ML20005A488

Revised Draft SEP Review of Safe Shutdown Sys for San Onofre,Unit 1

ML20005A488
Person / Time
Site:	San Onofre
Issue date:	06/20/1981
From:	FRANKLIN INSTITUTE
To:
Shared Package
ML14133A497	List: ML14133A495 ML20005A488
References
TASK-05-10.B, TASK-05-11.B, TASK-07-03, TASK-5-10.B, TASK-5-11.B, TASK-7-3, TASK-RR TER-C5257-309, NUDOCS 8106300386
Download: ML20005A488 (100)

Text

_.

(~%,

~\\

]

SEP Review of Safe Shutdewn Systests for the San Onofre Unit 1 Nuclear Power Plant l

THIS DOCUMENT CONTAINS l

POOR QUAUTY PAGES 81063003F(p NL Franklin Research Center A QBummen af hFeesman m

i

~

TER-CS257-309 CCNTEN*S Pace Section 3-1 1

INTRCDCCTICN.

B-6 2

DISCUSSICN 3-6 2.1 Normal Pl:rt Shutdown and Cooldown.

Shutdown and Cocidown with Icss of offsite Power 3-11 2.2 3

CCNFCRMANCE WI"5 3 RANCH "'ECHNICAL PCSITICN 5-1 3-12 FUNCTICNAL REQUIREMENTS.

3-12 3.1 Sackground.

Table 3.1 Classification of Shutdown Systems

~.

3-14 3-25 3.2 Functional Requirements.

3.3 Safe Shutdown Instrumentation 3-55 3-57 Table 3.2-9 Safe Shutdown Instruitents 4

SPECIFIC RESICUAL~ HEAT REMCVAL AND CTHER REQUIREMENTS CF 3 RANCH TECHNICAL PCSITICN 5-1.

e 3-59 4.1 Residual Heat Removal System Isolation Requirements.

5-59 B-61 4.2 Pressure Relief Requirements 3-66 4.3 Pump Protection Requirements 3-66 4.4 Test Requirements B-67 4.5 Cperational Procedures.

E-68 4.6 Auxiliary Feedwater Supply.

5 RESCLUTICH CF SYSMTIC EVALCATICH PROGRAM TCPICS B-69 5.1 *opic V-10.3 PER System Reliability B-69

)

5.2 Topic V-11.A Requirements for Isolation of 3-69 1

High and Low Pressure Systems

)

5.3 Topic V-11.3 RER Interlock Requirements 3-70 I

l 5.4 Topic VII-3 Systems Required for safe Shutdown.

B-71 3-74 5.5 Topic X Auxiliary Feed System.

3-76 6

REFERENCES j

i B-Lii l

@a..; Franidin Research Center j'[

A het h#meen memame-I

=

4

~

TER-C5257-309 1.

INTRCLUCTICN The Systematic Evaluation Program (SEP) review of the ' safe shutdown"

~

subject encompassed all or parts of the following SIP topics, which are among those identified in the November 25, 1977 NRC Cffice of Nuclear Reactor Regu-Lation dccu=ent entitled ' Report on the Systematic Ivaluation of Cperating Facilities":

1.

Residual Heat Removal System Reliability (Topic V-10.8) 2.

Requirements for Isolation of High and Low ?ressure Systems

.(Topic V-ll. A) 3.

Residual Heat Removal Interlock Requirements (Topic V-II.3)

Systems Rec. tired for Safe Shutdown (Top 115 VII-3)

~

4.

5.

Station Service ani Cooling Water Systems (Topic IX-3) 6.

Auxiliary Feedwater System (Tcpic X).

review was' pr marily performed during an onsite v,isit by a team of SIP The personnel. This onsite effort, which was performed from June 25 to June 27, 1978, afforded the team the opportunity to cbtain current information and to,

examine the applicable equipment and procedures, and it also gave the Licensee (Southern California Edison) the opportunity to provide input into the review.

The review included specific system and equipment requirements for remaining in a hot shutdcwn condition (defined as the reactor su? ritical wnile reactor coolant temperature is :naintained with the reactor residual heat, a

minimum number of reactor cociant pumps, and steam generator pressure af 930 psig) and for proceeding to a cold shutdown condition (defined as reactor coolant temperature less than 200*?).

The review for transition from reactor oporttion to hot shutdown considered the rem irement for the capabili:y to perform this operation from outside the c introl room. The review was augoented as necessary to assure resolution of the applicable topics, except as noted below:

Topic V-ll.A (Requirements for Isolation of High and Low Pressure Systems) was examined only for application to the residual heat removal s-1 4,unneee_e,ch _Cemen Atu.em m

ww

,n-

-,,--,w

---,,,.vw.,,-

~

TER-C5257-309 Qualification of ?afety-Related Equipment), and V-1 (Co. pliance with Codes and Standards) could be af fected by the results of the saf e shutdown review or could affect the safety of the cyst. ins that were leviewed. These effects will be ;eviewed later. Further, this review did not cover in any significant detail either the reactor protection ristem or the electrical power distribution, both of which will also be reviewed later.

Thestafdconsidersthat the ultimate decision concerning the safety of any of the SIP facilities is based upon the ability of the f acility to withstand the SEP design basis events (CBEs). The SIP tcpics provide a cajor input to the CBE revie's, from the standpoint of assessing both the probability and the consequences of the event. As examples, the safe shutdown topics pertaining to the listed CBEs are provided,in Table 1,(the extent of applicability will 1.a determined during the plant-specific review).

Completion of the saf e shutdown topic re.viev (limited in scope as noted above), as documented in the attached report, significantly contributes to an assessment of the existing safety =argins.

Pinine Svstem Passive Failures The NRC staff normally postulates piping system passive f ailures as (1) accident-initiating events in accordance with staff positions on piping failures inside and outside containment, (2) system leaks during long-term coolant recirculation following a LOCA, and (3) failures resulting from harards such as earthquakes and tornado missiles. In this evaluation, certain i

piping system passive failures have been assumed beyond those normally j

4 postulated by the staff, e.g., the catastrophic failure of moderate energy systems. Thase assumptions were made to demonstrate safe shutdown system redunda-cy in the event of complete failures of these systems and to facilitate future SIP reviews of CBEs and other topics that will use the safe shutdcwn evaluation as a source of data for the 572 f acilities. SRP 5.4.7 and 3TP RSS 5-1 do not require the assumptions of piping system passive failures.

1 a!

14 a_3 1

L Franidin Reseeren Center j ],

4om

.# % rewanm.nme

~

r 'v we-v m e-p

,+y

e s

"ZR-C5257-309 Credit for coeratino Procedures For the safe shutdown evaluation, the staff may give credit for facility operating procedures as alternate means of meeting regulatory guidelines.

Those procedural requirements identified as essential for acceptante of a SEP topic on CBEs will be carried through the review process and considered in the integrated assessment of.he f acility. At that time, we will decide wnich procedures are so important that an administrative method must be established to ensure that, in the future, these operating procedures are nc.t changed without appropriate consideration of their importance to -Jte SEP topic evaluation.

m es.

e e

e S

I

)

3

~

P00R ORIGINAL

+!,"i,U Frenidin Research Cemer 4 w wr

~.., _

s T u -C5257-309 At this point in the shutdown, the plant is in hot standby and the reactor power level is maintained by manual control of the controlling group of rods at (10% of full power and T betwaen 525'? and 540'F.

The acq pressure of the main coolant will be automatically controlled and maintained at 2085 pair.

s The secondary plant (turbine generator and auxiliaries) is in a hot standby condition with the unit on turning gear, steam seals on, normal vacuum, steam generator levels manually controlled at 50%, and a minimum nummer of auxiliaries in operation. An alternate source of auxiliary electrical power is available.

A :.icensee representative stated that during operatica at hot standby the

• eedwater to the steam generators is supplied by The auxiliaiy feedwater pumps, but this is not defined in the procedure. The path of the coolant from the auxiliary f eedwater pumps to r's steam generators would be from the condenser hotwell via the conden. ate pumps to either the condensate storage cank or the auxiliary feedwater pump section..

• he auxiliary feedwster pump suction is taxen frem the makeup and reject line to the cendensace storage tank.

Operating Instructions, " Reactor Shutdown from Ect Standby to Hot Shutdown," define the next steps in the plant shutdown. There are three major steps in this evolution:

1.

Trip all control rods into the core.

2.

Raset reactor trip breakers and withdraw shutdown god group No. I to the withdrawn position.

3.

Reduce the number of operating reactor coolant pumps to the minimum required to maintain Tavg within the operating temperature limi s.

The reactor is now in the hot shutdown condition with the reactor suberitical and shutdown red group No. I withdrawn. The reactor coolant system temperature is being maintained at approximately normal no-load value with reactor esidual heat and a minimum number cf reactor coolant pumps operating. Steam generator pressure is maintained at 930 psig by the steam dump system.

nidirr Research Center P00R BRIGINAL A Onesi el he reuset wenus

- +

7-e'

+

s "22-C5257-309 3.

Field breaker opens and there is no generator inertia coastdown for main coolant pumps.

Suosequent operator actions are te restore power to 4160-V ac buses 1A and 13 from the 220-kV system in the same manner as described in the not, mal approach to the hot standby condition and to restart eit.her A and C or B reac or c clant pumps. At this point, tue plant condit ens are :he same as at i of step No. 1 of the precedure

• Reactor Shutdowr. from Ect Standby to the Hot Shutdcwn."

