ML19260E309
| ML19260E309 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 01/28/1980 |
| From: | PUBLIC SERVICE CO. OF COLORADO |
| To: | |
| Shared Package | |
| ML19260E296 | List: |
| References | |
| EE-11-0001, EE-11-1, NUDOCS 8002150448 | |
| Download: ML19260E309 (15) | |
Text
~
i EE-ll-0001 Rev. 1 D.1 PART D SURVEILLANCE REQUIREMENTS FOR THE FORT ST. VRAIN RESERVE SHUTDOWN SYSTEM AND RUPTURE GAS SYSTEM 1960 06 9'9'9 8002150
EE-ll-0001 Rev. 1 D.2 1.
INTRODUCTION A review was performed of the current surveillance re-quirements for the reserve shutdown system and rupture gas system.
Additional or modified surveillance requirements may be recommended to comply with the criteria established for the Fort St. Vrain inservice inspection and testing program as outlined in Ref. 1.
For each item, the applicable proposed ASME code requirements (Section XI, Division 2, Draft) are identified and an explana-tion is given when the recommended surveillance differs from the proposed code requirements.
A review has been performed of the documents listed in Section 5 as well as the operating experience of the Fort St.
Vrain Nuclear Generating Station.
2.
SURVEILLANCE CLASSIFICATION The reserve shutdown system function is to provide suf-ficient negative reactivity to ensure an adequate core shutdown margin completely independent of the normal control rod system.
The reserve shutdown system may be used under all postulated design basis conditions, including design basis accident No. 1 Based on the importance of the safety function, the active parts of the system are assigned to surveillance class Sl.
The passive pressure retaining parts of the system are assigned to surveillance class S3.
The applicable surveillance criteria of Ref. 1 are outlined hereafter.
The operational readiness of systems assigned to surveillance class S1 shall be demonstrated by surveillance testing and monitoring to verify overall system performance and availability of emergency power sources.
The operational readiness of valves assigned to surveillance class S1 shall be demonstrated by surveillance testing based on the rules of subsection IGV of the proposed ASME Code,Section XI, Division 2, Draft.
The operational readiness of valves assigned to s ur-veillance class S3 shall be demonstrated by normal operation or by surveillance testing to exercisa those valves which do not normally operate.
1960 G7 i
Structural integrity of PCRV penetrations shall be verified by leakage monitoring.
Structural integrity of all accessible safety related piping shall be verified by examination for leakage once each year when the system is at or near normal working pressure, unless criteria of Ref. 1 allow exemption from such testing.
EE-ll-0001 Rev. 1 D.3 3.
OPERATIONAL READINESS 3.1 OPERATIONAL READINESS OF THE SYSTEM (a)
Current surveillance requirements:
Technical specification SR 5.1.2 requires the actuation capability of each reserve shutdown hopper to be tested quarterly by cressurizing the rupture disc to 10 psi above reactor pressure.
This test demonstrates that the pres-surizing lines are clear, the valves operable, and the rupture discs intact.
The technical specification further requires functional testing of the instrumentation which monitors the pressure in each rupture gas storage cylinder to assure that sufficient gas is stored to burst the rupture discs.
(b)
Recommended surveillance requirements:
The current surveillance requirements and correspond-ing surveillance procedures have been reviewed and found adequate to assure the operational readiness of the system, except under ACM conditions.
Therefore, it is recommended in addition, that the pressure of the nitrogen cylinders, provided as backup for actuation of the hopper pressurizing valves, be monitored once a week to assure that the re-quired quantity of actuation fluid is stored,should ACM system operation be required.
The recommended surveillance meets criteria 3.la of Ref.
1.
(c)
Proposed ASME code requirements:
Not applicable.
3.2 OPERATIONAL READINESS OF ACTIVE COMPONENTS 3.2.1 HOPPER PRESSURIZING VALVES (HV-1102-1 through HV-1102-37, HV-1104-1 through HV-1104-37)
(a)
Current surveillance requirements:
Each valve is full stroke exercised quarterly when performing the system surveillance test according to pro-cedure SR 5.1.2ad-0 (b)
Recommended surveillance requirements:
} g6Q.
