2CAN948409, Forwards Rept, Justification of Trip Two/Leave Two Reactor Coolant Pump Trip Strategy During Transients, in Response to Generic Ltr 83-10
| ML20084E356 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 04/20/1984 |
| From: | John Marshall ARKANSAS POWER & LIGHT CO. |
| To: | John Miller Office of Nuclear Reactor Regulation |
| References | |
| TASK-2.K.3.05, TASK-TM 2CAN948409, GL-83-10, NUDOCS 8405020246 | |
| Download: ML20084E356 (4) | |
Text
i ARKANSAS POWER & LIGHT COMPANY POST OFFICE BOX 551 LITTLE ROCK, ARKANSAS 72203 (501) 371-4000 April 20,1984 2CAN948409 Director of Nuclear Reactor Regulation ATTN: Mr. James R. Miller, Chief Operating Reactors Branch #3 Division of Licensing U. S. Nuclear Regulatory Commission Washington, DC 20555
SUBJECT:
Arkansas Nuclear One - Unit 2 Docket No. 50-368 License No. NPF-6 Reactor Coolant Pump Trip - Generic Letter 83-10 Gentlemen:
Guidance for resolution of TMI Action Plan Item II.K.3.5 " Automatic Trip of Reactor Coolant Pumps" was provided by Generic Letter 83-10b (0CNA028320) dated February 8, 1983.
The letter requested utilities to provide a submittal giving the technical justification for treatment of reactor coolant pumps (RCP's) during transients and accidents.
AP&L provided the plan and schedule for the ANO-2 response by letter dated August 12, 1983 (2CAN088310).
This letter completes AP&L's response to the subject generic letter.
As previously indicated, AP&L has participated with other CE owners in an effort to provide the information required by NRC for treatment of reactor coolant pumps.
The result is the attached report prepared by CE for the CE Owners Group which outlines the basis for the " trip two - leave two" (T2/L2) philosophy.
The major conclusions from the report are summarized below:
The T2/L2 RCP trip scheme results in all RCP's tripped in the case of a LOCA.
The trip scheme also provides for at least two RCP's operating for non-LOCA events such as steam line breaks (SLB's),
steam generator tube ruptures (SGTR's), and certain anticipated operational occurrences (A00's).
h 0
.9
4 i April 20, 1984
(
Mr. Jam 2s R. Miller Conservative best estimate analyses were performed to show acceptable system responses even if the second two RCP's were tripped or failed at the worst time during a small break LOCA.
These analyses demonstrate the fail-safe capability of the RCP l
trip strategy.
J j
The RCP trip strategies described meet the NRC analytical guidance i
for justification of manual trip.
An analysis of the worst small j
break LOCA with the licensing analysis assumptions demonstrated 1
compliance with 10CFR50.46, Appendix K limits.
In addition, a j
most probable best estimate analysis was conducted to demonstrate that there is no required time limit for operator action to j
terminate RCP operation.
This analysis satisfies draft ANSI i
standard 58.8 for the minimum time for operator action.
In reference to the specific guidelines provided in Section I of Generic I
Letter 83-10, the following is our specific item by item response:
i 1.
Setpoints for RCP Trip a.
We consider the guidance suggested by this section of the NRC Letter to be fully addressed by the attached report (i.e.,
Sections 6 and 7).
AP&L has chosen low RCS pressure (1400 psia) as the setpoint for manual trip of the first two RCP's, i
The second two RCP's will be tripped upon " loss of subcooling margin (LOSM)."
In order to maintain flexibility for
]
operator action in response to a SGTR, operators will be
)
permitted to allow the second two RCP's to remain in j
operation after subcooling is lost if secondary plant radiation monitors indicate the presence of a tube rupture.
In any case, it should be noted that present ANO-2 safety analyses show that a SGTR with concurrent loss of AC power 1
can be handled without exceeding the limits of 10CFR100.
The j
new setpoints will be implemented in conjunction with the new ANO-2 emergency operating procedures.
b.
The ANO RCP trip setpoints, when implemented will exclude extended RCP operation in a voided condition since the last two RCP's will normally be tripped at the time subcooling 2
margin is lost (reference Section 6.2 of the report).
c.
PORV operation is not used.for depressurization since ANO-2 has no PORV; rather, auxiliary pressurizer spray (not derived j
from RCP discharge pressure) is used, j
i d.
When completed, the ANO-2 emergency operating procedures I
(EOP's) will specifically describe symptoms of primary system voiding due to flashing of stagnant regions of hot coolant.
They will also deal with detecting, managing, and removing i
the volds that result from flashing.
The operator training programs designed for the implementation of the new E0P's i
l will include training on those aspects relating to the significance of primary system voiding, I
i i
. April 20,1984 Mr. Jtmts R. Miller e.
At ANO-2, a containment isolation signal is received upon receipt of a high reactor building pressure signal (18.4 psia) which would result in termination of component cooling water to the reactor coolant pump coolers.
The CIAS actuation setpoint ensures that RCP cooling will not be interrupted except for a large break LOCA (in which case RCP trip is ensured) or a steam line break.
As indicated in the report (Section 6.6), the setpoint for tripping the final two RCP's will distinguish between a steam line break and a LOCA.
Since RCP's can operate without cooling water for forty minutes or longer without major damage, we believe ample time for operator action is available for the operator to restore the cooling water flow to the RCP's.
f.
The parameters being used to determine when RCP's will be tripped will provide virtually unambiguous indication of a LOCA (please reference Section 6.6 of the report).
The inadequate core cooling instrumentation required by Item II.F.2 of NUREG 0737 will be factored into the E0P's insofar as the subcooling margin monitors will be utilized in indicating the need for RCP trip.
2.
Guidance for Justification of Manual RCP Trip a.
As indicated in Section 7.1 of the attached report, analyses have been performed which demonstrate that the limits set forth in 10CFR50.46 are not exceeded for the Ifmiting small break size and location using the previously described RCP trip philosophy.
The results indicated that Appendix K limits will not be exceeded based on an assumed two minute delay time for RCP trip.
b.
As further described in Section 7.2, a "most probable" best estimate analysis of the time available to the reactor operator to manually trip the RCP's was performed.
The results of this analysis indicated that the minimum time required for the operator to trip the RCP's is infinite; that is, should the operator delay in tripping the RCP's after reaching the trip setpoints, the consequences would be acceptable (i.e. clad temperatures remain within licensing limits).
3.
Other Considerations a.
The instrumentation that signals the need for tripping the first two RCP's is reactor coolant pressure (pressurizer) transmitters which feed the RPS and ESFAS systems.
Four transmitters are available for monitoring the reactor coolant pressure.
The transmitters are both environmentally and seismically qualified.
2
Mr. Jam 2s R. Miller
. April 20,1984 The criteria for tripping the second two pumps will be based on the subcooling margin monitors which were previously described by our letter dated January 18, 1980 (OCAN018022),
-as part of AP&L's submittal regarding NUREG 0737 Item II.F.2.
The subcooling margin monitors were environmentally qualified, and the temperature and pressure sensors which input to the monitors are in the current environmental qualification program.
The temperature signal is the RPS temperature input and the pressure signal is the RPS/ESFAS pressure input.
Although not considered part of the ANO-2 RCP trip setpoint instrumentation, certain secondary plant radiation monitors could be utilized to determine that tripping of the second two RCP's after LOSM is undesirable.
The radiation alarms from the steam lines, steam generator blowdown lines, or condenser off gas systems could provide indication of an SGTR.
The instrumentation is located in a mild environment for the event it is intended to monitor (i.e. SGTR).
Availability of monitors from up to three separate systems provides sufficient confidence that a SGTR can be detected and responded to appropriately.
b.
The new ANO-2 E0P's, when implemented, will provide instructions for the timely restart of the reactor coolant pumps when conditions which will support safe pump operation are established.
c.
When operators are trained on the new E0P's, proper emphasis will be given concerning the operator's responsibility for performing RCP trip in the event of a SBLOCA.
Very truly yours, John R. Marshall Manager, Licensing JRM/CHT/ac Attachments
CEN-268 JUSTlFICATION OF TRIP TWO/ LEAVE TWO REACTOR COOLANT PUMP TRIP STRATEGY DURING TRANSIENTS Prepared for the CE Owners Group NUCLEAR POWER SYSTEMS DIVISION MARCH 1984 3
POWER SYSTEMS Uu?
O !
CCM60$ TION ENGNEERNO. INC.
@ j'O Q' ! 'lllyiQ
i i
LEGAL NOTICE s
1 TIGE REPORT WAE PREPARED AS AN ACCOUNT OF WORK SPONSORS EY CORALNTION ENGINEERING, INC NEITHER'COMEUSTION ENG4NEERINE NOR ANY PERSON ACTING ON ITS BEHALP:
-l A.
MAKER ANY WARRANTY OR REPREBENTATION, EXPREW OR i
189UE0 INCLUO6NG THE WARRANTIES OF PITNSEE POR A PARTHNAAR l
PURPOSE OR AAERCHANTAEluTY, WITH RESPECT TO THE ACCUSACY, COtWLETENE88, OR USEPULNESS OF THE INPORAAATION CONTAINED IN TIGE j
RWORT, OR THAT THE USE OF ANY IMPORA4AT10N, APPARATUS, ASTH 00, 1
OR PROCESS DISCLOSSO IN THet REPORT AAAY NOT IMPRINGE PRIVATELY l
OIONS RHBHfE;0R l
- 8. AMLNSB AfdY UAEluTIES WITH RESPECT TO THE USE 07.011 POR DAAAMBEB REBULTDee PR004 THE LEE OF, ANY INPORMATION, APPARATts, i
METHOD OR PROCEM DISCLOSED IN THe# MSPORT, l
i 5
9 e
G l
's e
l ABSTRACT This report presents the justification of the trip two/ leave two manual reactorcoolantpump(RCP)tripstrategyduringdepressurizationtransients.
This RCP trip strategy was developed in order to trip all RCPs in the event of a small break LOCA, but to allow for operation of at least two RCPs during non-LOCA depressurization events.
The trip setpoints provide a straight-l I
forward, yet flexible approach for implementation of the trip scheme into plant-specific operational procedures.
In addition, the trip setpoints
[
utilize existing plant instrumentation. Analyses are presented which demon-l strate the inherently safe operational aspects of the RCP trip strategy during a small break LOCA as well as present an illustration of the trip strategy for sev7ral sample depressurization transients. The trip two/ leave two RCP trip strategy also satisfies the NRC guidance and criteria for manual RCP trip during transients.
i a
r i
o l
s W
i
[
EXECUTIVE
SUMMARY
The purpose of this report is to provide technical justification for the trip two/ leave two (T2/L2) manual Reactor Coolant Pump (RCP) trip strategy for depressurization events in response to TM! Action Item !!.K.3.5.
The goal of the T2/L2 RCP trip strategy is to trip all RCPs in the case of a small break loss-of-coolant accident (LOCA), but to have two or more RCPs operating in the event of a non-LOCA, e.g. steam line break, steam generator tube rupture or an anticipated operational occurrence. The incentive for stopping all RCPs during a small break LOCA is to minimize coolant inventory loss from the reactorcoolantsystem(RCS).
The incentive for operating the RCPs during non-LOCA depressurization events is to maintain the availability of the main spray flow to the pressurizer for better RCS pressure control.
The RCP operation also minimizes voiding of the reactor vessel upper head / upper plenum regions by providing some forced coolant flow through this region and provides for better mixing in the reactor vessel downcomer/ lower plenum region minimizingpressurizedthermalshock(PTS) concerns.
The T2/L2 trip strategy consists of tripping two RCPs, located in diametrically opposed coolant loops, very early in a transient on a low RCS pressure signal independent of the nature of the event. The remaining two RCPs are tripped subsequently after trip setpoints indicating a LOCA are reached.
The inherently safe operational aspects of the RCP trip strategy for small break LOCAs was demonstrated by conservative best estimate analyses. These analyses showed that sufficient core cooling would be available if the second two RCPs were mistakenly not tripped when the trip setpoints are reached but were tripped later or failed at the worst time during the event.
The T2/L2 RCP trip signals and setpoints were selected on a generic basis to provide a simple setpoint scheme with enough flexibility to accommodate plant specific signal and numerical setpoint selection.
The generic r(CP trip setpoints consist of two tiers.