O.s next procedure. " Plant Ect Shutdown to Cold Conditions,

• describes a method of cooling down and depressurizing the reactor from the hot shutdown to a refueling condition in which the reactor coolant temperature is =aintained below 150*F.

Prior to the cocidown, it is determined that the boric acid and primary makeup water systems have enough capacity to ecmpensate for the reactor coolant shrinnage.

O.e cocidown is then acccmplished by performance of the following steps:

1.

Berate the reactor ccolant system (RCS) to the cold shutdown concentration.

2.

Switch off all pressuri:er heaters.

3.

BMin cooldown of the RCS.

Place steam dump controller 413A on manual control and, if possible, maintain steam,

dump to condenser only.

Begin cooldown of the pressuri:er and depressuri:ation of 4.

the pressurizer and RCS with the pressurirer sprays.

Reactor coclant pump 3 or pumps A and C must be operated for spray flow.

5.

Manually block the saf ety injection actuation circuit when

~

the alert-to-block safety injection alarm is received or when pressure is appecximately 1750 psig.

6.

As cooldown progresses, maintain the pressurizer water level as high as possible.

7.

As the letdown flow decreases, open additional letdown orifices.

8.

Cpen reactor coolant pump seal bypass flow valve CV-176 when any one of the-three seal leak-off flows is 1 gpm on a running pump and the RCS pressure is 1500 psig.

4,MU FrankResea.rc.h.C.e.' iter 3-5 y

aon wn.r...

~

J, 8 jd

? R-C5257-309 cperster is directed to verify the operation of the steam du=p system, to ecnfirm nte stic starting of the diesel generators, anel to perform the necessary electrical switching to remove connections to -Je offsite power lines ud to connect the diesel generators to 4160-7 ac buses 1C and :C. Upon restoring power to these buses, the 480-V motor control centers will be autenatically teenergized. Diesel generator cooling and other support ' cads are thus reestablished. An au.xtliary feedwater pump is manually started to restore steam generator level to approximately 50%. Currently, design modifications are proposed such -Jat the auxiliary feedwater system will A

automatically initiate once low level in the steam generators is reached.

component cooling pump and an air compressor will start autcmatically on their respective low pressure signals. The operator must start a salt water cooling pump for :he heat removal frca the componenr. cooling system and. a charging pump for ptimary coolant inventory. Since the procedure is ccmpleted upon reaching a hot shutdown conditien, the cperator is instructed to energi:e the pressuri:er heaters. The peccedure does not provide instructions for securing

~

another source of water fer auxiliary f.eedwater pumps af ter the supply in the condensate storacie tank is exhausted. However, Cperating Instructions,

" Auxiliary Feedwater System Cperation," provide for aligning alternate water scurces as required.

The plant experienced a loss of offsite power and a subsequent loss of l

cne diesel generator on June 7, 1973. The unit had oeen shutdown on June 2, 1973 in preparation for a refueling outage and the RER system was in service at the tir.e of the loss of power. The single diesel generator supplied sufficient power foc approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> until offsite power was restored.

Since that loss of off. site power, the two 600-kW diesel generators have been l

l replaced with two 5000-kW units. The 6000-kW units inere installed and tested l

in 1977, and u I&E inspector verified that the acceptance criceria given in the test procedure were met. With the increase in diesel genvrator capacity, it ap; cars feasible to utilize the equipment used for a normal cocidown in order to achieve cold shutdown with a loss of offsite power. Ecwever, operator action is required to manually open breakers to the ofisite power lines and to place loads on the diesel generators.

l h

a-11 q

-sb Franklin Research Center

]

=i g

t a on==..e ne r. _ -

i l

i i

TZR-C5257-309 available and determined that the *only onsite power available" case is more limiting. The plant electrical system is sufficiently versatile to allow i

Therefore, ce energizing of all necessary equipment from only offsite power.

staff concentrated its evaluation of the San Cnofre Unit 1 safe shutdown systems to' shutdown folicwing a loss of offsite power.

A *saf ety-grade" system is defined, in tne NCREG-0138 (Reference 1) dise;ussio, of issue No. 1, as one 9nich is designed to seismic Category I (Regulatory Guide 1.23) Quality Group C or better (Regulatory Guide 1.26), and Institute of is operated by electrical instruments and controls that meet Electrical and Electronics Engineers Criteria for Nuclear Power Plant-Protection Systems (IIEE Std 273-1971). San Oncifre Unit I received its

)

i Provisional Cretacing License on March 27, 1967 pcior to the issuance of

' Regulatory Guides 1.26 and 1.29 (as Safety Guides 26 and 29 on March 23 and June 27, 1972, respectively). Also, the proposed *

• Std 279, dated August 30, 1968, was - not used in the design of the f acil,ity. Therefore, for this evaluation, systems which should be " safety-grade" are the shutdown systems classified in Tamle 3.1 and 'those esculated in the mi: imum list of safe ghutdown systems that follows.

General Design Criteria (GOC) 1 through 4 (Reference 3) require that l

be constructed to systems, structures, and cor.ponents important to safety (1) quality standards, and (2) be protected from the effects of natural phencmenT GDC 5 (earthquakes, etc.) and other conditions (fires, pipe breaks, etc.).

requires that systems important to safety not be shared among other nuclear power units unless such sharing does not significantly impair the performance l

l of system safety functions. The various aspects of GDC 1 through 5 will be i

I evaluated for.he San onofre Unit i systems and equipment, including the systems required for safe shutdown, elsewhere under several SF2 tcpics.

In order to accomplish a plant shuecown and cocidown following a loss of otfsite power, certain " tasks" must be performed such as core decay heat removal, steam generator maks"p, and component coolico. The staff and Licensee developed a " mini.aum list" of systems necessary to perform these tasks, considering a loss of offsite ac power and the most limiting' single l

P00g gggg,NAL

~

a_._

I 99 Nii #

/A

• $M>

%d.7,

+

TEST TARGET (MT-3) 1.0 lg m ng w:: na p=2 a

l,l

.h,

!!llN

~

i ll l.8 i,

l.25 1.4 1.6

'S y

g 1

'(;;(,h 4(f,i,,7 i

L

gA&>

kAV

++/

%'s4 TEST TARGET (MT-3) l.0 lf H UM 1.1 ' ((lS ll!!iM h

'd i

OllM 4

3 I l.8 l

111.25 1.4 1.6

'~

11 6"

1. • r*g,

/+4%

'iiV,3t////

'th.;,{$

Td).$,)*

'I{4'k

+

TEST TARGET (MT-3) l.0 WMen y @ lie 1.l i"2 Ea

_1 i.g 1.2 5 '

l.4 1.6 l

i 6"

+

1 1

<?+

4kh*r?">'// '4 ?' >

? 4/

o

< >4,g,%

v 4*

t

m

$53 TAbt.E 3.1 (Continued)

' g; Quality Group Seismic

o R.G.

1.26 Plant H.G. 1.29 Plant 3

Components /Subsystema SDP 3.2.2 Design SitP 3.2.1 Denign itema r k s h

Piping (loop A),

ASHE III USASI D31.1 Seismic

, 14ote 1 f

letdown line via Class 1 Category I reg. IlX to and including air operated valves CV-202, -203,

& -204 y

Piping (loop D)',

ASME III USASI B31.1 Seismic Hote 1 C

letdown sine via Class 1 Category I excess letdown llX to and 1polud-ing air operated valve llCV-1117 9

2 Piping downstream ASHE III USASI H31.1 Seismic Hote 1 o*. valves CV-202, class 2 Category I

-203, anul -204 to D

RIIH 1ine intesface 313 Piping downstream ASME III USASI D31.1 Seismic

.wte 1 Ref. Uwg. No. H20-568767 of HilkilX tiaroujls Class 2 Category I valve TC-Ilot, via FC filter to Volume Conttol Tank (VCT)

D Piping from VCT to ASME III USASI D31.1 Seismic Hot e 1 cliagging pumps Class 2 Category I r---

M

t o

EE g.

D yg TADI.E 3.1 iContinued)

]

E I.:3 Seism.ic 1,"

Quality Group R.G. 1.26 Plant H.G. 1.29 Plant compone nt s/Sut>sy stems SitP 3.2.2 Design SHP 3.2.1 Design Hemarks l

Charging puisp oil ASME III ASHl; VIII Seismic fleil e 1 Hef. Appendix of SCE is t stat ed hen cia 21, coolers Class 3 Categcry I s>/3

'Pipinn-Se i smic Hon-Seismic s,ystems and tot steam loop and "11ters Group D (t!!Lers) ASA Category A supply to Liarbisie AFP D 31.1, b l 6. 's and ataosphesic < Jump D

Cosapressor s and piping ASME III Hote 1 Seismic Hole 1 valves ( AINs).

Q for safe shutdown Class 3 Categosy I' valves in EllH, CCW, g

CVCS, AFP, and ADV.

systems.

Hef. DwJ. No. H20-5154026.

N DIESEI. CENEttATOlt FUEL. 011.

ii.2 L e s Intu is for ex-mus S1oRAGE AND SUPPLY SYSTtM piesel Unit 1,!>ut also m

Diesel ruel Dil Stor-ASME Ill ASME !!!

