9 a. Except for the rocker arm lubrication system, the diesel engine prelube will be continuous while the diesel generators are in the stancby mode. Therefore, expand your FSAR section on engine prelube to demonstrate that 1) diesel engine prelube is in accordance with manufacturer's recommendations, and 2) that continuous prelube will not result in dangerous accumulations of lube oil that could ignite.
- b. When manually starting the diesel generators for any reason, to minimize the potential fire hazard and to improve equipment availability, the prelube period for the rocker arm lubricating system should be limited to a maximum of three to five minutes unless otherwise recommended by the diesel engine manufacturer. Confirm your compliance with this requirement or provide your justification for requiring a longer prelube time interval prior to manual starting of the diesel generators. Provide the prelube time interval your diesel engine will be exposed to prior to manual start.
Response
Refer to revised FSAR Section 9.5.7.3 for the response to this question. Q430.117-1
-- . _ - . _ ~ . . .
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.118 (SRP Section 9.5.7) An emergency diesel generator unit in a nuclear power plant is normally in the ready standby mode unless there is a loss of offsite power, an accident, or the diesel generator is under test. Long periods on standby have a tendency to drain or nearly empty the engine lube oil piping system. On an emergency start of the engine as much as 5 to 14 or more seconds may elapse from the start of
, cranking until full lube oil pressure is attained even though full engine speed is generally reached in about five seconds. With an essentially dry engine, the momentary lack of lubrication at the various moving parts may damage bearing surfaces producing incipient or actual component failure with resultant equipment unavailability.
The emergency condition of readiness requires this equipment to attain full rated speed and enable automatic sequencing of electric load within ten seconds. For this reason, and to improve upon the availability of this equipment on demand, it is necessary to establish as quickly as possible an oil film in the wearing parts of the diesel engine. Lubricating oil is normally delivered to the engine wearing parts by one or more engine driven pump (s). During the starting cycle the pump (s) accelerates slowly with the engine and may not supply the required quantity of lubricating oil where needed i fast enough. To remedy this condition for the rocker arm assembly lubrication system, as a minimum, an electrically driven lubricating oil pump, powered from a reliable de power supply, should be installed in the rocker arm lube oil system to operate in parallel with the engine driven rocker arm lube pumps. The electric driven prelube pump sh'ould operate only during the engine cranking cycle or until satisfactory lube oil pressure is _ established in the engine rocker arm lube oil distribution header. The installation of this prelube pump should be coordinated with the respective engine manufacturer. Confirm your compliance with the above requirement or provide your justification for not installing an electric prelube oil pump.
Response
Refer to ' revised FSAR Sections 9.5.7.1 and 9.5.7.2 for the response to this question. Q430.118-1
L b MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.119 (Section 9.5.7) You state in Section 9.5.7 of the FSAR that the lube oil used to lubricate the engine is stored in a lube oil sump. During diesel engine operation a certain amount of lube oil is consumed as part of the combustion process. Since the diesel generator may be required to operate for a minimum seven days during a loss of offsite power or accident condition, sufficient lube oil should be stored in the sump and/or site to preclude diesel. generator unavailability due.to lack of lube oil. Provide the following:
- a. Provide the normal lube oil usage rate for each diesel engine under full load conditions. Also provide the lube oil usage rates which would be considered excessive.
- b. Show with the lube oil in the sump tank at the minimum recommended level that the diesel engine can operate without refilling the lube oil sump for a minimum of seven days at full rated load. If the sump tank capacity is insufficient for this condition, show that adequate lube oil will be
, stored onsite for each engine to assure seven days of cperation at rated load. Also provide the lube oil sump capacity.
- c. If the lube oil consumption rate-becomes excessive, discuss the provisions for determining when to overhaul the engine.
The discussion should include the procedures used and the quality of operator training provided to enable determination of excessive L.O. consumption rate. (Refer to requests 430.58.3 and 430.57 for additional requirements and training.)
Response
Refer to revised FSAR Section 9.5.7.2 and the response to NRC Question 430.121 for the response to this question. Q430.119-1
MHPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.124 (SRP Section 9.5.7) Section 9.5.7.3 of the FSAR provided a one sentence description of the Quality Group D lube oil moisture detection system. This is inadequate.- Provide a detailed description of operation of the moisture detection system including components and their function, power so,urces -(if required), associated alarms, trips, interlocks, and inservice inspection of the system. In addition describe how this. system relates to normal operation of the diesel. .If this system is needed during normal cperation of the diesel we require that the mechanical system (s) be designed to Seismic Category I ASME ; Section III Class 3 (Quality Group C) requirements,. and electrical systems (if any) to class 1E requirements.
Response
The response to this question will be submitted at a later date.
+
l l I 1 l Q430.124-1 l
I a .- ICIPS-3 FSAR , NRC Letters t!ay 31, 1983 , Question'Q430.128 (Section 9.5.8) r Provide the results of any analysis that demonstrates that the function. of your diesel cr.gine air intake and exhaust system design will not' be degraded to an extent which prevents deceloping full engine rated power or cause engine shutdown as a consequence of any meteorological or accident condition. Include in your discussion the e potential. and effect- of fire extinguishing (gaseous) medium, recirculation of diesel combustion products, or other gases that may intentionally or accidentally be released on site, on the ptrformance of the diesel' generator. Response: . The response to this question will be submitted at a later date. I'\, x
. q s
s i 4 s w
+
m.
# \
Q430.128-J s s s
,. o -
4 '% ,
-a s 1 g3 s
-,~ N
.c , ggtps.3 FSAR gr
!Q 4
'y, -N NRC Letter: May 31, 1983
, , .i '
Question Q430.131 (Section 9.5.8) 2~ ' t Experience .at some-.- operating plants has shown that diesel engines
, have failed to start due to accumulation of dust and other x Sw deleterious material on electrical equipment associated with starting
' 'cl w ;cf the' diesel generators (e.g.,. auxiliary relay contacts, control switches etc.). Describe the provisions that have been made in your diesel generator building design, electrical starting system, and
, L'( .
- s. ,
7ccmbustion air, and ventilation air intake design (s) to preclude this
.\ condition to assure availability of the diesel generator on demand.
.Also describe under normal plant operation what procedure (s) will be used to minimize accumulation of dust in the diesel generator room; specifically, address concrete dust control.
Response: %. The response.to this question will be submitted at a later date. e f
- j. ,
s _
..+
x
'1 T
y %= r , v. s 7 w, . .
' p a
.. .t 3 2
. i (s ' '
m 31 ce .s
-Q430.131-1
. -f.) ~ ' " _ , ,
? l l ;v.
. - . - - - -- . - - . - - . - _ = - . . - - . - - . .
,q , yNpg,3'FSAR
.jC '[ y* I'
} .jt/ s j
NRC Letter: May 31, 1983
;j !. '
,y ' s "
Question Q430.133'(Section 9 .8)- Diesel generr$ ors f for _ nucleai- power plants should be capable of operating at maximum rated output under various service . conditions.
, For no load and light operations, the diesel qinerator may not be
- g, , capable of operating for extended periods of ' time under extreme M, service' conditions or weather disturbances withoutu serious
,j < degradation of the engine performance. This could result in the
._ inability of the diesel engine to accept full load or fail to perform
, t on demand. ' Provide the followingt .
;- r , ; ,
, s -
,. [ ' r a . ^.. - 2Ihe" environmental . service conditions'for which your diesel B g ; generator is designated to deliver rated load including the ""/ -
/ "following:
Service conditions
~
q - _f -
- 1. Ambient air intake temperature range., *F
), '2. Humidity, max - % i ' b .~ Assurance that the_ diesel. generator can provide full rated Icad under the following weather disturbances:-
- 1. A tornado pressure transient causing an atmospheric i
pressure reduction of 3 psi in 1.5 seconds followed by a rise to normal pressure in 1.5 seconds
- 2. A_. low pressure storm such as a hurricane resulting in ambient pressure of not less _ than 26 inchea Hg for a minimum duration 'of two (2) hours followed by a pressure.of no less than 26 to 27 inches Hg for an extended period of time (approximately 12 hours)
- c. In light of- recent weather conditions (subzero temperatures), discuss the effects low ambient- temperature will -have on engine standby and operation and effect on its output particularly at no load and light load operation.
Will air preheating be required to ~ maintain engine performance verses ' ambient temperature for your diesel i generator at normal rated load, light load, and no load conditions. Also provide assurance that the engine jacket water and lube oil preheat systems have the capacity to
-maintain the diesel engine at manufacturer's .recemmended standby temperatures with minimum expected ambient conditions. If the engine jacket water and lube oil preheat
. systems capacity is not sufficient to do the above, discuss how this equipment will be maintained at ready standby status with minimum ambient temperature. Q430.133-1
. - . . - .- __ .. - _..=_-_.--. . . - . - .- -.. -- . - _ . - ,.. . . .. . - .-_ -_-
. HNPS-3 FSAR
- d. Provide the manufacturer's design data for ambient pressure vs engine derating.
e '. Discuss the effects of any other service and weather- , , conditions will have on engine operation and output, i . e., i . dust storm, air restriction, etc.
Response
The respense to this question will be submitted at a later date. p .t I ' e I s i t 4 F l I 1 l l Q430.133-2 L r y w--bywyymrq *v--g-w'%+-Ty-P y y w-wyT wwmeaMwmww ytwi N p *s *@'--r-We'~~Wi*a t g7 Tt m F P P- - 9 Nrv zW wrv wyA-w-w c- My+ v
U MNPS-3 rSAR NRC Letter: May 31, 1983 Question Q430.136 (Section 10.2) Expand your discussion of the turbine speed control and overspeed protection system. Provide additional explanation of the turbine and generator electrical load following capability for the turbine speed control system with the aid of system schematics (including turbine control and extraction steam valves to the heaters). Tabulate the individual speed control protection devices (normal, emergency, and backup), the design speed (or range of speed) at which each device brings operation to perform its protective function (in terms of percent of normal turbine operating speed). In order to evaluate the adequacy of the control and overspeed protection system, provide schematics and include identifying numbers to valve and mechanisms (mechanical and electrical) on the schematics. Describe in detail, with references to the identifying numbers, the sequence of events in a turbine trip including response times, and show that the turbine stabilizes. Provide the results of a failure mode and effects analysis for the overspeed protection systems. Show that a single steam valve failure cannot disable the turbine overspeed trip from functioning.
Response
The General Electric Company turbine's Mark II electro-hydraulic control (EHC) system incorporates the circuity and equipment required to provide the following basic turbine control functions:
- 1. Automatic control of tur'ine o speed and acceleration through the entire speed range, with several discrete speed and accceleration rate settings.
- 2. Automatic control of the load and loading rate from no load to full lead with continuous load adjustment and discrete loading rates.
- 3. Standby manual control of speed and load when it becomes necessary to take the primary automatic control cut of service while continuing to supply power to the system via this turbine-generator.
- 4. Limiting of load in response to preset limits on operating parmaters such as desired load or main stream pressure.
- 5. Detection of dangerous or undesirable operating conditions, annunciation of the detected condition, and initiatica of proper control response to the condition.
- 6. Monitoring of the status of the control system, including the power. supplies and redundant control circuits.
- 7. Testing of valves and contreis.
Q430.136-1
MMPS-3 FSAR The electrical control system which implements these functions is designed using both analog and logic circuity. The elements of the control system producing the signals used to position the valves and provide the valve position feedback signals are designed as analog circuits. The switching circuits used to implement the logic necessary to ensure proper and safe operation are two-state, or digital, in nature, and are implemented primarily using electromechanical devices. The basic building block of the low voltage solid slate analog. , circuity is the operational amplifier. Regulated power supplies provide the +22 V de and -22 V de levels used to enerize the analog circuity. The logic circuity utilizes 24 V de and 125 V de regulated power supplies. The EHC system electrical, hydraulic, and mechanical components are physically located in various parts of the power plant. The basic equipment comprising the EHC system is listed below:
- 1. The EHC cabinet, which contains the electrical power supplies and the electrical analog and legic circuits required to produce signals to the valve positioning devices, is located adjacent to the control room.
- 2. The EHC operating panels contcining the devices to operate, monitor and test the control system during startup and operation of the turbine are located in the control room.
- 3. The hydraulic power unit, which supplies and conditions 1600 psi hydraulic fluid for the valve operators and the emergency trip system, is located in the turbine building below the hydraulic mechanisms to ensure proper hydraulic fluid circulation.
- 4. The hydraulic valve actuators, which use the high pressure hydraulic fluid to operate the valves in response to electrical signals from the EHC cabinet, and the position transducer to provide valve position feedback signals to the EHC cabinet, are located at the centrolled valves.
- 5. The turbine speed transducers, the permanent magnet generator, the emergency trip valves, and the mechanical overspeed trip mechanism are located in the turbine front standard.
The EHC operating control system is organized into three major units to minimize interactions. As shown in Q430.136-1, the speed control unit compares actual turbine peed with the speed reference, or actual acceleration with the acceleration reference, and provides one speed error signal for the load control unit. The load control unit combines the speed error cignal with the load reference signal, and provides limits and bases ta determine desired steam flow signals for the main stop valves, control valves, and intercept valves. Q430.136-2 9 ,o 7- r t - - , ,- g , v- .m,-w--m,---e---r-- --,m
MHPS-3 FSAR Finally, the valve flow control units accurately postion the stop, control, and intercept valves to obtain the desired steam flow to the turbine. The EHC system provides three independent levels of speed sensing and protection devices:
- 1. Normal -
The operating speed signal is obtained from two magnetic pick-ups on a toothed wheel at the high pressure turbine shaft. Increase in either of the speed signals tends to close control and intercept valves. Loss of one of the speed signals will transfer control to the other speed signal. Loss of both speed signals will trip the emergency trip system through two redundant trip signals. The operation of both speed signals is continuously monitored by the alarm system.
- 2. Emergency - The mechanical overspeed trip uses an unbalanced rotating ring and a stationary trip finger operating a trip valve to dump the emergency trip fluid system pressure directly upon reaching its set speed. All stop and control valves and intermediate valves and extraction line non-return valves are closed.
- 3. Backup - The electrical back-up overspeed trip will trip the emergency trip fluid system pressure through two redundant trip signals, upon reaching trip speed.
These speed control protection devices are designed to function at i the following speed ranges: Speed- % Event 100 Speed begins to rise. 101 " Normal" speed control functions to begin closing control and intercept valves.
" Emergency" mechanical over-speed trip
~
110 ' signals all valves to close. 111 " Backup" electrical overspeed trip signals all valves to close.
-A schematic of the control and overspeed protection system is shown on Figure Q430.136-2. - Referring to Figure Q430.136-2, a trip signal
- energizes the 125 V de or 24- V de trip bus. The trip signal
( deenergizes the electrical trip (ETV) valve, ,hich w interrupts the i 1600 psi hydraulic fluid supply to the trip system. The trip system pressure falls to zero and all dump valves on the main stop valves, control valves, reheat stop valves, intercept valves, and the air relay dump. valves on .the extraction line non-return valves open causing all the valves to slam _ closed. These valves are designed to i Q430.136-3 i
4 1
- 19?PS-3 FSAR l t close in approximately C.2 seconds and their closing causes all sources of steam for driving the turbine to be isolated and the turbine speed decreases to zero.
4 An analytical failure mode and effects analysis has not been prepered for the turbine overspeed protection system, Table Q430.136-1 illustrates that a minimum of two independent lines of defense is employed for protection against overspeed and that no single failure of any device or steam valve can disable the turbine overspeed trip from functioning. 'i I d.
~
4 < r 1 i I 1 I l i i Q430.136-4
. c. . . , , _ - . . . _ . . _ _ . , - _ _ _ _ _ _ _ _ _ - . . _ . . . , _ _ . _ . , . - . - , _ _ _ . . _ . _ _ . _ . . _ . . - _ , , _ . . - _ _ . _ , _ _ _ . _ _ _ _ . . _ .
MNPS-3 FSAR
. TABLE Q430.136-1 OVERSPEED PROTECTION Fcr protection against overspeed, a minimum of "two independent lines of defense" is employed. The following redundancies are used:
Main Stop Valves Control Valves Reheat (intermediate) & Intercept Valves Stop Valves Speed Control & Overspeed Trip & Backup Overspeed Trip Speed Control -- Primary .& Backup Speed control Loop 24 V " electrical" Trip & 125 V " mechanical" Solenoid Valve (dual solenoids) Trip Solenoid Valve A Mechanical Trip & An Electrical Trip Fast Acting Solenoid Valves & Emergency Trip Fluid System In addition, these featut es are used: " FAIL SAFE" mode of operation of all valves: If hydraulic pressure is lost all turbine valves will close. Power / Load Unbalance to reduce overspeed on loss of high loads. Spring closed extraction check valves with air assist. 1 of 1 . I I l
l STA N D B Y SIGNAL M ATC H i r STANDBY STANDBY
- U MITS
.. CONTROL LOAD SET SPEED LOAD REFERENCE REFERENCE MAIN STOP VALVE M SV FLOW FLOW SIGNAL p y_S y pgg, ACCELERATION 8.OA DING UNIT REFERENCE . RATE l ' i '
i ri r1 r SPEED LOAD CV FLOW CONTROL ; CONTROL CONTROL : UNIT SIGNAL UNIT UNIT 4 6 4 6 F OW l.V FLOW
! -SPEED 1.V. FLOW SIGNAL 7 FIRST-STAGE LEGEND: PRESSURE CV CONTROL VALVE IV z INTERCEPT VALVE FIGURE Q430.136- 1 .
l uSv z MAIN STOP VALVE OPERATING CONTROL SYSTEM FOR REHEAT TURBINE-EHC MARK H ' MILLSTONE NUCLEAR POWER STATION UNIT 3 FINAL SAFETY ANALYSIS REPORT
OTHER OPERATIONAL CUSTOMER IMPORTANT TRIP INPUTS VACUUM SIGNALS SIGNALS 1 1 I $ I T lP RESET k k a BUTTON SUTTON g g g (O) O '"aN" 82S VDC VACUUM TRIP IM =T ypgpg
- RAT = AL TRIPS TEST OVERSPEED-TRIP TEST RESET AND MONITORING LOGIC h STATsOM ON TEST PANEL
-el i2Sv0C EHC TRir AND RESET LOGIC a
l 57 i CUSTOMER INPUTS SPEED <> ( qr
,SPEEO, g , ,, ,
e SOLENOIO
. A TRIP seen
? Y l g
& > E > OST "TSV t * *
- E n E CUSTOMFR SACKUP LOSS OF h h :f P 1r 1r
[hvDC PS OVERSPEED SOTH SPEED g 3 g > kE CH ANIC AL MECHANICAL OIL RESET OIL RE SE T TR@ S NGD BATTERY TRIP SIGNAL TRIP g g g g vg uD TRIP PISTON PIS TON s$m yg utsv MTP ORP cRSv
,, go 4 g g ag ,,
if 1r hII (i y g, s 12SVDC EHC TRIP ANO RESET LOGIC l MECHANICAL h $ggg C: TRIP HANDLE ANTIC ATOR I h MECHANICAL u TRIP PILOT ar TO SET SPEED t' 1r E VALVE REF TO ZERO ELECTRICAL WHEN TRIPPED PRESSURE TRIP SOLENOID 4- I::T E RLOC K 4 SwlTCHES {ALVE
,, 4 ,r . ,
5 ELECT RIC AL E LECTRICAL MECHANIC AL MECHANCAL MECHANICAL p
^
LOC OuT semimus TRIP VALVE W LOC,K OUT
^
TRIP VALVE sgum SHUT OFF g g E'V E" " "5"# LEGEND:
; ELECTRICAL SIGNAL a a 2 EMERGENCY TRIP SYSTEM ETS
^ =MECHANICAL SIGNAL h h h h h
----$> OTHER SIGNAL DibC DUMP VALVE DISC DUMP VALVE DISC DUMP VALVE CISC DUMP VALVE AIR RELAY ON ON ON ON BUMP VAWE
--o- + MULTIPLE LOGIC MAIN STOP VALVLS CONTROL VALVES RER STOP VALVES INTERCEPT VALVES FIGURE 0430.136-2 i2Out OP S iN MOST CASES'
' 4 PROTECTION SYSTEM TO PCsmON BLOCK DIAGRAM SUI"vi['n
v " MILLSTONE NUCLEAR POWER STATION UNIT 3 FINAL SAFETY ANALYSIS REPORT
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q430.344 (Section 10.4.1)
- In Sectica 10.4.1 you have discussed the provisions for tests and initial field inspection but not the frequency and extent of inservice inspection of the main condenser. Provide this information in the FSAR.
Response
There are no routine maintenance activities identified which require periodic condenser inspections. Conditions which would require condenser inspections are detected by operational abnormalities (such as high hotwell conductivity). Therefore, tests or inspections will be performed as needed on both the steam and water box sides of ecch shell. a 1 Q430.144-1
. - - - - _ . _ . - - _ _ _ , _ . _ . _ _ __ __ _ _ . . . - _ . . _ . . _ - . _ _ ~ , - . _ _ _ _ _ _ . . .
HNPS-3 FSAR NRC Letter: Hay 31, 1983 Question Q430.148 (Section 10.4.4) Provide the results of a failure mode and effects analysis to determine the effect of malfunction of the turbine bypass system on the operation of the reactor and main turbine generator unit.