QQ In addition to the above surveillance, it is recommended that the accuracy of the position indication and fail safe operation of the valves be verified at each refueling shutdown.
EE-ll-0001 Rev. 1 D.4 3.2.1 (cont.)
(c)
Proposed ASME Code requirements:
The valves fall under code category B (IGV-2100).
IGV-3300 requires visual observation, at least as frequently as scheduled refueling outages, to confirm that remote po-sition indications accurately reflect valve operation.
IGV-3411 requires valve exercising at least once every 3 months.
IGV-3415 recommends, when practical, to observe valve operation upon loss of actuator power, and allows the valves to be tested at each cold shutdown instead of every 3 months.
(d)
The recommended surveillance meets the proposed ASME C ode requirements, as required by criteria 3.2.2a of Ref.
1.
3.2.2' RESERVE SHUTDOWN HOPPERS (a)
Current surveillance requirements:
Technical specification SR 5.1.2 requires one hopper to be tested in the hot service facility at each of the first five refueling shutdowns, and then at every other refueling shutdown, to demonstrate that the rupture disc bursts at the correct set pressure and that the poisor material releases properly from the hopper and has not.
deteriorated.
(b)
Recommended surveillance requirements:
The review of the surveillance procedure SR 5.1.2c-X indicates that the current surveillance is adequate to demonstrate operational readiness of the hoppers.
(c)
Propused ASME Code requirements:
IGV-3620 requires rupture discs with testable design features to be tested in accordance with manufacturer's instructions at a frequency specified by the Owner.
(d)
The current surveillance meets the proposed Code requirements, as required by criteria 3.2.2a of Ref. 1.
3.2.3 CHECK VALVES 1960 09 See the surveillance requirements for check valves in section 3. 2. 2 in part C of this report.
EE-ll-0001 Rev. 1 D.5 3.2.4 ACM OUICK-DISCONNECT VALVES (a)
Current surveillance requirements:
None.
(b)
Recommended surveillance requirements:
It is recommended that these valves be connected and disconnected quarterly to demonstrate that they are capable of functionir.g properly.
(c)
Proposed ASME ' ode requirements:
Category B valves are to be tested every 3 months.
(d)
The recommended surveillance meets the proposed Code requirements, as required by criteria 3.2.2a of Ref. 1.
3.3 OPERATIONAL READINESS OF INSTRUMENTATION AND CONTROLS 3.3.1 PRESSURIZING LINE PRESSURE MONITORING (PS-1106-1 through 37, PIL-1106 through 37, PIH-1107-1 through 37)
(a)
Current surveillance requirements:
Technical specification SR 5.1.2 requires this in-strumentation to be functionally tested quarterly, in conjunction with the system test, and to be calibrated annually.
(b)
Recommended surveillance requirements:
The current surveillance meets criteria 3.2.3a of Ref.
1, and assures that the pressure switch and alarm circuits function properly and provide assurance that the helium storage cylinders are ready for operation.
(c)
Proposed ASME Code requirements:
Not applicable.
3.3.2 RESERVE SHUTDONN HOPPER PRESSURE ALARM CIRCUITS PDS/PAH-ll24-1 through 37)
(a)
Current surveillance requirements:
jg6Q y)Q The pressure alarm circuits are tested quarterly when performing the system test.
In addition, technical spe-cification SR 5.1.2 requires the pressure switches to be calibrated when the control and orifice assembly is removed from the reactor for maintenance.
EE-ll-0001 Rev. 1 D.6 3.3.2 (cont.)
(b)
Recommended surveillance requirements:
The test frequency is adequate to demonstrate the operational readiness of the system.
Calibration is not essential since there is an appreciable margin between test pressure and actual hopper actuation pressure, so that calibration need not be performed more often than the maintenance interval for the assembly, and since the pressure switch is otherwise unaccessible.
Therefore, the current surveillance is deemed adequate.
(c)
Proposed ASME Code requirements:
Not applicable.
3.3.3 TEST PRESSURE MONITORING (PDI-11258, PDIS-1101, PDIH -1101-1 and 2)
(a)
Current surveillance requirements:
Technical specification SR 5.1.2 and surveillance pro-cedure SR 5.1.2bd-A provide for annual calibration of PDI-11258 and PDIS-1101.