The first setpoint for tripping two RCPs in opposite loops occurs if the RCS pressure decreases below a certain value (e.g.,1300psta). The setpoint signals for tripping the second two RCPs are 11
t low RCS'aubcooling (e.g., less than 20 F), containment radiation alarm and/or absence of radiation alarm in the secondary cooling system.
Each utility using this approach would choose one of three sets of setpoint combinations (that is, low subcooling plus containment radiation alarm, or low subcooling plus absence of secondary side radiation alarm, or low subcooling plus con-tainment radiation alarm plus absence of secondary side radiation alarm) for tripping the second two RCPs based on plant specific considerations of signal availability, signal reliability, instrument location, etc.
l The T2/L2 RCP scheme also satisfies the NRC guidance and criteria for se-lection of a RCP trip strategy.
Besides tripping _all RCPs for a LOCA and allowing forced RCS circulation for-non-LOCA events, the RCP trip strategy meets other NRC guidance.
The RCP trip scheme excludes extended RCP operation when the RCS is in a voided condition an'd does not require the use of PORVs to aid in RCS depressurization during an ecident.
If two RCPs are operating for non-LOCAs, then forced circulation in the RCS minimizes upper head voiding.
Also, the trip scheme setpoints utilize Inadequate Core Cooling (ICC) instrumentation'(which includes the Subcooled Margin Monitor).
In addition, the T2/L2 trip strategy meets the NRC guidance and criteria for manual RCP trip.
An Emergency Core Cooling System (ECCS) licensing calcu-lation for the worst small br M LOCA resulted in a peak clad temperature of about 1970*F. Thus, confonnance with 10CFR50.46, Appendix K is demonstrated.
A most probable best estimate small break analysis was also performed to show that from core cooling considerations there is no time limit prior to which the second two RCPs need to be tripped. This satisfies the Draft ANSI Stan-dard 58.8 guidance for minimum time for operator action.
In sumary, the T2/L2 RCP trip strategy satisfies the CEOG goals and objec-
' 'r tives for a manual RCP trip scheme. The RCP trip scheme also meets the NRC f,
guidance and criteria for RCP operation during transients and accidents as well as for trip setpoint selection.
t l
l iii
TABLE OF CONTENTS Section Title Page ABSTRACT i
EXECUTIVE
SUMMARY
11 TABLE OF CONTENTS iv
~
1.0 INTRODUCTION
1-1 1.1 Purpose 1-1
1.2 Background
1-1 1.2.1 NRC Actions 1-1 1.2.2 Previous CE0G Analyses 1-2 1.2.3 NRC Guidance and Criteria 1-3 1.3 Report Organization 1-4 2.0 TRIP TWO/ LEAVE TWO RCP TRIP STRATEGY 2-1 2.1 Goals of Trip Strategy 2-1 2.2 Description of Trip Strategy 2-2 3.0
. CORE COOLING PERFORMANCE DURING A 3-1 SMALL BREAK LOCA 3.1 Objective of Evaluation 3-1 3.2 Analysis Assumptions 3-1 3.3 Plants Analyzed 3-2 3.4 Results 3-2 3.4.1 Reference Plant Analysis with Steam 3-3 Bypass System 3.4.2 Reference Plant Analysis with MSSVs 3-3 3.4.3 3410 MWt Plant Analysis 3-4 3.4.4 Conclusion 3-5 4.0 GENERIC TRIP SETPOINT PARAMETER SELECTION 4-1 6,
4.1 Goals of Parameter Selection 4-1 a.2 Selection of Parameters 4-1 4.3 Description of Setpoints 4-3 4.4 Generic Setpoint Values 4-4 I
l iv J
5.0 EVALUATION OF TRIP SETPOINTS FOR SAMPLE 5-1 TRANSIENTS 5.1 Setpoint Evaluation of LOCA Events 5-1 5.1.1 0.1 fte Small Break LOCA 5-1 5.1.2 Inadvertent Open PORY 5-3 5.2 Setpoint Evaluation for SGTR Events 5-4 5.3 Setpoint Evaluation for SLB Events 5-5 5.4 Setpoint Evaluation for Increased Heat 5-8 Removal (IHR) A00 Events 5.5 Other Transients 5-9 6.0 EVALUATION OF TRIP SETPOINTS AGAINST NRC 6-1 GUIDANCE AND CRITERIA 6.1 Small Break LOCA vs Non-LOCAs 6-1 6.2 Avoidance of RCP Operation Under Voided 6-1 Conditions 6.3 PORY Challenges 6-3 6.4 Upper Head Voiding 6-4 6.5 Service Water Availability 6-5 6.6 Unambiguous LOCA Indication 6-5 1
7.0 JUSTIFICATION OF MANUAL RCP TRIP 7-1 7.1 Compliance with 10CFR50.46 7-1 7.2 Justification of Time Required for Manual 7-2 RCP Trip 8.0 GENERIC INSTRUMENTATION EMPLOYED TO IMPLEMENT 8-1 THE RCP TRIP SCHEME l
9.0 CONCLUSION
S 9-1
10.0 REFERENCES
10-1 APPENDIX PLANT SPECIFIC RCP TRIP SETPOINT VALUES A-1
' 'i V
l
1.0 INTRODUCTION
1.1 PURPOSE The purpose of this task was to develop a trip two/ leave two (T2/L2)
Reactor Coolant Pump (RCP) operation strategy following depressurization events. This report is intended for use in response to the NRC request (Reference 1) for the development of a RCP operation strategy for acci-dent events. The T2/L2 RCP trip scheme strategy satisfies TMI Action Plan Item II.K.3.5, " Automatic Trip of Reactor Coolant Pumps". The T2/L2 RCP trip scheme was developed as a basis for the incorporation of a RCP trip strategy into the upgraded Emergency Procedure Guidelines and Operator Training Packages.
1.2 BACKGROUND
1.2.1 NRC Actions After the accident at TMI Unit 2, the NRC recomended (IE Sulletin 79-06C) that all operating RCPs be tripped immediately upon reactor trip and the initiation of high pressure safety injection (HPSI) caused by a low pressurizer pressure signal. However, actual events in operating plants since that time have demonstrated that plant control can be maintained more easily if RCP operation is continued during events which reduce primary system pressure but which do not cause a loss of primary coolant inventory sufficient enough to threaten core cooling. Therefore, in response to this additional information, the NRC issued generic letters (Reference 1) to the utilities requesting the development of a strategy for RCP operation during transients and accidents. The NRC I "
letter contains guidance and criteria for use in this development effort in order to resolve TMI Action Plan Item II.K.3.5.
1 1-1 1
1
-m
-+
+_s
l.2.2 Previous CEOG Analyses In response to NRC requests (e.g., NRC IE Bulletin 79-06C), analyses were performed in 1979 under the sponsorship of the CEOG to characterize the effect of RCP operation on small break LOCAs and to a smaller extent on non-LOCA transients. These analyses are reported in CEN-114-P, " Review of Small Break Transients in Combustion Engineering Nuclear Steam Supply Systems", and in CEN-115-P, " Response to NRC IE Bulletin 79-06C Items 2 and 3 for Combustion Engineering Nuclear Steam Supply Systems", Refer-ences 2 and 3, respectively.
The analyses were performed for a generic plant in the 2700 Mwt class.
Two main analysis models were used. An approved ECCS Evaluation Model, modified to allow for continued RCP operation, was used for analyses under Appendix K ground rules to determine compliance to 10CFR50.46 limits. A best estimate ECCS model assuming the flow of one, and in some cases of two HPSI trains, was used to assess the expected system re-sponse. The analyses addressed primarily the effect of the number of operating RCPs, worst break location, worst break size and effect of high pressure safety injection flow rate.
These analyses showed that for small break LOCAs, specifically for hot leg breaks, it is beneficial to trip all RCPs in the interest of minimiz-ing the loss of coolant from the primary system. The worst small break LOCA in this regard is a break in the hot leg. The break size for which continued RCP operation has a significant effect on peak cladding temper-ature and could result in temperatures exceeding the cladding temperature 2
2 limit is restricted to a range from about 0.1 ft to 0.02 ft for the generic plant. Conversely, for non-LOCAs involving system depres-
~
surization it is beneficial to keep one or more RCPs running in the interest of maximizing the margin to fuel failure and/or radiological releases.
1-2 i
1
]
The results of the analyses lead to the conclusion that, based on the 1
opposing behavior of small break LOCA and non-LOCA events, it appears desirable to turn off two RCPs (one in each loop) and, then after an assessment of the event, turn off the remaining RCPs in case of a LOCA.
This is the general concept of the current trip two/ leave two RCP trip strategy.
i 1.2.3 NRC Guidance And Criteria
~
9 l
The generic NRC letter (Reference 1) contains specific guidance and criteria for the development of a RCP operation strategy during tran-sients. The NRC guidance and criteria are divided into two categories:
(1) RCP operation strategies which could result in.RCP trip during j
transients and accidents and (2) RCP operation strategies which allow the l
RCPs to remain operating during transients and accidents, including small break LOCAs. The trip two/ leave two RCP trip scheme falls into the first
]
category. The NRC guidance and criteria associated with a RCP trip j
scheme is outlinea below.
i l
i Manual RCP trip is acceptable if certain guidelines and conditions are j
satisfied. The NRC guidelines include RCP trip setpoints designed to j
assure that the RCPs will be tripped for loss of primary system inventory
[
events to containment (i.e., LOCA) for which RCP trip is considered i
necessary. The RCP trip setpoints should be developed to provide forced l
RCS flow for non-LOCA events (especially for SGTR). Also, the RCP trip j
strategy should be developed.to exclude extended RCP operation when the I-RCS is in an extended two-phase condition.
i The NRC guidance further states that the RCP trip scheme should not result in challenges to the PORVs in order to accomplish depressurizing actions normally performed by the main pressurizer sprays. The emergency procedure guidelines and the emergency operating procedures should
[.
address detecting, managing, and collapsing of voids that result from the
(
flashing of stagnant regions of hot coolant. RCP trip schemes should l
incorporate provisions to preclude RCP damage such as seal damage due to
{
l 1-3
.,---e.,--.
,,-,,.ew-e.m e,,
--m..r--,.-m-.---
ypnm___._,.,my-m-m.--.,w-
-._.,n9._.
y_,,---.-
- - -m_,.m
loss of cooling water supply after a containment isolation signal. In l
addition, the RCP trip strategy should provide an unambiguous indication of a LOCA.
The NRC letter also included two criteria for justification of manual RCP trip. A small break LOCA analysis based on licensing assumptions was needed to demonstrate the RCP trip strategy meets the requirements of 10CFR50.46.
Lastly, a most probable best estimate sinall break LOCA j
analysis was needed to determine that the time available for operator action to manually trip the RCPs satisfies Draft ANSI Standard 58.8 recommendations.
1.3 REPORT ORGANIZATION The background surrounding the NRC request for the development of a revised RCP trip criteria is presented in Section 1.2 of this report.
In addition, the NRC guidance and criteria for the preparation of a RCP trip scheme is discussed in this section.
Section 2 provides the goals and an explanation of the two tier T2/L2 manual RCP trip strategy. Section 3 describes the conservative best estimate analyses performed to show that core cooling would not be jeopardized if the second two RCPs were tripped or failed at the worst time during a small break LOCA.
The goals used for the RCP trip setpoint selection are outlined in Section 4.
A description of the setpoint parameters and the generic setpoint values are presented. Section 5 presents an evaluation of the
~
r RCP trip setpoints for a variety of transients. The setpoints were analyzed for LOCA and non-LOCA events.
l l
The RCP trip setpoints were further evaluated against the NRC guidance and criteria and the results are presented in Section 6.
Justification of the manual RCP trip strategy is presented in Section 7.
This includes l
1-4
l
]
)
i l
the NRC requested licensing analysis of a small break LOCA to show e
compliance with 10CFR50.46 requirements. Also, a most probable best
)
estimate analysis was conducted to demonstrate that the time required for manual RCP trip meets Draft ANSI Standard 58.8 recommendations. Section 8 i
documents the generic instrumentation employed to implement the RCP trip scheme.
Throughout this report, reference is made to RCS pressure. RCS pressure j
for this work can be taken to mean pressurizer pressure unless otherwise j
noted. The pressure difference between the pressurizer and RCS piping is j
not significant in regard to the results and conclusions of this eval-uation.
d 1
e i
i 4
9 1
l**..
l I
e 1-5 i
2.0 TRIP TWO/ LEAVE TWO RCP TRIP STRATEGY The T2/L2 RCP trip strategy provides the reactor operator with the most flexibility in restoring control to the plant following a transient or accident. This section describes the goals of the strategy and presents a description of the trip scheme.
