ML19329B833

Verification for Compliance W/App G Pressure-Temp Limits During Startup & Shutdown.

ML19329B833
Person / Time
Site:	Davis Besse
Issue date:	12/07/1976
From:	TOLEDO EDISON CO.
To:
References
PROC-761207, NUDOCS 8002060847
Download: ML19329B833 (5)

Text

'

m ~

r--: n 9 S D - 3 %

c -::,M GLSk -

C'.' l'L-Nd chm DAVIS-BESSE NUCLEAR POWER STATION UNIT NO. 1 UZZUS CC .2I hll --

n

. VERIFICATION FOR COMPLIANCE WITH APPENDIX G PRESSURE TEMPERATURE LIMITS DURING STARTUP AND SHUTDOWN The design and operation of Davis-Besse Unit I are such that for the first five effective full power years (EFPY) of operation, no single equipment failure or singic operator error will result in 10 CFR Part 50 Appendix G limitations being exceeded and that no common equipment failure would both cause a pressure transient and render the mitigating equipment inoperable. After five EFPY the pressure-temperature limit curves shift enough, because of radiation embrittlement, to require additional pressure relief protection prior to aligning the reactor coolant system to the decay heat removal system. The design is presently being reviewed to determine the best method for providing the additional pressure relief protection. The results of this design review will be presented to the NRC when completed. However, for the first five EFPY the pressure-temperature limit curves provide ample margin to allow the reactor coolant system to be lined up to the decay heat removal system and its attendant pressure relief capacity providing ample protection to the reactor coolant system.

Where operator z tion is required to assure that Appendix G limitations will not be exceeded this will be attained through system alarm functions to alert the operator that such action is required through established procedural instructions. The only case in which operator error could result in an overpressurization event is the inadvertent dumping of a core flood tank. As discussed below, the operator would have to make two errors for this to occur. All other postulated events are mitigated by design and two operator errors or two single failures would be necessary to exceed the pressure-temperature limits of Appendix G.

Water solid conditions are precluded during the life of the unit by diverse means since, during unit cooldown, the pressurizer steam bubble will be replaced with a nitrogen bubble when the reactor coolant system pressure is decreased to approximately 30 psig. When reactor coolant system pressure is raised above 50 psig, a steam bubble shall be formed in the pressurizer and the nitrogen vented. Therefore, by procedure, water solid conditions will be precluded at all times.

During shutdown before decay heat removal system operation is initiated, suction valves DH-11 and DH-12 will be opened and power removed by opening the breaker at the motor control center. This will assure that the system functioning will not be affected by inadvertent valve closure, and it will also assure a relief path through relief valve PSV 4849 located in the suction line to the decay heat removal pumps should a pressure transient occur. The normal decay heat removal valves are seismically qualified and designed to Quality Group A. The control system is designed to withstand physical damage or loss of function caused by earthquakes and missiles; the control system for each valve l

l 80020gg y

receives control power from a separate essential supply. There is valve position indication in the control room. As discussed in FSAR' subsection

, 7.6.2.1, the control system is designed to meet the intent of IEEE 279-1971, Sections 4.11 through 4.15 not being applicable to this control system.

The relief valve is seismically qualified and designed to Quality Group B.

Its functioning is not dependent on any motive source such as electric power or air supply. It is dependent on system pressure alone and is, therefore, a passive component.

The relief valve has been sized to pass 1800 gpm at a set pressure of 320 psig. This was determined to relieve the fastest rate of pressure increase af ter an assessment of all postulated causes of an overpressure event, and is based on the maximum developed runout flow (900 gpm per pump) of both high pressure injection (HPI) pumps running simultaneously.

The possibility of this event occurring due to either a single operator error or a single spurious signal is precluded by the design of the safety features actuation system (SFAS), but was conservatively postulated to cause the worst credible pressure transient. The dumping of a core flood tank was not considered because either (1) power will be removed from the core flood tank isolation valve once it is closed upon plant cooldown and depressurization or (2) the tank will be depressurized.

Procedures will define the specific action required in either case.

Other postulated occurrences (makeup control valve failing open, loss of DER system cooling, all pressurizer heaters energizing) do not produce a pressure excursion as severe as that produced by the two HPI pumps.

Although the pressurizer, by procedure, cannot be solid, for the purpose of analysis it was considered to go solid during the transient.

As'noted above, in order to ensure that the core flood tanks will not dump into the reactor coolant system, one option available to the operator is the removal of power from the core flood tank isolation valves once they are closed. To this end, the unit includes the following features, as discussed in FSAR subsection 6.3.2.15:

Position switches on each core flood tank valve actuate open and close valve position indication for each valve. The indicators are located in the control room.