Coincidence of the two above indications is verified quarterly when performing the system test (SR5.1.2ad-Q).
(b)
Recommended surveillance requirements:
Review of surveillance procedure SR 5.1.2bd-A shows that the current surveillance requirements are adequate to assure that system testing can be performed without actuating the hopper.
(c)
Proposed ASME Code requirements:
Not applicable..
3.3.4 PRESSUR,7 ZING VALVE CONTROL CIRCUITS (a)
Current surveillance requirements:
Surveillance procedure SR 5.1.2ad-Q provides for a continuity test of the electrical circuits of both the 7 and 30 hopper subsystems to be performed quarterly.
This test indicates that there is electrical continuity between the control room and local control panels and also that the relay actuates.
1960
.iI
EE-11-0001 Rev. 1 D.7 3.3.4 (cont.)
(b)
Recommended surveillance requirements:
The current surveillance does not provide a positive assurance that all the pressurizing valve actuation switches, in one of the redundant trains of a subsystem, will close upon actuation of the relay.
The only positive assurance is that the relay actuated test switch (red light indication) closes and that the other relay actuated switches should close in the same manner.
The electrical continuity of the valve control system is not demonstrated.
Therefore, it is recommended that the pressurizing valve actuation switches in the control room be tested at each refueling shutdown, which is the only period when more than one hopper can be made non operable.
It is not required to test at that time the ability to pressurize the hoppers, since this is demonstrated by the quarterly test.
The recommended surveillance meets criteria 3.2.3d of Ref. 1 and demonstrates the operational readiness of the controls.
(c)
Proposed ASME Code requirements:
Not applicable.
4.
STRUCTURAL INTEGRITY (a)
Current surveillance requirements:
None.
(b)
Recommended surveillance requirements:
The structural integrity of those parts of the system designated as safety-related (FSAR Safety Class I) need not be tested for structural integrity as discussed in section 4, part C of this report.
Furthermcre, the part of the system between the locked closed valves (V 11601 through V 11637) and the pressurizing valves (HV-1102-X and HV-1104-X) is continuously monitored for integrity by the pressurizing line pressure switch (PS-1106-X) which would alarm low pressure, should leakage occur.
Downstream of the pressurizing valves, integrity of the system is verified quarterly, when performing the system test, by the demonstrated ability to pressurize the hoppers.
However, it is recommended that visual examina-tion be performed for that portica of piping inside the penetration, between the check valve and the control and orifice housing, when the penetration is open for re-fueling.
This examination is recommended since this portion of pipinc could be damaged when being dismantled or re-assembled.
(c)
Proposed ASME Code requirements:
See section 4, part C of this report.
1960 12 (d)
Differences with respect to proposed Code requirements are discussed in (b) above.
EE-ll-0001 Rev. 1 D.8 5.
LIST OF REFERENCES
References:
1.
Report EE-SR-1101. Surveillance inspection and test criteria for the Fort St.Vrain nuclear generating station.
2.
FSAR Section 3.8.3 3.
System Descriptions SD-ll-6, SD-12-5 4.
System Diagrams PI-ll-1, PI-82-5, PI-82-7 5.
Schematic Diagrams E1203 pages 610 through 626 6.
Assembly drawings SLR D1201-300 and -301 7.
Technical specifications SR 5.1.2 and SR 5.2.21, LCO 4.1.6 8.
Surveillance procedures SR 5.1.2ad-Q, SR 5.1.2bd-A, SR 5.1.2c-X, SR 5.1.2e-X, SR 5.2.21-SA 9.
ASME Code - Section XI, Division 2, Draft 1960 313
EE-ll-0001 Rev.
1.
Attachment I p.1 EVALUATION OF PCRV SAFETY VALVE ISOLATION 1.
INTRODUCTION In item 6 of their letter dated October 5,1979, the NRC addressed the subject of the isolation valves located between the PCRV and the safety valves.
The NRC stated it believes that these valves should be motor operated with remote manual actuation capability from the control room.
Their letter also addressed the surveillance program for these valves.
This evaluation provides the basis to establish such a program.
PSC has reviewed the Fort St. Vrain technical specifica-tions and the ASME Code regoirements for overpressure protection, in order to evaluate the safety advantages of remote manual motorized isolation valves, as well as the potential safety hazards which might be created.