Seismic Category A applies to plesel Un!L 2.

2 age Tank (D-23)

Class 3 Class 3 Category 1 Tanik located uswterground.

r--

t TAbl.E 3.1 (Continued) 3

?[

'?

3 E

4' 3 Quality Group Seismic it. G. 1.26 Plant R.G. 1.29 Plant f

Components / Subsystems SitP 3. 2. 2 Design Site 3.2.1 Design 14emas k s h

A puplex 1..O.

Filters ALME Ill ASME Vill Seismic Seismic Class 3 Category 1 Category A L.O. Strainer ASME III ASME Vill Seismic Selcalc Class 3 Category I Category A L.O. Pump ASME III Mannt cLurer Seismic Seir.mic Class 3 standards Category I Category A 4

IEt:E Std 344-11 to b

Piping and Valves ASME III ASME Vill Seismic Seismic Class 3 or At4St D)1st Category 1 Category A DIESEi. GEtat;ltATOtt COOI.It4G l

WATER SYSTEM Cooling Water lleat ASME III ASME Vill Selbalc Seismic ite t. IMJ. No, M20-5154028.

i Exchanger (E-5)

Class 3 Category 1 Cats. lory A tiotes Into is for Diesel unit 1, t.ut airo atplies

i o.-

unia Expansion Tank (D-21)

ASME III AShE VIII Seismic Seismic D

Class 3 Category I Category A J

Cooling Water Pump ASME I:I Mtg Std Seismic Seismic Class 3 Category I Category A Piping and valves ASME III Seismic Seismic Class 3 ANSI D31.1 Category 1 Category A

~

l2:=

r--

=

TIR-C5257-309 failure. Although other systems may be used to perform shutdown and cooldown functions, the blicwing list is the minimum number of functions required to fulfill the STP RSS 5-1 criteria:

1. Atmospheric dump valves

2. Turbine and motor-driven auxiliary feed pumps

3. Water sources - condensate stcrage tank and service water reservoir

4. Residual heat removal system

5. Component cooling water system

6. Salt water cooling system

,7. Chemical and volume control system - refueling water storage tank

8. Instrument air system

9. Instrumentation for shutdown and cooldownf...

10. Emergency power (ac and del and control pcwer for the above systems and equipment.

The stafi's evaluation of each of these systems with respect to the BTP 5-1 functional requirements is given belcw. The powe: supplies and 1cca': ions of ma:or safe shutdown ecmponents are,al'q provided.

s l

3.2 Functional Recuirements ATMCSpE NC CUMP VALVES AND STIAM CCMP CONTRCL SYSTIM 1

Task: Removal of core decay heat by venting steam frem the main steam system directly to atmosphere.

Discussion Immediately after the loss of offsite ac power, turbine trip, and reactor

~

scram, the steam bypass and dump valves cperate to impose an artificia3. load on the RCS and to limit the coolant temperature within design limits. Failure of the steam bypass or dump systems only curtails the ability to accept step load reduction. In this case, the steam generated due to residual heat or plant transient is discharged through the main steam safety valves to the atmosphere. Main steam safety valves (MSSVs), in accoedance with ASME "For a list of safe shutdown instrumentation, see Section 3.3.

[thranidin Resear.ch Center 4%wmr

,-w,,

,,n,e,

-nv,wg rw-

a

\\

1 TER-C5257-309 Redundancy Assuming the availability of either SDCS controller, there, are four A vs available for removing energy from the RCS.

However, the plant procedures for a loss of offsite ac power direct the cperators to start (if not already star ed) one of the two 6000-kW statien emergency diesel generators (E*;Gs),

energize one of the 4-kV buses, and restart ene circulating water pump. Once condenser vacuum has been restored, the SBVs are then able to dump steam l

directly to the condenser, thereby providing another path for RCS energy removal. Each I::G has sufficient generattng capacity to power the necessary feed system components (condensate and feedwater pump) to utili:e the condensed steam in the hotwell.

(This is further discussed in the followtng section.) Although the 53Vs, condenser, condensate pump, and'feedwater pumps

~

are not part of the " minimum systems,' they are mentioned 1 ere because they provide further redundancy beyond that provided by the f'ur ADVs.

In additien, the turbine-driven auxiliary feedwate t pump disenarges" its steam directly to the envi ?nment and, if operating, would remove energy fecm the steam generators. The turbine-driven auxiliary feed pump uses 8100 lbm/hr of steam at an inlet pressure of 600 psig and a 5 psig back pressure.

"'he following table shcws the earliest times af ter loss of offsite ac pcwer and scram when each ecmponent individually can remove the amount of core decay heat being added to the RCS.

Numcers are based on the core decay heat curve resulting frem infinite aperating time, the indicated steam flow races, and an energy removal rate of 650 Stu/ihm (h at P = 1000 psig).

gg RCS Full Approx.

Steam Energy Power Time After Flow Removal Fraction Scram

• Cemeenent (1bm/hr )

(Beu/hr)

(4)

(see) 2.38 x 10 5.12 8

s ADV 1.74 x 10 3.79 55 53V 6

Turbine AFP 8100 5.20 x 10 0.11 10 l

'Sased on Reference 4.

The time when the component energy removal capability equals the decay heat input corresponds to the time when (1) 1.! ant cooldown commences if the-D. h!:d FranWin Research Center B-27 a we wr==ma w

=

.e

-e

TER-C5257-309 Location and Ocoration The staff evaluated the aquipment discussed above with respect to its location and operability during a loss of offsite ac power. Table 3.2-1 gives the equipment's location, the pom ts from which it may be operated, and the equipment's power supply.

TURBINE-AND MOTCR-CRIVIN AUXILIARY FIED PCMPS Task: Providing steam generator makeup inventory whenever RCS temperature is >350*? and the feedwater system is inoperable.

Discussion While the PCS temperature is above 350*F, the core decay heat is removed by bleeding steam from the steam genera' tors using the various components and flow paths discussed in the previous sections. The condensate and feedwater pumps are normally powered frem offsite power so these components willnotbeitmed(atalhavailable, e

Two AFPs,, one turnine-driven and one motor-driven, are pre.vided to supply steam generator feed in the event of a loss of the mair; feed system. Flow from the AFPs can be directed to the steam generators by two paths. The normal path is from the pumps to the main feed header through connections upstream and downstream of high pressure feed heater. The second path is the emergency feedwater line, a 4-inen line that can be supplied by either AFP.

niis line branches into three 3-inch lines that join the main feed lines for each of the three steam generators between the main feedwater ' regulating valves (!RVs) and the main feed line containment penetrations. A normally closed isolation valve in the 3-inch line must be opened manually to supply feedwater through the emergency lines.

Control of A27 flow through the normal path is by means of aisperated auxiliary feedwater regulating valves (AFRVs) which bypass the main FRVs.

Another line bypasses each of the TRVs. This line has a 2-inch manual valve ndaRes a Ig;ygg_

- e_rch Center

TER-C5257-309 L

that may be spened to allow feedwater :,o bypass a failed-closed FRV.

Centrol c f the auxilia.y feedwater through the emergency lines is by manual p.itioning of the 3,

'*ms in each line. The FRVs and AFRVs are air-operated aid cont:

• rm

.se control room. On loss of air, the FRVs fail open, while the ATRVs tali closed.

Failed portions of the ATP flow paths can be isolated by manual valves, hydraulic-operated valves, motor-operated valves, air-operated valves, and check valves. The remotely operated valvets that can be used to isolate failed portions of the AES are the FRVs, AIRVs, and moter-operated valves (MCV-20,21,22, and 1204) and hydraulic-operated valves (HV-852A and EV-3523).

Closure of HV-6:2A and HV-8525 would isolate portions of the feedwater system from the auiliary feedwater flow path, but would'also isolate the feedwater

~

syrtem from the steam generators.

30th AFPs receive water through a 4-inch supply line tapping into a 14-inch condensate makeup / reject line from -Jie condensate storage tank. The passive failure of this line would render hoch AF7s inoperable. However, if o

either line should fail, indication of the failure in the control room would her a.

Cecreasing steam generator level (LI-450X, LI-451X, LI-452X) b.

No auxilia.y feedwater flow indication (FI-2002A, 3, C or F -2003A, 3, C)

If such a failure should occur, the steam generators could still be I

supplied by the main feed trains as addressed below in the discussion of system redundancy.

The steam supply for the turbine-driven AIP is provided from the main steam header upstream of the main steam stop valves. The main steam header design at San Onofre Unit I would result in the depressuriration cf all three

~

steam generators if a main steam line break (MSLB) were to occur upstream of the stop valves. Therefore, such an MSL3 would disacle the turbine-driven pump. A subsequent single failure of the motor-driven AEP would then leave no availabJe means of removing steam generator decay heat.

In this scenario, the O.., d Frankun Research,= Center 3-31.

';d a w U E1 y

a w n.r.-an

=--

e

1 Q

1 TER-C3257-309 l

The two San Cnofre Unit 1 feedwater pumps are also utill:ed in the ECCS system, and hence are provided with a highly reliable power supply. There are two 6000-kW EDGs, which enable the plant to operate the normal feedwater system (condensate and feedwater pumps) following a loss of offsite ac power.