Two separate alarms, one for each valve, are actuated if a valvt is open and reactor coolant pressure is reduced to a value that could cause emptying of the core flooding tanks; these alarms alert the operator to an impending situation where he could inadvertently discharge the core flooding tanks during station shutdown.

The isolation valves will be closed prior to depressurizing the reactor coolant system below 675 psig.

Power will be removed from the valves af ter depressurizing the reactor coolant system below 300 psig and prior to initiating decay heat removal.

With power removed, the possibility of the valves opening and causing either the pressure-temperature limits of the RC system or the design pressure limits of the DHR system to be exceeded, is precluded.

3 -

Assuming that the unit is undergoing cooldown from the hot shutdown condition, the following events will take place:

As RC pressure decreases below 675 psig, the alarms are actuated in the control room if the operator has not closed the valves prior to this pressure. The operator would then close the valves to deactivate the alarms. Failure to close the valves would require a double operator error. First, the operator must fail to follow the procedure which specifically instructs him to close the valve. Second, the alarms resulting from the open valve at a pressure below 675 psig would have to-be ignored by the operator. After opening these valves power will be removed from the valves.

When power is removed from the valves, in the cases described above, the breaker of the combination starter of each isolation valve will be manually tripped open and padlocked. The tripped position of the breakers will be monitored by essential indication of the main control board by one blue indicating light for each breaker.

Figure 1 plots the reactor coolant pressure response in the unlikely event that both HPI pumps are inadvertently started. The following assumptions were made:

1. The reactor coolant pumps have been secured af ter determination that the decay heat removal system was operating properly.

2. At t-0 two HPI pumps start.

3. Initial RCS temperature is 280F and initial RCS pressure is 235 psig.

4. Valves DH-11 and DH-12 are open and have power removed.

5. At DH suction pressure of 320 psig, PSV 4849 starts to open, but no credit s taken for relief flow until 350 psig.

6. Both DH pumps continue to pump 3000 gpm.

7. No credit is taken for any other relief mechanism.

8. No operator action is taken.

As indicated in the figure, the reactor coolant system pressure in-creases to no more than approximately 325 psig, assuming no operator action, which is well below the allowable pressure for this low temper-ature condition.

In order for the operator to monitor the reactor coolant system tempera-ture and pressure, there are a variety of control room readouts available, as indicated in FSAR table 7-8. Among these listed are the following:

-

• m ,

Measured Parameter Type of Readout Range i

RC loop pressure Linear scale indicator 0-2500 psig (2 sensors in each loop) Recorder Station computer output Audio-visual alarm indication (1 sensor in loop 2) Linear scale indicator 0-500 psig RC loop inlet Linear sesle indicator 50-650 F temperature (2 sensors in each loop) Station computer output This instrumentation (above) will be in service during long periods of cold shutdown as well as during startup and shutdown operations. The technical specifications require that the reactor coolant system, except the pressurizer, temperature and pressure be determined to be within limits at least once per 30 minutes during heatup and cooldown operations.

-Because of the design and operation of the unit as discussed above, it is determined that no design modifications to the unit are necessary during the first five effective full power years of operation. It is concluded that the present design and operation provides the overpressuri-zation protection necessary to assure that no single equipment failure or single operator error will result in Appendix G limitations being exceeded, and that no common equipment failure would both cause a pressure transient and render the mitigating equipment inoperable.

mj c/1-4 o

e * *

• e DH PUMP SUCTION PRESSURE '

s en am a DH PUMP DISCH ARGE PRESSURE ',,

mammaman RC LOOP "A" PRESSURE Ett -

x 500 -

1. p sum um um uma amm um amm um mum som em amm um mum um em

)

9*

9 ,,s 888 p E # #

E , ass # p *

• 400 -

E m.

eeeeeeeeeeeeeeeeeeeeeeee

• ,e**e

,e*e*,e

,,e***

• • • • DH RELIEF FULLY ,

OPEN 200 -

I I I I I I I 1 I i i I I I 90 110 120 130 140 0 10 20 36 40 50 to 70 00 100 11ME (SECONDS) DAVIS-BESSE NUCLEAR FOWER STATION PRESSURES AFTER STARTUP OF DH SYSTEM AT 280 F WITH HPl SYSTEM INADVERTENTLY ACTUATED FIG UR E .1.

.__ _ _ _ _