After consideration of the analysis as discussed in this report, PSC concludes that the potential safety hazards, mainly due to the difficulty of making a decision to close an isolation valve with the reactor pressurized without endangering the in-tegrity of the PCRV, do not offset the potential safety benefits in terms of dose to the environment, conservatively estimated to be less than one percent of the 10 CFR 100 limit.
This conviction is further strengthened when placing the problem in proper perspective, i.e. when considering t"at lifting of a safety valve is a very remote, (highly impt cable) event and that the worse consequence or not isolating a safety valve, which fails to reseat, is about 2 percent of the 10 CFR 100 limit.
Failure to adequately protect the integrity of the PCRV could result in doses at least 5 times larger than complete blowdown through the filter of the PCRV overpressure protection system.
Consequently, PSC recommends that the isolation valve actuators be kept manual, that they be not used except for testing and maintenance, consistent with current technical specifications, and that they be not considered as reactor coolant isolation valves with the reactor pressurized.
2.
NRC COMMENT
(.
)
It was noted that the isolation valves for the PCRV pressure relief system were manually actuated.
In order to meet the objectives of General Design Criteria pertaining to containment isolation and in keeping with the 1960 214
2E-11-0001 Rev. 1 Attachment I p.2 purpose and functioning of the PCRV pressure relief system, we believe that these valves should be motor operated with capability for manual actuation from the control room.
(.
.)
3.
PSC DISCUSSION 3.1 PCRV PRESSURE RELIEF PATHS The PCRV liner and concrete structure provide, re-spectively, primary and secondary containment for the reactor coolant and radioactive fission products, either circulating or placed out.
The only large piping which is part of the reactor coolant pressure boundary and penetrates the PCRV are the PCRV pressure relief lines.
Should reactor coolant pressure ever increase in such a way that it could approach PCRV Reference Pressure, the pressure relief lines ensure that the integrity of the contair cne is not jeopardized by preventing reactor coolant pressure from exceeding the PCRV Reference Pressure.
In order to meet the objectives of General Design Criteria pertaining to containment isolation, two normally closed isolation devices are provided in series on each of the pressure relief lines, namely a rupture disc and a safety valve.
The piping which provides for primary containment, i.e.,
the pressure retaining portion of the system, up to and including the safety valves, is installed within a double pipe and tank, which provide secondary containment.
Only when postulating that the PCRV safety valve system performs its pressure relief function, does a breach of the containment occur.
The conditions under which such an event would take place are extremely remote, if not incredible.
In effect, it would result from a moisture ingress design basis accident (offset rupture of a steam generator subheader in the main bundle) against which no protective action, either auto-matic or manual would have been taken by:
the plant protective system, which automatically trips the reactor and dumps the faulty steam generator upon high moisture in the primary coolant, the plant protective system, which automatically trips the reactor upon high primary coolant pressure, the operator in the control room, who has the capa-bility of monitoring the relatively slow pressure rise transient and manually performing the required pro-tective actions.
1960 ;15
EE-ll-0001 Rev. 1 Attachment I p.3 Postulating that such an event would take place, the breach in the containment is normally terminated by reseating of the safety valve.
Only when postulating the failure of the safety valve to reseat does a permanent breach in the contain-ment exist.
However, the safety valve discharge is filtered to limit the dispersion of radioactivity to the environment and it has been demonstrated (FSAR section 6. 8. 3) that the dose, resulting from a complete depressurization of the primary circuit through the safety valve system, remains at least an order of magnitude below the limit resulting from the ap-plication of 10 CFR 100 at the exclusion area boundary.
3.2 PCRV PRESSURE RELIEF ISOLATION VALVES (a)
Consideration related to overpressure protection Isolation valves, placed between safety valves and the vessel protected from overpressure, are subject to restrictions of use.
Section 6.8.2.1 of the Fort St. Vrain FSAR describes the purpose of these valves as follows:
"These valves are only closed when it is desired to perform routine maintenance or testing of the safety valves and/or rupture discs, after prior depressurization of the PCRV.
(.
)
Administrative controls are established to prevent pressurizing the PCRV (.