2.1 G0ALS OF TRIP STRATEGY There were two main goals of the RCP trip strategy. The first goal was to insure that all RCPs are tripped during a LOCA. The second goal was to maintain forced RCS circulation for non-LOCA events.
Tripping the RCPs minimizes the loss of reactor coolant system (RCS) fluid inventory for breaks located in the hot leg (References 2 and 3).
This is an important aspect of the trip strategy since core cooling could be impacted if the RCPs were not tripped and failures occurred in the safety injection system.
It is desirable to maintain at least one set of two RCPs operating for non-LOCA transients, such as steam line breaks (SLBs), steam generator tube ruptures (SGTRs) and anticipated operational occurrences (A00s).
This gives the reactor operator more control using main pressurizer spray in order to cooldown and depressurize the plant to shutdown cooling entry conditions as soon as possible.
o If two RCPs are operating in diametrically opposed coolant loops, main pressurizer spray can be maintained. Only one RCP operating in'the loop l,..
that contains the pressurizer is sufficient to provide main pressurizer l
spray because the spray lines are connected to the two cold legs in that loop. Tripping two RCPs in diametrically opposed loops is a method of being certain that the main pressurizer sprays remain operational. The
~
main pressurizer spray system is used by the operator in controlling the RCS depressurization to shutdown cooling entry conditions.
2-1
Also, operating one or more RCPs during a non-LOCA event results in the i
continuous mixing of fluid in the reactor vessel upper head, thereby minimizing void formation resulting from the flashing and boiloff of stagnant fluid. Forced RCS flow serves to circulate and cool the fluid in the upper head preventing the region from becoming stagnant. The RCS flow tends to reduce the upper head temperature to the hot leg
(-
temperature which would preclude premature flashing and boiloff of the i
fluid in the upper head compared to the rest of the RCS. Additionally, E
forced circulation would provide for better mixing in the reactor vessel downcomer/ lower plenum region minimizing pressurized thermal shock (PTS) concerns.
Another goal of the RCP trip strategy was to satisfy the NRC guidance and criteria (Reference 1) which was summarized in Section 1.2.3.
The NRC guidance essentially parallels the goals described above. Analytical evaluations were performed to justify the manual RCP trip strategy against the NRC acceptance criteria.
2.2 DESCRIPTION
OF THE TRIP STRATEGY Following a reactor trip, the T2/L2 RCP trip strategy results in the manual trip of two RCPs in opposite loops. Two RCPs are tripped for applicable depressurization events since it can be demonstrated (Sec-tion 3) that the plant can be maintained in a safe condition regardless of event diagnosis with two RCPs operating.
]
The RCP trip strategy was devised to trip the second two RCPs if plant conditions pertaining to a LOCA are ascertained. All RCPs are tripped for a LOCA since the consequences of a LOCA are reduced without RCPs opera ting.
i For non-LOCA events, at least two RCPs in diametrically opposed coolant l
loops may remain operating. Two RCPs are sufficient to enable the operator to provide a safe and controlled cooldown to shutdown cooling entry conditions. Also, the two operating RCPs will minimize the lag I
between changes in the upper head temperature and changes in the hot leg 2-2
. ~. -.
t 4
temperature minimizing the formation of voids in this region compared to the rest of the RCS for events such as SGTRs and SLBs. A schematic j
representation of the T2/L2 RCP trip strategy is presented in Figure 2-1.
r 1
}
t i
4 4
i o
j i
(
i l
l l
l lp,..
- e 2-3 i
FIGURE 2-1 SCHEMATIC REPRESENTATION OF THE T2/RCP TRIP STRATEGY RCP-18 RCP-2A PZR SPRAY SG1 RV SG2. -
PZ s
RC -1A RCP-8 i
r REACTOR TRIP o
LEAVE ALL FOUR LOW RCS NO PRESSURE RCPs OPERATING YES o
TRIP FIRST TWO RCPs a
/
LOCA.
NO _
LEAVE TWO N
DETERMINATION RCPs OPERATING YES o
TRIP SECOND
~
TWO RCPs 2-4
3.0 CORE COOLING PERFORMANCE DURING A SMALL BREAK LOCA 3.1 OBJECTIVE OF EVALUATION The purpose of this evaluation is to demonstrate the inherently safe operational aspects of the T2/L2 RCP trip strategy during a small break LOCA. Specifically, conservative best estimate (CBE) analyses were used to show that if the second two RCPs fail or are turned off at the worst time during the transient, core coolability would not be jeopardized.
This result provides support for justifying the manual RCP trip scheme against the NRC guidance and criteria outlined in Section 1.2.3.
3.2 ANALYSIS ASSUMPTIONS The main aspects of the CBE analysis assumptions are the use of a 1.0 multiplication factor on the ANS decay hea+, curve, the homogeneous equilibrium break flow model, and the availability of only one high pressuresafetyinjection(HPSI) pump.
The analyses were conducted on a best estimate version of the CEFLASH-4AS computer code. A best estimate two-phase head dogradation model of the i
RCPs based on the results of the C-E/EPRI pump tests was included in the CEFLASH-4AS input. The HPSI delivery characteristics (flow vs head) were minimizedinthe2700MWt(Referenceplant)analysessincethisresults in the lowest ratio of safety injection flow to initial plant power.
i Two analyses were conducted for the Reference plant assuming different
^
secondary side configurations. One analysis, assumed the steam bypass d.
system and the atmospheric dump valves were operational. This assumption was used since the steam bypass system is typically in the automatic mode during normal full power reactor operation and thus this operation is a valid best estimate assumption. The steam bypass system was assumed to open at about 900 psia. The atmospheric dump valves were assumed to be in the manual mode. The second analysis modeled the main steam safety valves (MSSVs) since this is a safety grade system as opposed to the l
3-1
steam bypass system which is not. This analysis was conducted to demon-strate additional conservatism in the RCP trip strategy. The MSSV setpoint was assumed to be at 1000 psia.
3.3 PLANTS ANALYZED The 2700 MWt class plants were selected as the Reference plant based on small break core cooling considerations. The 2700 MWt class plants have
'j the most restrictive combination of safety injection tank pressure (which affects the worst break size) and HPSI pump flow (which affects core l
coolability, as explained earlier).
A comparative analysis was conducted for the 3410 MWt class plants to 1
demonstrate that the results from the Reference plant bound the core l
cooling perfomance of the 3410 MWt and System 80 class plants.
4 3.4 RESULTS 4
In this evaluation, two computer cases were run for each analysis as ex-4 plained earlier.
In the first case, the first two RCPs were tripped after the RCS pressure setpoint (see Section 4.0) was reached and allowing for a 30 sec delay for operator action. The remaining two RCPs were left operating for the duration of the transient. The results of this analysis were reviewed to determine the time at which the minimum liquid inventory on the hot side of the RCS occurred. The hot side inventory includes the liquid mass in the reactor vessel including the downcomer, the hot legs and the riser portion of the steam generators.
The liquid inventory in these regions represents the fluid available for core cooling during a transient. Thus the time at which the minimum liquid inventory occurs is the worst time to trip or have the second two RCPs fail.
For reference, it was calculated in Reference 2 that roughly 102,000 lbm is required to keep the core covered with water when no RCPs are operati.ng.
i t
3-2
A second computer case was run similar to the first analysis, but the second two RCPs were assumed to be trMped or failed at the time of minimum hot side liquid inventory.
3.4.1 Reference Plant Analysis With Steam Bypass System The Reference plant, analysis with the steam bypass system available showed that the minimum liquid inventory for the two RCP operation case was about 87,360 lbm at 955 see as shown in Figure 3-1.
When the second two RCPs were terminated at 955 sec, the two-phase mixture level in the innerreactorvesseldecreasedquickly(Figure 3-2). The decrease in the core mixture level is due to the collapse of the two-phase frothy mixture created by the continued operation of the two RCPs. There is very little overall effect on the total liquid mass siqce only the core region contains a large amount of trapped bubbles in the two-phase mixture. The l
termination of the second two RCPs also had a minimal effect on the RCS pressure (Figure 3-3).
The termination of the second two RCPs caused an increase in the duration of core uncovery to 620 sec from 400 sec (Figure 3-2) as well as an increase in the maximum depth of core uncovery to 3.6 ft from 1.2 ft. A best estimate version of the PARCH computer code was used to determine the effect of the prolonged core uncovery on the core hot rod clad temperature. The peak clad temperature was calculated to be 1198'F when the second two RCPs were tripped at minimum inventory.
3.4.2 Reference Plant Analysis With MSSVs The Reference plant analysis using the MSSVs showed a decrease in the minimumhotsideliquidinventorycomparedtotheaboveanalysis(Figure 3-4)whentwoRCPsweretrippedandtwoRCPsremainedinoperation. This effect was expected since the higher secondary side pressure caused by
~
using the MSSVs instead of the steam bypass system results in higher primary RCS pressure during the early portion of the transient (until steamflowsoutthebreak). The higher RCS pressure results in higher leak flow rates, lower HPSI flow rate, and, therefore, a greater amount i
3-3
of core uncovery. The minimum hot side liquid inventory for this case is 79,400 lbm at 910 sec.
The second two RCPs were terminated at 910 sec which caused a collapse of the two-phase liquid level in the inner reactor vessel as in the previous analysis. The maximum depth of core uncovery reached 6.1 ft (Figure 3-5) below the top of the active core when the second two RCPs were tripped compared to 2.3 ft when the second two RCPs were left operating. The
.I duration of core uncovery increased to 650 sec from 610 sec. The reason the length of core uncovery did not differ by more than 40 sec is that the safety injection tanks (SITS) began to intermittently discharge into the RCS at about 1300 see into the transient. The RCS pressure for the analysis with the MSSVs is presented in Figure 3-6.
The best estimate PARCH analysis with all four RCPs off resulted in a peak clad temperature of 1664'F.
3.4.3 3410 MWt Plant Analysis An analysis for the 3410 MWt class plants was made for comparison to the Reference plant for the case with two RCPs tripped and two RCPs operat-ing. The 3410 MWt class plants were assumed to operate with the steam bypass system available (pressure setpoint is 950 psia). A hot leg break of.05 fts was simulated since this is the worst break size for the 3410 MWt plants.
The resulting minimum liquid inventory for the 3410 MWt class plants is about 96.000 lbm compared to 87,000 lbm for the Reference plant (Figure 3-7). This difference accounts for the fact that the inner reactor vessel two-phase mixture level does not fall much belod the bottom of the hot leg (Figure 3-8).
Thus, if the second two RCPs were tripped at the time of minimum inventory producing a decrease in mixture level from 2.5 to 4.0 ft as in the Reference plant, the core would still remain covered with a two-phase liquid mixture.
In fact, the SITS could discharge even earlier than they did, and thereby recover the core because the 3410 MWt class plants have a SIT discharge pressure of 600 psig. The RCS pressure is presented in Figure 3-9.
Therefore, it was not necessary to run the 3-4
1 i
1 additional computer case with the second two RCPs off. The System 80 plant behavior is expected to be similar since those plants have a mu:h larger hot side inventory than the 3410 MWt plants with the same SIT discharge pressure.
4 3.4.4 Conclusion The analytical results provided in this section demonstrate the inherent-ly safe nature of the RCP trip strategy for the Reference plant as well as the other C-E class plants. The analyses showed that under conserva-tive best estimate conditions, if the second two RCPs were tripped or failed at the time of minimum hot side liquid inventory, core cooling would not be significantly jeopardized.
l
)
g.