Since there are redundant EDCs and feedwater trains, there is "ull redun-dancy in.he plant's ability to utt11:e the feedwater train following a sus-tained loss of offsite power. Sowever, as in the case of the two SBVs, the feedwater components are not included in the " minimum systems" list, and are mentioned here oni for. completeness.

Location and Coeration

~

The staf f evaluated the equipment discussed bve with respect to its location and operability during a loss of offsite ac pcwer. Table 3.2-2 gives the equipment's location,.he points from which it may be operated, and its power supply.

WATER SCURCES - CONCENSATE STORAGE TANK AND SERV 2CZ WATER RESEEVOIR Task: Provide water to the auxiliary feedwater system for steam generator makeup.

Discussion Both AFPs take suction

• rom the condensate storage tank (CST) via the 14-inch hotwell makeup and rejection line. This line leaves the bottom of the CST and then branches into the following:

1. A 3-inch hotwell rejection line (i.e.,

• low from hotwell using condensate pumps into the CST).

2. A 4-inch ccmbined AFP suction.

3. Two 10-inch lines. Cne is the emergency makeup to condensers E-2A and E-23.

The second connects to a 12-inch header with four 8-inch branches to the condensers (i.e. two 8-inch branches for each condenser).

P00R ORIGINAL B-33

..e' J Franidin Research Center 4'JJ acoa en.c_--

=

TER-C5257-309 l

The CST has a capacity of 240,000 gallons, and Technical Specification i

3.4 requires a minimum of 15,000 gallons. Following the loss of offsite ac power, the CST can be filled from either the primary plant makeup tank (PPMUT) or from the service water reservoir (SWR).*

- "he PPMU"' nas a capacity of 150,000 gallons and the SWR has a capacity of 3,000,000 gallons. The SWR supplies water to the two service water pumps (SWPs) and the two motor-driven fire pumps (fps). Technical Specification 3.4.1 requires at least 105,000 gallons to be available from the PPMUT and/or the SWR. "

Water from the PPMUT can be pumped directly into the CST using either of the two primary plant makeup pump (PPMCPs). Each pump is,cated at 100 gym at 235 total discharge head (TDE). Since adequate AEP makeup is'available from the SWR via the CST, as described below, the PPMUT and PPMUPs are not included in the list of safe shutdown systems.

Water from th*e SWR can be supplied to the CST using the fire protection system.

The' fps' pressurize the 8-inch facility yard fire main fecm the SWR.

Wo fire hydrants in the vicinity of the CST (.7-9 and TH-10) could be used to fill the CST through pcetable fire heses attached to 3-inch couplings on the CST drain and fill lines.

Redundancv There are two PPMUPs that can provide ficw frem the PPMUT to the CST.

The pumps have separate power supplies (MCC-1 and MCO-2) that are powered from separate sources. Even if bcth pumps become unavailable, the SWR normally has a large amount of impure water that can be used. The Licensee has calculated that gravity drain from the SWR into the fire protection system "The flash evaporators are the normal source of makeup of the CST and PoMUT.

Since the evaporators require LP turbine extraction steam for heating, the loss of ac power will disable them.

" Technical Specification 3.14 requires 300,000 gallons in the SWR for fire protection if the fire main is being pressuri:ed by the two SCNGS-1 fire e.

i pumps.

P00R ORIGINAL a _ _ c. _

S->s v

a TIR-C5257-309 Water in the condensers cannot be considered availacle. However, it is highly likely that a significant amount of condensate would be available to supplement the already mentioned supplies (steam generator inventory, CST, PPMUT, and SWR).

I.ccation and Ceeratien The staff evaluated the equipment discussed acove with respect to its location and operability during a loss of offsite ac per. Table 3.2.-3 lists the equip =ent' a location, the points frem which it =ay be operated, and its power supply.

RISIDUAL EF.AT RDtCVAL SYSTIM Task _: Removal of care decay heat and RCS latent heat to cool the system from 350*? to 140*F.

Discussion The RER loop is placed in service after the temperature has been reduced to approximately 350*F and the pressure to less than 400 psig. The RER system then reduces the RCS temperature to 140*F approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> af ter shut-down and operates continuously to caintain this temperature during =aintenance and/or refueling operations. The RER performance described here is based on s

Each of the two residual heat, operation of both pumps and beat exchangers.

exchangers is designed to remove one-half of the heat load when the residual heat loop is first placed in service during plant shutdown..This assures that partial heat removal capacity can bei maintained if one heat exchanger is inoperable. 'Since only one heat exchanger is required during nor-4 full power operation or during plant shutdown after residual heat produced by the core has diminished, loss of one heat exchanger does not limit plant operation.

The RER loop consists of two heat exchangers, two RER pumps, and the asso-ciated piping, valves, and instrumentation necessary for operational :ontrol.

Curing plant shutdown, coolant is withdrawn from the hot leg of loop C, pumped l

l

[Sd' Fukun Resear.ch. Center r-4 B-37 E UU I

i J

l a.w wwr

~

f w

TER-C5257-309 through the tube side of the residual heat exchangers, and then returned to the reactor coolant system in the cold leg cf loop A.

Decay heat lead is trans-

.arred through the RER cooler to the component cooling system that is cooled by salt water (salt water tooling system). An alarm will sound in the control room if the RER flow drops to 1000 gpm.

Ocuole remotely operated valving is provided to isolate the residual heat removal loop from the reactor coolant system. When reactor coolant system pressure is above the RER loop design pressure, an electrical interlock between the RCS wide-range pressure channel and the first set of RER isolation valves prevents the valves from being opened. During plant heatup, an alarm sounds in the main control room if RER pump discharge pressure exceeds a pcaset level when the isolation valves are open, *.hus indicating an approaching overpressure event.

The RHR loop is designed to be placed in operation approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> af ter reactor shutdown, when the RCS pressure and temperature are less than 4GO psig and 350*T,'respectively.

The heat load removed cy the residual heat e

i removal loop is maximum at this time. This heat load is the sum of tne residual heat produced by the core and the sensible heat removed from the RCS.

When the RER locp is placed in service, -le hot reactor coolant must be increduced into the RER loop gradually, by regulation of the remote-manual

<*ontrol valve (HCV-602) and observation of he flow indicator. The primary method of controlling the cooldown rate of the RCS is throttling of ECV-602.

In addition to RCV-602, automatic pneumat.c temperature control valves TCV-601A and 601S are provided in the inlet piping to the shell side of residual heat exchangers I-21A a.d E-213, r espectively. These temperature f

control valves receive a signal from temperature elements in the tube side cutlet of the residual heat exchangers. Normally, these temperature control valves are used to maintain the coolant discharge at il5'T when the residual heat exchangers cool primary coolant letdown. Thus the cooldown rate of the primary is altered by the throttling of HCV-602, the operation of TOV-601A and 6013, or a ecmbination of both.

D B-3 9-g E Franklin Research Center -

= >.em a - -

-a

+

l TIR-C5257-309 l

Total RHR HX Temos PER RHR' RER Total Tube Tute Shell Shell Heat Pump EX's RHR flow In Out In Out Removal (1ba/hr)

(*F)

(*F)

(*F)

(*F)

(Stu/hr) 6 2

2 1.17x10 140 112.5 31 95.5 32.2x10 0

2 2,

1.17x10 350 230 142 205.9 141x10 6

2 1

936X10 350 251 119.2 IS6 93x10 6

1 1

585X10 350 230 105 155.6 70.1x10 1

2 800X133 350 214 105.2 154.9 109x106 The worst single failure associated with RER system from the standpoint of heat removal is the failure, or unavailability,'of a single RER heat exchanger. This reduces the system's heat removal capability by about 34%.

However, even if an entire RER train were unavailable (one RER pump and heat exchanger), tne heat removal capability of the system would be well above the 6

core decay heat output (p/p, = 0.00 8 6 8 39.5 x 10 Stu/hr) 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> af ter the loss of ac power, and scram. Therefors, if the PER system suffers a loss of a pump and heat exchanger, the remaining train can be olaced in service 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> af ter the scram, an'.ae RCS cooldown can continue with only the remaining RER i

train.

The Licensee estimated the capability of the RER system under 'various single failures with the results given below.

Earliest Time Time to Cool Down RER Equipment RER System Can RCS from.350*F Available Be Placed on Line to 140*F (hr)

(hr) 2 pumps + 2 coolers 4

16 1 pump + 1 cooler 4

1 pump + 2 coolers 4

30-32 2 pumps + 1 cooler.

4 30-32 The San Ontfre Unit 1 RER system is susceptible to a completely disabling single failure. Specifically, if any one of the motor-operated valves in the suction or return lines fails to open, the RER system is inoperable. However, P00R0

..ranklin_Resea_rch_Ce_nter

I l

l bb

• f 3

E 43 l.

y t

S TA151.E 3.2-4 k

EQUIPMENT IDCATION CONTitOI. I' DINTS EI.ECTRIC 14MER SUPPL.Y BilR Pumps and Inside containment Contsol so[>m and 4-kV Pump A - SHGR 1 (400-V) (elev. 14')

so lleat Exchangers splier e (elev. 14').

and duu-V rooms at Pump B - SWGR 2 (480-V) (elev. 14')

h sup;ly lareakers.