)
unless (.
) both isolation valves are fully open.
Only one of the isolation valves shall be closed at any time."
Technical specification LCO 4.2.7 establishes the above mentioned administrative controls:
"The PCRV shall not be pressurized (.
) unless (.
.)
both inlet block valves are locked open."
The basis for technical specification LCO 4.2.7 further states:
"A single manually operated block valve is provided
(.
) so that necessary maintenance and/or testing of the discs and safety valves can be performed after k9 0
}hshutdownanddepressurizationoftheplant. Redundant instru-mentation, as well as mechanical locks on the valve, ensure that the valves will always be open when the PCRV is pres-surized."
Neither licensing document states that the isolation valves can be used to isolate a relief path for purposes of containment isolation, nor is there any evaluation of such an action and its effects on overpressure protection requirements.
PSC has reviewed the overpressure protection requirements contained in the ASME Boiler and Pressure vessel Code for
EE-ll-0001 Rev. 1 Attachment I p.4 Concrete Reactor Vessels. (Section III, Division 2, 1977 Edition).
Paragraph CB-7153 states:
"Stop valves or other devices shall not be placed relative to a pressure relief device so that they could reduce the overpressure protection below that required unless such stop valves are constructed and installed with positive controls and interlocks so that the relieving capacity requirements of CB-7400 are met under all conditions of operation of both the system and the stop valves."
The relieving capacity requirements of CB-7410 do not provide information about the required. number of pressure relief devices.
However, paragraph CB-7421 states:
"The required relieving capacity intended for overpressure protection shall be secured by the use of at least two pressure relief devices."
Paragraph CB-7430 (b) also references paragraph CB-7620 for pilot operated pressure relief valves, which are the type of safety valves used at Fort St. Vrain.
Paragraph CB-7620 states:
"At least two valves are used to contribute to the re-quired rate relieving capacity.
(.
) The relieving capacity with which such valves are credited is not more tha n
- the stamped relieving capacity of the smallest one where two valves are installed."
It is apparent that the intent of the code requirements is to assure, in particular where pilot coerated pressure relief valves are used, that at least two pressure relief devices are always available to provide overpressure protection during PCRV operation.
Consequently, closing an isolation valve with the reactor pressurized should not be allowed with the current design.
(b)
Considerations related to containment isolation It is possible to envisage closing an isolation valve to terminate PCRV blowdown in case a safety valve has operated and failed to reseat.
This action is considered in the Fort St. Vrain auxiliary piping system description (SD-ll-6 section 7.2), as well as in the system descriptions for large HTGR designs.
Closing of an isolation valve would then be considered to meet the objectives of the General Design Criteria per-taining to containment isolation for the purpose of limiting the release of radioactivity to the environment.
1960.17
EE-ll-0001 Rev. 1 Attachment I p.5 This action could only be acceptable provided that it does not create a greater safety hazard than the one it intends to prevent.
In particular, if the integrity of the PCRV were to be damaged as the result of such an action, the radiological consequences to the environment could prove to be much worse than the consequences of releasing filtered primary coolant at a reasonably slow rate.
This means that closing of an isolation valve can only be acceptable if this action does not jeopardize the system primary safety function, i.e.
overpressure protection, by which it assures the integrity of the PCRV, and by way of consequence, of the containment and perhaps of the core itself.
So, before the operator makes the decision to isolate a pressure relief train, i.e. to violate the limiting condi-tions of operation and the ASME code requirements, he will have to ascertain that all the events which have provoked the safety valve to operate are under his control and that no subsequent pressure increase is expected.
Further, he will have to assure that he positivelv has the capacity to reopen the isolation valve, should this be recuired at anv time and under all_ conditions to again provide pressure relief capacity.
Consideration must also be given to which of the two safety valves failed to reseat.
If it were che higher set pressure safety valve, it could be an indication that the lower set pressure safety valve failed to lift; isolation of that valve could mean complete obstruction of all pressure relief capability.
In the opposite case, the operator could be relying on a safety valve which may fail to lift.
So, should one agree to allow closing of an isolation valve with the PCRV at pressure, it would be necessary to provide the operator with an emergency procedure which dic-tates all the steps and precautions to be taken before allowing such an action to be performed.