.i
+
F l
i t
d i
i':..
i I
4 1
35
FIGURE 3-1 2
0.1 FT HOT LEG BREAK ANALYSIS STEAM BYPASS SYSTEM OPERATIONAL HOT SIDE LIQUID MASS j
300 i
2RCPSTRIPPED 4
- - - 4 RCPS TRIPPED 250 200 s
a g'150 e8 3
g100 f
I l
50 FIRST WD SECOM) M RCPsTRIPPED RCPsTRIPPED
/
u a
i 0
0 300 C00 000 1200 1500 TIE,SEC a
3-6
l FIGURE 3-2 i
2 0.1 FT HOT LEG BREAK l-STEAM BYPASS SYSTEli OPERATIONAL INNER REACTOR VESSEL MIXTURE HEIGHT 48 2RCPsTRIPPED l
--- 4 RCPs TRIPPED W
32 5
I 2
es 9
24 x
mew cms s
E T
~~..
g 16 8 - FIIST TW SEC0f0 TWO RCPs TRIPPED ICPsTRIPPED a
g 1*
i 0
0 300 000 900 1200 1500 j
Tile,SEC 3-7
1 i
FIGURE 3-3 2
0.1 FT HOT LEG BREAK STEAM BYPASS SYSTEM OPERATIONAL RCS (PRESSURIZER) PRESSURE 7
l 2G I
2RCPsTRIPPED
--- 4 RCPs TRIPPED i
2M i
1000 5
E l
N I
g 1200 E
I 800 400 FIRSTB0 SEC0 0 E O RCPsTRIPPED RCPsTRIPPED f
0 l
0 300 000 000 1200 1500 TifE,SEC 3-8
l l
i i
FIGURE 3-4 a
l 2
0.1 FT HOT LEG BREAK l
NSSVs IN OPERATION HOT SIDE LIQUID l%SS j
i i.
--- 4 RCPs TRIPPED I
250 0
l
~
i i
i 150
)
S8 3
100 c
s 5
1 e
i
% ~ FIRST TWO SEC0feTh0 RCPs TRIMID RCPs TRIPPED 4
j d
d Q
4 l
1 1
i O
300 000 900 1200
.1500 t
TifLSEC i
3s
FIGURE 3-5 0.1 FT HOT LEG BREAK 2
flSSVs IN OPERATION
-l' INNER REACTOR VESSEL MIXTURE IIE! Gilt
. r 48 l
2 RCPs TRirPED 4 RCPs TRIPPED 40 7
i i
32 I
t
?!2 24 tw w cme D
\\, ~ _..,,
I 10 I
e g, FIRST M SECOE M RCPsTRIPPED REPsTRIPPED d i i l 0
i i
i t
0 300 000 900 1200 1500 T!fE, CEC l
3-10
1 FIGURE 3-6 2
0.1 FT HOT LEG BREAK MSSVs IN OPERATION RCS (PRESSURIZER) PRESSURE j
i
[
l.*
1 2400 l
2RCPsTRIPPED 1
- 4 RCPs TRIPPED i
2000 l
I i
1000
]
.c 1
E 1200 i
l 4
i 4
400 - FIRSTTh0 SEC0f0 RCPsTRIPPED RCPsTRIPPED
'~~~.
a u
1, 0
i 0
300 000 900 1200 1500 TifE,SEC i
3=11 4
t i
FIGURE 3-7 COMPARISON OF 110T SIDE LIQUID MASS BETilEEN 3410 MWT PLANT AND REFERENCE PLANT 1
. ~.
.g.
j i
~A10 fy ME #RYSIS t
1
(,05 FT ICT EG BEAK) d 250
-\\
g
--- PETEPByl0T LEG BEAL 3 M K # R YSIS i
\\
(.10FT
\\
\\
i j
200
\\
l s'
i g
\\
t
\\
r
'vg
~
i e
1
\\
(
y ig 100
)
~~ s i
1 i
50 l
?
O
~
0 000 1200 1000 2@
3000 TifE,ffC 1
3 12
l l
\\
t i
FIGURE 3-8 3410 MW PLANT ANALYSIS I
.05 FT4 HOT LEG BREAK I
STEAM BYPASS SYSTEM OPERATIONAL INNER REACTOR VESSEL MIXTURE LEVEL 40 l
l 40 l
l 5
22 t=
E.
W BOTTM w ICT LEG L
/
24 Tw wcwE
[
1 1
10 8
l-0 0
000 1200 1000 2400 3000 T!ft,0EC 3 13
t i
}
FIGURE 3-9 l
)
3410MWzPLANTANALYSIS
.05 FT' HOT LEG BREAK STEAM BYPASS SYSTEM OPERATIONAL i
RCS (PRESSURIZER) PRESSURE
'l i
1 i
. 1 i
2@
i 1:
t 4
i 2000 I
l l
I l
1000 1
i e
f i
s i
g 1200 L
j l
W, 400 t
e 8
t O
^
0 000 1200 1000 2'00 3000 i
Tilt,SEC l
4 3 14
4.0 c.ENERIC TRIP SETPO!NT PARAMETER SELECTION 4.1 C0ALS OF PARAMETER SELECTION l.
Two major goals w re used in the selection of the parameters to be used j
to implement tne RCP trip strategy in addition to meeting the NRC guld-ance and criteria outlined in Section 1.2.3.
The first goal ws that the i
parameters yield a clear indication to the reactor operators to trip the i
RCPs. The sei;end goal was that the parameters must be presently avail-s$1e to tne operaters uting entsting instrumentation.
ine first gual was divdded into two sub. goals: simpItcity and mini-miration of the number of parameters. For simplicity, the paramators wre chosen to be those foe' wtten direct Indications or alams are available, rather tu n parametors which might be calculated from other l
parameters.
The use t/ esisting instrumentation results in the least delay in imolementati "i of the recommended procedures for RCP trip and t
reduced the cost to the utilitics.
To minimize the number of parameters, it was decided tc tass 1,no decision to trip the first two RCPs on a single parameter.
fee t!ectslan to trip the second two RCPs requires a larger number of paremeters as discussed in the following section, Hewoner, the basis for the decisten to trip the second two RCPs has been i
limited to a maximum of three praetters, and may be only two for certain plants.
i 4.2 A Qt g 0,h g PAfA,MQ g{
3 Following the goals for paraniter telection outilned in Section 4.1, and thu (cals of the trip strategy Jutlintro in Section 2.1, the RC5 pressure was seficted as the parameter upon which a decision to trip the first two A'Ps should be based. 4 shun in Section 3.0, a RCS pressure setpoint can be found below which tripping of in RCPs in opposite loops will result in aneptable consequences for any small break I.0CA.
Further, as shown in Section 6.4, this same sofpoint results in no RCPs being tripped 41
for increased heat removal A00s, facilitating rapid recovery from these events.
Thus, this single parameter, already available in all plants, provides a simple, clear cut indication to trip the first two RCPs.
The decision to trip the second two RCPs requires that a LOCA be distin-guished from the other two types of accidents which have similar depres-a turtration characteristics:
SGTR and SLB. The presence of a containment radiation alarm or the lack of a steam plant radiation alarm indicates that the event is a LOCA rather than a SGTR. A SLB may involve low level radiation releases, thus activating a radiation alarm, particularly the containment alarm for an inside containment SLB.
So a radiation alarm cannot be used to differentiate between a LOCA and a SL8.
However, a 1
LOCA results in loss of subcooling in the RCS, while a SLB will actually cause an increase in subcooling, particularly in the loop with the affected steam generator.
Therefore, RCS subcooling can be used to clearly distinguish between a LOCA and a SLB.
However, a SGTR will also cause a loss of RCS subcooling.
Thus, it can be shown that no single criterion can, be used to determine whether or not to trip the second two RCPs.
Therefore, the combination of low RCS subcooling and no steam plant radiation alarm and a containment radiation alarm clearly indicates if the second two RCPs need to be tripped. However, plant specific requirements may dictate selection of either of the two parameter combinations:
(a)lowRCSsubcoolingandacontainmentradiationalarm or (b) low RCS subcooling and no steam plant radiation alarm.
Combination (a)indicatesaLOCAdirectlywhilecombination(b) indicates a LOCA by eltminating non LOCA depressurization events. This is shown schematically in Ffgure 4 1.
Finally, the goal of using existing instrimntation is met by using the subcooling monitors which all plants have installed.
The subcooling during a LOCA will be unifonnly low. A SL8 may result in appreciably larger subcooling in the loop with the affected steam generator.
There-fore, where the instrumentation provides the subcooling of the individual coolant loops the largest value of subcooling indicated for the Individu-al loops should be used to determine whether or not to trip 42
the second two RCPs.
Further, use of cold leg subcooling will produce greater extremes of subcooling, therefore, when possible, cold leg subcooling should be used.
However, the present study shows that use of hot leg subcooling will yield sufficient subcooling to prevent trip of the second two RCPs during SLBs (Section 5.3).
4.3 DESCRIPTION
OF SETPOINT PARAMETERS The RCP trip strategy described in Section 2.2 with the trip setpoint parameters selected in Section 4.2 is summarized in Figure 4-1.
Follow-ing reactor trip, if the RCS pressure falls below a specified value (S1),
the reactor operator will manually trip the first two RCPs in dia-metrically opposed coolant loops. Then, a decision is made to trip the second two RCPs based on one of three sets of plant specific criteria:
(1) a direct indication of LOCA:
(a) maximum subcooling less than a specified value (Sil) and (b) a containment radiation alarm (S12) or (2) an inoication of LOCA by elimination:
(a) maxinum subcooling less than a specified value (Sil) and (b) no radiation alarm in the steam plant (S13) or (3) a combination of (1) and (2):
.a #
(a) maximum subcooling less than a specified value (Sil) and (b) a containment radiation alarm (S12) and (c) no radiation alarm in the steam plant (S13).
~
1 l
l l
4-3 e
4.4 Generic Setpoint Values A set of generic setpoint values for the T2/L2 RCP trip scheme parameters have been established.
The generic setpoint value for tripping the first two RCPs on low RCS pressure, 51, is [1300 psia]*. This has been determined by requiring that the first two RCPs are tripped early enough to obtain acceptable consequence for any small break LOCA, as described in Section 3.0.
~ f The generic setpoint value for the subcooling criterion on tripping of the second two RCPs, S11, is [20 F]. This value was chosen for consis-tency with values of subcooling used for other decisions in the EPGs (Reference 4) and includes an assessment for measurement uncertainty.
This value has also been shown to be adequate to prevent tripping of the second two RCPs for SLBs (see Section 5.3).
Plant. specific nominal setpoint values are provided in the Appendix.
'The criteria on radiation, S12 and S13, are based on alarms already present. These are to be consistent with the values at which these alarms are required to actuate according to present plant procedures.
I
- [ ] indicates plant specific value required.
4-4 i
I
FIGURE 4-1 RCP TRIP STRATEGY SETPOINTS EVENT r
REACTOR s
TRIP SaurA SGTR SLB AOC FIRST 2 RCPs TRi m E
E ES E
=
- 8 SECD C 2 K Ps TRI M WS E
E E
o
$g p
AcPSWUS 12M2 T2/L2 12A2 L4 5s S1 acs' _
g ;g 13 consta _
=
5
=
$ $ ti v
y a
y E5 5 TRIPFIRST
% RCPs y
I T
CONTAlltBIT
[2a$) ] Y S12 FAD AUS S11 OR SEIPOINTS T
/
mg T0 E S11
- - (\\
S13 ALATI IN
> SO.ECTE 20
)
sm MJ ON A PUWT s
SPECIFIC OR BASIS
+
S12 AN S11
+
S13 N
Ezo
]
ST o
TRIPSECOND TWORCPs
[] PLANT SPECIFIC VALUE REQUIRED 4-5 l
i 5.0 EVALUATION OF TRIP SETPOINTS FOR SAMPLE TRANSIENTS This section presents an evaluation of the generic RCP trip setpoints (Section 4) for representative transients and accidents. The sample events considered include a small break LOCA, SGTR, SLB, and two differ-ent types of depressurization A00s, increased heat removal transients and pressurizer control system malfunctions.
5.1 SETP0 INT EVALUATION OF LOCA EVENTS Two small break LOCA events were analyzed using the Reference 2700 MWt plant to evaluate the generic RCP trip setpoints. They are a 0.1 fte hot leg break and an inadvertent opening of a Power Operated Relief Valve (PORV).
5.1.1 0.1 ft2 Small Break LOCA The 0.1 fte hot leg break is the worst combination of break size and location from a core cooling standpoint with RCPs operating '(Reference 2). A conservative best estimate approach was used in the analysis of the RCP trip setpoints. These assumptions were explained in Section 3.2.
~
A 30 sec delay time before trip actuation was used following the in-dication to trip the RCPs.
The analysis shows that the initial depressurization after the break opens results in th RCS (pressurizer) pressure quickly decreasing to the generic setpoint value of [1300 psia] at 36 sec (Figure 3-1).
The RCS pressure continues to decrease to slightly above the steam bypass system setpoint of 900 psia, and remains at that value until all steam flows out the break.