Response
The response to this question will be submitted at a later date. t Q430.146-1
. - _- . - - - - -. .. . . - - . ~ _ _. .. ..-,_-- - _. .- -
MNPS-3 FSAR NRC Letter: May 31, 1983 e Question Q430.149 (Section 10.4.4) In Section 10.4.4 of the FSAR you stated that during refueling shutdowns, the turbine bypass valves and turbine bypass system controls will be inspected and tested for proper operation. They will also be periodically tested for partial opening. We find this inspection program partially acceptable. Since the operation of the turbine bypass system eliminates the need to rely solely on safety systems which are required to. meet the redundancy and power source requirements of GDC 34 and to mitigate the consequence of certain steam line break accident conditions, the turbine bypass system should be tested (full stroking of the valve) on a frequent basis, but no less than once every three conths. Modify your inservice inspection program accordingly. Respcnse Since the turbine bypass system will be observed in operation frequently during normal plant operation, it has been determined that
- no additional testing is necessary.
5
- The design of Millstone Unit 3 contains multiple means of removing ,
decay heat at temperaturcs above 350 F. These means include the ! j following steam release mechanisms: i Main steam safety valves - There are five main steam safety i valves per steam generator. Each valve is capable of passing ! 9.7x105.lb/hr of steam. These valves require no power to operate i ,and start lifting at 1,185 psig. 1
- Main steam pressure relieving valves - There is one main steam pressure relieving valve per steam generator. Each valve is capable of passing 9.7x10s lb/hr of steam. These valves are air
- operated. Lift point is dependent on control system setpoints.
Main steam pressure relieving bypass valves - There is one main steam pressure relieving bypass valve per steam generator. Each valve is capable of passing 9.7x10s lb/hr of steam. These valves 7 are motor operated and controlled by operator action. Power supplies are redundant. ! Turbine bypass system - There are a total of nine turbine bypass valves in three banks of three. Each valve is capable of passing 9.7x10s lb/hr of steam. These valves are air operated. . Lift point is dependent on control system setpoints. The turbine bypass system is expected to release steam during normal plant operation to mitigate the effects of steam demand transients. It will be the normally used system for startups and shutdowns. t i Q430.149-1
, . . - - ~ . -. .- . - _ - . . _ . . _. -. _- _ . - . . . . . .
4
~
frtiPS-3 FSAR i j NRC Letter: May 31, 1983 a a Question Q440.9 (SRP Section 5.1.1) Section 5.1.1 of the FSAR implies that typical values for principle I parameters of the RCS are on Figure 5.1-2 and that these values at each numbered point are in process flow diagram tables. Provide or reference these tables.
Response
Refer to the response to Acceptance Review Question 440.1. i I i i f i 4 l 5 e Q440.9-1 I 5 a. I,
i MNPS-3 FSAR ! NRC Letter: May 13, 1983 Question Q440.10 (Section 5.2.2)
- Provide a description of the design features to be used to mitigate the consequences of overpressure events while operating at low temperatures. Our position regarding overpressure protecticn while operating at low temperatures is presented in the Branch Technical Position RSB 5-2 attached to SRP Section 5.2.2. Your description should address each portion of this position.
i
Response
The cold overpresssure mitigation system is described in FSAR Section 5.2.2.11. Compliance with Branch Technical Position RSB 5-2 is set forth below:
- 1. The design basis of the cold overpressure mitigation system is to preclude Appendix G violation for mass inputs of up to 120 gpm with letdown isolated. For non-design basis transients it is possible that the Appendix G limit may be exceeded by a relatively small amount, but such minor violations would have no safety impact.
- 2. As described in FSAR Section 5.2.2.11.1, the cold overpressure mitigation system meets the single failure criteria.
- 3. The overpressure mitigation system has been designed using IEEE-279 as guidance. It is, however, manually set into operating mode. See FSAR Section 7.6.8 for a description of the actuation logic. See FSAR Section 5.4.13 for a discussion of the PORVs.
j 4. The cold overpressure mitigation system is testable.
. However, the PORVs are not exercised at power. Surveillance j requirements are described in the Technical Specification.
Valve testing is in accordance with ASME XI.
- 5. The PORVs are Safety Class 1. This is comparable to Regulatory Guide 1.26, Group A. The actuation logic has been designed using IEEE-279 as guidance.
- 6. As described in FSAR Section 5.2.2.11.3, the cold l
overpressure mitigation system will not be disabled by an OBE. l l 7. Offsite power is not required to operate the overpressure mitigation system. See FSAR Section 5.4.13 for information i on power supply to the PORVs. For a detailed discussion of the Class IE distribution system see FSAR Section 8.3. { Q440.10-1 l l l
MNPS-3 FSAR
- 8. If a PORV were to be opened inadvertently and not closed the RCS would be depressurized. It should be noted, however, that the PORVs are solenoid operated, normally closed, fail closed valves. See FSAR Section 5.4.13 for a discussion of the PORVs.
- 9. Pressure relief from the RCS is not to a low pressure system. Therefore, this requirement of BTP 5-2 does not apply.
Q440.10-2
MNPS-3 FSAR NRC Letter: May 31, 1983 QuestionQ440.ll(Nection5.2.2) In previous reviews of certain other Westinghouse plants, failure of a de power bus was identified which could both initiate an overpressure event at low temperature (by isolating letdown) and fail closed one of the PORVs. A postulated single failure (closed) of the other PORV would fail the mitigative systems for this event. Address this concern for the Millstone design.
Response
The discussion below addresses the following scenario: With the plant in a cooled down and depressurized condition in which the cold overpressure protection system is required to be operable, and with charging and letdown established, a de vital bus fails. This failure causes normal letdown to isolate and also results in the loss of one of two power cperated relief valves (PORV). In addition to the de bus failure, an additional random failure of the second PORV is postulated to occur. This sequence of events places the plant in a condition in which letdown is isolated, the automatic cold overpressure protection systen is inoperable and charging flow is filling the- pressurizer increasing system pressure towards the Appendix G limits. To begin this discussion, the limitations placed on plant operation by the current Westinghouse Standard Technical Specification (STS) will be addressed.
- 1. With reactor coolant system (RCS) temperature below 200'F, i.e., cold shutdown, one residual heat removal (RHR) pump is required to be in operation and the other RHR loop is required to be operable, or the secondary side water of at least two steam generators must be greater than 17 percent.
This requirement ensures that at least one RHR suction relief valve is available for overpressure protaction of the RCS. This valve is sized to relieve the capacity of one charging pump at the valve lift setting pressure.
- 2. Whenever the RCS is in a condition in which the cold overpressure protection system is required to be operable, all but one charging pump are required to be made incapable of operation. This requirement assures that only one charging pump would be operating at the initiation of the event. Considering these requirements, any time RHR is in operation and the RCS is in a condition requiring the cold overpressure protection to be operable there will be no ove rpressure events as a result of the prescribed scenario.
;440.11-1
MNPS-3 FSAR Assuming the event as described (i) did occur the RHR relief valve would prevent RCS pressure from reaching the Appendix G limit by relieving all charging flow. Typically, the RHR system is in operation, or at a minimum, the RHR loop suction valves are open providing an open path from the RCS to the RHR suction relief valves, whenever RCS temperature is below 350*F. For this reason, an overpressure event resulting from the prescribed scenerio is very unlikely: however, the discussion will be extended to the infrequent case where the RHR system is isolated from , the RCS and the cold overpressure protection system is required to be operable. To gain a better understanding of the results of the event, it is necessary te address the functions of some of the chemical and volume control system (CVSC) control valves. As stated earlier, the letdown valves will fail closed on loss of de power isolating letdown. The normal charging isolation valve will fail open on loss of de power to the solenoid air valve; however, between the charging pump and the norn.al charging isolation valve there is a normally throttled valve (FCV-121) which receives its power from the process and control racks powered by the vital ac instrument buses. This valve would be unaffected by a de bus failure and would continue to work normally during the event. FCV-121 is the charging flow control valve which automatically regulates flow to maintain a prescribed pressurizer level. Assuming this valve continues to function normally as pressurizer level rises, charging flow would be reduced until the flow is limited to a minimal amount (15 gpm) required for Regenerative HX cooling. If the valve control were in manual, the valve position would remain unchanged. Another valve unaffected by a de bus failure is the seal injection regulator (HCV-132) which is manually positioned to regulate flow to the seals. This valve would remain in its initial position, limiting flow to 32 gpm to the seals. The effect of these two valves would be to limit total charging flow to its value at the beginning of the event if valve FCV-121 were in manual, or 47 gpm if the valve is in automatic. Assuming maximum letdown at the initiation of the event, total flow (charging plus j seal injection) to the RCS would be limited to approximately 120 gpm. An additional consideration is that with the plant in the hot shutdown condition and RHR isolated from the RCS, normal operation is ( to have a steam bubble in the pressurizer of approximately 1350 fta, [ At a maximum charging rate of 120 gpm it would take in excess of 30
- minutes to reach the Appendix G limit at 200 F, the temperature i corresponding to the coldest RCS temperature at which RHR is permitted to be isolated. As an extreme case, with a bubble of only half the normal size, the corresponding time available for appropriate action would be in excess of 15 minutes.
i (1) As additional information, during RHR operation letdown is typically taken from the discharge of the RHR pumps and would not be isolated by the de bus failure. i 44C.;;-2 j l i
MNPS-3 FSAR To Summarize:
- 1. The postulated event is unlikely to occur since the de buses have a battery as an emergency power supply and should the dC bus fail, it must be coupled with the additional failure of the second PORV for overpressurization.
- 2. In the unlikely event that the prescribed scenario did occur, RHR would normally be on the line and capable of mitigating any potential overpressure resulting from one charging pump.
- 3. In the highly unlikely event that the scenario should occur when RHR is isolated from the RCS, the operator would have sufficient time to mitigate the event.
- 4. The Appendix G curves are excessively conservative for their intended purpose of assuring vessel integrity during cold condition.
No further action is necessitated to address this postulated event since existing plant design and operational techniques will result in successful event mitigation. Q440.11-3 s -. . . , - - - - . - , . -- - _ . . - . - - - -
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.12 (Section 5.2.2) SRP Section 5.2.2 requires the Applicant to demonstrate adequate overpressure protection has been provided during the most severe abnormal operational transient and the reactor trip is initiated by the second safety grade signal from the reactor protection system. Provide a detailed discussion that confirms that the overpressure protection provisions of Millstone 3 comply with this criterion. Responsen Verification of adequate overpressure protection for the RCS is accomplished in several stages. Initially, all transients that may cause overpressurization of the RCS are identified. That transient which is anticipated to result in the maximum system pressure and maximum safety valve capacity is then chosen as the design transient for determining the actual safety valve capacity to be provided. This design transient is then analyzed, utilizing input parameters that are conservatively chosen to result in a higher RCS pressure and safety valve capacity requirement. Following selection of the valve capacity, the overpressure transients previously identified are analyzed to verify that the chosen capacity results in peak RCS pressures within that identified in Article NB-7000 of Section III of the ASME Code. For Millstone 3, the protection is afforded for the following events which envelop those credible events which could lead to overpressure of the RCS if adequate overpressure protection were not provided:
- 1. Loss of Electrical Load and/or Turbine Trip (FSAR Sections 15.2.2 and 15.2.3)
- 2. Uncontrolled Rod Withdrawal at Power (FSAR Section 15.4.2)
- 3. Loss of Reactor Coolant Flow (FSAR Section 15.3)
- 4. Loss of Normal Feedwater (FSAR Section 15.2.7) 7
- 5. Loss of Offsite Power to the Station Auxiliaries (FSAR l Section 15.2.6) i Review of these transients shows that the turbine trip transient results in the maximum system pressure and the maximum safety valve relief requirements. Therefore, to determine the required safety l
- valve capacity, the turbine trip transient was analyzed, with
-additional conservatisms included over those considered for FSAR
- Chapter 15 analyses. The sizing of the pressurizer safety valves was based on analysis of a complete loss of steam flow to the turbine with the reactor operating at 102 percent of the engineered safeguards design power. In this analysis, feedwater flow was Q440.12-1 i
MNPS-3 FSAR assumed to be maintained, and no credit was taken for operation of pressurizer power operated relief valves, pressurizer level control system, pressurizer spray system, rod control system, steam dump system or steam line power-operated relief valves. The reactor was maintained at full power (no credit for reactor trip), and steam relief through the steam generator safety valves was considered. The maximum surge rate into the pressurizer during this transient was identified and a total safety valve capacity in excess of this value was chosen. As no reactor trip was assumed, the safety valves by - themselves provide adequate capacity to turn around the overpressure transient. Following selection of the safety valve size and quantity (three valves with a total rated capacity of 43.21 fta/sec are provided), the overpressure transients listed above were analyzed. These analyses confirmed that the overpressure protection afforded the RCS is in accordance with ASME Code requirements. Discussion of those transients and their results is provided in FSAR Chapter 15, i l l t l l l 1 Q440.12-2
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.13 (Section 5.2.2) You referenced WCAP-7769 for an evaluation of the functional design of the overpressure protection system and an analysis of the capability of the system to perform its function. Provide a comparison of Millstone parameters with all those parameters used in WCAP-7769 or otherwise show that the WCAP-7769 results are applicable to the Millstone design. Where differences exist, show that the differences will not affect the . conservatism of the results given in WCAP-7769.
Response
i The references to WCAP-7769 contained in FSAR Sections 5.2.2.2 and 15.2.3 provide the reader with an additional information source that discusses the generic methodology for sizing pressurizer safety valves. As discussed in FSAR Section 5.2.2.2, the WCAP results reflect ove rpressure analyses for a typical plant and are not to be construed as the analyses and results required to demonstrate Millstone compliance with ASME Code requirements. The overpressure protection analyses and report for Millstone 3 address those transients as identified in FSAR Section 5.2.2.1. Within these transients, the turbine trip event results in the maximum system pressure and the maximum safety valve relief requirements. Consequently, the turbine trip transient is discussed in both the overpressure protection report and FSAR Chapter 15. The Millstone parameters which affect the analysis are discussed in FSAR Sections 15.0.3 and 15.2.3. Comparsion of the Millstone parameters with those of similar plants is contained within FSAR Section 1.3. Q440.13-1
MNPS-3 FSAR NRC Letter: May 31, 1983 9 Question Q440.14 (Section 5.2.2) In Section 5.2.2.11.1 of the FSAR, you indicate that "an auctioneered system temperature is continuously converted to an allowable pressure and then compared to the actual RCS pressure. The system logic will first annunciate a main control board alarm whenever its measured pressure approaches within a predetermined amount of the allowable pressure, thereby indicating that a pressure transient is occurring. On further increase in measured pressure, an actuation signal is transmitted to the PORVs when required to mitigate the pressure transient." Our review of the low temperature overpressure protection design for certain other Westinghouse plants indicates that a failure in the temperature auctioneer fer one PORV (signaling it to remain closed) could also fail the other PORV closed (by denying. its permissive to open). Address this concern about a potential common mode failure in the low temperature overpressure protection system for Millstone.
Response
The response to this question will be submitted at a later date. 9 9 Q440.14-1 p 9 - , - , - , rg - - .
., - . , , - - - , . , n., -,.-. . . , , - , ~ . - , - -
MHPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.15 (Section 5.4.7) Recent plant experience has identified a potential problem regarding the loss of shutdown cooling during certain reactor coolant system maintenance evolutions. On a number of occasions when the reactor coolant system has been partially drained, improper reactor coolant system level control, a partial loss of reactor coolant inventory, or operating the RHR system at an inadequate NPSH has resulted in air binding of the RHR pumps with a subsequent loss of shutdown cooling. Regarding this potential problem, provide the following additional information:
- 1. Discuss the design or procedural provisions incorporated to maintain adequate reactor coolant system inventory, level control, and NPSH during all operations in which RHR cooling is required
- 2. Discuss the provisions incorporated to ensure the rapid restoration of the RHR system to service in the event that the RHR pumps become air bound
- 3. Discuss the provisions incorporated to provide alternate methods of shutdown cooling in the event of loss of RHR cooling during shutdown maintenance. These provisions should consider maintenance periods during which more than one cooling system may be unavailable such as loss of steam generators when the reactor coolant system has been partially drained for steam generator inspection or maintenance.
Response
The response to this question will be submitted at a later date. Q440.15-1
._ -. _ . - - - _ . . ~ ~ _ _ _ .. - . - - . . . - . = - . . - . . ~. . _ _ _ -
MNPS-3 FSAR NRC Letter: May 31, 1983 J Question Q440.16 (Section 5.4.7) You state in Section 5.4.7.1 of the FSAR that the RHR design heat load is based on the decay heat fraction that exists at 20 hours following reactor shutdown from an extended run at full power. In Section 5.4.7.2.2 you ir.dicate however, that the heat exchanger design is based on heat load and temperature differences between
; reactor coolant and component cooling water existing 24 hours after reactor shutdown when the temperature difference between the two
, systems is small. Clarify the discrepancy between these statements.
Response
Refer to revised FSAR Section 5.4.7.1 for the response to this , question. t ( i i Q440.16-1
__ . _ _ _ _ _ . . _ _ _ _ . . _ _ _ _ . . _ . . _ _ _ _ _ _ _ _ _ . ~ ~ . - ~._. . _ _ - _ _ - . _ - _ . . . __ _ I MNPS-3 FSAR ( NRC Letter: May 31, 1983 Question Q440.17 (Section 5.4.7) , l 4
, You state in Section 5.4.7.1 of the FSAR that two of the motor-
- operated valves on the RHR suction side are interlocked and will
- automatically close if RCS pressure exceeds 750 psig. This is not consistent with Section 7.6.2.1 which indicates the valves will close if the RCS pressure increases to above 700 psig. Resolve this i discrepancy. .
l
Response
The response to this question will be submitted at a later date. 5 t l i t i e I-- i l 1 Q440.17-1
~ , . - . - - .-_s,
-r*me'-+w-----"--* =m-*---~ "*W we w-+-- y=n m-* * - , * - '
- UNPS-3 FSAR NRC Letter: Hay 31, 1983 Quection Q440.18 (Section 5.4.7)
A. You state in Sections 5.4.7.1 and 5.4.7.2.4 that each suction line to the Residual Heat Removal System (RHS) is equipped with a pressure relief valve sized to relieve the combined charging pumps flow of 900 gpm at a set pressure of 450 psig. This flow capacity appears to be less than the capacity indicated by the performance curve (Figure 6.3-4) for the charging pumps. Explain the discrepancy. B. Section 5.4.7.2.4 indicates that the pressure relief valve provided for each of the RHS discharge lines has a relief flow capacity of 900 gpm at a set pressure of 450 psig. An analysis has been conducted to confirm the capability of the RHS relief valve to prevent overpressurization in the RHS. Provide this analysis. C. Specifically identify the credible events that were examined and those noncredible events excluded from the analysis and the basis for the exclusion. Describe the postulated accident events and their consequences, including the discharge of the accumulators, and the combined flow of the safety injection pumps which exceeds the charging pump flow at lower pressures.
Response
A. The pump performance curve shown in FSAR Figure 6.3-4 depicts flow rates for differential head at the pump itself. The curve does not display the flow delivered to the RCS (and consequently, to the RHS). Consideration must be given to the piping resistance between the pump discharge and the RCS, with two charging pumps delivering through the same injection lines. l An example of the combined flow from two charging pumps is l provided in the notes to FSAR Figure 6.3-1. Locations 55 and 59 show the individual charging pump discharge flows. A combined flow rate of 838 gpm is shown for Mode A (RCS l pressure assumed to be 0 psig). At 450 psig, the combined flow of two charging pumps would, of necessity, be lower. l B. The analysis for overpressurization of the RHS considered both mass and energy input mechanisms. Mass input mechanisms derive from a mismatch in charging and letdown flow rates. For example, an inadvertent startup of a charging of safety injection pump will add mass to the system in excess of that for the previous letdown flow < established prior to the pump start. Sources for mass input include the charging and safety injection pumps and the accumulators. Q440.18-1 l i l
s MNPS-3 FSAR During shutdown operations, the operator is instructed to remove power to the safety injection pumps following lowe' ring of RCS pressure to below the SI actua* ion signal s s ' block pressure (approximately 1900 psig). Addit.;nally, the ' operator is instructed to restore power to, then close and _ remove power from the accumulator discharge valves , (approximately 1000 psig). Both of these actions are ' accomplished prior to the initial initiation of the RHS (below 425 psig) and preclude these mass input sources from ' becoming an overpressurization event initiator. The RHS overpressurization analysis did, however, consider inadvertent pump startup, i.e., the combined flowrate for ' two charging pumps or two safety injection pumps is less than that of one of the suction line relief valves (see above). .. An overpressurization transient resulting from inadvertent opening of an accumulator discharge valve wouac produce a peak RHS pressure less than the statem nomir.al ' design pressure (600 psig). 1 overpressurization transients due to energy' input h:ve aise been considered. Energy sources withjA the RCS &nd RHS include core decay heat, pump heat,s and steam generator retained heat. Core decay heat is included in all cases with significance given to a RCS overpressurization transient occurring due to loss- of the RHS (see FSAR Section 5.2.2). Pump heat (reactor coolant pumps or RHS pumps) is a continuous, gradual addition to the fluid and can be readily controlled by the operator. An overpressurization event may , occur zhould an inactive reactor coolant pump be started while a significant temperature mismatch existed be: ween a hot steam generator and the bulk of the fluid in the coreland other loops. To preclude such an occurrence, Technical Specifications require the operator not to start up an inactive reactor coolant pump >hould a temperature differential in excess of 50*F exist. C. The credible events that have been examined are discussed above'. The combined flow of the safety injection pumps is approximately the same as the combined flow of the charging pumps, et low pressure. The example discussed in Section A above for the charging pumps may be applied to the safety injection pumps, i.e., the notes to FSAR Figure 6.3-1 show that the two safety injection pumps would provide approximately 796 gpm (location 17) with the RCS depressurized. Q440.18-2
. MMPS-3 FSAR URC Letter: May 31, 1983 Question Q440.19 (Section 5.4.7)
Section 5.4.7.2.4 states that each discharge line from the RHS to the RCS is equipped with a pressure relief valve designed to relieve the maximum back leakage of 20 gpm. through the valves isolating the RHS from the RCS, at a sat pressure of 600 psig. Provide the basis for determining the maximum possible back leakage. Also, show that there
' y~ are design provisions to pennit periodic testing for leak tightness of .the check valves that isolate the discharge side of the RHS from the hCS.
s
Response
1 Technical Specifications place maximum limits on RCS leakage. The
, relief valve design basis is double that of the maximum permitted RCS
' identified leakage.