} g6Q
'} 8 3.3 MANUAL VS REMOTE ACTUATION CAPABILITY (a)
Motorized isolation valves are already used at Fort St. Vrain in the PCRV penetration overpressure protection system.
However, the technical specifications and the ASME code require only one pressure rel.'.ef train to be operable at any one time, which differs substantially from the PCRV over-pressure protection system.
Motorized isolation valves were also considered on the PCRV overpressure protection system of the large HTGR.
However, chis appears to be mainly for access reasons which make manual valves impractical even for maintenance and testing.
Their motors are emergency power supplied and their interlocks are part of the plant protective system.
If motorized valves
EE-ll-0001 Rev. 1 Attachment I p.6 were to be installed at Fort St. Vrain, the same typ3 of design features would have to be implemented.
(b)
With the current manual isolation valvas, it would take an estimated 15 minutes between the moment an operator is given the instruction to close a valve and the moment he actually performs the operauion.
No conditions have been identified which would prevent the operator from reaching the valve hand wheel.
This operator would have to remain posted at the valve hand wheel, awaiting possible instructions from the control room to reopen the valve.
With remote manual motorized valves, the above time can be shortened by about 10 minutes, allowing about 5 minutes for administrative clearance, valve unlocking and operation.
Should it become necessary to reopen the valve, the required actions can be performed readily from the~ control room. However, should then a malfunction occur in a motorized valve, which cannot by design have a fail safe position (in this case in the open position), the operator would have to instruct someone to go and manually open the valve.
This operation would require an estimated 10 to 15 minutes at a time when the valve needs to be open to assure the integrity of the PCRV.
To evaluate the safety advantage of the remote manual valve over the manual valve, conservative assumptions have been made to yield the greatest estimated safety advantage to the remote manual valves.
The following scenario has been considered.
One safety valve lifts at the set pressure and all protective actions have been taken so that the pressure starts decreasing immediately; with the normal reseat pressure being about 670 psi, the operator decides to close the isolation valve when the pressure reaches 600 psi.
The time required to close the isolation valve is as stated above.
A mixture of helium and steam and also pure helium were considered for the blowdown.
Assuming a linear relation between amount of released reactor coolant and dose at the exclusion area boundary, the corresponding safety advantage in terms of dose is 0.147 rem (0.59 percent of 10 CFR 100 limit) for the mixture, and 0.137 rem (0.55 percent of 10 CFR 100 limit) for pure helium 0
19 These figures beccme respectively 0.206 rem (0.82 percent of 10 CFR 100 limit) and 0.140 rem (0.56 percent of 10 CFR 100 limit) when comparing the safety advantage of remote manual isolation valves versus no isolation.
The above figures show that the safety gain with respect to dose to the environment is very small, and does not pre-sent a compelling reason to consider changing the valve actuator design.
EE-ll-0001 Rev. 1 Attachment I p.7 4.
PSC CONCLUSION (a)
In the above analysis, it has been put into per-spective that lifting of a relief valve is an almost incredible event, although no credit was taken for that fact.
(b)
It has been stated that it is of utmost importance to preserve the integrity of the PCRV,and that no closing of an isolation valve can be allowed which may endanger the pressure relieving capacity of the PCRV overpressure pro-tection system.
It is believed that closing of an isolation valve may not be allowed under all conditions, due to the design of the PCRV overpressure protection system.
(c)
The gain in release of radioactivity to the en-vironment, when comparing full depressurization to limited depressurization using either manual or remote manual isolation valves, is small and, on its own, does not justify any change of procedures or equipment which are used by plant operators to deal with such a situation.
In all cases, the dose remains well within acceptable limits.
(d)
The use of remote manual motorized isolation valves, which do not have a fail sare design feature versus the currently used manual valves, besides adding to the complexity and cost of the system, may provide malfunctions (such as spurious valve closing or failure of a valve to reopen) which could endanger the primary overpressure pro-tection function of the system.
(e)
As a consequence, PSC concludes that the existing manual isolation valves provide the best possible design with respect to plant safety ar.d integrity of the PCRV and that they should not be used as containment isolation valves with the PCRV pressurized, consistent with the current design basis and ASME Code requirements.
1960 20