The fluid temperature in the cold legs does not change very rapidly during the first 100 sec of the transient. The hot leg temperature decreases to a temperature slightly higher than the cold leg temperature valueafterreactortripoccurs(20sec). After the reactor is tripped, decay heat is the primary heat input into the coolant. The cold and hot 5-1
leg temperatures are approximately equal within the first 100 sec, as shown in Figure 5-2.
The cold and hot leg subcooling fall below the generic setpoint value of [20*F] at 41 and 32 sec, respectively (Figure 5-3).
In fact, the hot leg is completely saturated by 50 sec.
The loss of RCS subcooling is due primarily to the drop in RCS pressure.
7 The importance of this fact is that both RCS pressure and subcooling decrease at essentially the same rato.
. 'I The containment radiation alarm is expected to indicate high radiation levels within seconds from the start of the accident.
3ased on estimates from a.02 fta break (.02 ft2 is the lowest break size for which the RCPs must be tripped to avoid core overheating according to Reference 2), a radiation level of 1 R/hr is reached within 15 sec. The IR/hr limit is identified in NUREG-0737, II.F.1 as the lowest range for which contain-ment radiation monitors should be operable.
For any LOCA inside the containment, the secondary side radiation moni-tors should not result in a valid alarm..
Since the RCS pressure and.subcooling reach their setpoints essentially at the same time and containment radiation monitor reacts quickly, the reactor operator is essentially given the indication to trip all four RCPs simultaneously.
The mixture level in the inner reactor vessel is shown in Figure 6-4 for camparison with other analyses. The RCP trip strategy results in no significant core uncovery and virtually no clad temperature heatup.
l l
l l
5-2 l
i 5.1.2 Inadvertent Open PORV l
The RCP trip setpoints were also evaluated against an inadvertent opening of a PORV transient. This event was selected because it represents a break size in the "small" small break LOCA category (effective break area is approximately 0.0075 ft2) and is a more realistic scenario than the
" larger" small break LOCA events.
In addition, the stuck open PORV was investigated to demonstrate that a very small LOCA event would not be confused with a SGTR and provide ambiguous indications to the operator.
Conservative best estimate assumptions (i.e., 1 HPSI available) were used in this analysis in which a PORY is postulated to open inadvertently and remain open for the entire transient. This analysis used a main steam safety value setpoint of 1000 psia.
The RCS pressure time history for this case is shown in Figure 5-5.
The pressure setpoint to trip the first two RCPs is reached at about 200 sec.
The hot and cold leg temperatures (Figure 5-6) are virtually constant after the hot leg temperature decreases following the reactor trip. At 200'sec, the hot leg is 5*F subcooled and the cold leg'is approximately 30*F subcooled. The cold leg subcooling falls below the [20*F] generic setpoint value at about 240 sec.. Note that the hot leg subcooling is
{
slightly less than 20*F at 130 sec when the reactor trip setpoint is reached (Figure 5-7). Thus, as in the case of the 0.1 fta break, the RCS l
pressure and subccoling parameters reach their respective setpoints at almost the same time. This is important since it shows that even for i
very small break sizes, there two key parameters reach their setpoints almost simultaneously possibly resulting in a " trip four" indication to the operator.
'e Rough estimates of the amount of radiation released into the containment result in a 1 R/hr indication within approximately 60 sec after the start of the transient. This estimate, however, does not include the time i
required for the rupture disk in the pressurizer quench tank to burst.
As before, a secondary side radiation alarm signal is not anticipated for a break inside the containment.
5-3
The mixture level in the inner reactor vessel is shown in Figure 5-8.
1 For this event, the mixture level in the vessel essentially does not fall below the top of the hot leg, and core cooling is not a concern for breaks of this size.
~
5.2 SETPOINT EVALUATION FOR SGTR EVENTS The SGTR event was evaluated because of the importance of leaving at least two RCPs operating during this type of event. The NRC request in
~ 1 IE Bulletin 79-06C to trip the RCPs subsequent to reactor trip and
]
initiation of high pressure safety injection was prompted by the benefits for a small break LOCA due to a trip of all RCPs.
However, for SGTR events, RCS pressure control can be better and more easily maintained if RCP operation is continued beyond the time of reactor trip. Thus, the j
preferred mode of RCP operation during a SGTR event is to keep at least two RCPs (in diametrically opposed loops) running beyond this time. The RCP trip strategy satisfies this objective.
If the size of the rupture is small enough, then the loss of primary coolant will be made up by the Pressurizer Level Control System (PLCS) by maximizing charging and minimizing letdown. Additionally, the Pressuriz-t
]
er Pressure Control System (PPCS) will maintain the RCS pressure within l
the operating band preventing a reactor trip on low pressurizer pressure, j
If the size of the break is large,'then the PLCS and PPCS will not be able to maintain the pressurizer level and pressure within the operating l-bands and in lieu of a manual trip, an automatic reactor trip would l
eventually occur. An example of a double-ended SGTR event, which results in an automatic reactor trip, was evaluated for the Reference 2700 MWt j
plant. The variation in RCS pressure and hot leg subcooling are presented in Figures 5-9 and 5-10, respectively.
The results provided in Figure 5-9 indicate that the RCS pressure de-
~
creases slowly until the reactor trips on' low pressurizer' pressure, and then more rapidly after the trip resulting in safety injection actuation and the first RCP trip pressure setpoint of [1300 psia) being reached.
The pressure continues to decrease until the safety injection flow begins t
5-4 i
J l
to repressurize the RCS, as shown in Figure 5-9.
In Figure 5-10, the hot leg subcooling is presented.
It decreases more or less linearly prior to reactor trip due to the decrease in RCS pressure and nearly constant RCS hot leg temperature.
Immediately after reactor trip both the RCS pressure and hot leg temperature decrease rapidly. However, the decrease l*
in pressure is relatively less rapid than that of the temperature.
Additionally, a slight increase in pressure occurs immediately after
}~
turbine trip. Consequently, the subcooling increases very rapidly inenediately after trip. Subsequently, the hot leg temperature decreases e
I at a relatively slow rate, and results in the leveling off of the j-subcooling. During this time period the subcooling decreases below the I
Sll setpoint of [20*F]. However, the other setpoints of containment radiation alarm (S12) and the absence of a secondary side radiation alam l
(S13) will not be satisfied for this event. The containment radiation f
alarm is not expected to occur for the SGTR event, since the break occurs q
within the SG. The secondary side radiation monitors are expected to provide audible alarms in the control room subsequent to initiation of i
l the SGTR event. Consequently, the second two RCPs will not be manually l
tr'ipped for this event.
l Thus, the RCP trip strategy would result in manual tripping of the first j
two RCPs on low RCS pressure, and no manual tripping of the second two j.
RCPs due to the absence of containment radiation alarm and/or the pres-j ence of secondary side radiation alanns. Allowing for the two RCPs to j
continue operating beyond the reactor trip time would provide for Detter
{
plant control and cooldown. This results from the availabilty of the j,
main pressurizer spray system and the mixing of the upper head fluid with j
the RCS fluid which minimizes the possibility of the upper head fluid from stagnating and forming a void.
4 ' ',,
]
5.3 SETPOINT EVALUATION FOR SLB EVENTS
!~.
i H
A double-ended guillotine break (DEGB) of a main steam line at the steam generator outlet nozzle was analyzed to evaluate the effectiveness of the 4
{
generic RCP trip setpoints for increased heat removal (IHR) accidents.
j This SLB causes a rapid depressurization of the RCS resulting in tripping 5-5
of the first two RCPs. Due to the large depressurization, it also presents the greatest challenge of any IHR event to the subcooling criteria for tripping of the second two RCPs.
With the exception of moisture carryover, best estimate assumptions were used for this SLB analysis.
It was conservatively assumed that there was no moisture carryover during the steam generator blowdown.
This assump-tion exacerbates the cooldown and depressurization, yielding slightly earlier trip of the first two RCPs and a greater challenge to the sub-cooling criteria for tripping the second two RCPs.
The event was analyzed for the Reference 2700 MWt plant and was assumed to occur while the plant was operating at full power with nominal values of plant parameters, such as temperatures, pres'ures, and water levels.
s A 30 second delay time was used following an indication to trip the RCPs.
The DEGB SLB results in reactor trip at 3.4 seconds on low steam genera-tor pressure. ;The steam blowdown then causes a severe cooldown of the RCS resulting in a rapid depressurization of the primary system. The analysis shows that the i..ltial depressurization results in the RCS pressure decreasing to the generic setpoint value of [1300 psia] at 24 seconds (Figure 5-11). The RCS pressure continues to decrease, reaching a minimum of 900 psia when the affected steam generator dries out at one minute into the transient. Thereafter the RCS pressure increases due to the increase in coolant energy caused by decay heat addition and heat transfer from the metal of the primary system to the coolant and due to the increase in coolant inventory which results from HPSI and charging pump flows.
1 The DEG8 SLB results in blowdown of both steam generators until a low steam generator pressure or a high containment pressure causes a main steam isolation signal (MSIS). The MSIS initiates the closure of the main steam isolation values (MSIVs) and the main feedwater isolation values (MFIVs) terminating the blowdown of the unaffected steam generator by 10 seconds into the transient. This is reflected in the RCS coolant l
temperatures shown in Figure 5-12 and in the hot leg subcooling (Figure i
1 5-6
1 3
5-13). The initial cooldown rate is very severe and is essentially i
uniform in the two loops. After the unaffected steam generator is isolated the cooldown continues in the affected loop. However, this cooldown is not fully propagated to the loop with the unaffected steam generator due to incomplete mixing of the coolant in the reactor vessel.
After steam generator dryout at one minute into the transient, the RCS temperatures increase due to decay heat addition and heat transfer from the metal of the system and from the fluid in the intact steam generator.
i This increase is most marked in the loop with the affected steam genera-l, tor, due to the effect of mixing with the hotter fluid from the loop with the unaffected steam generator.
By approximately 4 minutes into the transient, the two loops have reached thermal equilibrium with each other and with the fluid in the unaffected j
steam generator. Thereafter, primary and secondary (in the unaffected steam generator) pressures and temperatures con'tinue to rise slowly until the operator takes action to stabilize the plant using auxiliary feedwater and either the steam bypass system or the atmospheric dump
~
valves.
If the operator takes no action, then the pressures will reach the safety valve setpoints.
The hot leg subcooling (Fig 5-13) decreases from an initial 60*F to approximately 40*F during the first few seconds of the transient, since l
the effect of the cooldown upon the pressure is propagated essentially instantaneously throughout the RCS, while the thermal effect requires more than 5 seconds to be transported by the fluid through the cold legs.
I and the reactor vessel to the hot legs. This short decrease in the l
subcooling would not challenge the subcooling criteria even if it were to I,., ~
approach the setpoint, since it occurs prior to reaching the pressure setpoint for tripping of the first two RCPs.
After the initial quick decrease in the subcooling, the affected loop subcooling rises rapidly to 120*F at one minute (steam generator dryout)-
with another momentary fluctuation following MSIV closure. Subcooling in the unaffected loop decreases after the MSIVs close to a minimum of 65'F.
After steam generator dryout, subcooling in the affected loop also l
5-7 I
decreases. The minimum subcooling in the affected loop following steam generator dryout is 85*F at about 4 minutes into the transient. There-after, the subcooling in both loops steadily increases.
Since the subcooling in both hot legs was never less than [20 F], the second two RCPs would no't be tripped.
For this event, there would be no secondary side radiation alarm and most probably no containment radiation alarm. The first of these indications
~
would signal a trip of the second two pumps if it were not for the subcooling criterion.
The lack of a containment radiation alarm would have resulted in the second two pumps not being tripped even if the i
subcooling criterion had not been met. Thus the RCP trip strategy would result in manual tripping of the first two RCPs on low pressurizer pressure, and no manual tripping of the second two RCPs due to the presence of more than [20 F] subcooling in at least one hot leg. Since this is true for the DEGB SLB it would also be true for smaller SLBs.
Allowing for the two RCPs to continue operating provides for better plant control and cooldown, resulting in timely shutdown cooling entry.
Additionally, having the increased coolant flow from the two RCPs, as opposed to natural circulation, results in a less severe thermal tran-sient in the reactor vessel downcomer region and therefore reduces the concern for potential pressurized thermal shock effects.