The check valves on the discharge side of the RHS form part of the Icw pressure safety injection system. Test valves and piping are
- shown on FSAR Figure 5.4-5, Sheet 1 (hot leg injection) and FSAR Figure 5.4-5, Sheet 2 (cold leg injection) and discussed in FSAR Section 6.3.4.2.
h
\
l 7 Q440.19-1
MNPS-3 FSAR NRC Letter: May 31, 1983 1 . Question Q440.20 (S9ction 5.4.7) Section 5.4.7.2.4 indicates that the pressure relief valve provided for each of the RHS discharge lines is located in the ECCS, and references Figure 6.3-1 for the valve location. Figure 6.3-1 does not show the location of this valve. Where is the valve located?-
Response
The RHS discharge line relief valves (8842, 8856A, and 8856B) are shown on FSAR Figure 5.4-5, Sheet 1. Refer to revised FSAR Section 5.4.7.2.4. I i l l. I i I' - t l Q440.20-1 l .
- _ _ _,m,,_ . . _ . .
,, , , , ~ . , _ . . - . . . . . _ - ,-,-,,,,.....m , , . _ , . . - , . -
MNPS-3 FSAR NRC Lettere May 31, 1983 Question Q440.21 (Section 5.4.7) In the event the RHS relief valves open, describe the means available to alert the operator of the situation. What procedures are available to the operator for responding to this event?
Response
Refer to FSAR Figure 5.4-5 (Sheet 1) and FSAR Sections 5.4.7.2.4, 5.4.11.4, and 9.3.3.5.3. The relief valves on the suction lines to the RHS pumps (RV 37A,B and RV 8708A,B) discharge to the pressurizer relief tank. Should one (or more) of these valves open, the operator would be alerted by either a pressurizer relief tank high pressure alarm or high level alarm. The relief valves on the discharge lines from the RHS pumps (RV 8856A,B) discharge to the primary drains transfer tank. Should one (or both) of these valves open, the operator would be alerted by a primary drains transfer tank high level alarm. (This tank is also provided with a high-high level alarm.) Operator response to these alarms would be to ascertain the source and validity of the indication of tank inleakage, i.e. an inadvertent valve opening may be treated differently than a valid overpressure event. Should a valve inadvertently open, the operator would isolate the affected RHS train and continue the cooldown with the nonaffected RMS train. Rerponse to an overpressure event would be to determine the source of the overpressurization (i.e., inadvertent pump startup or accumulator valve opening) and sdasequent termination of the event. Pump discharge relief. valve cpening (RV 8856A,B) may occur during startup or while at power. Such opening indicates check valve leakage and falls within limiting corditions for operation. Q440.21-1
,- -- e r ,--.,g,. e -.m- , - - - -
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.22 (Section 5.4.7) Describe the design basis for the RHS isolation valves and the tests performed to demonstrate that they will operate properly for the postulated pressure transients and environments. Responsa: ,
; Design parameters for.the RHS isolation valves are.as follows:
MV 8701A.C MV 8701B MV 8702B,C MV 8702A Design Temperature 620*F 400*
; Pressure 2,580 psig 600 psig Stroke Time 14.6 seconds 11.0 seconds (open & Close) (open & Close)
Discussion of tests performed to demonstrate proper operation is provided in FSAR Table 14.2-1, Item 10 (pre-operational) and FSAR Section 3.9B.3.2.2 (operability program) . T Q440.22-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.23 (Section 5.4.7) RHS suction lines can have water trapped between the two isolation valves. Address the need to provide overpressure protection for the section of piping between these two valves in the event the trapped water expands due to local temperature increases.
Response
Relief valves are used to provide overpressure protection for closed sections of piping between RHS suction line valves. See valves 37A,B and 8708A,B shown on FSAR Figure 5.4-5, Sheet 1. ] ~ Q440.23-1
r MHPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.24 (Section 5.4.7) In accordance to Branch Technical Position RSB '5-1, the system (s) shall be capable of bringing the reactor- to a cold shutdown condition with only offsite or onsite power available within a reasonable period of time following shutdown, assuming the most limiting single failure. A reasonable period of time is considered to be 36 hours. Identify the most limiting single failure and provide the basis for selection of this failure. Provide an analysis to show that the reactor can be brought to the RHS entry conditions within 36 hours. Identify and justify the assumptions used in the analysis. Also identify the non-safety related systems for which credit is taken and the basis for use of these systems. Provide a sequence of events and actions and their time of occurrence.
Response
The response to this question will be submitted at a later date. I l Q440.24-1
MNPS-3 FSAR i NRC Letter: May 31, 1983 4 Question Q440.25 (Section 5.4.7.2.1) Section 5.4.7.2.1 refers to Figure 5.4-6. The notes for this figure appear to be incomplete in that the data for the process flow conditions are. not presented. Provide the process flow condition data.
Response
Refer to the response to Acceptance Review Question 440.3. i t d i 4 ? l. l l l r l r b, ., I i
.Q440.25-1 l
1
-.,,-r-,. 7 - ~ ,,.,.,..w,,-g,- .....n., s.---,.,n ...g ,....,vpc,,4n,,,., ,,,,,,.y e v.,. ,y.. . . , ..n,_, ,, .,-n, ., . , , ,g.,,, .,v,.,-,, ,+my, --e-- ,,,
i- HNPS-3 FSAR i NRC Letter: May 31, 1983
- Question Q440.26 (Section 6.3) i You state that spurious movement of a motor operated valve due to the actuation of its positioning device coincident with a LOCA has been analyzed and found to be a very low probability event. Provide the analysis to demonstrate the Millstone design meets Branch Technical
- Position RSB 6-1.
Response
During the injection mode of ECCS operation, the charging, safety , injection, and residual heat removal pumps draw water from the RWST. The charging pumps have two valves in parallel in their suction line from the RWST (LCV-112D and E) and are not susceptible to a single active failure loss of suction. The safety injection pumps suction line has a single valve (8806) and
. thus are susceptible to loss of suction should this valve spuriously close (or be in a closed position ~ due to operator action). As discussed in FSAR Section 6.3.2.2.7, to comply with BTP EICSB-18,
. power lockout will be provided for this valve. As this valve does not have to automatically operate during the injection phase, the power lockout provision also complies with BTP RSB 6-1.
Downstream of valve- 8806, each . safety injection pump utilizes a single motor operated valve . in - its suction line (8923A and B). Should one of these valves spuriously close, a single safety i injection pump would be; lost. This ' case falls within the ECCS. minimum safeguards case where a loss of diesel train (non-startup of a diesel generator) is considered the ~ single active failure (ANSI /ANS-58.9-1981, Section 2 Single Failure Criteria for Light
. Water Reactor Safety-Related Fluid Systems).
The ' residual heat removal pumps utilize a valve arrangement similar to the safety injection pumps wherein.a' single motor operated valve is utilized on each pump's suction line from the RWST. Like-the safety injection pump case, loss of a residual heat removal pump dae - to spurious closure of its suction valve (6312A or B) would fall within thc' ECCS minimum safeguards case. The four containment recirculation pump design precludes ~1oss of l ~ minimum required. recirculation cooling due to spurious mispositioning of a single pump suction isolation valve. + J Q440.26-1 1 i-l+, , , n -, -. . .. :- , , , . , - . . . . , , , m... ,.,._,,-.,.,-4,,,,,, ,,.-..,-:,,,,...n,+_n,-,- ,-- -,-,,,,, , -- . . - , , - . ~ ,
MNPS-3 TSAR NRC Letter: May 31, 1983 Question Q440.28 (Section 6.3) Certain automatic safety injection systems are' blocked to preclude unwanted actuation of' these systems during normal shutdown and startup conditions. Describe the alarms available to alert the operator to a failure in the primary or secondary system during this phase of operation, operator actions and time frame available for the operator to mitigate that such an accident, and the consequences of the accident.
Response
The response to this question will be submitted at a later date. 1 l' r Q440.28-1
NNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.29 (Section 6.3) Provide a detailed design drawing of the containment recirculation sump. Discuss any anti-vortex criteria which were used in the sump design. Describe the -containment water level instrumentation, its availability following a LOCA, and its capability for measuring the containment flood level. What is the maximum possible flood level and the basis for this level? What is the seismic category and
. quality class of the sump structure? Frovide.a detailed drawing indicating all the ECCS valves, their elevation inside containment and demonstrate that the safety function of these valves will not be compromised under the LOCA environment.
Response
Vortex suppressors have been placed in the containment recirculation sump above the intake of the recirculation pumps as described in FSAR Section 6.2.2.2. Containment flood level is monitored by two redundant differential pressure level elements. These elements measure the level through sixty foot long oil filled capillaries, and have a measurement range of 180 inches. Thus their range will cover elevations (-)24 feet-6-inches to (-)9 feet-6 inches. The transmitters can not be submerged because they are located seven feet above flood level and will be qualified in accordance with the Environmental Equipment Qualification Program' described in FSAR Section 3.11. The maximum flood level is at elevation (-)10 feet-8 inches, as listed in Appendix 3B of FSAR Section 3.11, and is based on the combined volumes of the RWST, the four accumulators, the entire reactor coolant system, the chemical addition tank, and the pressurizer. The sump structure is Seismic Category I, QA Category I, and Safety Class 2. The only ECCS valves which may have their operators submerged are the accumulator isolation valves. These valves are not required to
- function during power operation or in the post-accident environment as described in FSAR Section 6.3.2.2.5. All other ECCS safety related valves are qualified for the LOCA environment.
Q440.29-1
ItlPS-3 FSAR NRC Letter: May 31, 19bs _ Question Q440.31 When . operator action is required to complete the switchover to the recirculation mode, SRP Section 6.3 states that a time greater than , 20 minutes should be available for the operator to respond. What is the minimum time from initiation of a LOCA to the start of switchover to the recirculation mode for Millstone? Response: . The response to this question will be submitted at a later date. T S
.Q440.31-1 m.r.,,,_,- y. , -+-
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.32 (Section 6.3) You state in Section 6.3.2.8 that the low-low RWST level signal is also alarmed to inform the operator to initiate the manual action I required to realign the charging, safety injection, and containment recirculation pumps for the recirculation mode. What is the minimum time available for completion of switchover before the RWST water is exhausted? Provide your basis fo- this minimum time. Provide the detailed actions for switchover including actions to restore power to . valves and an evaluation of the maximum time required for each operator action in switchover to recirculation. Identify the most restrictive single failure and its impact on the time required for switchover. What are the consequences of premature operator switchover to recirculation? Also discuss the consequences of the operator failing to act promptly within the minimum available time for switchover.
Response
The response to this question will be submitted at a later date. f I l l l l Q440.32-1 4 i
. - . . . . - . , . . . _ . _ .- - - . . , , . - _ , , . - . - - - , , _ - . , , . . - - , y -.- -
HNPS-3 FSAR 4 NRC Letter: May 31, 1983 4 Question Q440.33 (Section 6.3) Describe your plans and program for maintaining the ECCS lines in a filled condition to prevent water hammer. How have the effects of water hammer been considered in the design of the ECCS?
Response
Except for containment ~ recirculation, which is normally drained, proper initial fill and venting of the ECCS ensures that water hammer i will not occur in ECCS lines. In addition, the head of water provided by the RWST further ensures the lines will remain full and water hamme'r concerns will not develop. High point vents in the ECCS lines are provided to ensure means for proper venting of lines and pumps. Fill and venting procedures for the ECCS ensure removal of air frcm the system to prevent the possibility of a water hammer if injection flow is initiated. The effects of water hammer have been considered in the design of the . ECCS components as discussed in FSAR Section 3.9B.3.1.2 and listed on FSAR Tables 3.9B-11 and 3.9B-12 (1 tem H). J l i l l I Q440.33-1
--.-n , ,, y .,--,s. w,, ,.e . - - y, ,.v--va y - g. 4m.,p., , _ _ _ . , .-- y . , - - y , ,. ,-
MEPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.34 (Section 6.3) What are the initiation and completion times of actions of the ECCS components that were used in the Chapter 15 analysis with and without offsite power? What are the bases for these times and will they all 4 - be verified during preoperational testing?
Response
The response to this question will be submitted at a later date. i i i Q440.34-1
- + - - - , m , , , . - , .e-.~ - m. --. ,. -e-- - -, - - , -es-,-----,,-w--,.ar e- , yv- y--- - . --, -- - , e -- w<
, MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.35 (Sectica 6.3) Clarify whether the volume cont.ol tank level control system is classified as safety related. Confirm .that your plant procedures instruct the operator to take appropriate action to assure adequate water supply to the charging pump in the event of a volume control tank level control system failure.
Response
The volume control tank level control system, which is part of the CHS system, is not classified as safety related. Plant procedures will instruct the operator to take appropriate. action to assure adequate water supply to the charging pump in the event of a volume control tank level control system failure. I L Q440.35-1
MNFS-3 FSAR NRC Letter: May 31. 1983 Question Q440.36 (Section 6.3) Recently, a similar plant has indicated that a design error existed in the sizing of their RWST. This error was discovered during a design- review of the net positive suction head requirements for the containment spray and residual heat removal pumps. The review showed that there did not appear to be sufficient water in the RWST to complete the transfer of pump suction from the tank to the containment sump before the tank was drained and ECCS pump damage occurrred. It was reported that in addition to the water volume required for injection following a LOCA, an additional volume of water is required in the RWST to account for:
- 1. Instrument error in RWST level measurements
- 2. Working allowance to assure that normal tank level is sufficiently above the minimum allowable level to assure satisfaction of Technical Specifications
- 3. Transfer allowance so that sufficient water volume is available to supply safety pumps during the time needed to complete the transfer process from injection to recirculation
- 4. Single failure of the ECCS system which would result in larger volumes of water being needed for the transfer process. In this situation, the worst single failure appears to be failure of a single ECCS train to realign to the containment sump upon low RWST signal. This results in the continuation of large RWST outflows and reduces the time available for manual recirculation switchover before the tank is drawn dry and the operating ECCS pumps are damaged.
Additionally, some amount of water above the suction pipes may also be unusable due to UPSH considerations and vortexing tendencies within the tank. Preliminary indications are that approximately an additional 100,000 gallons of RWST capacity were needed to account for these considerations. In light of the above information, discuss the adequacy of your refueling water storage tank design. Provide a discussion of the
.necessary water volumes to accommodate each of the considerations indicated above. Justify your choice of volumes necessary to account for each consideration of tank suction lines, and level sensors.
Q440.36-1
IEPS-3 FSAR
Response
The response to this question will be submitted at a later date. l l i Q440.36-2
l MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.37 (Section 6.3) Figure 6.3-1 did not show the flow rate for the containment spray pump. Provide the flow rate for this path. Justify tt.a t with the inclusion of this flow rate it will not affect (a) the RWST size, (b) the minimum usable volume remaining in the RWST at initiation of switchover to the cold leg recirculation, and (c) the available NPSH to the ECCS pumps.
Response
The maximum flow for the quench spray system is approximately 6000 gpm. The actual flow varies with the number of pumps operating, the containment pressure, and the height of the water in the RWST. Section 6.2.2 describes the operation of the quench spray system. Refer to the response to NRC Question 440.36 for a discussion of the RWST volumes, .and the response to NRC Question 440.30 for i discussion of available NPSH to the ECCS pumps. Q440.37-1 i
MNPS-3 TSAR NRC Letter: May 31, 1983 Question Q440.38 (Section 6.3) Provide the design parameters for all types of valves used in the ECCS. Indicate where these valves are located and demcnstrate each valve's ability to perform its safety function under the accident environment.
Response
Refer to revised -FSAR Section 6.3.2.2.5 for the response to this question. l l 4 Q440.38-1
h MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.39 (Section 6.3) Provide a list of all valves which might have their motors (drivers) or controls flooded following a LOCA, feedwater line break or steam
.line break. If any are flooded, evaluate the consequences of this flooding for both short and long term ECCS functions. List all control room instrumentation loss following these accidents and evaluate the consequences of failures and malfunctions of flooded instrumentation.
Response
The only ECCS valves which may have their motor operators submerged following a LOCA, feedwater line break, or steam line break are the accumulator isolation valves. These valves are not required to operate during power operation or in the post-accident environment as described in FSAR Section 6.3.2.2.6. No short or long term ECCS functions are lost as a result of flooded instrumentation. Refer to Table Q440.39-1 for a list of all instrumentation flooded. I i I Q440.39-1
l MNPS-3 FSAR TABLE Q440.39-1 CONTAINMENT INSTRUMENTS THAT WILL BE FLOODED UNDER LOCA Flooded Control Room Consequences of Instrument Instruments Lost Failure / Malfunction 3RCS-FIS447 None Loss of low flow annunciator on RTD Bypass Loop Main Board 4 4 Flow 3RCS-PT469 3RCS-PI469 Loss of automatic control of , Pressurizer Relief 3RCS-PCV469, high pressure Tank Pressure annunciator on Main Board 4, and computer impact point 3RCS-LT470 3RCS-LI470 Loss of Low, High and High-High Pressurizer Relief level annunciator on Main Board Tank Level 4 computer input point, and automatic control of 3DGS-AV8031 3CHS-PT150 3CHS-PI150A Loss of low pressure annunci-RCP ID #1 ator et Main Board 3 Seal Dif-1 ferential 1 3CHS-FIS194 None Loss of high flow annunciator RCP 1A Seal on Main Board 4 Leakoff 3DAS-LT22 None Loss of analog computer input, i Containment loss of indicator an High-High Drains Sump level annunciator on LW panel No. 3 Level 1 l 3DAS-LT39 None Loss of automatic control of l Unidentified 3DAS-P10, analog computer in-Leakage Sump put, an excessive pump running / l No. 2 Level cycling annunciator on Main Board 1, and level indication on LW panel ! 3DAS-LT42 None Loss of automatic control of Containment the containment drains iso-Drains Sump No. 3 lation valve and the contain-Level ment drains sump pumps. Note: As a result of the pos-tulated events the iso-lation valves will be-shut and will not allow the pumps to run 1 of 1
. ... -- - , - - - - - , , _ - - , . - , _ - - - . - , . . . - ~ . . . . , - -. - - - - . - -
I MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.40 (Section 6.3) Recent plant experience has identified a potential problem regarding ! the long-term reliability of some pumps used for long-term core ! cooling following a LOCA. For all pumps that are required to operate l to provide long-term core cooling, provide justificatien that the l pumps are capable of operating for the required period of time, This justification could be based on previous testing or on previous operational experience of identical pumps. Differences between expected post-LOCA conditions and the conditions during previous testing or operational experience cited should be justified (for example, water temperature, debris, and water chemistry).
Response
The pumps required for long term core cooling are the containment recirculation pumps and the service water pumps (to provide cooling water to the containment recirculation coolers). FSAR Section 3.9B.3.2 discusses the operability assurance programs for these pumps. These pumps are seismically qualified by a combination of analysis and test which includes structural and operability analysis. Each pump is tested in the vendor's shop to verify hydraulic and mechanical performance. Performance is again checked at the plant site during preoperational system checks and monthly per ASME Section XI. Pump design is specified, with particular consideration given to shaft critical speed, bearing, and seal design. These pumps are bought to QA Category I requirements and the motors and electrical components are qualified to IEEE-323 1974 to operate . in post-LOCA environmental conditions. The reliability program extends to the procurement of the ECCS components so that only designs which have been proven by past use in similar applications are acceptable for use (FSAR Sections 6.3.2.2 and 6.3.2.5). Reliability tests and inspections (see FSAR Sections 6.2.2.4 and 6.3.4.2) further confirm their long-term operability. Q440.40-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.41 (Section 6.3) Provide' a discussion on excessive boron concentration in the reactor
. vessel and hot leg recirculation flushing related to long-term cooling following a LOCA. During hot leg injection, what will be the minimum expected flow rate in the hot leg, and what is the required flow rate.to match boil-off?