RCS/IlllR MOVs Inside containment Contsol suom by remote Same as al.ove.

81:ere.

manual opesation and 4

locally by valve liandwheels.

I Cooldown valve Inside containment Control room and locally MCC-1 telev. 14').

IlCV-602 near bottom of A steam at the valve's feed / bleed generator (elev.

air to diaphragm. A steam 108).

manually operated backup valve, 776-4-T5.4, is also available.

6

x:s

~

n.

lllzlly

==m Summus 1

3:=

r--

e TER-C5257-309 operation of the plant is not affected. Eich heat exchanger is capable of removing one-half of the maximum heat reme. val load occurring between the 4th and 20th hours after a normal shutdown. The use of two cod heat exchangers and three cod pumps assures that the heat removal capacity is only partially lost if one exchanger or one pump fails. This pro-ision also permits maintenance of one exchanger and one pu=p while the other heat exchanger and one pump are in service.

• he table below summarizes the *.icensee's estimate of the CCd system capability under various single failures.

Earliest Time C04 Iquipment RER System Can Se Time to Cool Down Available Placed on I.ine RCS from 350* to 140' 3 pumps + 2 coolers 4h 16 h 2 pumps + 2 coolers 4h 18-20 h

~~

3 pumps + 1 coolers 4h 30-32 h There is no system which can replace the cod system in the removal of heat fr:m the RER coolers and the other heat leads. Should a rupture of the CC*d system occur, the breax must ce isolated f rom the remainder of the system.

If, for example, a CCA return line ruptures, then continuous makeup frem the surge rank using the manual fill valve may provide sufficient flow to meet tte CCd pump suction requirement.

(An isolation valve in.he C system between the surge tank and the makeup line would allow pressurization of the CCA pump suction with the PPMUP.)

i The staff performed scoping calculations to evaluate the heat removal capability of the cod system considering various equipment configurations and throttling of the reactor coolant flow on the discharge of the RRR heat exchangers. The C::W system temperature was limited to protect both the equipment being cooled and the cod equipment itself. Specifically, the CCd pump suction and heat exchanger inlet temperature was to remain below 200*F, and the CCd heat exchanger outlet temperature below 120*F for pictection of the reactor coolant pump bearings. The results demonstrate that one RER pump and heat exchanger, with the discharge throttled to approximately 400 gym, 4

coupled with one CCd pu=p and heat exchanger can remove the core decay heat hours aftee shutdown.

P00R ORIGINAL

l l

I bbs E

E3 TAllLE 3.2-5 f4 EOUllHE14T II) CATION cot 4TitOI. PolitrS EIICTi4IC POWER SUPP!J ln 4k CCW Pumps Outside, on roof of Control room and the 4-kV Pump A - SWGit 1 (480 V) (elev. 14').

(three) reactor auxillary and 400 V rooms at the Pump B - SWGit 2 (480 V) (elev. 14').

building, west of supply breakers.

Pump C - SHGit 3 (480 V) (elev. 14').

containment sphere (elev. 20').

Same as above.

local operation only of Hone.

y CCN Ileat Exchangers and the heat exchangers and Surge Tank CCW expansion tank filling.

HOV-720A(D)

Outalde, north of Control room and local.

720A HCC-2 (elev. 14').

CCW Ileat Exchanger CCW beat exchangers 7208: HCC-1 (elev 14').

I Discharge Valves (elev. 20').

TCV-601A, B Outalde doghouse Automatic temperature i< emote manual Temperature on west side of control and r exnte from itegulated Control Valves containment, manual from the control Dus l1.

for E-21A and room.

E-21D Bleat Q

Exchangers, g

g respectively Id 6

m"23 s

2:=

F"""

db c

• M

[,

C3 f2-f IB TAhlE 3.2-6 n

9k

=

EQUIPMEffT EDCATION COffTitut. POINTS 1;IJfTitlC 1444111t tiUPPLY SNCPs (two)

Outside, side by side Control room and Pump A - SWGit 1 (480 V) (elev. 14').

In the facility pt.:.p swi tclagear room.

Pump 1: - iWGH 2 (400 V) (elev. 14').

well (elev. O').

1*

Screen Wash Outside, side by side Control room, switclagear Pump G43-SWGit 1 (480 V),

Pumps (two) in ttie facility pump room, and local.

Pump G43S-SWGli 2 (480 V).

well, west of Llie: SWCPs.

3 Main Circulation Outside, side by side Contsol room and

' Pump A - Ims 2C (4160 V).

Water Pumps in Llie facility. pump swi tcli9 ear room.

Pump B - bus IC (4160 V).

(two) well, east of ttie SWCPs.

Auxiliary ShCP Outside, west of tiie Control room and LWGit-3 (400 V).

pump well, next to pitcligear room.

Llie tsunami wall.

Cllllll3

• \\

t C3 s

ll2llp A

a Cll2 b

2 a

3

-O t

r---

d

1

=

l "IR-Cf.T7-309 Location and Coeration :.:. :ss.: - : :: :. :..- -.:

....:1.-

r..

• he staff-evk1 hated th6 equip =Ent 51scussed above' with'Yespest"to les-~

location and' operability dQring k W Y of dffsite he powei.Tible Y.Y-T g'!.ves the equipmei ~th-I.bcati'on, the' points from whlch it may bk operated,'ahd its 3,.......

e sup M ----..........,- ----- - -

.::::1: ::s.:.:.

=~=* ' ' * = '

~

==

~

-.ERGENCY DIESid. N TOR W

.::.n:

r.,.-

.r. :: :::. :

s ::.:

Task: Supply a reliable source of ac power for necessary equipment.

2

.n : - :... : :s :: :..r :