5.4 SETPOINT EVALUATION FOR INCREASED HEAT REMOVAL (IHR) A00 EVENTS i
l An inadvertent increase in turbine power from no load to full power was
~
analyzed to evaluate the effectiveness of the generic RCP trip setpoints for an IHR A00. This event causes the greatest rate of cooldown and
~
depressurization of any IHR A00, thereby presenting the greatest chal-lenge to the RCP trip criteria. However, the depressurization is not
~
i sufficient to result in tripping of the first two RCPs.
Therefore, all RCPs are kept operating, thus, maintaining the greatest potential for easy recovery from the event.
I 5-8
i i
i Best estimate assumptions were used for this analysis. The event was analyzed for the Reference 2700 MWt plant and was assumed to occur while the plant was operating at no load with nominal values of plant parame-ters, such as temperatures, pressures, and water levels.
Following the postulated instantaneous turbine power increase from no load to full power, the reactor trips on high core power at 16.5 seconds.
Steam flow is assumed to continue through the turbine until a MSIS on low j
steam generator pressure results in closure of the MSIVs on both steam
),
generators by 37 seconds. MSIV closure terminates the cooldown and the l
resultant depressurization.
i The pressurizer pressure (Figure 5-14) decreases rapidly to a minimum of i
1700 psia following MSIV closure. Since this is above the generic setpoint value of [1300 psia], the first two RCPs are not tripped.
Therefore, all foue pumps would remain operating, facilitating a rapid recovery from the event.
l The hot leg subcooling for this event is presented for information in 1
l Figure 5-15.
Note that this subcooling, as well as the lack of a con-tainment radiation alarm, would prevent tripping of the second two RCPs, even if the first two were tripped due to a higher setpoint for the pressure criterion or an operational error.
Since this event results in the most severe depressurization of any IHR A00, the RCP trip strategy would result in all four RCPs remaining in l
l operation for any IHR A00.
5.5 OTHER TRANSIENTS l 1 Other transients for which the reactor might automatically trip on low pressurizer pressure followed by high pressure safety injection actuation include the letdown line break events and the PLCS (no charging flow and i
maximum letdown) and PPCS (full main spray) malfunction events. However, timely operator action would prevent an automatic reactor trip, and the 5-9,
plant could then be manually shutdown using appropriate plant procedures without actuating safety injection.
For these events, an automatic reactor trip on low pressurizer pressure resulting in subsequent RCP trip is not expected to occur for a long period of time (probably more than 30 minutes). According to the American National Standards Institute criteria for safety, related operator actions documented in ANSI-N660, operator actions can be assumed
~
within 20 minutes after the start of the above transients. Therefore, an automatic reactor trip for these events would be highly unlikely.
Assuming no manual operator actions to correct the cause of the PPCS malfunction event, an automatic reactor trip on low pressurizer pressure will eventually occur. The first two RCPs would then be manually tripped for the PPCS malfunction event due to the RCS pressure decreasing below the Si setpoint of [1300 psia].
However, the second two RCPs would not be tripped since the hot leg subcooling will remain well above the S11 setpoint of [20*F].
For the letdown line break and the PLCS malfunction events, if no operator actions are assumed and should a reactor trip on low pressurize pressure occur, the first two RCPs would be manually tripped upon reaching the S1 setpoint. Additionally, as the hot leg subcooling decreases to the Sll setpoint of [20 F], the second two RCPs would be manually tripped if setpoints S11 (subcaoling) and S13 (no steam plant radiation alarm) are employed as combination setpoints for operator action. Other setpoint combinations (Sil + S12, or Sll + S12 + S13) will not lead to tripping of the second two RCPs due to the absence of containment radiation alarms for these events.
The probability of manual tripping of any of RCPs for the above tran-sients is considered very low since there is adequate time for the operator to correctly diagnose the events and take appropriate actions without RCP trip.
However, even if the first two RCPs were tripped, i
there is a very high probability that the second two RCPs would remain operating.
5-10
FIGURE 5-1 0.1 FT2 HOT LEG BREAK RCS (PRESSURIZER) PRESSURE 2400 -
2000 1600 -
E-S1 =
1300 PSIA' y
1200 -
isOE 800 -
400 -
4,.
0 0
200 400 000 800 1000 TIME,SEC 5-11
FIGURE 5-2 2
0,1 FT HOT LEG BREAK i
RCS FLUID TEflPERATURES
~
800 HOT LEG
--- COLD LEG 700 l
600 J
~
s_
EE 500 5
!is le 400 300 200 l
0 200 400 600 8 00 1000 i
Tit 1E, SEC i
l 5-12 1
FIGURE 5-3 2
0.1 FT HOT LEG BREAK HOT LEG SUBC00 LING 120 -
100 80 o'
S 3
60 i
8M 5!
40 S11 =
20 F0 20
' ~
~
0 0
200 400 000 800 1000
~
TIME, SEC 5-13 i
FIGURE 5-4 0,1 FT2 HOT LEG BREAK INNER REACTOR VESSEL MIXTURE LEVEL 1
48
~
40 i
32 3
d N
BOTTOM 0F HOT LEG B
24 a
g TOP OF ACTIVE COR.
iE 5
- c 16 i
8 0
0 200 400 600 800 1000 Tif1E, SEC 5-14
FIGURE 5-5 INADVERTENT OPEN PORV RCS (PRESSURIZER) PRESSURE e
2400
]
2000 1600 5g S1=[1300 PSIA' d
1200 5!
$E 1
i 800 400
~
0 0
200 400 000 800 1000 TIME, SEC 5-15
FIGURE 5-6 INADVERTENT OPEN PORV RCS FLUID TEMPERATURES 800 HOT LEG 700
--- COLD LEG
.4 4
600
(
E' d
EE 500 E!!
W 5
i 400 i
l 300 200 0
200 400 000 800 1000 l
TIME,SEC 5-16
FIGURE 5-7 INADVERTENT OPEN PORV HOT LEG SUBC00 LING 120 100 80
. u-c 5E EO d88 o
40
~
20 0
~
0 200 400 000 800 1000 TIME,SEC 5-17
l FIGURE 5-8 lilADVERTENT OPEN PORV INNER REACTOR VESSEL MIXTURE LEVEL e
4 l
48 4
40 i
j 32 tr c5 BOTT0f1 0F HOT LEG 3
=
24 a
g TOP 0F_ ACTIVE CORE 5
25 16 4
8 -
I i
0 0
200 400 600 S00 1000 l
Tif1E, SEC 5-18
FIGURE 5-9 2700 MWT CLASS PLANT ANALYSIS SGTR W/0 LOSS OF 0FFSITE POWER RCS PRESSURE 2500 i
2200 1900
- 5 2
u2 E 1600 Mu c.
^
~
1300 1000 700 0
200 400 600 800 1000 1200 l
TIME, SECONDS 5-19
FIGURE 5-10 2700 MWT CLASS PLANT ANALYSIS SGTR W/0 LOSS OF 0FFSITE POWER HOT LEG SUBC00 LING 60 i
e i
i 50 40
~
~
E' sj 30 l
38 e
5?
S11 =
20 F 20 10 I
Q t
i i
i I
0 200 400 600 800 1000 1200 TIME, SECONDS 5-20
I i
i I
?
j FIGURE 5-11 i
DOUBLE E!1DED GUILLOTlilE SLB 1
1 RCS(PRESSURIZER) PRESSURE i
e i
2500 t
i i
i i
j 2000 i
i 5
'500 l
E 1
S1 =
1300 PSIA $ __
i g
/y-g
,CCC t
c_
r f
1 l
5CC '
1 3
!p*,
g i
I I
I i
O 100 200 300 400 500 i
TIME.
SECON05 4
1 i
5-21 4
i I
t l
FIGURE 5-12 i
i DOUBLE ENDED GUILLOTINE SLB liOT LEG TEMPERATURES I,
l 650 i
i i
i i
.t 3
{
600 p i
1 l
.I 550
\\
c"'
1
\\
t i
lt!
E 500 I
E UNAFFECTED HOT LEG a$
1
/
\\ /j/
j 450 AFFECTED HOT LEG J
J l
1 4CC
}
i i
I 350 I
I I
i 1
0 ICC 200 300 400 500
/
i TIME.
SECONCS d
5-22 i
f
4 FIGURE 5-13 i
4 DOUBLE ENDED GUILLOTINE SLB HOT LEG SUBC00 LINGS I
4 i
150 i
i i
l l
i 125 i
i
(
AFFECTED LOOP 100 i
l M
75 I
.i g
,j UNAFFECTED LOOP v
i E
m 506 4
t
'o S11 =.20 F_
)
L..
O I
I I
0 100 200 300 400 500 l
TIME.
SECONOS 5-23
1 i
FIGURE 5-II4 i
i INCREASED HEAT REMOVAL A00 ZER0TOFUI.LTORBINELOAD l
RCS (PRESSURIZER) PRESSURE 2500 i
i i
i I
i 1
i j
2000
_m 1500 g
i S1=.L1J0, PSIA, 0
w 8
j 1000 i
500 i
.I, 0
I I
I 0
100 200 300 400 500 TIME. SECONOS l
4 i
i 4
5-24
-v.
_-,--..,w.,_
,-.h,. E,.,
~ - -
i FIGURE 5-15 INCREASED HEAT REMOVAL A00 ZERO TO FULL TURBINE LOAD i
HOT LEG SUBC00 LINGS 1.
150 i
,i i
i I
125
-LOOP WITH PRESSURIZER
)
I t
100 o
l b
75 a8 3
v l
!B m
50.
i t
25
$11=[200F[
3 O
I I
I I
0 100 200 300 400 500
- TIME, SECONOS l
t 5-25
6.0 EVALUATION OF TRIP SETPOINTS AGAINST NRC GUIDANCE AND CRITERIA e
The NRC guidance and criteria (Reference 1) for a RCP operation strategy that could result in RCP trip during transients and accidents was outlined in Section 1.2.3.
This section discusses how the T2/L2 RCP trip strategy meets the key features of the NRC guidance and criteria.
6.1 SMALL BREAK LOCA VS NON-LOCAs 4
i.
The NRC guidance and criteria states that the RCP trip scheme should result in RCP trip for all losses of primary coolant to the containment (e.g., small break LOCA) for which RCP trip is necessary (Reference 1).
C-E calculations showed it is recommended to trip the RCPs for small l
break LOCAs in the break size range from 0.02 ft2 to 0.1 ft (Reference 2). The NRC guidance additionally suggests that forced RCS
]
circulation should be ensured for other non-LOCA events, such as a SGTR.
I This guidance and criteria was one of the primary goals of the T2/L2 RCP trip strategy which was presented in detail in Section 2.
The RCP trip setpoints parameters were selected in order to identify a I
LOCA from a non-LOCA event. For LOCA events, all four RCPs are tripped on virtually simultaneous trip signal indications. Two RCPs may remain operating for non-LOCA events to aid the operator in RCS pressure control and RCS heat removal.
More information about the unique identification of a LOCA will be i
presented in Section 6.6.
6.2 AVOIDANCE OF RCP OPERATION UNDER VOIDED CONDITIONS i
Another NRC concern is the prolonged operation of the RCPs when the RCS
^
is at saturation conditions.
RCP operation when the RCS is under voided conditions or otherwise-operating outside design conditions could result in damage to the RCP 1
l 6-1
-. ~. _ -- _., _
u.
seals and/or other RCP subcomponents. RCP damage would then negate the effects of the planned RCP operation and possibly increase the severity of the initiating event in progress.
~
The T2/L2 RCP trip strategy was designed to preclude prolonged RCP operation when the RCS becomes saturated. The RCS can become saturated during a small break LOCA and can remain in that condition for a
{
considerable length of time depending upon the break size. The generic j
RCP trip setpoints result in essentially a " trip four" scheme since the
~
l RCS pressure and subcooling decrease at. virtually the same rate.
Recall that the generic trip setpoint for subcooling is [20'F] which provides some margin for the RCPs to be tripped prior to a significant void I
fraction in the RCS.
For the 0.1 ft2 break ECCS licensing model analysis (see Section 7.1) in which the RCPs were tripped two minutes after the j
trip setpoints were reached, the RCS had a void fraction of approximately 0.3 at the time of RCP trip (162 sec).
For this case, the RCS became j
saturated about 50 sec after the start of the transient. Therefore, it can be assumed that there would not be prolonged RCP operation under high void fraction, even for a relatively "large" small break LOCA.