The staff position concerning boron dilution is as follows:
- 1. The boron dilution function shall not be vulnerable to a single active or limited passive failure (i.e., leakages of seals). Specifically, the limiting single active failure should be considered during the short-term period of cooling. During the long-term period of cooling, the limiting single active failure should be considered and so should a limited passive failure be~ considered, but not necessarily in conjunction with each other
- 2. The inadvertent operation of any motor-operated valve (open or closed) shall not compromise the boron dilution function, nor shall it jeopardize the ability to remove decay heat from the primary system
- 3. All ' components of the system which are within containment shall be designed to Seismic Category I requirements and classified Quality Group B
- 4. The . primary mode for maintaining acceptable levels of boron in th- vessel should be established. Should a single
. failure disable the primary mode, certain manual actions outside the control room may be allowed, depending on the i nature of the action and the time available to establish the backup mode
- 5. -The average boric acid concentration in any region of the reactor vessel should not exceed a level of four. weight percent below the solubility limits at the temperature of.
the solution I l 6. During the' post-LOCA long-term cooling, the ECCS normally
- operates in two modesi the initial cold leg injection mode,
~
followed by the dilution mode. The actual operating time in the cold leg injection mode will depend on plant design and steam binding considerations; but in general, the esitchover to the dilution mode should be made between 12 and 24 hours 2 after LOCA
- 7. The minimum ECCS flow rate delivered to the vessel during the dilution mode shall be sufficient to ' accommodate the boil-off due to fission product decay heat and possible i
'Q440.41-1
MNPS-3 FSAR liquid entrainment in the steam discharged to the containment and still provide sufficient liquid flow through the core to prevent further increases in boric acid concentration
- 8. All dilution modes shall maintain testability comparable to other ECCS modes of operation (HPI-short term, LPI-short term, etc). The current criteria for levels of ECCS testability shall be used as guidelines (i.e., Regulatory Guide 1.68, 1.79, GDC 37)
Discuss your conformance to this. position. Responses e The response to this question will be submitted at a later date. 4 L l Q440.41-2
MNPS-3 FSAR NRC Letter: May 31, 1983 i Question Q440.43 (Sections 6.3.3.3 and 15.6.5.1) Section 6.3.3.3 of the FSAR defines a small break LOCA as a break up to 0.5 fta in area and a large break LOCA as larger than 0.5 ft2, Section 15.6.5.1 defines a large break as greater than 1.0 fta and a small break as less than 1 ft2 Resolve the discrepancy. ,
Response
1 Refer to the response to Acceptance Review Question 440.6. i
=.
4 L Q440.43-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.44 (Section 15) Provide a confirmation, with bases, that all transient and accident events would not exceed the associated acceptance criteria when credit is not taken for non-safety related systems and equipment. Systems and components are classified as safety related if they are necessary to assurer
- 1. The integrity of the reactor coolant pressure boundary
- 2. The capability to shut down the reactor and maintain it in a safe shutdown condition
- 3. The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures comparable to the guideline exposures of 10CFR Part 100
-Response:
The transient analyses presented in FSAR Chapter 15 only assume non-safety grade systems and equipment are operable in the following situations:
- 1. If the operation of the system would cause the transient to be more severe. If there is doubt about the system's effect, the transient is analyzed and presented with and without the system available.
- 2. When a loss of a non-safety grade system initiates a transient by itself, it is not superimposed upon other transients unless there is a credible reason that one would cause the other.
Thus, the following non-safety grade systems and equipment are i assumed operable in some analyses presented in FSAR Chapter 15. I
- 1. Automatic rod control
- 2. Pressurizer pressure control (power-operated relief valves and spray)
- 3. Main feedwater system i
Q440.44-1
t MNPS-3 FSAR
- 1. Automatic Rod Control The automatic rod control system is assumed to be operable in the following transient analyses:
15.1.3 Excessive increase in secondary steam flow 15.6.1 Inadvertent opening of a pressurizer safety or relief valve Analyses of the excessive increase in secondary steam flow transient are done with and without automatic rod control and are presented in FSAR Section 15.1.3. Both cases meet acceptance criteria. For 'the inedvertent opening of a pressurizer safety or relief valve transient, it is conservative to assume the automatic rod control system is operable. During this transient, RCS pressure will be decreasing. Decrersing RCS pressure will cause the reactor power to decrease due to moderator density feedback. If the automatic rod control system is operable, it will function to maintain power and average coolant temperature, thus causing a more severe transient.
- 2. Pressurizer Pressure Control (Power-operated Relief Valves and Spray)
The pressurizer pressure centrol system is assumed to be . operable in the following transients: 15.2.3 Turbine Trip 15.4.2 Uncontrolled rod cluster control assembly bank withdrawal at power Analysis of the turbine trip event with and without pressurizer pressure control is presented in FSAR Section 15.2.3. Both cases met acceptance criteria. For the rod bank withdrawal transient, it is conservative to assume pressurizer pressure control. is operable. The limiting criteria for this transient is the DNB ratio. Maintaining RCS pressure low will result in lower DNB ratios.
- 3. Main Feedwater Control System The main feedwater control system is assumed to function during the following transient analyces':
4 15.1.3 Excessive increase in secondary steam flow 15.1.5 Steam system piping failure Q440.44-2
MNPS-3 FSAR 15.4.2 Uncontrolled rod cluster control assembly bank withdrawal at power 15.4.4 Startup of an inactive loop 15.5.1 Inadvertent operation of emergency core cooling system during power operation 15.6.1 Inadvertent opening of a pressurizer safety or relief valve Loss of main feedwater . flow is a Condition II occurrence by itself and is analyzed in FSAR Section 15.2.7. There is no credible reason for any of the condition II events listed above to cause a loss of feedwater flow. Therefore, a loss of feedwater is not considered coincidently with those occurrences listed above which are Condition II. For the steamline break transient, it is conservative to assume main feedwater is available. This maximizes the amount of steam generator inventory available to be blown down and prolongs the transient. The steam generator tube rupture analysis takes credit for the pressurizer PORVs and the steam generator PORVs. The large and small break LOCA analyses performed in FSAR Chapter 15 presently do not take credit for non-safety grade systems or equipment. The LCCA analyses performed assume the limiting single failure and take credit for operation of safety grade equipment only. Q440.44-3 l l l
. - ~ - - .
MNPS-3 FSAR a d NRC Letter: May 31, 1983 Question Q440.45 (Section 15.1.4) Section 15.1.4.1 states that assuming a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the engineered safety features system there will be no return to criticality after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any safety valve. However, Figure 15.1-12 contradicts the statement. The discrepancy should be resolved. ,
Response
Refer to revised FSAR Sections 15.1.4.1 and 15.1.4.2 for the response to this question. 4 1 J Q440.45-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.46 (Section 15.1.5) You indicate in Table 15.1-2 that in the event of a rupture of a main steam line, the Auxiliary Feedwater System (AFWS), including pumps, water supply, system valves, and piping must be available to supply water to the operable steam generators no later than 10 minutes after the incident. Since the AFWS starts on low-low SG water level or SIS signal, discuss the consequences of additional cooldown caused by early introduction of AFW or the failure of the operator to isolate the AFW to the faulty steam generator.
Response
The response to this question will be submitted at a later date. i , Q440.46-1 1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.47 (Section 15.2.8) You state that Figures 15.2-11 and 1_.2-19 show that following-i reactor trip, the plant remains suberitical. It appears that the l statement is only applicable to Figure 15.2-19, while Figure 15.2-11 apparently contradicts the statement. This discrepancy should be resolved.
- Response
Refer to revised FSAR Section 15.2.8.2 for the response to this question. a 4 a 1 1 Q440.47-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.48 (Section 15.2.8) Figure 15.2-13 indicates that the feedline flow fraction is approximately 26 percent of nominal between the time span of 1 to 10 seconds. The flow then drops sharply down to -160 percent of nominal and abruptly jumps back to approximately. -90 percent of nominal. Explain the behavior of this curve.
Response
FSAR Figure 15.2-13 . illustrates the feedline flow between the rupture and the faulted steam generator during a feedline rupture. As indicated in FSAR Table 15.2-1, the feedline rupture occurs after 10 seconds of steady state conditons. Thus up to this time, each steam generator receives 25 percent of the total feedline flow. At the time of the rupture, all main feedwater flow is assumed to spill out the break. Negative flow fractions indicate flow from the faulted steam generator out the break. The variation after the feedline break is dependent on the break discharge quality. As noted in Assumption 8 listed in FSAR Section 15.2.8.2, A conservative feedline break discharge quality. is assumed prior to the time the reactor trip occurs, thereby maximizing the time the trip setpoint is re;ched. After the trip occurs, a saturated liquid discharge is assumed until all the water inventory is discharged from the affected steam generator. This minimizes the heat removal capability of the affected steam generator. I Q440.48-1 ( l
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.49 (Section 15.2.8) J What operator actions, if any, are assumed in your analysis of the feedwater system pipe break? If operator actions are assumed, show i that sufficient time is available for completion of these actions.
Response
~
The response to this question will be submitted at a later date. l l ? l I. l ( ( l Q440.49-1 l I
MMPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.50 (Section 15.3.3) In the reactor coolant pump shaft seizure analysis it is not clear whether a loss of offsite power coincident with the accident has been assumed. The SRP requires that this event should be analyzed assuming turbine trip and coincident loss of offsite power and coastdown of undamaged pumps. Appropriate delay times may be assumed for loss of offsite power if suitably justified. The event should also be analyzed assuming the worst single failure of a safety related active component. Maximum Technical Specification primary system activity and steam generator tube leakage at the rate specified in the Technical Specification should be assumed. Describe how your analysis has considered these assumptions.
Response
The response to this question will be submitted at a later date. [ l l. l l l l Q440.50-1 i
, ,,-n---, - . - , , . - - . - , - - - . . . ~ , ,,
i MNFS-3 FSAR NRC Letter: May 31, 1983 Question Q440.51 (Section 15.3.3) Figure 15.3-9 indicates that the faulted loop drops below the
-40 percent of nominal in approximately 2 saconds. Explain the negative flow phenomenon.
t
Response
The . negative flow phenomenon is reverse flow through the RCP which i occurs after the rotor locks and is caused by the positive cold leg to hot leg AP from the operating loops. i 4 l l l n l 3 2 h i Q440.51-1 f J
,.y- , -
g.- ---w -- - ,-,-n .-p-.,,.n-. ,,,,nn,n. ,-_,n ,-,,-,,-+v--.,
. , ,r,, , - . . , , - - . , , .n.rx,,,,. w-,,
Pii4PS-3 FSAR 3 NRC Letter: May 31, 1983 Question Q440.52 (Section 15.3.2) For the complete loss of forced reactor coolant flow analysis you , indicate that Figure 15.3-12 shows the DNBR to be always greater than 1.30. Figure 15.3-12 in the FSAR shows the clad inner temperature versus time only. Resolve this discrepancy.
Response
Refer to revised FSAR Section 15.3.2.2 for the response to this question. 4 i t 5 i + s 9 4 {. l i f a Q440.52-1 m r-ws-e--- gmm+--.y--w--ev,g - - +---= e ir - - -- --e+-y w e- g p m-w -
-w.-- 9,,,--.my--v-- p..,-yv- = - - ---- w-ew>-i
1 MNPS-3 FSAR NRC Letter: May 31, 1983 1 Question Q440.54 (Section 15.3.3) Provide a figure showing DNBR versus time for the locked rotor accident.
Response
The ~.ocked rotor accident is a condition IV event and is not limited by DNB. Therefore, a figure of DNBR versus time is not appropriate. e f i 1 4 d Q440.54-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.55 (Section 15.4.4) Reference or describe the analytical model used to obtain the results in Section 15.4.4.2. Discuss the degree of conservatism incorporated in your analysis.
Response
The response to this question will be submitted at a later date. t l I i 1 Q440.55-1 l I l
~- - - . _ - . _ _ . _ . ,,_...,,,._ - _ _.____ _ ., , . , . , . . _ . ,- . , . - - , - _ _ , . _ . , . . , _ - _ - , - . , . _ _ _ _ . _ _ _ , . . . , _ . . - , , , - . , , _ , . . . - - . .
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.58 >Section 15.6.3) In Figure 15.6-3A you indicate a primary pressure of approximately 2200 psia at 1800 s>conds after the steam generator tube failure while in Figure 15.6-3C you indicate a constant pressure of 1250 psia within the faulted steem generator between 250-1800 seconds, explain how you terminate the primary to secondary leakage with the existing . large pressure differential.
Response
Following a steam gen:rator tube rupture event, RCS pressure will equilibrate at a value alove the affected steam generator pressure where incoming safety f.njection ficw matches primary to secondary leakage. Break flow will continue until operator actions to cooldown and depressurize the RCS are completed. The required actions are described in FSAR Section 15.6.3.2 and include terminating safety injection. In the analysis of this event, these specific actions have not been explicitly m.sdelled since such actions would reduce the radiological releases. En the analyses for the Westinghouse Owners Group Emergency Response Guidelines the operator actions were demonstrated to be effective in terminating break flow following a SGTR. Q440.58-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.59 (Section 15.6.3) You state that with indications provided at the control board and the magnitude of the break flow, the accident diagnostics and isolation procedure can be completed within 30 minutes of initiation of the event. However, the recent steam generator tube rupture events at Ginna, Point Beach. and Prairie Island indicate a longer equalization time than 30 minutes. It is, therefore, our position that your analyses should assume a primary to secondary pressure equalization time substantiated by an evaluation of the operator actions necessary to effect pressure equalization and a conservative estimate of the amount of time necessary for each action, as well as an initial delay time. The event should also be analyzed by assuming a most limiting single failure following the accident. A stuck open atmospheric steam dump valve (ADV) may be the most limiting single failure associated with this accident. If another failure is found to be more limiting, we require the Applicant to substantiate that the case of a stuck open ADV on the damaged steam generator is less limiting.
Response
It is assumed that the operator actions to equilibrate primary and secondary pressures would be completed within a 30 minute period following initiation of the SGTR. Hence, no primary-to-secondary leakage occurs after the initial. 30 minutes. Since the recovery actions can be completed from within the control room, 30 minutes is considered adequate time to complete the recovery sequence. This is generally consistent with draft ANSI N660 recommendations for Class IV events. Furthermore, significant margin exists ( 30 minutes for the design basis event) before water would enter the steamline of the affected steam generator. Although additional time may be required to recover for smaller break sizes, break flow would be less and, hence, more time would be available. The single failure assumed in the analysis is the failure of an auxiliary feedwater pump. This results in an increase in the total , steam l produced and, thus, an increase in the radiological release. ! No failure in the SIS is assumed since maximum SI flow results in i increased break flow. Both centrifugal charging'and both HHSI pumps ! are assumed to operate for 30 minutes after the accident. Failure of ! a safety valve 'to close would be a passive failure, and passive failures are not required to be considered until after 24 hours
- following the initiation of the accident. No significant steam releases occur after the initial 8 hours following the accident. If
! any atmospheric relief valves stick open, there is a backup isolation valve which can be controlled to close the leak path. To have an uncontrolled release would require failure of both the relief valve and the backup isolation valve. Similarly, an alternative means of isolating the affected steam generator is available should any MSIV i fail. If the faulted steam generator MSIV failed to close, the ! control grade turbine stop and steam dump valves are assumed to Q440.59-1 L
MNPS-3 FSAR operate and provide isolation of the faulted steam generator. The turbine stop and steam dump valves are designed to fail close on loss of power. l l l l l l l l l { Q440.59-2 f-l l l
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.61 (Section 15.6.3) Clarify whether you have analyzed a case which considers the radiological effects of a SGTR with the highest worth control rod stuck out of the core, with equilibrium iodine concentration, including the effects of any additional fuel failure caused by this event. (
Reference:
SRP Section 15.6.3, Subsections II (1) and i (III.7).
Response
Refer to revised FSAR Section 15.6.3.3 for the response to this
- question.
i a 1 l i l I Q440.61-1 l _ _ . - _ . . ~ - ~ _ _ - - - . . . _ . - - , _ _ _ _ _ - . _ . - - .
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.63-(Section 15.6.5) The input parameters used in the ECCS analysis as indicated in Table 15.6-8 shows the total peaking factor (F ) assumes the value of 2.14, while Table 4.3-2 shows a peaking factor of 2.32 as a nuclear design parameter. Clarify the discrepancy and justify why the higher
. peaking factor of 2.32 should not be used for the ECCS analysis.
Discuss the effects of using a higher peaking factor in the ECCS analysis.
Response
The ECCS analysis presented in FSAR Section 15.6 is in the process of being updated. Upon completion of this analysis, the present discrepancy between peaking factors in Sections 15.6 and 4.3 will be resolved by revising and resubmitting the amended FSAR sections. i Q440.63-1
MNSP-3 FSAR NRC Letter: May 31, 1983 Question Q440.65 (Section 6.3) Westinghouse has indicated a potential problem associated with the volume control level instrumentation and level control system. In some designs a potential single failure could cause loss of suction and subsequent damage to all safety injection pumps. Provide a discussion of this potential problem for the Millstone design.
Response
The design of the control of the Millstone 3 charging pump suction is consistent with the generic design reported by Westinghouse in that there is adequate indication of the potential single failure and sufficient time for operator action. For the generic case reported by Westinghouse, refer to letter NS-TMA-2451, dated May 1981, from T.M. Anderson (W) to V. Stello (NRC). Q440.65-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.68 (Section 15) A change in the Westinghouse fuel rod internal pressure design criteria will permit the internal fuel rod pressure to exceed system pressure. For some events, this will result in an increase in the number of rods normally expected to fail. If the fuel design is based on this higher fuel red internal pressure design criteria, show that the effects of the higher fuel rod internal pressure have been properly factored into predictions of the effects of fuel rod ballooning and number of rod failures.
Response
The NRC staff has completed its review of the revised Westinghouse
- j. fuel rod internal pressure design criteria (WCAP-8963) and has decided on an acceptable amended criteria.
The internal pressure of the lead fuel rod in the reactor will be limited to a value below that could cause (1) the diametrical gap to increase due to outward cladding creep during steady-state operation and (2) extensive DNB propagation to occur. WCAP-8963, Safety Analysis for the Revised Fuel Internal Design Basis, was found to be acceptable to support the conclusion that an insignificant number of additional DNB events would occur during transients and accidents as a result of operating with fuel rod pressure (1) greater than nominal system pressure and (2) limited by the above criterion. For all Condition III and IV overpower events, the number of rods that are assumed to fail is less than 10 percent. Therefore, the analyses for Millstone 3 are bounded by the analysis presented in the WCAP. The results presented in the WCAP are based on the detailed probability analysis performed to determine the maximum extent of core damage that could lead to DUB propagation. It was shown that the propagation mechanism causes only a small incremental increase in the percentage of rods in DNS. In view of the conservative nature of the failure prcpagaticr. mechanism scheme and the small percentage > increase in the number of failed rods, the potential increase in site release in inconsequential. Although this effect, resulting from the revised fuel rod internal pressure design criterion, is small, it was factored into the number of rods predicted to fail. i Q440.68-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.70 (Section 15.6.5) Identify single failures and operator errors that would divert ECCS flow. For both large and small breaks discuss the effect of these failures on flow to the core, the containment water level and
, conformance with 10CFR50.46 acceptance criteria.
Response
Design basis single failures which could result in the diversion of flow is limited to inadvertent repositioning of valves. FSAR Section 6.3.2.2.7 identifies single failure of motor-operated valves that could result in degrading ECCS flow. Operator errors that would affect ECCS flow such as operator procedural omission error and operator control selection error have been analyzed in WCAP-9207. i 3 Q440.70-1 f
~-e - -
,-- -n - . - , - - ~ . . w.r4 -- -.. -- - , , -.- w,---,-e , , . ,
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q440.71 (Section 15.6.5) Provide an analysis of the transient resulting from a break in the ECCS injection line. Describe the flow splitting which will occur in the event of the most limiting single failure and verify that the amount of flow actually reaching the core is consistent with the assumptions used in the analysis. Show that 10CFR50.46 acceptance criteria are satisfied. l
Response
A break of an ECCS injection line represents a small break LCCA transient. The safety injection flow from the header to the broken loop would spill. to the containment and would not be available to make up inventory lost from the RCS through the break. The small break transients included in FSAR Chapter 15 in fact conservatively assume that the small LOCA is an injection line. The safety injection line of least resistance is assumed to break, and 100 percent of the SI flow to that line spills to the containment without entering the RCS. This assumption minimizes the SI flow that does enter the RCS from the other loops. The resistance of the non-broken loops are conservatively maximized to reduce SI flow. Broken loop accumulator flow is also assumed to completely spill to the containment, and does not enter the RCS. The pumped SI flow that enters the RCS with the single failure of loss of one train of SI is conservatively calculated assuming parallel resistance with one line spilling. Therefore, the small breaks in FSAR Chapter 15 do represent SI line breaks to conservatively minimize SI flow injected. If the LOCA in fact was not an injection line, additional SI would enter the RCS which would reduce the peak clad temperature. The FSAR Chapter 15 i analysis represents the most conservative scenario in terms of break location, which satisfies 10CFR50.46 acceptance criteria. l l l Q440.71-1 l l l
MNPS-3 FSAR NRC Letter May 31, 1983 Question Q450.3 (SRP Section 6.4) Provide data, assumptions and analyses which demonstrate the control room operators of all three units on the site are protected against the effects of the radiological releases originating at each of the three units. As a minimum include the following information:
- 1. The distances between the control room air intakes of each unit and the major release points, the containment surface and the stack of each unit
- 2. The diameter of the containment for each unit
- 3. For each unit, filtered make-up flow, filtered recirculation flow rates, unfiltered leakage rates, and assumed filter efficiencies of the control room emergency ventilation system in the radiation release accident mode
Response
The Unit 3 control room habitability evaluation will be provided in a future FSAR amendment. Radiological releases originating at each of the three units on site will be addressed. l~ Q450.3-1 1
!!MPS-3 FSAR NRC Letter: !!ay 31,1983 Question Q450.4 (SRP Section 15.6.2)
On FSAR Page 15.6-4 a minimum flashing fraction of 10 percent was assumed. However, a conservative or bounding approach would be to assume that there is no scram during this accident. The temperature of.the dumped primary coolant is the same as that of the primary system which results in a flashing fraction of about 40 percent (Standard Review Plan Section 15.6.2). Provide a justification for your assumption of 10 percent flashing fraction for the dumped primary coolant in your analysis of a small line break.