Discussion

!~

5

~ ~

1. 2 2 -- # --'"*b"-

~~~;'~-

=

s-s:-..

The staff's evaluation of the EDCs is contained in Section 2.1.2 of the SER regarding the starttp of san Chorre Unit 1 foi Cycle 6-(Amend:nent 25,-

22 N 2

- 227 :

2

-'~

April 1, 1977):

: :;.:.: s :: -. +.e::-

t-c.-:

^ * * '

'~'"'3-

~~' '

~" ;;'

125 V OC PCWER*

-s Task: Supply a re.liacle.s.o. u.rc.e.o.;f d.c. oowe. r., fo.r breake. r control and

-y instrumentatien.-

Discussion The staff's, evaluation of the 125-V de San Cnofre bus.tl is :entained in the SER referenced in the ED.G se.c. tion.,.abov.e.......

CHIMICAL AND VCLCME CONTRCL SYSTZM Task: Previde RCS makeup (required.due to the contracticn of the coolant

=........

during cooldown) and borate the RCS to the necessary shutdown margin.

Discussion t

The CVCS consists of two centrifugal charging pumps, the regenerative heat exchangersi pressure reducing valves and orifices, either or both of the two RHR heat exchangers, the volume control tank (VCT), refneling water storage tank (RWST), and associated pipingi valves : fittings ard. instruments.

l zw m P00ROR

=

"TR-C3257-309 i

During ncesal operation,,reactmc coolant is withdrawn from the cold leg l

of loop A at approxisately 550*F.

The coolant then passes through the snell side of the regenerative heat exchanger (REX), through the letdown orifices (three in parallel), then through tne tube sida of one of the RER heat exchangers, af ter which the' coolant terrporature and pressure have been reduced to acout 115*? and 350 psig, respectively. After another pressure reducticn to 150 psig, and after leavt19 containment, tna coolant flows through varicus domineralizers and then into the volume control tank.

The charging pumps take a suction feca the VCT, -Jian pump the coolant through charging and pressurizer level control valves, througa the tune side ef the REX, then into locp A at about 460*F.

During periods of decreasing power level, the charging fkow is increased by the pressurirer level centrol to make up for the contraction of reactor coolant water and the temperature of the letdown stream leaving the regenerative heat exchpnger decreases. There is sufficient space in the volu=e centrol tank between ene cakeup set point (low level) and the radioactive waste disposal system dump set point (high level) toaccobmodate ecolant expansion and centraction resulting from changing reactor power level.

The chemical blander, boeic acid transfer pump (BATP), and reactor makeup control system act together to inject a predetermined volume of mixed boric acid and pure water into the VCT.

There are three modes of operation:

automatic makeup mode, dilute mode, and borate mode.

The charging pumps are centrifugal pumps with a shutoff head of 5600 feet

(%2400 psig).c.d a maximum flow of 280 gym (at 5100 feet). The charging pump suction can bet from the following sources:

I

1. RWST (gravity ficw)

2. VCT (gravity flow) i i

3. Chemical blender (BATP + PPMUP)

=

4. T*"'UT (PPMUP)

5. BAT (BATP)

6. Batching tank (BATP).

Scration of the RCS using the blender described above is acccmplished with the boric acid tank (3500 gallons - 12 wet H 30 ).. The refueling 3 3 M.,b Frenidin Research Center B-53 e

h A

a sg A Clenumse d the hasume buumas-

TIP.-C5 257-309 pump seals. Since the test pump does not have sufficient capacity to provide the necessary reactor coolant makeup during cooldown, it is not considered to be part of the equipment associated with the minimum systems list.

The test pump has been addressed because it does provide a path for berated water injection to the reactor coolant system.

Either the 3AT (12 wc%) or the RWST (3750 ppm) can dorate the RCS sufficiently to reach cold shutdown with adequate shutdown margin at any time in core lif e. '

Lecation and Operation The staff evaluated the equipment discussed above witn respect to its location and ope-ability during a loss of offsite'"ac power. ' Table 3.2-8 lists the equipment's location, the points from which it may be cperated, and its pcwer supply.

Safe Shutdown Instrumentation.

3.3 Table 3.2-9 lists the instruments required to conduct a saf e shutdown.

The list includes those instruments which provide information to the control reem operator from which the proper operation of all safe shutdown systems can be inferred. These instruments are the RCS pressure and temperatures, pres.

suri:er level, and steam generator level. Improper trending of taese parame-ters would lead the operator to investigate the potential causes. Cther instruments listed in the table provide the operator with (1) a direct check on safe shutdown system performance and (2) an indication of, actual or impend-ing degradation of system petformar.co. The list of instruments satisfies the requirement of 3TP RSB 5-1 for safe shutdown. The DBE evaluations, which in many cases are not based on the same assumptions as this review, may determine that additional instrumentation is required to achieve and maintain a safe 3

shutdown following a OBE.

The design of the instrumentation and controls used for. safe shutdown will be evaluated later in the electrical portion of the resolution of SEP Topic VII-3.

arrom bases for Technical Specification 3.2.

ORIGINAL ranklin Research Center

Ni Q,}

TAllt.E 3.2-9 SAFE SliuT1xMH INSTDLMENTS El5 e

1,"

Component /

System InstrumenL Instrument location References Steam Generator Steam Generator level (t/r&

LT-Inside Containment EMG. 56u?66 LI 450, 451, 452)

LI-Control koom Aux 111ary Feed System Condensate Storage Tank L1-Control Hoom IMG. 560776 level (1.T 6A, D3 LI 6A, b)

LT-At Tank Aux. Feed flow (ET & F1 kT-tM Hezzanine 2002 A,0,C and 2003 A,u,C)

FI-Control Hoom Y

Chemical and Volume Refueling Water Stosage LI-Control Hooin IMG 568769 Control Tank level (l.I 950)

FIT-Piping Penetration Bldg.

IMG. 568767 CVCS Pump flow (FIT &PI-1112) F1-Control Room i

Residual lleat Removal Built flow (tT&FI-602) t'T-Inside Containment FI-Control Houm (MG. 560760 System D

Component Cooling CCW flow (tT&F1-606) tT-Auxiliary lluilding IMG. 560768 FI-Control Hoosa g

Water System CCW Surge Tank levul alarm IC-Auxiliary Duilding h

g (if-610A & D)

Alarm in Control Hoom O

U D

Salt Water Cooling System SCW flow Intake Structure Y

(EE-6, 63-7) ammunne 2:=

I'"""

i TIR-C5257-309 4.

SPECIFIC RESIEUAL dIAT REMOVAL AND CTHER REQUIREMENTS CY 3 RANCH TECHNICAL PCSITICN 5-1 Branch Technical Position 5-1 also contains detailed requirements for specific systems used during safe shutdown. Each requirement is presented telow vi-h a deacriptien of the San Cncfre system or ec:tponent *eatures :o which tha requirement is applicable.

4.1 RER Systett Isolation Recuirements Recuirement The fo11cwing shall he provided in the suction side of the RER system to isolate it " rem the RCS:

1.

At least two power-operated valves in series. The valve positions shall be indicated in the control rocm.

2.

The valves shall hase independent diverse interlocks to prevent the valves fecm being opened unisss the RCS pressure is telcw the PS.R system design pressure. Failure of a power supply shall not cause any valve to change a

position.,

3.

The valves shall have independent diverse interlocks to protect against one er both valves being open during an RCL increase acove the 'esign pressure of the RER system.

Ivaluation 1.

The San Cnofre Unit 1 RER suction line has two pr.,See-operated isolation valves which have position indication in the control room.

2.

The upstream (i.e., closest to the RCS) valve, McV-813, is provided with an *cpen permissive' interlock. The interlock, PC-d:5, prevents opening MCV-813 whenever RCS (pressuricer) pressure is above 399 i

psig. The other (downstream) RER suction valve, MCV-814, is under administrative control only.

The two suction valves, O ~ \\3 and MCV-814, are powered from the reat panels of MCC-1 and El-2, respectively. Since both valves are P00R BRIGINAL

TIR-C5257-309 2.

The d: nstream valve, McV-834 (i.e., closest to the RCS), is provided witn a. "cpen permissive" interlock. The interlock, PC-425, prevents opening of McV-834 whenever RCS (pressuriser) pressure is above 399 psig. The other (upstream) RER discharge valve, MCV-833, has no interlock and is under administrative control only.

The two discharge valves, MOV-833 and MCV-834, are powered frem the rear panels of MCC-1 and MCC-2, respectively. Since both valves have "I,imitorque" type motors, a failure of the power supply (NCC-1 and/or MCC-2) would nct cause valve position change (either close-to-open or cpen-to-close).

3.

Neither of tne two RER discharge valvas is provided with

" auto-closure" interlocks. The RER pressure is controlled by tha RCS pressure and RER pump performance when de two systems are connected.

To ensure that the RER system is not overpressurized, the RCS overpressure mitigating system (CMS) and the RER relief valve, RV-206, are provided (see the followib.g sectiv ).

"'he staf f has concluded that.he deviations regarding the independent diverse intarlocks for the RER isolation valves that prevent opening until pressure has decreased below RER design should be corrected. The staff's position on these deviations is given in Section 5.2.

The deviation from the STP regarding lack of automatic closure for RER isolation valves is acceptable because of the combination of adminstrative controls and alarms provided on ther RER system. These alarms provide additional assurance that the operator action required by procedure will be taken to shut the.solacion valves when RCS pressure is increasing towards RER design pressure.

4.2 Pressure Relief Recuirements - Overeressure Protection Recuirement

\\

To protect the RER system against accidental overpressurization when it is in operation (not isolated from the RCS), pressure relief in the RER system B-61 a

2.l,, Franklin Research Center l

00R ORIGINAL

~~~~

TER-C5257-309 3.

result in a nonisolable situation in wnich the water provided to the RCS to maintain the core in a safe conditicn is discharged outside of the containment.

Evaluation 1.

The RER relief valve, RV-206, discharge is directed to the pressurirer relief tank (PRT) via a 4-inch line. The 4-inen line joins the 10-inch combined discharge header for the pressurirer safety valves (two) and the PCRVs (two) upstream of the PRT.

Once the 10,-inch line enters the 8500-gallon capacity PP"',

the fluid (or vapor) is discharged in a header under the water level. '. a PRT level control system maintains about 6800 gal for steam quenching.

An air-controlled drain valve directs excess liquid'to the containment 2-inch drain header. The PRT rupture disc will open at 100 psig to prevent overpressuriring the tank. The liquid will then

,s spill out onto the containment floor and into the containment sump where the two containment sump pu=ps can be used to drain the sump.

If the RER relief valve is stuck cpen, then a maximum of 783 gpm*

will be icst out of the RCS and RHR systems. If this open RER relief valve is unisolated, the PRT will be full in abcut 2.2 minutes, and the rupture disc will cpen. Indtcations available to the plant operator include:

o TE-1104 - Temperature elemer' located in relief valve discharge header. The temperature is displayed in the control room and alarms en high temperature, o PT-441 - Pressure transmitter located la the pressure relief tank. Tank pressure is displayed in the control room and alarms on high pressure.

o r;-602 - RER ficw transmitter would indicate a lower-than expecte/.

discharge flow and would alarm if flow drops below 1000 gpm.

If the stuck-open relief valve is not isolated and the pressure relief tank ruptures, then the following indications are 'available:

• Rv206 relieves 783 gym at 25% overpressure. (625 psig) (from Reference-7).

B-43 d.

Frenidin Research Center A Osmuse.e af The Fw suunne-

l l

TER-C5257-309 4.3 Pumo Protection Recuirements I

Recuirement

]

l The design and operating procedures of any RER system shall have provisions to prevent damage to the RER system pumps due to overheating, cavitatien, or loss of adequate pump suction fluid.

1 Ivaluation The RER pumps' shaf t bearings are cooled by a lubricating oil system. If a bearing begins ts, ear unevenly, if a snaf t begins to bind, or if a bearing 1

overheats for any reason, the lubricating oil temperature will rise. The Licensee intends to add a "HI RER PUMP LUBE GIL' alarm to trigger at 160*F.

However, this alarm may not be triggered by motor overheating, pump cavitation, i

or loss of suction flow.

Between the RER system suction and disenarge lines, there is an unisolable 3/4-inen line which would provide a small flow if one (or both) of the suction valves shut.

SCI states that the flow through this line is t

sufficient to keep the pump suction flooded if the suction MCVs were inadvertently shut (e.g., prever.s cavitation), or to keep pump temperature no rmal. In addition, RER pump G-14A is equipped with a 2-inch recirculation line. For a normal valve lineup this eteirculation line would also provide a recirculation path for G-14B.

The RER system has the following indications which could alert the operator to a problem with RHR flow j

i Indicatien or Alarm Location 1.

MOV-613, -814 Position Indications Control Room 2.

McV-833, -834 Position Indications Control Room s

3.