There may be a decrease in subcooling.below [20 F] for some SGTR events due to the decompression of the RCS, but subcooling subsequently increases as RCS pressure control is restored.
Reactor vessel upper head voiding for a SGTR is not anticipated for.the T2/L2 RCP trip strategy since the forced circulation with two RCPs operating should prevent a I
loss of subcooling in the reactor vessel upper head as the upper head fluid continues to be mixed with the RCS fluid. This is explained in more detail in Section 6.4.
Therefore, there would not be prolonged RCP operation for a SGTR with subcooling below [20*F] since subcooling is 3
restored quickly.
A loss of subcooling is not expected for SLB and A00 events.
1 I
i 6-2 1
i r...
_.,. e. %.
s,.,.e.,.,
,r,
.-m.~~.r.-. w-m..
6.3 PORV CHALLENGES All of the events considered for potential manual trip of the RCPs are depressurization and/or cooldown events resulting in a decreasing RCS pressure. The decrease in pressure is due to either an overcooling of the RCS or a loss of RCS inventory resulting from a break in the RCS pressure boundary or malfunctions of certain control systems.
Challenges to the PORVs can be either automatic or manual.
For the events during which the RCP trip strategy might be employed, there is only a small probability that the PORY opening pressure setpoint will be automatically reached. This is because, the shutoff head of the HPSI pumps is smaller than the PORY setpoint and RCS repressurization would occur slowly due to the charging flow. The slower repressurization rate would provide 4
adequate time for the operator to take appropriate actions to control the RCS pressure.
l Although the RCS can be depressurized by opening of the PORVs, the preferred means of RCS pressure control is via t:1e main or auxiliary pressurizer sprays. The main pressurizer sprays would be unavailable if all the RCPs have been tripped, which would be the case for LOCAs with the T2/L2 RCP trip strategy. However, the auxiliary pressurizer sprays would be available if needed, but are not essential for this event.
l Similarly, for the SLB event, a quick depressurization of the RCS is not essential. Only for the SGTR event is it necessary to quickly depressur-ize the RCS close to the SG secondary side pressure in order to minimize the primary to secondary leakage, and in turn to minimize any steam
).
releases to the environment. This can be accomplished using the auxiliary pressurizer sprays in the absence of the main sprays. All of the C-E NSSSs are equipped with auxiliary spray systems which employ the charging pumps to feed the sprays. Thus, no challenges to the PORVs, either automatic or manual, need occur as a result of the RCP trip
~
strategy.
t i
l I
6-3
6.4 _ UPPER HEAD V0IDING The non-LOCA depressurization and overcooling transients evaluated in Section 5 have a potential for causing void formation in the upper head region of the reactor vessel with single phase liquid conditions in the rest of the RCS.
This void formation is maximized for the case with no RCPs operating due to the nearly complete thermal decoupling of the upper head from the rest of the RCS. Analyses of this scenario for the
.~
~
non-LOCA transients were completed and documented in Reference 5.
These analyses indicate that the upper head voiding is not extensive enough to uncover the reactor vessel hot legs. The main impact of the vessel upper head void is a slower pressure response, since once this relatively stagnant region reaches saturation, it acts like a pressurizer. The slower pressure response can hold up the pressure for SGTR and SLB events. This will increase the primary to secondary leakage during a SGTR event and reduce the safety injection flow during a main SLB event.
However, the impact of these effects does not result in a violation of the cr.iteria specified by the Standard Review Plan guidelines even though upper head voiding has an impact upon trans'ient values of plant parame-ters.
C-E emergency procedure guidelines (Reference 4) adequately address the control of RCS voids. For void formation in the upper head region to occur, the pressurizer does not have to drain.
Depressurization of the system to saturation conditions is sufficient for voids to be generated (e.g., after a SLB, the rate of depressurization is such that this
~
situation exists). Although natural circulation will not be impeded since the upper head voids do not expand beyond the top of the hot legs, an asymmetric cooldown as discussed in Reference 5 will exist. Pre-cautions as detailed in Reference 5 to prevent voids from forming in the affected steam generator loop need to be considered and are contained in Reference 4.
The above conclusions were reached for the case with no RCPs operating.
In terms of upper head voiding, the conclusions will bound the scenario 6-4
with two RCPs operating which is the case for the non-LOCA transients considered in Section 5.
6.5 SERVICE WATER AVAILABILITY RCP cooling water will be isolated at some plants upon a containment isolation actuation signal (CIAS). Continuous RCP operation under this condition may lead to potential RCP damage.
Low RCP cooling flow alarms are available in the control room, and timely operator action could be employed to restore essential water service.
Each utility should review the RCP cooling water service system requirements on a plant specific basis and make changes as necessary.
6.6 UNAMBIGU0US,LOCA INDICATION One of the most important aspects of a RCP trip strategy is to ensure that the RCPs are tripped for a LOCA.
In the case of a hot leg LOCA, core cooling can be threatened if the RCPs were left operating (Refer-ent.es 2 and 3).
The T2/L2 RCP trip strategy results in.two RCPs being tripped for any sizable depressurization event. The purpose of the second tier setpoints (see Section 4) is to differentiate between a LOCA and a non-LOCA. A key feature of a LOCA is the loss of RCS subcooling. A SLB provides for an asymmetric cooldown of the RCS, so while one coolant loop may lose i
subcooling, the other loop would show an increase in subcooling.
- Thus, the subcooling requirement provides a direct distinction between a LOCA l
and a SLB. Note, that an A00 would not normally cause a depressurization severe enough to trip the first two RCPs, but if it did, it is expected that there would not be a loss of RCS subcooling.
~.
The containment radiation alarm and lack of a SG secondary side radiation
~
alarm indications are utilized to discern a LOCA from a SGTR. A LOCA would result in a high containment radiation alarm which is a direct l
indication of a LOCA inside containment. A SGTR would not cause a containment radiation alarm since the coolant leakage is from the primary 6-5
RCS into the SG secondary side and not into the containment. The absence of a secondary side radiation alarm is also a positive indication of a LOCA. A LOCA inside containment would not result in a secondary side radiation alarm since there is not any radiation leakage from the primary to the secondary system. A LOCA outside containment (letdown or charging line break) may result in a secondary side radiation alarm. Operator judgement is necessary to diagnose this type of event, which can be 1solated. Note that for breaks less than 0.02 ft2 in the Reference 2700 MWt plant, RCP operation does not affect core uncovery (Reference 2). A double-ended rupture of a letdown or charging line has a break size of 0.016 fta. A SGTR would result in actuation of this alarm since there is direct leakage from the primary to the secondary side. Thus, the absence of this alarm provides an indication of a LOCA.
l e
I 6-6
. - _ - -.. =
3 7.0 JUSTIFICATION OF MANUAL RCP TRIP i
l In order to justify a manual RCP trip strategy, the NRC (Reference 1) recommended that two specific small break LOCA analyses be performed.
j.
One of the analyses is to demonstrate acceptable compliance with the 10CFR50.46 limits under Appendix K ground rules..The second analysis is j
j.
to determine the time available for the reactor operator to manually trip i
the RCPs after the trip setpoint has been reached.
I,,
i i
7.1 COMPLIANCE WITH 10CFR50.46 l
An analysis was perfonned to show that the RCP trip scheme described in Section 2 would meet the limits set forth in 10CFR50.46, Appendix K.
i l
A best estimate version of the CEFLASH-4AS computer code was used for this analysis.
Input changes were made to comply with the Appendix K I
groundrules. Most notably, only one HPSI pump was assumed available, and a 1.2 multiplication factor on the 1971 ANS de' cay heat curve and the Moody break flow model were used in the calculation. These analyses were
{
performed for the Reference 2700 MWt plant. The lowest high pressure l
safety injection (HPSI) delivery flow rate in that plant class was used.
As stated earlier, the limiting break size (0.1 ft*) for the Reference i
plant class and the worst break location (hot leg) for accident analysis with extended RCP operation were modeled (References 2'and 3).
Following the thermal-hydraulic blowdown calculation, a separate clad temperature j-calculation was made using the PARCH computer code.
I t[,..
The results of the anal.ysis showed that the pressure setpoint of [1300 I
psia] was reached at about 40 sec after the start of the transient (Figure 7-1). At this time, the hot leg fluid was saturated and the cold
{
leg fluid was 10'F subcooled.. Thus, the setpoints to trip all four RCPs f'
were reached virtually at the same time resulting in a defacto " trip 4" l
signal.
In accordance with the NRC guidance for the Appendix K calcu-lation(Reference 1),atwominute(120sec)delaytimewasassumed l
before the four RCPs were tripped.
i 7-1
I i
i l
The mixture level for the inner reactor vessel node is shown in Figure j
7-2.
The active core starts to uncover at 731 sec and remains uncovered for approximately 1450 sec. The maximum depth of uncovery was 4.0 ft at 1228 sec. The hot si n liquid inventory time history is presented in l
Figure 7-3.
The minimum liquid inventory of about 88,500 lbm occurs at j
1050 sec. The peak clad temperature (Figure 7-4) for this calculation l
was 1973'F at 1530 sec, which is below the limit of 2200*F set forth in l
i This result is consistent with the conclusions of Reference 2, that under licensing analysis conditions, cladding temperatures will not exceed i
Appendix K limits if the RCPs are tripped within 6 minutes of the safety l
injection actuation signal (SIAS).
For the analysis just presented, SIAS j
occurred at 23 sec.
i jl Another conclusion from Reference 2 that is applicable to the licensing evaluation of the RCP trip scheme is repeated here for convenience.
Core
(
uncovery will not occur if two RCPs are tr.ipped as,soon as possible after j
SIAS and the' remaining two RCPs remain operating, provided two HPSI pumps j
are verified to have started and are operating normally, i
1 j
7.2 JUSTIFICATION OF TIME REQUIRED FOR MANUAL RCP TRIP
]
A most probable best estimate analysis of the time available to the reactor operator to manually trip the RCPs was performed.
The results of j
this analysis were then compared to the time required for operator action j
recommendedinDraftANSIStandard58.8,Rev.2(Reference 6)inorder.to demonstrate compliance with the Standard.
The major assumptions contained in the most probable best estimate analysis in:1ude the availability of two HPSI trains, the use of the steam bypass system and the atmospheric dump valves on the steam genera-j tor secondary side, a 1.0 multiplier on the 1971 ANS decay heat curve and the homogeneous equilibrium break flow model. A 0.1 ft8 hot leg break i
was analyzed using a best estimate version of the CEFLASH-4AS computer-l code assuming all four RCPs in continued operation. This calculation was i
7-2
4 l
\\
l performed previously and is documented in CEN-ll4 (.9eference 2) as case 1
P14 (Question 13).
]
The assumption of two HPSI pumps for this analysis is reasonable. The availability of two HPSI pumps is controlled by plant specific Technical Specifications. C-E plants with the exception of Palisades, St. Lucie 2 and the System 80 plants have three HPSI pumps installed on site.
For
{,,
those plants with three HPSI pumps, if routine Technical Specification surveillance determines that one HPSI is unavailable, the third HPSI -
could be put on line to maintain two HPSI pumps available. The failure of an individual HPSI pump to start is estimated to be 2x10-3 per demand (Reference 7), which is based on actual operating experience.
Reliability assessments made at C-E of the probability of HPSI system failure is on the order of 10-4 per demand depending on HPSI system configuration.
The primary result of this calculation was that core uncovery would not J
occur with all four RCPs operating as shown in Figure 7-5.
The hot side liquid inventory is presented in Figure 7-6.
The minimum liquid inven-tory of 87,000 lbm occurs at 900 sec.
Draft ANSI Standard 58.8 recommends approximately 15 minutes be allowed for the reactor operator to manually turn off the RCPs.
Based on the r
analysis performed, the RCPs do not have to be tripped prior to 15 minutes after the RCP trip setpoints were reached.
Tripping the RCPs after 15 minutes may result in some core uncovery.
although not sufficient to cause excessive fuel failure.
For the case presented in Figures 7-5 and 7-6, if the RCPs had been tripped (or failed)atthetimeofminimuminventory(Figure 7-6),thecorewould uncover to a depth of roughly four feet. Under such conditions, cal-culated clad temperatures at the fuel hot spot would be well under
~
licensinglimits(Reference 2).
In conclusion, the results of the most probable best estimate analysis I
demonstrates the minimum time required for the operator to trip the RCPs i
7-3 1
is infinite. Therefore, the manual RCP trip strategy satisfies the Draft ANSI Standard time response criteria.