Response
The analysis of a small line break in FSAR Section 15.6.2 will be revised in 6 future amendment to reflect a 40 percent flhshing fraction. l' I Q450.4-1 l l
MNPS-3 FSAR . NRC Letter: May 31, 1983 Question Q492.1 (5RP Section 4.4) Provide the results of fuel assembly tests applicable to the Millstone 3 desig.1 to verify the values of the loss coefficients for the upper and lower end fittings and spacer grids.
Response
The results for 17x17 hydraulic. flow tests are documented in.the NRC approved topical report, Hydraulic Flow Test of the 17x17 Fuel Assembly, Demario, E. E., et al, WCAP-8278(P), WCAP-8279(NP), February 1974. . l l t l Q492.1-1 I l-i .
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q492.2 (SRP Section 4.4) State the method used for evaluating the effects of rod bow on DNB for application to the Westinghouse standard 17x17 fuel assembly. Prior to issuance of the Technical Specifications, the Applicant should present to the staff an acceptable method of accommodating the thermal margin reduction due to rod bow. Also, insert into the bases of the Technical Specifications any generic or plant specific. margins that will be used to offset the DNBR reduction due to rod bowing.
Response
The response to this question will be submitted at a later date. l l i t i l' r l ( Q492.2-1 r { l I
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q492.3 (SRP Section 4.4) The Standard Review Plan Section 4.4 Acceptance Criteria No. 3 states: The reactor should be demonstrated to have sufficient margin to be free of undamped oscillations and other thermal-hydraulic instabilities for all conditions of steady-state operation (including part loop operation), and for anticipated operational occurrences. . State your intentions with regard to N-1 loop operation. If you intend to operate under partial loop condition, provide core thermal-hydraulic analysis taking int < account the effect of partial loop operation on core inlet flow distribution and HDNBR. If you decide not to use the N-1 loop operation then state your position in
- the Technical Specification.
Response
The response to this question will be submitted at a later date. 1 . f 1 Q492.3-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q492.4 (SRP Section 4.4) pressurized water reactors indicate a operating experience on two in the core flow rate can occur over a significant reductionrelatively short period of time as a result of Specifications forcrud depositien on the In establishing the Technical fuel rods. require provisions to assure that the minimum Millstone 3, we will Therefore, provide a description of design flow rates are achieved. the flow measurement capability for Millstone 3 as well as a description of the procedure to measure flow.
Response
The response to this questions will be submitted at a later date. i I Q492.4-1 \ l - - - _ - - - - - - - ~ _ _ _
HNPS-3 FSAR NRC Letter: May 31, 1983 Question Q492.5 (SRP Section 4.4) Regulatory Guides 1.133, Fevision 1 and 1.70, Revision 3 require that FSAR Section 4.4.6 contains a description of the Loose Parts Monitoring System (LPMS) which will be installed at Millstone 3. The information that should be supplied is:
- 1. A " description of the monitoring equipment including sensor type and location, data acquisition, recording and calibration equipment
- 2. A description of how alert levels will. be determined, including sources of internal and external noise, diagnostic procedures used to confirm the presence of a loose part, and precautions to ensure acquisition of quality data
- 3. A description of the operation program, including signature analysis during startup, normal containment environment operation, the seismic design, and system sensitivity
- 4. A detailed discussion of the operator training program for operation of the LPMS, planned operating procedures, and record keeping procedures
- 5. A report from the Applicant which contains an evaluation of the system for conformance to Regulatory Guide 1.133
- 6. A commitment from the Applicant to supply a report describing operation of the system hardware and implementation of the loose part detection program
Response
The response to this question will be submitted at a later date. L Q492.5-1
MNPS-3 FSAR NRC Letter: May 31, 1983 Question Q492.6 (SRP Section 4.4) s The staff has reviewed the Applicant's submittal (FSAR Section 4.4.6.5) with respect to NUREG-0737, Item II.F.2 requirements and has found .that the Applicant's submittal is incoraplete. Therefore, the staff will require the Applicant to provide the documentation required by Item II.F.2 of NUREG-0737 for staff review.
Response
A response to this question will be provided at a later date. i l i 1 e I Q492.6-1 I i _ . . . . , _ , . - _ . , . _ , . - . . . . . . _ . _ _ . . _ . , . - . _ . . . , . , . . . , .. ,. .-_.____..._,-..m_.. . . _ ,
HUPS-3 FSAR NRC Letter: June 29, 1933 Question Q640.10 (Section 14.2.12) A March 28, 1983 letter from W.G. Counsil (Northeast Nuclear Energy Company) to R.C. Haynes (NRC-Region 1) stated that a modification to the . charging system would be made to provide two alternate miniflow paths which would be available to protect the operable charging pumps whenever an engineered safeguard system (s) actuation signal is present and the normal miniflow path is ' isolated. The auxiliary miniflow path will be placed in service, any time the "S" actuation signal is present, by the automatic opening of the one upstream motor operated isolation valve which is normally closed. Modify your preoperational test descriptions to include testing to be performed to verify the proper operation of this new design feature.
Response
Refer to revised FSAR Table 14.2-1 for the response to this question.
' ' %m
~
- ~
sg . ? ,
*P . s s
j ,
~'
Q640.10-1. ' Q l' w
e, EIPS-3 FSAR NRC Letter: June 29, 1983 Question Q640.13 (Section 14.2.12) FSAR Subsection 9.3.1.1.4.1 states that while the instrument air system is not safety related, it does have an interface with components that are part of safety related systems. Modify Preoperational Test Number 38 (Instrument Air and Containment Instrument Air), or the peroperational test objectives in FSAR Table 14.2-1 for all safety related systems that interface with instrument air, to include individual valve testing in accordance with section C.8 of Regulatory Guide 1.68.3 (Freoperational Testing of Instrument and control Air Systems), or red;)se the current exception to Regulatory Guide 1.68.3 in FSAR Subsection 14.2.7.9 to include a listing of the applicable safety related systems.
Response
Refer to revised FSAR Table 14.2-1 for the response to this question. l l l l Q640.13-1
nwsoarr.rg;s NRC Letter: June 29, 1933 i Question Q640.16 (Section 14.2.12)
- 1. In accordance with Regulatory Guide 1.108 (Periodic Testing of Diesel Generator Units )(sed as Onsite Electric Power Systems at Nuclear Power Plants), ?csition C.2.a.4, modify Preoperational Test Number 51 (Diesel Generator) or Number 67 (Engineered Safety Features Test With Loss of Normal Power) to demonstrate proper operation during diesel generator load shedding, including a test of the loss of the largest single load and complete less of lead and verify that the voltage requirements are met and that the overspeed limits are not exceeded. Your testing should, in addition. provide assuranci that any time delays in the diesel generator's restart circuitry will not cause the supply of starting air to be consumed in the presence of a safety injection,
. signal (see I&E Information Notice Number 83-17, March 31, 1983).
- 2. Modify Preoperational Test Number 51 (Diesel Generator) to include testing to ensure the satisfactory operability of all check ~ valves in the flow path of cooling water for the diesel generators from the intake to the discharge (see I&E Bulletin No.
83-03: Check Valve Failures in Raw Water Cooling Systems of Diesel Generators). Response . Refer to revised FSAR Table 14.2-1 for the response to this question. There are no check valves in the service water lines that provide cooling water to the diesels. As such, the concerns of I&E Bulletin 83-03 do not apply to the Millstone Unit III design. Q640.16-1
~
MNFS-3 FSAR NRC Letter: June 29, 19S3 Question Q640.17 (Section 14.2.12) Modify Preoperational Test Number 59 (Solid State Protection System) to provide assurance that a manual reactor. trip will both remove voltage from the under-voltage trip coil and energize the shunt trip coil (see I&E Bulletin 83-01, February 25, 1983). Responses Refer to revised FSAR Table 14.2-1 for the response to this question. W C. i. i l l l 9 I l Q640.17-1 l
, MNPS-3 FSAR e
NRC Letter: June 29, 1953 Question Q640.20 (Section 14.2.12) In FSAR Section 1.3 (Table 1.3N-1, page 6 of 39) the degree of compliance to Regulato ry Guide 1.20 (cemprehensive vibration Assessment Program for Reactor Internals During Preoperational and Initial Startup Testing) states that testing and test inspections will be conducted during hot functional testing.
- 1. Modify Preoperational Test Number 71'(Integrated Precore Hot Functional Testing) item 11 in FSAR Table 14.2-1 to include a cross-reference to TSAR Section 3.9.2 for additional information on vibration testing.
- 2. Modify or provide a new startup test description in FSAR Table 14.2-2 that describes the post-core load vibration assessment testing and inspection intended to be accomplished. (Appropriate reference may be used for description. )
Response
Refer to revised FSAR Table 14.2-1 for the response to this question. - There is no post core load vibration assessment testing and inspection intented to be accomplished. Westinghouse stated in WCAP-8780
" Verification of Neutron Pad and 17x17 Guide Tube Designs by Preoperational Tests on the Trojan I Power Plant", that vibration levels were lower than Indian Point II (prototype for Westinghouse 4 loop plant) and were in agreement with predicted results. Also, it was concluded that the internals.are free from harmful vibrations.
Refer to FSAR Section 3.9N.2.3 for additional information. e t Q640.20-1 qp - e ,,,r--n-g-
-- - ,n-- -- ,
ATTACHMElft 2 FSAR changes as a result of responses to the questions listed in Attachment 1. i f I l t I
MNPS-3 FSAR Nuclear plants employing the same RHS design as the Millstone 3 Steam Electric Station are given in Section 1.3. 5.4.7.1 Design Bases i RHS design parameters are listed in Table 5.4-7. The RHS is designed to operate in conjunction with other plant
; systems to reduce the temperature of the RCS during the second phase '
of plant cooldown. 1 The RHS is placed in operation approximately four hours after reactor j shutdown when the temperature and pressure of the RCS are i approximately 350*F and 425 psig, respectively. Assuming that two heat exchangers and two pumps are in service and that each heat
, exchanger is supplied with component cooling water at design flow and
- temperature, the,3415 is designed to reduce the temperature of the reactor coolant from 350'F to 120*F within 19 hours. The time required, under these conditions, to reduce reactor coolant temperature from 350*F to 212*F is about 4 hours. The heat load by the RHS during the cooldown transient includes residual and decay heat from the core and reactor coolant pump heat. The design heat load for the heat exchangers is based on the decay heat fraction that 440.16 exists at 24 hours following reactor shutdown from an extended run at full power. .
Assuming that only one heat exchanger and pump are in service and that the heat exchanger is supplied with coiaponent cooling water at
, design flow and temperature, the RHS is capable of reducing the temperature of the reactor coolant from 350'F to 200*F within >
- 30. hours. The time required, under these conditions, to reduce reactor coolant temperature from 350*F to 212'F is about 15 hours.
The RHS is also designed to operate in conjunction with the other 7 systems of the cold shutdown design in order to address the functional requirements of Regulatory Guide 1.139 guideline for Residual Heat Removal to achieve and maintain cold shutdown. The i cold shutdown design enables the nuclear steam supply to be takan from hot standby to cold shutdown conditions using only safety grade systems, with or without offsite power, and with the most limiting , single failure. The cold shutdown design also enables the RCS to be l taken from hot standby to conditions that will permit initiation of
.RHS operation within 36 hours. The reliability of the cold shutdown design is discussed in Section 5.4.7.2.6.
l r l The RHS is designed to be isolated from the RCS whenever the RCS pressure exceeds the RHS design pressure. The RHS is isolated from the RCS on the suction side by three normally closed, motor-operated valves in series on each suction line. Two of the motor-operated valves are interlocked to prevent its opening if RCS pressure is
- greater than 425 psig and to automatically close if RCS ' pressure j exceeds 750 psig. ' (These interlocks are discussed in detail in i Sections 5.4.7.2.4 and 7.6.2.) The RHS is isolated from the RCS on the discharge side by three check valves in each return line. Also Amendment 4 5.4-26 September 1983
~
MMPS-3 FSAR cooldown proceeds as described in normal cold shutdown (Section 5.4.7.2.3.4). 5.4.7.2.3.6 Refueling Both residual heat removal pumps may be utilized during refueling to pump borated water from the refueling water storage tank to the refueling cavity. During this operation, the residual heat removal pumps are stopped, the isolation valves in the inlet lines of the RMS are closed, the isolation valves to the refueling water storage tank are opened, and the residual heat removal pumps are restarted. The reactor vessel head is lifted slightly. The refueling water is then pumped into the reactor vessel through the normal RHS return lines and into the refueling cavity through the open reactor vessel. The reactor vessel head is gradually raised as the water level in the refueling cavity increases. After the water level reaches the normal refueling level, the residual heat removal pumps are stopped, the inlet isolation valves are opened, the refueling water storage tank supply valves are closed, the residual heat removal pumps are restarted, and the residual heat removal is resumed. During refueling, the RHS is maintained in service with the number of pumps and heat exchangers in operation as required by the heat load. Following refueling, the residual heat removal pumps are used to drain the refueling cavity to the top of the reactor vessel flange by pumping water from the RCS to the refueling water storage tank. The vessel head is then replaced and the normal RHS flowpath re-established. The remainder of the water is removed from the refueling canal via a drain connection in the bottom of the canal. 5.4.7.2.4 Control Each inlet line to the RHS is equipped with a pressure relief valve sized to relieve the combined flow of all the charging pumps at the relief valve set pressure. These relief valves also protect the system from inadvertent overpressurization during plant cooldown or startup. Each valve has a relief flow capacity of 900 gpm at a set pressure of 450 psig. An analysis has been conducted to confirm the capability of the RHS relief valve to prevent overpressurization in the RHS. All credible events were examined for their potential to overpressurize the RHS. These events included normal operating conditions, infrequent transients, and abnormal occurrences. The analysis confirmed that one relief valve has the capability to keep the RHS maximum pressure within code limits. Each discharge line from the RHS to the RCS is equipped with a ' pressure relief valve to relieve the maximum possible back-leakage through the valve separating the RHS from the RCS. Each valve has a relief flow capacity of 20 gpm at a set pressure of 600 psig. These 440.20 relief valves are located in the low pressure safety injection portion of the ECCS (Figure 5.4-5). Amendment 4 5.4-34 September 1983
MNPS-3 FSAR The safety injection pumps deliver water to the RCS from the RWST during the injection phase and from the containment sump via the containment recirculation pumps during the recirculation phase. Each high head safety injection pump is driven directly by an induction motor. The pump lubricating oil coolers are cooled by the safety injection pump seal cooling subsystem (Section 9.2.2.5). A minimum flow bypass line is provided on each pump discharge to recirculate flow to the RWST in the event that the pumps are started with the normal flow paths blocked. This line also permits pump testing during normal plant operation. Two parallel valves in series with a third, downstream of a common header, are provided in this line. These valves are manually closed from the control room as part 2, of the ECCS realignment from the injection to the recirculation mode. A pump performar.ce curve is shown on Figure 6.3-5. Containment Recirculation Pumps The containment recirculation pumps (Section 6.2.2) are provided for containment structure depressurization and later during the recirculation mode for core heat removal. The pumps will provide low heat pressure safety injection directly and via the charging and safety injection pumps during recirculation. 6.3.2.2.4 Containment Recirculation Coolers The containment recirculation coolers (Section 6.2.2) are shell and tube type heat exchangers serving to cool recirculated water flowing through the shell side from the containment recirculation pumps. Service water acts as the cooling medium flowing through the tube side of the cooler. 6.3.2.2.5 Valves The design parameters for all ECCS valves are consistent with the design parameters of their respecitve systems as described in 440.38
- Table 6.3-1. Relief valve design parameters are listed in Table 6.3-2.
The IEEE 323 Environmental Qualification Program for all ECCS valves I will be completed prior to fuel load. l The design features used to minimize valve leakage include: , 1. Where possible, use of packless valves
- 2. Other valves which are normally open, except check valves and those which perform a control function, with backseats to limit stem leakage
. 3. Normally closed globe valves installed with recirculation fluid pressure under the seat-to prevent stem ' leakage of recirculated (potentially radioactive) water
- 4. Enclosed relief valves with a closed bonnet
.U , Amendment 4 6.3-7 September 1983
.)
a MNPS-3 FSAR
- 5. Control and motor operated valves (2-1/2 and above) exposed to recirculation flow with double-packed stuffing boxes and stem leakoff connections to the reactor plant gaseous drain system Motor Operated Gate Valves The seating design of all motor operated gate valves is of the Crane flexible wedge design. This design releases the mechanical holding force during the first increment of travel so that the motor operator works only against the frictional component of the hydraulic imbalance on the disc, and the packing box friction. The disc is guided throughout the full disc travel to prevent chattering and to provide ease of gate movement. The seating surfaces are hard faced to prevent galling and to reduce wear.
Where a gasket is employed for the body-to-bonnet joint, it is either a fully trapped, controlled compression, spiral wound asbestos gasket with provisions for seal welding, or it is of the presssure seal design with provisions for seal welding. The valve stuffing boxes are designed with a lantern ring leakoff connection with a minimum of a full set of packing below the lantern ring and a minimum of one-half of a set of packing above the lantern ring. A full set of packing is defined as a depth of packing equal to 1-1/2 times the stem diameter. The motor operator incorporates a hammer-blow feature that allows the motor to impact the discs away from the backseat upon opening or closing. The hammer-blow feature not only impacts the disc but allows the motor to attain its operational speed prior to impact. Valves which must function against system pressure are designed so that they function with a pressure drop equal to full system pressure across the valve disc. Manual Globe, Gate, and Check Valves
- Gate valves employ a wedge design and are straight through. The wedge is either split or solid. All gate valves have backseat and outside screw and yoke construction.
Glebe valves, ("T" and "Y" style) are full perted with outside screw and yoke construction. Check valves are spring-loaded lift piston types for sizes 2 inches and smaller, swing type for size 2-1/2 inches to 4 inches, and tilting disc type for size 4 inches and larger. Stainless steel check valves have no penetration welds other than the inlet, outlet, and bonnet. The check hinge is serviced through the bonnet. The stem packing and gasket of the stainless steel manual globe and gate valves are similar to those described above for motor operated valves.. Carbon steel manual valves- are employed to pass nonradioactive fluids only and, therefore, do not contain the double packing and seal weld provisions. Amendment 4 6.3-8 September 1983
MNPS-3 FSRR 9.5.3.2 System Design Station lighting comprises four separate systems.
- 1. Normal ac lighting system is supplied from the normal (i.e.,
4
" black") 480V ac motor control centers (Section 8.3.1) through dry-type 480/208-120V ac lighting transformers rated
- both one- and three-phase. This system provides general plant area lighting.
- 2. Essential. ac lighting system is supplied from the emergency
. (i.e. , " orange" or " purple") 480V ac motor control centers (Section 8.3.1) through 480/208-120V ac, three-phase, dry-type voltage regulating transformers which are qualified as isolation devices. The output of the isolation transformers, although " black," is run exclusively in conduit and does not share raceways with normal " black" 1 power, emergency power, or with " black" power that originates from an isolation transformer supplied from the opposite emergency bus. The output of the isolation transformer is protected by an air circuit breaker. This System provides lighting for the control room,'the emergency 430*63 switchgear . rooms (including the auxiliary shutdown panel),
and other safety related and vital areas required to bring the plant to safe shutdown. In additon, access and egress paths for personnel evacuation throughout the station are
. provided with lighting from this system. The essential ac lighting operates continuously, with the exception of the lighting in the containment. Upon loss of offsite ac power, the essential ac lighting is automatically energized via the emergency _ ac power source (i.e., emergency generator) as
- _ discussed in Section 8.3.1.1.3.