RER pump motor current Indication and Alarm in Control Room 4.

RER pump discharge pressure Local 5.

RER pump bearing temperature Local

~

d5J Franidin Research Center P00R BRIGINAL

~

TER-C5257-309 Evaluat g i

• he RER isolation valve etability and 'i.. erlocks cannot be tested during the RER cooling mode er operation. This test requirement is not applicable to San Cnofre Unit 1 since the installed interlocks function only when the RHR isolation valve sie shut.

• he Licensee conducted - 2ral circulat..on tests and included the test findings in the FSAR. Thesa tests conclusively showed the presence of natural circulation in the RCS, but did not address either the assumed cooldown rate in the emergency operating.:.ocedures or the adequacy of the mixing of the borated water being adde,' during a cocidown. However, the staff believes that, with the boric acid cancentrations used for shutdown, adequate boren mixing will occur under natural circulation flow.* he judgment is based on results of tests conducted at aucther operating Westinghouse reactor with similar power level and boren concentration.

4.5 C:erational Precedures Recuirement The operational procedures for bringing the plant from normal operating power to cold shutdown shall confor:n with Regulatory Guide 1.33.

For pressurized water reactors, the operational procedures saali include specific' procedures and information required for cooldown under natural circulation conditions.

Evaluation Cperational procedures reviewed in this comparison of the San Cnofre Unit 1 plant to BTP 'RS3 5-1 are discussed in Section 2.

All of the procedures require the use of nonsafety-grade equipment for portiens of the_shatdown operation. No procedures exist for shutdown and cooldown using safety-grade

~

equipment caly. The need for such procedure, is not identified in Regulatory Guide 1.33 but stems from the provisions of BTP 5-1 and SEP Topic Vl!-3.

The staff will consider requiring the Licensee to develop these procedures during l

A Omemma 4the#

f TER-C5257-309 5.

RISCLU* CN CF SEP *CPICS The SEP topics associated with safe shutdown have been identified in the introduction to this assessment. The following discussions evaluate the degree to which 'che safety objectives of these topics are fulfilled at San Cnofre Unit 1.

5.1 Tecic V-10.3 RER Svstem Reliability "he safety cbjective of this topic is to ensure reliable plant shutdown capability using safety-grade equipment subject to the guidelines of SRP 5.4.7 a d 3TP RS3 5-1.

The San onofre Unit 1 systems have been capared with these j -

criteria, and the results of these comparisors are discussed in Sections 3 and 4 of this assessment. Based on these discur.stons, the st' f has concluded that the systems fulf.111 the topic safety objective provided 'the plant operating proccdures include procedures for shutdown and cooldown using safety-grade equipment only. The resolution of this requirement will be i

o addressed in the SEP integrated assessment.

5.2 Tooie V-11.A Reeuirements for Isolation of !!ich and icw Pressure Svstems The safety objective of this topic is to assure that adequate seasures 1

are taken to protect low pressure systems cennected to the primary system from being subjected to excessive pressure which could cause failutes and in some j

cases pc 2entially cause a LCCA cutside of containment. This topic is assessed with regard te the requirement for isolating the RER system from the RCS.

As discussed in Section 4.2, the Licensee will be required to install diverse interlocks to prevent cpening of the RER isolation valves until RCS pressure is below RER design pressure.

's currently The San Cnofre Unit 1 overpressure mitigating system (CMS) i under design review by the NRC staff. The et riew is scheduled for completion in the near future. NRC reviews of other PWRs have shown that the RER system has adequate overpressure protection if account is taken of the reactor vessel CMS.

Based on the previous. review of the contribution of the CMS to RER P00R ORIGINAL

e TIR-C5257-309 to indicates (1) whether, to ensure integrity, continucus surveillance or periodic testing was currently being conducted, (2) whether any valves of concern were known to lack integrity, and (3) whether plant procedures shculd be revised or plant modifications be made to increase reliablity.

San Oncfre Unit 1 is one of those plants identified as susceptible to the potential failure, since the safety injection system is protected by one taecx valve and one cotor-operated valve in series.

5.4 Tecie VII-3 Systems Recuired for Safe Shutscwn The safety on]ectives of this topic are 1.

To assure the design adequacy of the safe t idown system to (a) automatically initiate the operation of appropriate ' systems, including the reactivity control systems, such thac specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences or postulated accidents, and (b) initiate the operation of systems and compenents required to bring the plant to a safe shutdown.

2.

To assure tIhat the required systems and equip =,ent,, including

~

necessary instrumentation and controls to maintain the.unf t in a safe condition during het shutdown, are located *at appropriate locations outside the control room and ha've a potent:.a1 capability for subsequent cold shutdown of the reaccar through the use of suitable procedures.

3.

To assure that only saf ety-grade equipment is required fot a PWR plant to being the reactor coolant system

• rom a high pressure condition to a low pressure condition.

Safety objective 1(a) will be resolved in the SIP design basis event reviews. These reviews will determine the acceptability of the plant response, including automatic initiation of safe shutdown related sfstems, a design basis accidents and transients (Reference S).

Objective 1(b) relates to avsilability in the control room 'of the control and instrumentation systems needed to actuate the saf e shutdown rsystems capaele of following the plant shutdown from its initiation to its conclusion at cold shutdown conditians. The ability of San onofre Unit 1 to fulfill objective 1(b) is discussed in the preceding sections of this report. These O

B-71 FtAORORIGINAL bu FrenWin Research Center l

e.

-":P. ~. ' ~.! 7 -!: ?

I it f rom either the 4-kV switchgear room or the DC-dis. ;.r.ation switchgear room.

2.

If auxiliary control panel is operable, proceed with : e fo11 ewing:

a.

Watch Engineer: Proceed to auxiliary control pa ti and unlock door.

b.

riant Equipment Cperator: Cpen discharge valve -

suxiliary feedwater pump and verify auxiliary feedwater ;..:; running either from auxiliary control panel or local breaker c;sration.

c.

Control Cperator: Cperate feedwater control 2 d u ch to "'M" and stabili:e steam generator levels.

Cperate steam dump transfer switch to "LCCAL" and maintain reactor coolant temperature at approximately 525"F with steam dump to atmosphere.

d.

Assistant Control Cperator: Seco east and west feedwater pumps and verify heater drain pumps tripped.

Verify unit PC3s have opened by position relay 452X at south auxiliary relay panel in 4-kV roem.

3.

If the auxiliary panel is not operable, the following steps will be dones a.

The Plant Equipment Operators (1) Start electric auxiliary feedwater pump by manual breaker cperation (AC3-52-1306). If electric pump is not available, start steam-driven pump. Cpen discharge valve. Report to feedwater mezzanine.

(2) Maintain steam generator levels using handjack control on auxiliary feedwater regulator.

(3) Close pressurizer steam space sample return to volumer control tank, va3.ve 999; RCS pressure will be indicated on PI-905 in the sample room.

b.

Control Operator: With auxiliary feedwater pump running, stop east anc west feed pumps and verify heater drain pumps are off.

Verify unit PC3s have opened by position relay 452X at south auxiliary relay panel in 4-kV room.

c.

Watch Engineer: Report to the feedwater mezzanine and monitor steam generator level and steam temperature.

i 1

1 l

O B-73 dtj Franklin ReseerettCenter P00R ORIGINAL

~~--

o 4

TER-C3257-309 3.

The San Cnofre Unit 1 AFS is not now autcmatically initiated.

Modifications to provide for automatic AF2 initiation in accordance with ::RC Sulletins and Ceders Task Force requirements are under staff review.

4.

"'he San onofre Unit 1 AFS is n<tt designed to automatically terminate feedwater flow to a depressurized steam generator and provide flow to tne intact steam generator. The consequences of this design will be assessed in the oesign casis event evaluations for San Cnofre Unit 1.

5.

The AFS control system deviates from the provisions of Regulatory Cuide 1.62 regarding manual actuation at the system level from the control room. The turbine-driven pump must be started locally, from outside the control room. Although the motor-driven pump can be started from *the control room, manual. valves located outside the control room must be opened to align the pump discharge to the steam generators. Modifications to provide remote (control room) operation are current'y under staff review.

6.

The Licensee has made several design and precedural changes to limit waterhammer. The staff is continuing to evaluate feed system waterhammer for the plant en'a generic basis. SIP Topic V-13,

• • 4aterhammer," applies.

7.

A failure of the single pump su'ction frem the CST would prevent the AFS fecm supplying feedwater to the steam generators even without an assumed cencurrent single active failure.

If a suction line failure

~ -

cccurs, the steam generator can be fed with the main feed pumps as described in Section 3.2.

Even thougn this alternate method is available and alleviates.he need for i= mediate corrective measures, the staff intends to examine the need for a long-term improvement in.

the redundancy of the AIS at San Cnofre Unit 1.

This will be considered in the SD integrated assessment of the plant."

8.

The technical specifications for the AFS will be reevaluated with reference to current requirements under SD Tepic X7T, " Technical Specifications."

S i

IGINAL r

W

,n TER-C5257-309 SAFE SMCTOCWN WATER REQUIP.I.C TS Introduction Standard Peview Plan (SRP) 5.4.7,

• Residual Heat Removal (RER) System *:

Regulatory Guide 1.139, " Guidance for Residual Heat Renova 1*

and Stanch Tecnnical Position (BTP) RSB 5-1, Rev.1, *cesign Requirements of the Residual Heat Removal System," are the current criteria used in the Systematic Evaluation Program (SEP) evaluaticn of systems required for safe shutdown.