S e
O 9
0 9
e O
e S
7-4
FIGURE 7-1 2
0.1 FT HOT LEG BREAK LICENSING ANALYSIS RCS (PRESSURIZER) PRESSURE 2400 I
2000 1600
<c ti a.
&E 1200 b;
w E
800 3
400 -
0 0
300 600 900 1200 1500 1800 2100 TIflE,SEC L
7-5 f
. _.. - -. _ -. _ _ -., _. _. _ _. ~..
FIGURE 7-2 2
0.1 FT HOT LEG BREAK LICENSING ANALYSIS INNER REACTOR VESSEL MIXTURE LEVEL i
48 i
i i
.~
40 1
32 d
u_
ri 3
24
~
E TOP OF CORE E
16 g
0 0
300 600 000 1500 1800 2100 2400 TIME, SEC
+
7-6
2 FIGURE 7-3 2
0.1 FT HOT LEG BREAK LICENSING ANALYSIS j
SUN HOT SIDE LIQUID MASS 1
300 i
i i
i i
i 250 1
m 200 a
~
i My 150 e
Ea
=
100 E
i 50 1
I i
i i
i 0
0 300 600 000
~1500 1800 2100 3000 TIf1E,SEC 7-7
FIGURE 7-4 2
J 1 FT HOT LEG BREAK LICEllSING ANALYSIS CLAD TEMPERATURE AT HOT SPOT 2200 -
2000 -
O el 1800 i2
$s b
1600 e
3 1400 1200 1000 0
400 800.
1200 1600 2000 TIME,SEC 7-8
FIGURE 7-5 0.1 FT2 HOT LEG BREAK MOST PROBABLE BEST ESTIMATE ANALYSIS FOUR RCPs OPERATliiG INNER REACTOR VESSEL MIXTURE LEVEL 48 4
40 32 j
BOTTOM OF HOT LEG y
l g
24
~
~
W
~
~
TOP OF CORE i
"J 10 a
8-1 0
0 500 1000 1500 2000 TINE,SEC I
i 7-9
5 FIGURE 7-6 2
0.1 FT HOT LEG BREAK I
fl0ST PROBABLE BEST ESTIMATE ANALYSIS l
FOUR RCPs OPERATING SUM HOT SIDE LIQUID MASS q
300 IL r
i 250 1
L 200 l
g m
x a
150 a
- ,2 8%y 100
.i 5
q
=
50 a
l 0
O 500 1000 1500 2000 TIf1E,SEC u
7-10
'l
8.0 GENERIC INSTRUMENTATION EMPLOYED TO IMPLEMENT THE RCP TRIP SCHEME The T2/L2 RCP trip strategy does not require additional instrumentation or processing equipment to implement.
The existing or planned pressurizer pressure sensors are satisfactory to cover the necessary range for the RCP trip scheme. The 2700 MWt class plants have pressurizer pressure instrumentation to cover the ranges 0-1600 psia and 1500-2500 psia. The 3410 MWt and System 80 class plants have wide range pressure sensors to cover the range from 0-3000 psia.
The pressurizer pressure sensors are safety grade class 1E instrumenta-tion.
The RCS Fubcooling is determined from the Subcooled Margin Monitor (SMM).
The SMM receives pressure input from the pressurizer pressure sensors and temperature input typically from one hot leg RTD and two cold leg RTDs per channel. The SMM processing equipment selects the highest tempera-ture from the three temperatures input and computes the RCS margin to saturation.(i.e.,subcooling).
In general, the RCS subcooling that is computed and then displayed to the operator is based on the hot leg RTD temperature since the hot legs are usually hotter than the cold legs.
The cold leg temperatures can be displayed from the SMM if selected. Cold leg subcooling can then be calculated based on the difference in tempera-ture between the hot and cold legs and the hot leg subcooling. The SMM is part of the Inadequate Core Cooling Instrumentation and is required by the NRC to be safety grade class IE (NUREG-0737, Section !!.F.2).
A minimum of two inside containment radiation level monitors are required in accordance with NUREG-0737, Section !!.F.1 to be qualified to function in an accident environment (class IE). The containment radiation moni-8 tors must be able to span a range from I rad /hr to 10 rads /hr(betaand 8
gama) or 1R/hr to 10 R/hr (gama only). Radiation levels of about 1-10
~
R/hr is anticipated to be sufficient to detect a 1.0CA.
The SG secondary side radiation monitors typically consist of radiation monitors in the condenser air ejector, SG blowdown line and/or main steani 8-1
L lines. These sensors are not required to be safety grade instrumenta-tion. However, actual operational experience from past SGTR events have shown that in many cases, a secondary side radiation alarm provides the earliest indication of a SGTR.
[
9 E
t 8
e f
'* l 8
e I
t L
r e
l I
l l
1 l
l r
e s
4 8-2
9.0 CONCLUSION
S The evaluation of the trip two/ leave two manual RCP trip strategy de-termined that the RCP trip scheme meets the goals and objectives for the trip strategy and trip setpoints.
In addition, the RCP trip strategy satisfies the NRC guidance and criteria for a manual RCP trip scheme.
The T2/L2 RCP trip scheme results in all RCPs tripped in the case of a LOCA. The trip scheme also provides for at least two RCPs operating for many non-LOCA events (SLBs, SGTRs and A00s).
Conservative best estimate analyses were performed to show that the core would not incur significant core damage if the second two RCPs were tripped or failed at the worst time during a small break LOCA.
The RCP trip setpoints selected provide a simple trip scheme with suffi-cient flexibility for plant specific setpoint selection. One setpoint is used for tripping the first two RCPs and a choice of three setpoint combinations are provided for tripping the second two RCPs.' One setpoint combination should be selected by each utility on a plant specific basis.
The T2/L2 RCP trip strategy meets the NRC analytical guidance for justi-fication of manual RCP trip. An analysis of the worst small break LOCA with the licensing analysis assumptions demonstrated compliance with 10CFR50.46, Appendix K limits. A most probable best estimate small break LOCA analysis was conducted to show that there is no required time limit for operator action to terminate RCP operation. This analysis satisfies ANS! Standard 58.8 for the minimum time for operator action.
In conclusion, the T2/L2 manual RCP trip strategy provides the reactor operator with a simple, straight forward RCP trip strategy which facili-tates regaining control of the reactor during a transient or accident.
g-1
_ __~
l
10.0 REFERENCES
I l
1.
NRC Letter from Darrell G. Eisenhut (Director of Licensing, NRC) to AllApplicants(andlicensees)withCombustionEngineeringDesigned Nuclear Steam Supply Systems, Resolution of TM! Action Item l
{,
!!.K.3.5, " Automatic Trip of Reactor Coolant Pumps," Generic letter NO.83-10a (and 83-106), February 8, 1983.
j 2.
Combustion Engineering, Inc., " Review of Small Break Transients in Combustion Engineering Nuclear Steam Supply Systems," CEN-114-P (Amendment 1-P), July 1979(Proprietary).
3.
Combustion Engineering, Inc., " Response to NRC !E Bulletin 79-06C, Items 2 and 3 for C-E Nuclear Steam Supply Systems," CEN-115 P.
August 1979(Proprietary).
j 4.
Combustion Engineering, Inc., " Combustion Engineering Emergency Procedure Guidelines," CEN-152, Revision 01, November 1982.
1 j
5.
Combustion Engineering, Inc. " Effects of Vessel Head Voiding During
}
Transients and Accidents in C-E N555s," CEN-199, March 1982.
4
[
6.
American National Standard Institute " Time Response Design Criteria for Safety Related Operator Actions " Draft ANS 58.8, March 1981.
7.
" Generic Data Base for Data and Models Chapter of the National, Reliability Evaluation Program Guide," EGG EA 5887 June 1982.
i b' '.
l J
1 10-1
APPENDIX i
PLANT SPECIFIC RCP TRIP SETPOINT VALUES 1
This Appendix provides nominal RCS pressure and subcooling setpoint values.
These nominal values provide a basis for development of plant specific set-points to be incorporated into the plant emergency operating procedures.
For j
this purpose, C-E plants have been divided into four classes shown on Table
}
A-1.
A plant specific assessment of the effect of instrument uncertainty on
)
the nominal setpoints is not included in this evaluation.
RCS Pressure Setpoint i
l Analyses of the lowest pressure setpoint to trip all four RCPs following a small break LOCA to avoid degradation in core cooling were previously per.
i fonned for the CEOG.
These analyses were based on the concept of tripping all I
four RCPs at a pressure setpoint which is lower than the Safety Injection Actuation Signal (S!AS) pressure but high enough to assure tripping of all RCPs for a LOCA.
If this concept is applied to the T2/L2 RCP trip scheme, then a lower limit for the RCS pressure setpoint for tripping the first two L
RCPs can be established.
The methodology used is based on the fact that following a small break LOCA, i
the RCS pressure stabilizes at a pressure sufficiently high above the SG secondary side pressure to remove the core fission product decay heat. The l
i j
RCS pressure stabilization is referred to as the " pressure plateau". The l
analyses were conducted to calculate a RCS pressure setpoint which results in I
all four RCPs being tripped for a LOCA, but a110 wing for the desirability of
- g, continued RCP operation for non LOCA events. The RCS pressure setpoint evaluations resulted in a conservative upper bound of the magnitude of the RCS 1
pressure during the plateau period. Although the pressure setpoints were originally computed for the purpose of tripping all four RCPs simultaneously,
)*
the pressure setooint to trip the first two RCPs can be detemined in the same manner.
A-1 1
m
Hence, the results of the previous analyses remain valid for the T2/L2 RCP trip scheme.
The major analytical parameters used in the analyses included reactor power, break size, HPS! flow rate, SG safety relief valve setpoint, and overall SG heat transfer characteristics.
,1 Based on the results of the previous analyses, the nominal setpoint for tripping the first two RCPs is 1210 psia for the 2700 MWt class, and 1320 psia i
for ANO-2. A separate calculation determined the nominal RCS pressure set-e' point to be 1361 psia for the 3410 MWt class plants.
The setpoint for the System 80 plants is 1400 psia, which was derived from a comparison of SG safety relief valve setpoints.
The actual RCS pressure used for the setpoint to trip the first two RCPs should include an allowance for instrument error.
For example, assuming the normal operating pressurizer pressure uncertainty is about t 45 psi for the Reference 2700 MWt plant, then the resulting RCS pressure setpoint would be 1210 psia plus 45 psia which equals 1255 psia.
The exact setpoint value should be determined on an individual plant specific basis, including an assessment of instrument inaccuracy for abnormal operating conditions.
RCS Subcooling Setpoint The loss of RCS subcooling in both coolant loops is symptomatic of a LOCA.
1 Thus, the nominal RCS subcooling setpoint is O'F.
As with the RCS pressure setpoint, an estimate of the instrument error must be factored into the actual subcooling setpoint.
The actual setpoint value used should include an assess-ment of the plant specific RCP operating limits.
Each utility must evaluate the plant conditions required to maintain RCP operating equipment integrity.
An example of the error in the RCS subcooling calculation is presented for the Reference 2700 MWt plant for illustrative purposes only. A t 45% psi pressure uncertainty and a t 7'F RTD temperature measurement uncertainty were assumed in this evaluation, which when combined, results in a total measurement uncertainty of approximately 212*F.
Since this value is close to the 20*F subcooling Ifmit which is referred to in several places in the Emergency Procedure Guidelines, 20*F is recomended as the subcooling setpoint value for A-2
I i
l i
tripping the second two RCPs.
This value should be confirmed on a plant specific basis taking into account instrument errors for abnormal conditions as well as requirements to avoid possible RCP damage, o
4.
I I
D
- t 0 D
e i
A-3
I J
i l
j TABLE A-1 C-E PLANT CLA$$ES FOR RCP TRIP
- i i
NOMINAL SETPOINT EVALUATION 4
j ii
'J t
l i
)
Class Plants 9
i
]
2700 M t:
Palisades Ft. Calhoun, Calvert Cliffs 142, j
Millstone 2, St. Lucie 1 & 2 l
4 i
j AN0 2:
ANO 2 i
t l
t i
3410 W t SONGS 243. Waterford 3 I
t k
System 80:
ANPP 1,243 4
t 1
j 4
i 4
8 f
4 l
i A4
+
m -
COMBUSTION ENGINEERING, i.
-