- 3. The de lighting system consists of 8-hour, self-contained, sealed beam battery packs. These battery packs are supplied with a trickle. charge via the Class 1E ac power system (reference Section 8.3.1.1.2) which, in the event of a loss of offsite power, is supplied automatically from the emergency generator (reference Section 8.3.1.1.3). The dc
. lighting system operates upon the loss of the normal ac lighting _ system (reference . Sectien 9.5.3.2(1)). Upon l 430.63 energization of the essential ac lighting system (reference Section 9.5.3.2(2)), the de lighting will extinguish. The
[. de lighting system is sufficient to provide emergency lighting until ac lighting can be returned. The de lighting system provides lighting for the control room, emergency , switchgear' rooms (including the auxiliary shutdown panel), other safety related. and vital areas, and in access and egress paths for personnel evacuation throughout the
- j. station.
Amendement 4 9.5-14 September 1983 1
.w-- -
r -~=,ev-- , - ,-e--w, ,,--,-+,,-,---e- -,---r w-r ,, e-e-...,- a e. ,.v --- - - -mv ~
l MNPS-3'FSAR l 1
- The jacket water system, which dissipates heat rejected from the l
- cylinder liner jackets, turbochargers, and lube oil coolers, consists !
i- of a direct engine-driven water circulating pump, water temperature ; t 430.98 regulating valve, electric immersion heater (Table 9.5-9), motor- J
! driven water circulatir.g pump (Table 9.5-9), and heat exchanger.
I i The intercooler water system, which dissipates heat rejected from the engine air coolers, injection nozzles, and outside bearing at the
- alternator end consists of a direct engine-driven water circulating
, pump, water temperature regulating valve,-and heat exchanger, i- ! The' jacket cooling water cooler and the air cooler water heat exchanger are shell and tube types, .are in accordance with the . mechanical standards for TEMA Class "R" heat exchangers, and conform to the applicable edition of ASME III, Class 3. 1 The engine cooling water flows through the shell side, and the
! service water through the tube side of the heat exchanger.
Table 9.5-10 gives a list of the types of diesel jacket cooling water i
- 430.99 system leakages, means used to detect these leakages, and the
' corrective measures that will be taken,
- j. The shell' side design pressure is sufficiently high to eliminate the I possibility of overpressurization as a result of any mode of operation of the equipment supplied. The tube side design pressure is 150 psig. Tube material is 18 BWG, 90-10 Cu-Ni, per SB-111, All y 706. ,
0.92 The diesel engine cooling water system is chemically treated to j preclude long-term corrosion and organic fouling. Water purity and 430.93 chemistry is maintained at the following specifications which are in
- j. compliance with the manufacturer's recommendations.
- 1. Corrosion inhibitor - borate-nitrite - 2,500 ppm; mixed in j the expansion tank, with periodic monitoring l
l 2. pH: 8.5 to 9.5 i
- 3. Chlorides: 50 ppm max
- 4. Total dissolved solids: .150 ppm max
- 5. Total _ hardness: 50 ppm CACO 3 max Samples of makeup water supplied from the condensate makeup and
, 430.93 drawoff system are taken periodically to . ensure makeup water ! chemistry is within specified limits (Reference Section 9.2.6.4). Table 9.5-3 lists the design data for the major components in ! emergency generator. cooling water systems. i i l
- i. Amendment 4 9.5-24 September 1983
(~ e n. 4e - e. en-e.,,
,w - , - . - . , - - - - , - - - - - - - - ,, - .-.n,-,,,-.,..w- ...,,,-n.,,w -n ,,.m, ,,,,,-,_w.--,--,...r,,-- - , -c, - - = m-e,
MNPS-3 FSAR 9.5.5.3 Safety Evaluation The diesel generator cooling water systems are housed in the Seismic Category I emergency diesel generator enclosure (Section 3.8.4). The diesel engine cooling water system is an integral part of the diesel engine. Section 8.3.1.2.6 provides the electrical single-failure evaluation of the diesel engine. The emergency diesel generator engines and associated subsystems are independent and redundant (reference Sections 8.3.1.1.3 and 9.5.5.1). There is no sharing of cooling water subsystems or components between the two diesel generators. Each diesel generator has its own cooling water subsystems which are cooled by redundant service water trsins. 430.92 Section 9.2.1 and Figure 9.2-1 describe the interface to, and the analysis of, the service water system. No single failure or piping interconnections between the engine water jacket, lube oil cooler, governor lube oil cooler, and the engine air intercooler can cause degradation of both emergency diesel generator engines. Protection from floods, tornadoes, and missiles is discussed in Sections 3.4.1, 3.3, and 3.5, respectively. Protection from high and moderate energy pipe breaks is discussed in Section 3.6.1. The emergency diesel cooling water systems are Seismic Category I, as defined in Regulatory Guide 1.29 (Section 3.2.1). They are Safety Class 3 (Section 3.2.2) and designed to ASME III, Code Class 3, to the extent possible (Section 3.2.2). Emergency generator protective trip circuit bypasses are discussed in Section 8.3.1. Certain engine-mounted components, not covered by ASME III, are designed in accordance with the diesel manufacturer's latest standards for reliability. These components include:
- 1. Lower header and flexible hose supply cooling water to the i cylinder jackets and turbocharger i
- 2. Upper header, including orifices, returning cooling water from the cylinder jackets and turbocharger
- 3. Piping and orifice supplying water to and returning water l from the governor lube oil cooler
- 4. Piping, pump, heater, and controls associated with the cooling water keep-warm system
- 5. Control air piping and controls to the diaphragm-operated three-way valve on the jacket water heat exchanger i 6. Engine-driven jacket water pumps
- 7. Flexible hoses and couplings l
Amendment 4 9.5-25 September 1983
MNPS-3 FSAR
- 8. Supply and return cooling water headers to the fuel injectors The emergency diesel generator cooling water system is vented back to the overhead expansion tank to assure that the entire system is filled with water.
valves are provided to isolate components of the cooling water system which are not required during diesel operation under emergency or-faulted plant conditions. 9.5.5.4 Inspection and Testing Requirements Section 8.3.1 discusses emergency generator testing requirements. 430.94 All active system controls are periodically tested (Chapter 16). 9.5.5.5 Instrument Requirements The emergency diesel engine cooling water system is provided with low pressure, high temperature, and low temperature alarm switches to alert personnel when the manufacturer's recommended limits are exceeded. A low level alarm switch is provided on the overhead expansion tank to alert personnel of coolant loss from the system due to excessive leakage. Section 8.3.1 discusses alarms and trips for the emergency generators. Annunciators located on the emergency generator panels alarm when the following conditions exist:
. Emergency diesel generator jacket coolant pressure low
. Emergency diesel generator jacket coolant temperature high 430.94
- Emergency diesel generator jacket coolant temperature low
. Emergency diesel generator fresh water expansion tank level low A trouble alarm for each emergency diesel generator panel is located on the main control board and is alarmed whenever the associated panel has a condition alarmed on it.
9.5.6 Emergency Generator Starting Air System The emergency generator starting air system is shown on Figure 9.5-3. f 9.5.6.1 Design Bases Each independent starting system is designed to be capable of starting the engine five times from an initial pressure of 425 psig 430.11 without recharging the starting air tanks. The air start system is able to crank the diesel engine to the manufacturer's recommended rpm and enables the generator to reach voltage and frequency, and is able to begin load sequencing within 10 seconds. Amendment 4 9.5-26 September 1983
MNPS-3 FSAR A diesel engine test was performed by the manufacturer to demonstrate the capability of the engine to successfully start from a normal air r,eceiver tank pressure of 425 psig as shown on Table 9.5-11. The air 430.111 start cycles last approximately 2 to 3 seconds until the engine speed reaches 115 rpm. Each motor-driven air compressor has sufficient capacity (26.5 cfm) to recharge the air storage system in 30 minutes from minimum starting air pressure to maximum starting air pressure. 9.5.6.2 System Description There are two emergency generators for Millstone 3. Each emergency generator has two independent, redundant, air-over-piston starting systems with a separate starting distributor for each bank of cylinders. Either air system can start the engine without offsite power. However, onsite power in the form of Class 1E 125 V de source (batteries) is required for the operation of the air start solenoid valves. Each emergency generator starting air system includes the following components: Ac Motor-Driven Air Compressors (3EGA-CIA, C2A) Each unit is supplied with two air compressors (Table 9.5-9) that are 430.106 driven by electric motors. Each compressor and motor are mounted on a welded steel baseplate and anchored to the building foundation. Pressure switches are used to start the compressor motors when the pressure in the air start reservoirs decreases to 375 psi, and stop the compressor motors when the pressure increases to 425 psi. Each compressor has a free air delivery rate of 26.5 cfm and is equipped with an automatic leadless starting device to allow the compressor to come up to rated speed before they start compressing air. A safety valve is installed in the discharge line of the air compressor and is set at 450 psi. Starting Air Tanks (3EGA*TK1A, 2A) 430.104 i Two 30 in. by 108 in, air rese rvoirs that are manufactured in conformance with ASME III are provided for each unit. The reservoirs l supply enough air to effect five starts from an initial receiver pressure of 425 psig. Each of the air reservoirs is equipped with a safety valve that is set at 450 psi and a manually operated drain valve that is used periodically to blow down any moisture that may have accumulated in the rese rvoir. These starting air tanks are complete with all necessary pressure gages, pressure relief valves, and all other necessary fittings for connection into the starting systems of the engine. Air Start Solenoid Valves (3EGA*SOV26A, *SOV27A) Each unit is equipped with two solentid operated three-way, two-position, normally closed magnetic valves which pilot an air admission valve in each of the air inlet lines to the engine. These Amendment 4 9.5-27 September 1983
5' MNPS-3 FSAR air admission valves allow the starting air to enter the engine undar the control of the air start distributor. Each bank of seven cylinders has a separate air supply system consisting of all valves and fittings and a complete instrumentation and control system. Only one bank is required for starting, even though, normally, both systems and both air start valves are used when starting the engine. The emergency generator starting air system, exclusive of the motor-driven air compressors, starting air tanks, and interconnecting piping, is an integral part of the emergency generator diesel engine. The diesel engine starting sequence is as follows: h A diesel start signal causes operation of starting control relays _ which energize the air start solenoid valves which pilot'the main air start valves and admits starting air to each bank of seven cylinders of the engine. During starting, air pressure is applied to the starting booster device causing the control linkage and fuel injection pump racks to move toward the " max fuel" position. Starting air rotates the engine and causes the firing to commence. 430.104 As the engine speed increases, the tachometer relay senses when the engine reaches 115 rpm and causes the start control relays to deenergize. Deenergizing the start control relays causes the air start solenoid valves to become deenergized and shuts off the starting air supply to the engine. If the engine fails to start during the cranking period of 7 seconds, the normally open contacts of the cranking time limit relays close to energize the start failure relay. When energized, the normally open contacts of the start failure relay close to lock in the relay coil and keep the relay energized. Energizing the start failure relay also causes the normally closed contacts to open to energize the annunciator and deenergize the start i relays. Deenergization of the start relays causes the normally open contacts to reopen and deenergize the air start so3enoid valves. During any restart condition, the engine shutdown reset pushbutton on the control panel must be operated in order to start the diesel engine. This will deenergize the start failure relay and the shutdown relay if it were energized. A 0.'19 cubic foot capacity, 450 psig design pressure, ASME III, Class 3 air tank is provided in the air-supply line to each servo 430.110 fuel rack shutdown and starting booster solenoid valve (3EGA*SOV25A&B). A check valve isolates the tank from the main i
- Amendment-4 9.5-28 September 1983 L
MNPS-3 FSAR i starting air system. The air tanks are provided to ensure a source l 430.110 of air.for positive fuel shut off in the event of loss of all 430.104 starting air pressure in the main starting air system. n 4
,9.5.6.3 Safety Evaluation 1
Two independent redundant starting air systems are supplied for each
- emergency generator. The starting air systems are housed in the
, Seismic Category I emergency generator building (Section 3.8.4). There is no sharing of starting air system components between the two , emergency generators. A complete failure in one emergency generator starting air system will not lead to a failure of the other emergency
- generator to start. A single active failure in either of the emergency generator's redundant starting air systems will not lead to i the loss of the other redundant starting air system.
i ' Protection from floods, tornadoes, and missiles is discussed in Sections 3.4.1, 3.3, and 3.5, respectively. Protection from high and moderate energy pipe breaks is discussed in Section 3.6.1. The emergency generator starting air system is Seismic Category I, as defined in Regulatory Guide 1.29 (Section 3.2.1), Safety Class 3, and designed to Quality Group C Standards (Regulatory Guide 1.26, l Section 3.2.2), to the extent possible. Engine-mounted components and the starting air compressors which are not covered in the rules l Lof ASME-III, Code Class 3 are designed in accordance with the diesel
. manufacturer's latest standards for reliability. These components include the-following:
- 1. Engine-mounted air start distributors
- 2. Engine-mounted air. start valves _
9
- 3. Engine-mounted starting booster air valve
- 4. Engine-mounted fuel rack shutdown and starting booster servo
- 5. Engine-mounted piping and valves supplying air-to-jacket I
water system air-operated valves (Section 9.5.5) which are not required for performance of safety related function of l the emergency generator The seismic Category I starting air receiver tanks are of sufficient i capacity to start the emergency diesel generator and operate the L engine controls for at least seven days.' Starting air system leakage will be determined. at a minimum by periodic evaluation of the
. compressor cycling period. If the cycling period goes beyond 430.107 acceptable range, the system will be repaired.
Any failure that results in a loss of control air pressure to the positioner of the diaphragm operated three-way valve, would cause the valve 'to go.into its safe position tolfully open and will not cause failure or shutdown of the diesel generator, j Amendment 4 9.5-29 September 1983 e I
MHPS-3 FSAR In addition, a 0.19 ft3 capacity, 450 psig design pressure, ASME III, Class 3 air tank is provided in the air supply line to each servo fuel rack shutdown and starting booster solenoid valve 430.107 (3EGA*SOV25A&B). A check valve isolates the tank from the main starting air system. The air tanks are provided to assure a source of air for positive fuel shut off in the event of loss of all starting air pressure in the main starting air system. 9.5.6.4 Inspection and Testing Requirements Test connections have been provided on the interconnecting piping between the emergency generator and starting air tanks. This enables the operator to manually bleed the storage tanks, and periodically, to test and check startup of the starting air compressors. Moisture and other contaminants which might affect the air starting system will be maintained by periodic blowdown of the air storage 430.105 tanh. Other plant operating procedures consistent with the recommendations of the diesel manufacturer will be developed to ensure proper functioning of the air starting system. Section 8.3.1 discusses the emergency generator functional testing requirements. 9.5.6.5 Instrumentation Requirements Each air compressor is equipped with a manual control switch and indicator lights, located on the motor control center. A pressure switch on the air receiver tank automatically starts and stops each r compressor. This switch is set to start the compressor when the tank pressure drops below the low setpoint pressure of 375 psig and to stop the compressor when the pressure reaches the high setpoint 430.111 pressure of 425 psig. Relief valves on the receiver tanks and at each compressor discharge are set at 450 psig to protect the system from overpressurization. The compressor motor is also protected against thermal overload. 430.111 If the receiver tank pressure drops to the low-low setpoint pressure of 350 psig, the condition actuates an alarm an the respective 430.103 emergency generator panel and the emergency generator trouble alarm on the main control board. Each receiver tank is also provided with a local pressure indicator. A control air system is connected to the starting air system (Figure 9.5-3) to provide a source of air for operation of different compcnents in the jacket coolant temperature control system and the shutdown control system. 430.107 . coolant temperature control system consists of a The Jacket temperature transmitter, a temperature controller, and a diaphragm operated three-way valve with a positioner. Both the temperature transmitter and the temperature controller are supplied with air at 20 psi from the starting air system. Amendment 4 9.5-30 September 1983
MNPS-3 FSAR The temperature transmitter delivers an output signal between 3 and 15 psi as the temperature of the jacket coolant discharge from the engine varies between 100*F and 200*F. A temperature of 100*F will produce a temperature transmitter output signal of 3 psi while a temperature of 200*F produces a 15 psi output signal. The temperature controller receives the 3 to 15 psi output signal from the temperature transmitter and develops its own 3 to 15 psi output signal that controls the positioner of the disphragm operated three-way valve. The controller gives decreasing output pressure with increasing input pressure (reverse acting) that will cause the valve to go into full cooling with a loss of air pressure (fail safe). The diaphragm operated three-way valve is controlled by a positioner that receives the controller output pressure and air at 45 psi from the starting air system. This causes the valve to open and close its ports to control the flow of jacket coolant through the heat exchanger or divert the coolant around the heat exchanger so that the temperature of the coolant discharged from the engine will remain at the value set into the controller at all loads and ambient temperatures. The port controlling the flow of jacket coolant into the shell side of the heat exchanger is fully open when the positioner receives a controller output pressure of 3 psi or less and fully closed with a controller output pressure of 15 psi. Pressures between 3 and 15 psi will result in both ports being partially open. The shutdown control is also governed by the control air and starting 430.107 air systems. The shutdown control consists of an air cylinder and an oil cylinder in a two-compartment body. The air cylinder (linkage end) has connection to the starting air control pressure. During starting, the starting air pressure expands the cylinder by moving the piston which moves the linkage to the injection pump to admit fuel to the engine.
. Control air pressure is connected to the cylinder opposite to the rod end through a line containing a shutdown solenoid valve. The engine is stopped when the shutdown solenoid valve admits enough control air pressure against the piston to move the piston which will move the injection pump linkage to the "no fuel" position.
l 9.5.7 Emergency Diesel Engine Lubrication System Each emergency diesel engine lubrication system (Figure 9.5-3) lubricates and cools various emergency diesel engine components. 9.5.7.1 Design Bases The engine-driven lubricating oil and rocker-arm lubricating oil pumps have sufficient capacity to ensure adequate lubrication of main bearings, crank pins, camshaft bearings, valve gear, rocker arms, and Amendment 4 9.5-30a September 1983
MNPS-3 FSAR all other wearing parts. The oil also provides a cooling media for the pistons. A motor-driven prelubricating oil pump and electric heater are provided to supply warmed (125 F) lubricating oil to the engine sump and other necessary components when the engine is not running so as to enhance the "first try" starting reliability of the engine in the standby condition. The lubricating oil in the rocker arm lubrication system is heated by 430*122 conduction from the standby jacket coolant heating system which has a minimum temperature of 95'F, thus making preheating unnecessary. An electric motor driven rocker arm prelube oil pump, powered by an 430.118 electrical Class 1E ac power source, is provided to establish an oil film on the wearing parts of the diesel engine. Portions of the emergency diesel engine lubrication system are also designed to the following criteria
- l. General Design Criterion 2 for structures housing the system and the system itself being capable of withstanding the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, and floods
- 2. General Design Criterion 4 for structures housing the system and the system itself being capable of withstanding the effects of external missiles and internally generated missiles, pipe whip, and jet impingement forces associated with pipe breaks
- 3. General Design Criterion 5 for the capability of shared systems and components important to the performance of required safety functions 1 4. Regulatory Guide 1.26 for quality group classification of the system components i
- 5. Regulatory Guide 1.29 for the seismic design classification of system components
- 6. Regulatory Guide 1.38 for quality assurance requirements for the packaging, shipping, receiving, storage, and handling of items for water-cooled nuclear power plants
- 7. Regulatory-Guide 1.68 for preoperational and startup testing of the diesel engine lubrication system
- 8. Regulatory Guide 1.102 for the protection of structures, systems, and components important to safety from the effects of flooding Amendment 4 9.5-30b September 1983
, t MNPS-3 FSAR
- 9. Regulatory Guide 1.117 for the protection of structures, ;
systems, and components important to safety from the effects
'of tornado missiles .
- 10. Specific design criteria as follows
- a. The operating pressure, temperature differential, flow rate, and heat removal rate of the jacket water system which is external to the engine are in accordance with 430.112 recommendations of the engine manufacturer and are listed in Table 9.5-3
- b. The system has been provided with sufficient protective measures to maintain the required quality of the oil during engine operation
- c. Protective measures (such as relief ports) have been taken to prevent unacceptable crankcase explosions and
! to mitigate the consequences of such an event ; Relief ports are spring loaded relief valves that'
" quick open" crankcase doors on increasing pressure.' 430.112 The doors will " quick close" upon pressure relief.
- d. The temperature of the lubricating oil is automatically maintained above a minimum value by means of an
-independent recirculation loop, including its own pump ;- and heater, to enhance "first try" starting reliability of the engine in the standby condition
- 11. Branch Technical Position ASB 9.5-1 for lube oil system fire protection.
] 12. Branch Technical Position ICSB-17 (PSB) for-diesel engine lubricating system protective . interlocks during accident 4 conditions. 9.5.7.2 System Design There are two emergency diesel generators for Millstone 3, each with an independent lubrication system. Each engine lubrication system, as- shown on Figure 9.5-3, is _self-contained, integral to the emergency diesel engine, and consists of the following four subsystems: 430.115
- 1. The rocker arm lubrication subsystem ensures lubrication of the rocker arm assemblies and protects the crankcase oil from contamination by possible cooling water and fuel leaks at the cylinder head upper deck level.