BTP RS3 5-1 Section A.4 states that the safe shutdown system shall be capable of bringing the reactor to a coid shutdown condition, with only offsite or onsite power available, within a reasonable period of time fo11cwing shutdown, assuming the most limiting single failure." BTP R53 5-1 Section G, which applies specifically to the amount of auxiliary feed system (AFS), water of a pressuri:ed water reactor available for steam generator feeding, Aequires the seismic Category I water r,upply for the APS to have sufficient inventory to permit operatien at hot shutdown

• for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, followed oy ecoldcwn to the conditions permitting cperation of the RER system. The inventory needed for cooldown shall be based on the longest cooldown time needed with either only onsite or only offsite power available with an assumed single failure. A reasonacle period of time to achieve cold snutdown condi,tions, as stated in SRP 5.4.7,Section III.5, is 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

For a reactor plant cooldown, water is the medium for transfer of heat f rom the plant to the environs. Two modes cf heat removal are available. The first mode involves the use of reactor plant heat to boil water and the venting of the resulting steam to the atmosphere. The water for this process is typically domineralized " pure" water stored onsite and, therefore, is limited in quantity. The systems designed to use this mode of heat removal (boiloff) are the steam generators for a pressurized water reactor (PWR) and the emergency (isolation) condenser for a boiling water reactor (SWR). The second heat removal mode blowdown involves the use of power-operated relief valves to remove heat in the form of steam energy directly frem the reactor coolant system. Since it is not acceptable to vent the reactor coolant system h.$! Franklin Research Ces ser-B-77 i

e

• - et.

e TFR-C5257-309 materials in the steam generator and emergency condenser tubes even if the water is fresh.

Seawater can cause chloride stress ccerosion cracking of the tubes within one week.'

Raw fresh water can cause caustic stress corrosion cracking of both stainless steel and inconel tubes in less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> through NaCH concentration. Plant cooldown and depressurization would help reduce the rate of tube cracking by reducing the stresses in the tube materi-als and would also reduce the leasage rate of reactor coolant througa cracks that do occur.

• he original design criteria for the SIP f acilities did not require the ability to achieve cold shutdown conditions. For these plants, and for the majority of operating plants, safe shutdown was defined as hot shutdown.

Therefore, the design of the systems used to achieve a cold shutdown condition was determined by the reactor plant vendor ard was not necessarily based on safety concerns. Safe shutdown reviews have pointed out a difference in vendor approaches to system, design for cold shutdown reflected in the Standard Tech-nical Specification defi.nition of cold shutdown.- For a 3WR, cold shutdcwn requires reactor ecolant temperature to be 1212*F for a PWR, the temperature is 1,20 0

• F.

This difference in cold shutdown temperatures requ, ires additional systams for PWR cooling not needed for a BWR.

For example, a 3WR could use an

f. solation condenser alone to reach 212*F (although the approach to the final temperature would be asymptotic) but a PWR, in addition to the steam genera-tors, cust use an RER and supporting systems to cool to 200'Y.

Evaluation

~

Table 1 provides plant-specific data and assumptions used 6: the staff calculation of safe shutdown water requirements for the San onofts Unit 1 plant. Table a presents the results of.he calculation.

Upon a loss of load, steam released to the atmosphere and condenser will limit the reactor coolant system pressure and temperature transient. If the load decrease exceeds the capability of t.he atmospheric dump valves and

• VanFooyen, Daniel and Martin W. Kendig, " Impure Water in Steam Generators and Isolation Generators,".Infomal Report, 1980.

P00R BRIC l

nkun Reneerch Center

~ - - -

es 1

TIR-C5257-309 pressure near nor:nal operating pressures by venting the system to the at=c-sphere for a period of 4 hcurs prior to cc:=encing the ccoldcwn. The 4-ccur delay is based on BTP RSB 5-1 Section G and again is intended to maximi:e pure-water consumption.

Four hours after reacter trip, the decay hest rate is 39.6 x 10 Stu/h and tne integrated heat ever the four-hour period is 223 x,10 Stu.

Assuming that the plant operator has maintained a constant mass of water in the steam generator and has maintained steam generator pressure by throttling the atmospheric dump valves, 24,000 gallcas of auxiliary feedwater is required

• 4 remove the integrated heat. Secping calculatiens indicate that if auxiliary feedwater flow is initiated at design flew, the cooldewn rate wculd exceed 130*F/h. This ecoldown rate exceeds the aF.Eninistrative limit of 50'F/h as well as the technical specification limit of 100*F/h.

To reduce the cocidevn to the administrative limit while maintaining a constant steam generator level, the operator must throttle auxiliary feedwater flow as well as the sten $ flew to the atmosphere. *hese calculations also demonstrate that

.ne 4-hour' delay price to starting ecoldown permits tce decay heat race to decrease sufficiently so that a single failure i= pairing auxiliary feedwater flew is not significant in extending the cooldown time.

Revised scoping calculations assuming a constant cooldown rate at the administrative limit indicate that the cooldown rate of 50*F/h can be maintained throughout the cooldewn to 350'F.

The quantity of dominerali:ed water consumed at the end of the 4-hour delay period is 24,000 gallons.

Cooldown to the conditions permitting residual heat removal system operation requires 3.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> and consumes an additional 27,650 gallons. Althcugh the condensate storage tank has a capacity of 240,000 gallons, Technical Specification 3.4.1 requires a mini =um.of caly 15,000 gallons, in addition to at least 105,000 gallens frem the primary plant makeup tank and/or the service water reservoir. Based en these calculation, sufficient makeup inventory capacity is available to conduct a plant cooldown in accorda5ce with 3TP RS3 5-1.

dowever, the San Cnofre Unit 1 plant technical specifict* ions should be modified to require the plant operators to maintain suf ficient condensate storage tank inventory to conduct the cooldown (approximately 52,000 gallons).

l

(

l 3

3-81,

.i.d Franklin Research Center

e*

~

TER-C5257-309 TABLE 2 Plant San Cr.cfr2 Unit 1 Phase I (Reactor trip to point at which decay heat generation rate equals atmospheric dump valve capacity)

Cne atmescheric du. p valve (sec): appecx, 8 Phase II (Tour-hcur delay prior to cooldown):

Decay heat generated prior to cooldewa (Beul 2.23 x 10 Feedwater expended prior to cooldown (gal):

24,000 Phase III (Cooldown)

~

Steam PCS Generator Time (h)

Tercerature f'?)

Pressure (psia)

Cecav Meat Generated (Stu) 4 544.6 1000 2.23E8 5.55 466.8 500 2.83E8 7.89 350 149.3 3.65ES Oecay heat rate at t = 7.89 hs 33.2 x 106 Stu/h Feedwater expended during cooldown to 350*?: 21,650 gallons 1

P00R ORIGINAL 1r

.- Res,earch C_ amer nidin e

e.. c.

ENCt.05URE B STAFF p0SITIONS REGARDING SEP SAFE SHUTDOWN SYSTEMS REVIEW, SAN ON0FRE UNIT 1-1.

The licensee nust install diverse interlocks on the RHR isolation valves to prevent opening until RCS pressure is below RHR system design pressure.

These interlocks are needed to adequataly protect the low pressure RHR sys-tem f rom potential overpressurizatio.1.

2.

The licensee should develop a procedure for cooldown to cold shutdown from outside the control room in order to satisfy the safety objectives of topic V II-3.

This may us done in conjunction with the fire protecticie review if appropri ate.

3.

The licensee should develop a procedure for shutdown and cooldown using only the mininum list of systems as identified in Section 3.1.

This will help fulfill the safety objectives of topics V-10.B and VII-3.

4.

The staff will consider in the integrated assessment the need to increase the technical specification minimum. ndensate storage tank inventory to enable the plant to conduct a cooldown in accordance with BTP RSB 5-1 using only pure water. Raw water can accelerate corrosion of steam generator tubes, and thus increase the rate of tube cracking. Use of pure water, or curtailment of the amount of time tubes are in contact with raw water by expeditious reduction of pressure and temperature to RHR initiation condi-tions will minimize cracks and leakage.

5 *. A f ailure of the single pump suction from the condensate storage tank would prevent the auxiliary feedwater system (AFS) from supplying feedwcter so the steam generators even without an assumed concurrent single active fail-The steam generator could still be fed with the main feedwater pumps u re.

which can be powered by the diesels. Nevertheless, the staff will evaluate the need for a long-term improvement in AFS redundancy, considering the TMI Action Plan items, in the integrated assessment.

6.

The steam supply for the turbine-driven auxiliary feedwater pump (AFP) is provided from the main steam header, which can depressurize and blowdown all generators if a main steam line break occurs upstream of the stop valves. A subsequent single failure of the motor driven AFP would leave no means of removing generator decay heat. The main feedwater pumps could not be used for steam generator feeding since they would be operating in the emergency core cooling injection mode. The staff will evaluate the signifi-cance of this scenario during the integrated assessment. The low probabil-ity of this sequence of events makes it acceptable to defer resolution until design basis events and other topic reviews are complete.

P00R ORIGINAL

--