1 Amendment 4 9.5-30c September 1983 i e,. , _ __ , . . . . _ . . , , , . . r.,-,, , , , , _ .~,,s .-y., ,__.,--,m.m__r. r ~ , - . - . , 7,m. - vm,
MNPS-3 FSAR Subsystem Components: Engine Driven Rocker Arm Lubricating Oil Pump (35GO-PZA): This pump takes suction from the engine mounted oil reservoir and discharges through the duplex filter to the upper. cylinder header and lubricates the rocker arms during engine operation. Electric Motor-Driven Rocker Arm Prelubrication Oil Pump (3 EGO-PlA): This pump is operated two minutes prior to any manual engine start in order to prelubricate the rocker arm assemblies. Refer to Table 9.5-9. Duplex Rocker Arm Lubricating Oil Filter (3 EGO-FLZA): This duplex filter is provided to remove foreign particles, which may have entered the system, before they reach the engine. Rocker Arm Lubricating Oil Reservoir: This reservoir provides the rocker arm lubricating oil subsystem with an adequate supply of lube oil. It is connected to the diesel engine lubricating system (lube 430.115 oil header) by a float valve that controls the admission of lube oil to the reservoir. The reservoir is also equipped with a sight glass, a vent, supply and return line connections, and a drain connection. Rocker Arm Oil Pressure Regulating Valve (3 EGO-V4): This valve opens when the pressure becomes too great at the discharge of the duplex filter to allow some of the oil to be returned to the suction of the rocker arm engine driven pump.
- 2. The lubricating oil keep warm subsystem is designed to maintain the temperature of the engine lubricating oil system -between 120'F and 125 F and to permit the engine to come up to rated speed within the specified ten (10) second time limit without delay for engine warm up.
System Components: Electric Motor-Driven Prelubrication and Filter Pump (3 EGO-P4A): This pump is provided to prelubricate the engine prior to startup and to circulate oil through the keep warm heating system and lube oil filter. The pump takes suction-from the engine sump (crankcase) via a strainer Amendment 4 9.5-30d September 1983
MNPS-3 FSAR and discharges through a 15-kW electric heater to the lubricating oil header and engine. Refer to 430.116 Table 9.5-9. 15-kW Electric Prelubricating 011 Heater (3 EGO-H1A): This heater is thermostatically controlled to maintain the lubricating _ oil temperature in the crankcase between 120*F and 125 F so that the lubricating oil system is in a state of readiness for startup. Refer to Table 9.5-9. Lubricating Oil Filter (3 EGO-FLTIA): This filter is capable of retaining 98 percent of particles 5 microns and larger. The lube oil filter elements require replacement when the differential pressure exceeds 20 psi at the normal operating temperature. Prelubrication and Filter Pump Suction Strainer (3 EGO-STR2A): The strainer prevents foreign particles, leaving the engine sump, from entering the prelubrication and filter pump. The strainer will be cleaned weekly initially, then at an interval determined by operating 430.115 experience. This interval will not exceed one month.
- 3. The diesel engine lubricating oil sdasystem lubricates the main bearings, crank pins, camshaft bearings, and other wearing parts.
System Compcnents: Direct Engine-Driven Lubricating oil Pump (3 EGO-P3A): This pump is mounted below the governor drive and is gear driven from the engine drive gear. It takes suction from the engine oil sump (crankcase) and discharges into the engine lube oil header. Thermostatic Three-Way Temperature Control Valve (3 EGO-V20): This valve controls the flow of lube oil to the lube oil heat exchanger during engine operation and maintains the temperature of the lubricating oil to the lube oil header between 125 F and 140'F under all conditions of load and ambient temperature. It also bypasses the flow of lubricating oil around the lube oil heat exchanger on startup of the engine. Amendment 4 9.5-30e September 1983
MNPSd3 FSAR Lubricating Oil Cooler (3EGS-E3A): This shell and tube heat exchanger is used to transfer the heat picked up by the lubricating oil to the jacket coolant system and is suitable for the temperatures and pressures encountered in tFis service. This oil cooler is capable of controlling the lube oil (flowing through the shell) temperature between 125'F and 140*F by using the engine jacket cooling water (flowing through the tubes). The heat exchanger is designed in accordance with mechanical standards for TEMA Class "R" heat exchangers and conforms to the applicable edition of ASME III, Safety Class 3. Lubricating 011 Strairer (3 EGO-STRIA): This full flow strainer removes foreign particles from the lubricating oil before they reach the engine lube oil header. The lube oil strainer elements should be removed end cleaned when the differential pressure exceeds 10 psi at the normal operating temperature. 430.115 4. The moisture-detecting subsystem is connected between the shell side drain and the oil inlet on the lubricating oil cooler. Subsystem Components: Moisture-Detector Circulating Pump (3 EGO-P5A): This small motor-driven circulating pump takes suction from the shell of the lubricating oil heat exchanger,
~
pumps the oil through the . water detector, and discharges it to the shell side inlet of the 430.116 lubricating oil heat exchanger. Refer to Table 9.5-9. l Moisture-Detector Circulating Pump Suction Strainer (3 EGO-STR3A): This line strainer is provided to keep foreign particles, suspended in the oil that leave the lubricating oil heat exchanger, from entering the water detector circulating pump. Moisture Detector: This detector is provided to detect water leakage into the crankcase lubricating oil. Water detection energizes an annunciator that sounds an alarm. The protective measures for.the lubricating oil system consist of oil filters and strainers that do not require power sources or alarms and are of the multiple element, continuous full-flow type. 4 Amendment 4 9.5-30f Septemoer 1983
MNPS-3 FSAR The crankcase vacuum system (Figure 9.5-3) includes a crankcase vacuum pump, oil separator, piping, and fittings. The crankcase vacuum system removes oil vapors from the diesel crankcase preventing the leakage of oil vapors through crankcase seals. The crankcase vacuum system can be started manually whenever the vacuum pump control switch is in the start position, or automatically whenever the control switch is in the auto position and the emergency diesel 430.126 generator is running at greater than 360 rpm. Both operating modes are possible provided there is no vacuum pump motor thermal overload. The vacuum pump is powered from a safety related motor control center as described in Table 9.5-9. The diesel crankcase is equipped with relief ports to mitigate the consequences of a crankcase explosion. A 1200 ga'llon capacity lubricating oil sump is provided to supply the engine with an adequate amount of lubricating oil during engine operation. The minimum recommended sump level of approximately 1000 gallons would be reached after 5 days of operation at full rated load with a normal oil usage rate of 40 gallons per day. This low level is alarmed in the control room to alert the operators. Upon 430.119 reaching this minimum level, oil will be added to the system without an engine shutdown. Adequate lubricating oil is stored onsite to assure seven days of operation at rated load. An oil usage rate of 65 to 70 gallons per day is considered excessive and is one indication that an engine overhaul is needed. Sufficient oil film remains on the wearing parts between manual starts to ensure lubrication during any emergency start. Therefore, 430.118 it is not necessary to operate the motor driven rocker arm pump in parallel with the engine driven rocker arm pump. Table 9.5-4 provides the design data for the major components in the emergency diesel lubricating oil system. 9.5.7.3 Safety Evaluation The lubrication system is housed in the Seismic Category I emergency generator enclosure (Section 3.8.4). There is no sharing of lubricating system components between the two emergency generators. A single failure in the diesel engine lubrication system would not lead to the loss of more than ene emergency diesel engine. Protection from tornados, floods, and missiles is discussed in Sections 3.3, 3.4.1, and 3.5, respectively. Protection from high and moderate energy pipe breaks is discussed in Section 3.6.1. The emergency diesel lubrication system is Seismic Category I, as defined in Regulatory Guide 1.29 (Section 3.2.1). The emergency diesel lubrication system is classified as Safety Clsss 3 and is designed to Quality Group C, as defined in Regulatory Guide 1.26 (Section 3.2.2) Standards and ASME III, Code Class 3, to the extent possible. Certain engine-mounted components as well as components either not l covered by the rules of ASME III, code class 3 or not related to the Amendment 4 9.5-30g September 1983 l
MNPS-3 FSAR safety function of the diesel engine are designed in accordance with
.the manufacturer's latest standards for reliability. The components include the following:
- 1. Water detector system, including pump strainer and associated piping
- 2. Prelube and filter pump strainer
- 3. Prelube and filter pump
- 4. Three-way, three-position, three-port valve
- 5. 15 kW lube oil heater
- 6. Three-way valve, plus piping around the 5 micron oil filter
- 7. 1 1/2-inch check valvo and length of 1 1/2-inch piping on outlet of 5 micron oil filter
- 8. Three-way valve, plus piping around the lube oil strainer
- 9. Engine-driven lube oil pump ar.d suction strainer
- 10. Rocker arm lube _ system 630.126 11. Crankcase vacuum pump and crankcase vacuum oil separator The condition of the lubricating oil will be checked at least monthly 430.125 to ensure that viscosity, alkalinity, and detergent levels are within the tolerance specified by the oil supplier.
A vacuum pump, an additional protective measure, maintains a vacuum 430.112 on the engine crankcase preventing the accumulation of oil mist which reduces oil leakage and minimizes the possibility of crankcase explosion. A water detector, and associated motor-driven pump, monitors the lube oil so that leakages from the water side of the lubricating oil heat exchanger into the lubricating oil system will Je detected. Addition of lubricating oil will be done by trained maintenance 430.113 personnel using procedures developed and proven satisfactory during the preoperational and startup test program to prevent entry of deleterious materials into the engine lubrication oil system. The . diesel engine prelubrication system is self-contained and integral to the diesel engine. Continuous operation is permitted in accordance with the manufacturer's recommendations. The "V" design 430*117 of the diesel engine allows for lubricating oil to continuously drain down to the engine sump. This prevents the buildup of lubricating oil in the cylinders which could be blown into the exhaust system on engine start. The turbocharger lubricating system is self-contained and does not get its supply from the engine oil header thus Amendment 4 9.5-30h September 1983
MNPS-3 FSAR preventing buildup of oil in the turbecharger housing during prelubrication of the engine. Each diesel engine prelubrication system is periodically inspected during plant operation for possible leakage. .This ensures against any dangerous accumulations of lubricating oil that could ignite during continuous prelubrication. 430.117 The prelubrication period for the rocker arm lubricating system is two minutes prior to any manual start which is in accordance with the recommendations of the diesel engine manufacturer. 9.5.7.4 Inspection and Testing Requirements 4 Section S.3 discusses emergency generator inspection and testing requirements. 9.5.7.5 Instrumentation Requirements Section 8.3 discusses emergency generator protective trips and trip circuit bypasses. Refer to Chapter 16, Technical Specifications, for
~
430.114 periodic tests of active components. A low lubricating oil level alarm is provided to alert personnel when. the lubricating oil level in the sump falls below the manufacturer's recommended minimum 12 vel. A high-pressure alarm is provided to alert personnel when the pressure in the crankcase exceeds the manufacturer's recommended high-pressure limit. A high-level alarm switch is provided to alert personnel when the oil - . level in the separate rocker arm lubricating oil tank exceeds the manufacturer's recommended maximum. A low-pressure alarm is provided to alert personnel when the rocker arm lubricating oil pressure falls below the' manufacturer's 430.114 recommended minimum. Actuation of the low lube oil pressure switch will energize an annunciator and give an alarm that the lubricating oil pressure has
- reached a dangerously low level. Actuation of any two (2) of these low lube oil pressure switches will shutdown the engine.
A low-pressure alarm switch is provided to alert personnel when rocker arm lubricating oil pressure falls below the. manufacturer's ! recommended minimum. l High- and low-temperature alarms are provided to alert personnel when. the oil temperature rises above, or falls below; the operating range recommended by the manufacturer. 430.114 The following annunciators are on each emergency generator local panel: Amendment 4 9.5-30i september 1983 4
MilPS-3 FSAR Moisture detector circulating pump motor thermal overload or loss of control power Lube oil moisture content high Rocker arm lube oil pressure low Crank case pressure high Lube oil sump temperature low Lube oil sump level low 430.114 Lube oil temperature high Rocker arm reservcir level high Lube oil pressure low , i
. + /
An emergency'cjenerator local p'anel trouble annunciator for each panel is locate'd on~the main cohtrol board and is ' alarmed whenever a
~
respective l'ocal panel annunciator'is alarmed. j/ .
~
9.5.8 Emergency Generator Combbstion Air'Ificake -and Exhaust System
+ j n - . ;
3 , JThe emerge 6cy generator combustion air intake and exhaust system
' supplies fi'itered air to the eriergency diesel engir.e for' combustion
" and releases . exhaust gases to atmosphere. (Figure 9.5-3) / ,
,, , s .
Air is:. Supplie'd from outsideithrough filter and silencer to the diesel' engine and-is exhausted through'a muffler to atmosphere. The system is QA Category;I, Nucl"dar Safety Related except for the, pipe
=from the muffler to'the atmosphere .. ~ . ...
which is QA Category II. ,, 4, _ 9.5.8.1 Design Bases / - The safety related porti6ri of the emergency diesel combustion air intake and exhaust system is designed in accordance With. the ~ following: y; ,f
- 1. General Design Criterion,2 for structures housing the' system and the system itseli being capable of withstanding the effects of natural' yhenoiena, such as- earthquakes, tornadoes, hurricanes,' and floods'
, , f f' '
- 2. General Design .CriteritTo 4 for stiuctures housing the systenl5 and the syst'em . components /7being .. capable of
- , withstanding the effects of external'.nissiles. and internally genErafed missiles, pipe yhip, anddj~et impingement < forces
-r associated with pipe ~bre6ks j I' ~ '
- ~ c .
, , .- '/:
' 32 mGeneral Design Critkrici 5lfor shared systems and components
~ $important to safety [being capable of performing safety
~"-
, -, - :j, funciions
^-
, m .
m , , .-e v -
.*4._ , Regulatory . Guide E }.2p for quality group classification of q s --
%4 the' ystem ' coat.ponents ,
- 5. Regulatory ' Guide 1.h9 for the seismic, classification of
'_ system components ,
r v_ _ y,,"
~y _
f, , Amendment 4 3.5-30y September 1983
' 1 J
^
j/ ( z .};. . i .' ,.
' . . N .. , , ... _ . . _ _ . . , _ _
s , .in, [ ' [;' * [? L/T vs
, i-e 1e wy _,.
.4 s.. . c .. .
;/. "1. ~. V ' "
,'- 7 MNPS-3 FSAR _.
d ' r s t .<;. - j ' ' i [," 5'y ~,, c -s t TABLE 9,I3 ,
~' ' '
DESIGN DATA FOR'HOTOR COMPOPAERTS its v .' ,
-s r EML}RCENCY GENERATOR COOLING WATER ry S16TEMS n
. , - t,
, , , i' ,
'? -/ -
?
I gefign . I E _s- e . J Heat- Total Design '/^ l' 1, , . De bpri f # Flow - Tempera tu re .. Re'aova l - Design Heat itemoval ? J PrCssure ~ ' rapacity Di f re ren t ia l .. %j Rate Ma rg i n Rate Co.mpongni Jpsit L
^
$j? iluom) I"TT ,,,-{hlu/hr) fBtu/hr) ( H r.teLh r ) l. /[' gf F
~y"2 ;, *;
, . _ . PUMPS ,
w '
.lacl<et Wa ter << 57 880 - [g ..
~
1.sigine Driven / , Pump
,e .
/ f . '
/ ,
Jacket Water 3 10 60 - 4 A .- - - -
%O V Motor- f
',0 riven Circ ; jv / e -
Vtimp , .
., b .:
,t ~/- #~
I n te rcoo le r 57 880 -
.j
Water Engine- . s ~ i'; - ~
./ , Hounted Pump 430.90
' ~~ ' ilEA1 E$f t%GING EQUIPMENT: JACKET WATER SYSTEM Cylinder Liner - - 15 (normal) 6,781,000 /- 678,100 7.459,100 Jackets and 18 (maximum) Iu rbocha rge rs - a f *., } k-i lobe oil Cooler 150 913 / 3. 6 (."n rma l ) 1,638,000 163,800 '.-- 1,801,800 ( no rr+.s t ) . ..
, ; . ,. ;r / ,
~ <
Governor Lube Lator La te r'
~-
Lator
~0 20 %0 Oil Cooler Total: 8,419,000 841,900 g, 9,260,900
'a -
84i,900 Jacket Water 150 913 18.5 ( she l l ) 8,419,000 9,260,900 Ileat Exchanger (shell) 9 (tube). " j d
; 430.112 1900 < -
(tubo) d Amendment 4 1 Of 2 September 1983 i i
?
MNPS-3 FSAR TABLE-9.5-3 (Cont) Design Heat Total Design Design flow Tempe ra tu re Removal Design Heat flenova t Pressure Capacity Ol f fe rent i a l Rate Ma rg i n Rate 'yomponent
, _1psiql (coml (*fl 'fBtu/hr) (Btu /hr) fBqu/hr)
INTERCOOLER WATER SYSTEM intercoolers - - - 3,000,606 880,362 3,880,968 Injection - - - 12,000 3,521 15,521
' llozz l e s outside Bearings - - - 6,000 1,760 7.760 Total: 3,018,606 885.643 3,904,249 430.90 I nte rcoo le r 150 800 11. 2 ( she l l ) 4,388,055 433,806 4,771,861 11a te r Hea t (tube / (shell) 12.5 (tubo) 1xchanger shell) 1900
.(tube)
. (0JJ;:
total lleat Rejection f rom Engine: 1,260,000 Btu /hr a 1 Amendment 4 2 of 2 September 1983
MNPS-3 FSAR i TABLE 9.5-4 DESIGN DATA FOR THE MAJOR COMPONENTS OF EMERGENCY GENERATOR - DIESEL LUBRICATING OIL SYSTEM Design Flow Heat l Design Capacity Temperature Removal , Pressure Each Differential Rate ) Component (psig) (gpm) (*F) (Btu /hr) Lubricating 011 Heat 150 475 15.4 1,638,000 Exchanger (shell) (shell) Lube Oil Heater 120 50 - 51,194 (design heat duty) PUMPS : Lubricating Oil Pump 100 400 - - (normal) (normal) 430.90 Rocker Arm Lubri- 20 @ 2.2 - - cating Oil Pump 514 rpm Prelubricating 011 100 50 - - Filter Pump Rocker Arm Pre-Lube 50 2 - - Oil Pump (discharge) Moisture Detector 50 2 - - Pump (discharge) NOTE: Each component has approximately 12 percent additional capacity t (margin). Amendment 4 1 of 1 September 1983
MNPS-3 FSAR TABLE 9.5-10 COOLING WATER SYSTEM LEAKAGES Pe rmi ss ib le inleakage lyoe or Leakaoe Means used to Detect Corrective Measures or Outleakaoe
- 1. Jacket water into tube oil .a. Lube oil moisture detector Repair cooler leak and clean Lube oil water content system ( standby mode) or 0.5 percent maximum
- b. Visual inspections of tube oil sump tank (abnormal level) and color or oil (greyish or yellow-brownish tint if water is polluted)
- c. Periodic testing of the tube oit quality
< 2. Lube oil into the Jacket .a. Periodic testing of the Repair cooler leak and clean La te r water system (operating Jacket water quality mode)
- 3. Jacket water into the engine a. Visual inspection of Repair defective turbocharger Later a i r intake and governor turbocharger Jackets or governor tube oil cooler systems (operating or standby 430.99 mode) lube oil b. Periodic testing of the governor tube oil quality
.i
- 4. Jacket water / service water a. Periodic testing of the Repair leak in Jacket water Any leakage which systems Jacket water quality cooler or engine air cooler results in exceeding water heat exchanger manufacturer's water
- b. High level in the expansion quality limits tank i
f i 4 Amendment 4 1 of 1 September 1983 4 4
MNPS-3 FSAR TABLE 9.5-11 AIR START TEST DATA Internal Pressure (psig) Time Start (sec) North Tank South Tank 1 7.6 422 422 2 7.75 365 368 3 8.3 328 330 4 8.5 291 292 4 5 9.0 261 260 6 9.5 233 229 7 10.1 207 205 8 10.25 184 185 430.11 9 11.0 167 168 10 11.4 149 149 11 11.75 132 133 12 13.3 120 120 , 13 14.2 103 105 14 Failed to start 89 92
REFERENCE:
Test Report Emergency Diesel Generator Unit MPS 3 - Fairbanks Horse Engine Division. October 7 and 8,1976. Amendment 4 1 of 1 September 1983
- . . . . _ .~- . - _ , . . _ , _ . . . _ ~ . . - -~ _ _ ~ _ _ - - - - .
MNPS-3 FSRR temperature does .not rise significantly above its initial value during the transient. The calculated sequence of events for the excessive load increase lt incident is shown-in Table 15.1-1. 15.1.3.3 Conclusions The analysis presented above shows that for a 10-percent step load increase, the DNBR remains above 1.30; the design basis for DNBR is described in Section 4.4. The plant reaches a stabilized condition rapidly following the load increase. 15.1.3.4 Radiological Consequences There are no radiological consequences associated with this event and activity is retained within the fuel rods and reactor coolant system. 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 15.1.4.1 ' Identification of Causes and Accident Description The. most severe ; core conditions resulting from an accidental depressurization of the main steam system are associated with an inadvertent opening, with failure to close, of the largest of any single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steam line are given in Section 15.1.5. The steam release as a consequence of this accident results in an
- initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a-reduction of coolant temperature and pressure. In the presence of a
. negative moderator . temperature coefficient, the cooldown results in an insertion of positive reactivity.
The analysis is performed to demonstrate that the following criterion is satisfied: r
' Assuming' a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the engineered safety
- features system there will be no consequential damage to the core or. 440.15 reactor coolant. system after reactor. trip for a. steam release equivalent to the spurious . opening, with failure to'close, of the
, largest of any single steam dump, relief, or safety valve. Accidental .depressurization of the secondary system is classified as an ANS Condition II event. See Section 15.0.1 for a discussion of Condition II events. The following systems provide the necessary protection against an accidental depressurization of the main steam system due to the i opening of e steam generator relief or safety valve: l Amendment 4 15.1-9 September 1983
MNPS-3 FSAR
- 1. Safety injection system actuation from any of the followings
- a. Two out of four pressurizer pressure signals
- b. Two out of three low steamline pressure signals in a loop
- 2. ' The overpower reactor trips (neutron flux anddLT) and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, a safety injection signal will rapidly close all feedwater control valves and back up feedwater isolation valves, and trip the main feedwater pumps.
- 4. Trip of the fast-acting steam line stop valves (designed to close in less than 5 seconds) cn:
- a. Safety injection system actuation derived from two out of three low steam line pressure signal in any loop (above Permissive F-11)
- b. High negative steam pressure rate indication from two out of three signals in any loop (below Permissive F-11)
Plant systems and equipment which are available to mitigate the effects of the accident are also discussed in Section 15.0.8 and listed in Table 15.0-6. 15.1.4.2 Analysis of Effects and Consequences Method of Analysis The following analyses of a secondary system steam release are performed for this section:
- 1. A full plant digital computer simulation using the LOFTRAN Code (WCAP-7907) to determine RCS temperature and' pressure during cooldown, and the effect of safety injection 440.45 2. Analyses to determine that there is no damage to the core or the reactor coolant system.
The following conditions are assumed to exist at the time of a secondary. steam system release:
- 1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and with the most reactive rod cluster control Amendment 4 15.1-10 September 1983
, - , - - - . , - - . , . -,m,
MNPS-3 FSAR expansion occurs due to reduced heat transfer capability in the steam generators; the pressurizer safety valves open to maintain primary pressure at an acceptable value. Addition of the safety injection , flow aids in cooling down the . primary and helps to ensure that ) sufficient. fluid exists to keep the core covered with water. Figures 15.2-11 and 15.2-19 show that following reacter trip, the core remains subcritical except for a brief return to criticality 460.47 following a feedline break with offsite power available. This is due to the cooldown caused by the steam generator blowdown. This condition is terminated when boron from the safety injection system reaches the core at approximately 212 seconds. DNBR remains above 1.30 at all times during the transients, as shown on Figures 15.2-18 and 15.2-26; the DNBR design basis is discussed in Section 4.4. Release of radioactivity due to the steam generator blowdown is less than' that calculated for the steam line rupture, analyzed in Section 15.1.5.
-RCS pressure will be maintained at the safety valve setpoint until safety injection flow is . terminated by the operator, as mentioned above. The reactor core remains covered with water throughout the transient, as there is no water relief from the pressurizer.
'The major difference between the two cases analyzed can be seen in the plots of hot and cold leg temperatures, Figures 15.2-14 through 15.2-16 (with offsite power available) and Figures 15.2-22 through 15.2-24 (without.offsite power). It is apparent from the initial portion of the transient (300 seconds), that the case without offsite power results in higher temperatures in the hot leg. For longer times, however, the case with offsite power results in a more severe rise in temperature until the coolant pumps are turned off and the auxiliary feedwater system is realigned. The pressurizer does not fill for either case, and the core remains covered with water.
15~.2.8.3 Conclusions Results of the analyses show that for the postulated feedwater line rupture, the assumed auxiliary feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. Radioactivity doses from the postulated feedwater line rupture are less than those previously presented for .the postulated steam line break. All applicable acceptance criteria are therefore met. 15.2.8.4 Radiological Consequences
-The feedwater line break with the most significant consequences would be one that occurred inside the ' containment between a steam generator and the feedwater check valve. In this case,'the contents of the steam generator would be released to the containment. Since no fuel failures are postulated..the radioactivity released is less than that from the steam line break. Furthermore, automatic isolation of the containment would further reduce any radiological consequences from this postulated event.
Amendment 4 15.2-22 September 1983
MNPS-3 FSAR 15.2.9 References for Section 15.2
- WCAP-7769, 1971. Mangan, 11. A . Overpressure Protection for Westinghouse Pressurized Water Reactors.
t WCAP-7907, 1972. - Burnett, T.W.T. et al. LOFTRAN Code Description. WCAP-7908, 1972. Hargrove, H.G. FACTRAN-A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod. WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis. I 1 Amendment 4 15.2-23 September 1983
_ .- -=. . . . . - V e MNPS-3 FSAR
'either reactor' coolant pump power supply undervoltage or underfrequency.-
Results Figures 15.3 thru 15.3-8 show the transient response for the loss +
'of power to all reactor coolant pumps with four loops in operation.
The reactor' is assumed to be tripped on an underspeed signal. Figure 15.2-8 shows the DNBR to be alwaysLgreater than 1.30. 440.52 The . plant is tripped sufficiently fast to ensure that the ability of the primary coolant to remove heat from the fuel rod is not greatly
-reduced. Thus, the average. fuel and ~ clad temperatures do not increase significantly above their~ respective initial values.
4 1 ~The calculated ' sequence of events is shown in Table 15.3-1. The reactor coolant ~ pumps will continue to coastdown, and natural circulation flow will eventually be established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition i would be attained. Normal plant. shutdown may then proceed. 15.3.2.3 Conclusions The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow,-the DNBR does not decrease below 1.30 at any time -'during the . transient. .Thus, .no fuel'or clad damage is predicted, and all applicable acceptance criteria are met. 7 15.3.2.4 Radiological Consequences-A . complete ~. loss of reactor coolant flow from full load results in a . reactor and turbine trip. Assuming in addition that the condenser is not available, atmospheric steam dump would be required. The quantity of. steam released would be the same as for a loss of offsite power incident. l There are only. minima 1' radiological consequences' associated with this event. Since fuel damage -is not postulated, the radiological consequences resulting from atmospheric steam dump are less severe , than the steam line break- analyzed' in- Sectior 15.1.5. Therefore,
- this event-is not limiting.
15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description 4 The accident postulated is an instantaneous seizure of a reactor i coolant-pump rotor such as is discussed in Section 5.4. Flow through
-the affected freactor coolant loop is rapidly reduced, leading to an
~
' initiation of a reactor trip on a low flow signal.
{. LFollowing initiation of the reactor trip, heat stored in the fuel
- i. rods continues to be transferred to the coolant causing the coolant to. expand. At the same time, heat. transfer to the shell side of the Amendement 4 15.3-5. September 1983 t
y -
.e-,
m- - . - - . . - - - - c., ,,,,-n.. . ~ . - . , - .
,---.e-m.-,w-m n- ~n-., v ,.,-,,.+.pme. _,,r,.4 .m .,v.m,.w- ,nm,wmn-~.--,--ew~,~em re,--
~_. - . . , ._.
. .= .-- ~, _ - -.
F MNPS-3 FSAR resulting in the condenser- being. unavailable for steam dump. The , nondefective steam generators continue to release activity through the steam relief valves until the plant is brought to a cold shutdown 8 hours after the tube rupture. The analysis considers the effect of the highest worth control rod stuck out of the core. The calculation indicates that the DNB-limits are met, thereby precluding any release 440.61
.from additional fuel failure. The activities released are based on technical specification primary to secondary leak rate of 1 gallen -
l- per minute. It is also' assumed the reactor coolant and secondary l , coolant are at equilibrium technical specification -activity concentrations. A partition factor of 0.01 is assumed for_ iodines I passing between the water and steam phases in both the defective and 7 nondefective steam generators. The assumptions _used to calculate the doses to the EAB and the LPZ
.from a steam generator tube rupture are summarized in Table 15.6-5.
Two cases'are analyzed to ascertain the results of increased reactor
- coolant iodine concentration resulting from operating transients
- 1. The- iodine activity in the primary coolant is increased due to a preaccident iodine spike
? An iodine spike occurs concurrently with the steam generator ^ 2. tube rupture . The' calculated activities released to the environment as a result of a steam generator tube rupture based on the parameters -described. in Tables 15.6-5 and 15.6-6 are shown in Table 15.6-7. The tabulated release values are-for the two cases examined:
- 1. An assumed preaccident iodine spike condition in the reactor coolant, and
- 2. An accident initiated concurrent iodine spike.
i-- LThe releases together with the atmospheric dispersion factors listed ( in Table 15.0-11' are. used to compute the doses presented in
~ Table 15'.0-8 for the EAB (0-2 hr) and the LPZ (0-5 hr). ,
L: . = The whole body and thyroid doses calculated for the postulated l accident assuming a preaccident iodine spike in the reactor coolant ! 'is less than the dose-guideline values described in 10CFR100, i.e., 300 Rem to the thyroid and 25 Rem to the whole body. l
.For the - assumed condition of.a concurrent iodine spike in combination j .w ith equilibrium. iodine concentrations at full power, the_ analysis of the postulated accident. resulted in dose values less than a small fraction ofL10CFR100, i.e., 30 Rem to the thyroid and 2.5 Rem 'whole body.
15.6.4 Spectrum ~ of BWR : Steam System' Piping Failures outside of I Containment l_ 3 Not applicable to Millstone 3. Amendment'4 15.6-9 September 1983 4
.m -, - . , . -. , . , , - _ . _ . _ _ _ _ _ _ .,
. , _ _ . , , _ , . , , , ,_ , , _ , _ _ _ . , __,._._,,,____,,-,,,,m. , , , , , . , _ _ , , , , _ _ _ . , _ , _ , , , , . , . , , , , ,
as they are returned. If compressors are used as a source of breathing air, only units approved for breathing air should be used. Special care must be taken to locate the compressor in areas free of dust and contaminants."
RESPONSE
Self-contained breathing apparatus, with full positive pressure face mask for fire brigade, damage control, and control room personnel will be provided. POSITION (i) "Where total flooding gas extinguishing system are used, area intake and exhaust ventilation dampers should close upon initiation of gas flow to maintain necessary gas concentration. (See NFPA 12, ' Carbon Dioxide Systems,' and 12A, 'Halon 1301 Systems.')"
RESPONSE
All ventilation dampers, etc, will be closed or will close upon initiation of gas flow to maintain necessary gas concentration. , POSITION
- 5. Lighting and Communication
" Lighting and two-way voice communication are vital to safe shutdown and emergency response in the event of fire.
Suitable fixed and portable emergency lighting and communication devices should be provided to satisfy the following requirements: , (a) Fixed emergency lighting should consist of sealed beam units with individual 8-hour minimum battery power supplies."
- RESPONSE Vital areas where operators may be required during emergency situations are provided with a minimum of 10 foot-candles of lighting. ' 280.15 at the work station powered from an 8-hour battery pack.
In addition, a minimum of 3 foot-candles of lighting at floor level 280.15 is provided along access and egress paths throughout the plant from 8-hour battery packs. POSITION (b) " Suitable sealed beam battery powered portable hand lights should be provided for emergency use." Amendment 4 A-23 September 1983
_.m - . . . .- . - _ _ . . _
RESPONSE
. Suitable _ sealed ' beam battery powered portable hand lights are provided for emergency, use.
I POSITION
- ~
(c) - " Fixed emergency communication should use voice-powered - head sets at preselected stations." RESPONSE' 4 I An emergency communication system using voice-powered headsets has
- been installed at preselected operating stations. In addition, there is a separate five-channel maintenance telephone system for use with y
plug-in headsets and jacks distributed throughout the plant; this F system is powered by a normal source. A paging. system capable of operating independent of telephone systems and portable radios is also provided. , POSITION 1: (d) " Fixed repeaters installed to permit use of portable radio communication units should be protected from exposure fire damage."
RESPONSE
Fixed repeaters for portable radios are protected from fire damage. I E. Fire Detection and Suppression (2nd C in APCSB 9.5-1, p. 23)- 1 POSITION
- 1. Fire Detection 1 _(a) " Fire ~ detection systems should as a minimum comply with r 4
NFPA 72D, ' Standard for the Installation, Maintenance and Use of Proprietary Protective Signalling Systems. ' (b) " Fire detection system should give audible and visual alarm and annunciation in the control room. Local audible alarms should also sound at the location of the 4 .. fire. (c) " Fire alarms should be distinctive'and unique. They should not be capable of being confused with any other plant system alarms. (d) " Fire detection and actuation systems should be l connected to the plant emergency power supply." i Amendment 4 A-24 September 1983
+ +=dri--- *-**r'+ *w,-- --y-m em* s erve y =r-7 vsmrwwwwy-- erw--wwm,-yww--,, ee,--v ..w-.9--rgm ,y ,r, e- f-7e f e , - -
*t-*- = - - ' -
- RESPONSE The fire detection system complies with NFPA-72D, " Standard for the Installation, Maintenance, and Use of Proprietary Protective i Signalling Systems." The fire detectors are of the high and low velocity ionization type and are sensitive to their actual use 1
1 ? G 1 I l l l r i l i Amendment 4 A-24a September 1983
MUPS-3 FSAR TABLE 14.2-1 (Cont)
- 5. PREOPERATICNAL TEST - VOLUME CONTROL (CHARGING AND LETDOWN)
Prerequisites for Testing General prerequisites have been met. The reactor coolant, reactor plant component cooling, and interfacing portions of other support systems.are available. Plant is at cold ambient conditions for initial testing of components and controls and at normal operating temperature and pressure during hot functional testing for verification of thermal-hydraulic i performance. Test Objective and Summary Testing will demonstrate the charging and letdown functions of the chemical and volume control system (CHS). The proper functioning of system components, including charging pumps, heat exchangers, valves and orifices, as well as the volume control tank level control and cover gas
- system, purification demineralizers, excess letdown reactor coolant pump seal water, .and chemical control and makeup functions will be demonstrated. Proper operation of system controls, (including the proper operation of the auxiliary miniflow path), interlocks and alarms will 640.10 be verified.
Acceptance Criteria The charging pumps meet or exceed design performance requirements. The charging and letdown normal and alternate flow paths, including heat exchangers, letdown orifices and control valves, function in accordance with design requirements. The volume control tank level system, diversion valves and cover gas system function as required. The system
- demineralizers operate at specified flow rates and pressure drops. The chemical control and makeup function operates in accordance with design requirements. Controls, interlocks,;and alarms function properly in response to normal or simulated input signals.
4 9 + i
,8 of 82
. - - = , - --
!CIPS-3 F3AR IABLE~14.2-1 (C:nti r
- 38. PREOPERATICHAL IEST - INSTRU:!ENT AIR AND CCNTAII*IIENT INSTRUMEIIT AIR Prerequisites for Testing
, General prerequisites have been met. The system has been pressure tested using instrument air quality gas. Test objective and Summary r-Testing will be performed to provide assurance that the instrument air system will provide clean dry air at the proper pressure to end use ; equipment. 640.13
,-J>
Compressors will be tested for manual and automatic starting, quality and volume of air delivered and verification of instrument readings. Cooling water flows to the compressors will be verified. Instrument air '. dryers will be coupled to the compressor and full flow air tests will be conducted. Dryers will be operated full cycle with automatic switching of dryer towers verified. Instruments and alarm settin.gs will be verified. . Total air demand at normal steady state conditions, including leakage from the system, will be verified to' be in accordance with design. ' Quality of air will be evaluated at the dryer outlet. Further verification of cleanliness shall be verified by blowdown of instrument air lines through a filter cloth. A loss of instrument air test shall be conducted at near normal operating conditions to verify acceptability of emergency response procedures and system response. A test shall be conducted to demonstrate that plant equipment designed to be supplied by the instrument air system is not supplied by other air supplies having less restrictive air quality requirements. Plant components requiring large quantities of instrument air shall be' operated simultaneously. while the system 'is at near normal steady state conditions to verify i that pressure transients in the distribution system do not exceed acceptable values. Functional testing shall be performed to verify that failures resulting in an increase in the supply system pressure will not } cause peak. transient pressures above the design pressure of the system components. Acceptance Criteria All equipment in the instrument air system will perform in an acceptable manner in accordance with design requirements. L sg All air operated valves are individually tested to ensure proper operation. i This testing includes proper response to loss of air. 1 41'of 82 ,
- - , , . - -j
CNPS-3 FSAR TABLE 14.2-1 (Cent)
- 51. PREOPERATIONAL TEST - DIESEL GENERATOR Prerequisites for Testing General prerequisites have been met. Component testing of the diesel generator and its support systems has been completed. Fuel oil, cooling, air start, fire protection, and ventilation systems have been
-tested and are ready for service.
Test Objective and Summary Testing will verify that the diesel generators and supporting equipment will perform in accordance with design. The testing objectives will conform to the general requirements of Regulatory Guide 1.108. They
.will verify that the -diesel generator is capable of operating in parallel with site power, or alone on the emergency bus. This test will primarily' confine itself to verifying the diesel generator's capability to . operate as an electrical. power source. The preoperational test of engineered safety features with loss of normal power, together with this test, will demonstrate the generator's capability to supply power under emergency conditions.
l The specific areas to be covered by this test are as follows:
-1. The diesels will be operated for a 24-hour full load test including a 2-hour segnent at the 2-hour load rating. The
. required voltage and frequency as well as proper cooling system
~
operation will be verified.
- 2. -The ability to synchronize with offsite power, transfer loads, isolate the diesel and return to standby will be verified.
-3. The ability of the' diesels to operate during forwarding of fuel from storage tanks to day. tanks will be verified.
- 4. During the combined testing of the diesels, a minimum of 34~ consecutive valid tests per diesel will be performed.
! 5. The ability of the diesel air-starting system to deliver the required starts without recharge will be verified.
- 6. The functional capability of the generator to sequence onto the emergency bus under full load temperature- conditions will be tested in the engineered safety features test. Consequently Item 1 may be done in that test.
l : INSERT A- l640.16' During the test sequences, proper operation of each diesel generator 5 unit:will be verified through monitoring of specified parameters on the engine and generator. units, control systems, interlocks, and alarms
-including the annunciator' "first-out" capability, lubricating oil and cosling . water systems. and generator breaker operation. Major ,
i 54 of 82
A
- 7. Proper operation during load shedding including a test of the loss of the single largest load and complete loss of load will be performed with the diesel initially at its maximum continuous rating. Testing will verify voltage requirements are met and that overspeed limits
.are not exceeded.
460.16
- 8. Testing will verify that during the time the shutdown relay is energized, neither the air start solenoid nor the fuel' racks will open, e
r i
, - , -v . . . . . , , - - - , ,,..,,__m v,. ,. _ ,,.-.m,,. ,, , - . , . , - - - - . . . - . _ - - - - - - - .
MMPS-3 FSAR TABLE 14.2-1 (Cont)
- 59. PREOPERATIONAL TEST - SOLID STATE PROTECTION SYSTEM Prerequisites for Testing General prerequisites have been met.
Test Objective and Summary Testing will demonstrate proper operation of the reactor trip and engineered safeguards actuation logic and output signals of the solid state protection system in response to simulated input signals on each channel. Each design logic condition will be tested and proper coincidence logic verified. Fail safe operation on loss of power will be verified. The manual reactor trip up to the tripping of the reactor trip breakers will also be' tested. This will include testing using the l640.17 2 Acceptance criteria The solid state protection system produces proper logic response for specified input signals. methods of Westinghouse Technical Bulletin NSD-TB-83-03 to individually s, test that a manual trip will remove power from the reactor trip breaker- 640.17 undervoltage coil and energize the shunt trip coil. l l I 63 of 82 l
. v.,
m l MUPS-3 FSAR TABLE 14.2-1 (Cent)
- 10. Demonstrate the proper operation of pressurizer safety and dd relief valves, and the capability of the pressurizer relief tank to condense a steam discharge frcm the pressurizer
- a. Proper actuation, operation, and response time of the power operated relief valves (PORV) will be demonstrated by simulating a high pressure signal to each valve. .
- b. The PORV will be operated manually to confirm valve operability and the ability of the pressurizer relief tank (PRT) to condense a discharge. Leakage following operation will be verified within acceptable limits.
Discharge header leakage detection instrumentation will be verified operable in accordance with design requirements,
- c. Operability of PORV and PRT instrumentation, controls, interlocks, and alarms will be verified.
- d. Safety valve leakage at RCS normal pressure will be verified within specified limits . Actual safety valve operation will be demonstrated by hydrostatic bench test to verify set points.
- 11. Operate the reactor coolant pumps for a minimum of 240 hours at full flow to achieve approximately 1 million vibration cycles on reactor internals. Following hot functional testing, the 8 L internals are removed and inspected for vibration effects. See c' Section 3.9N.2.3 for additional information on the required inspection. $
- 12. Demonstrate proper operation of reactor coolant pump trips and alarms
- 13. Demonstrate the operability of remote shutdown controls , .-
- 14. Perform or complete those portions of the following system tests (see individual descriptions), which require the RCS to be at or near normal operating temperature and pressure
- a. Reactor coolant system expansion and restraint
- b. Chemical and volume control
- c. Baron thermal regeneration
- d. Residual heat removal
- e. Low pressure safety injection
- f. High~ pressure safety injection
- g. Reactor plant sampling
- h. Containment ventilation 76 of 82 I}}