ML19332B168

Safety Evaluation Supporting Amend 30 to License DPR-66

ML19332B168
Person / Time
Site:	Beaver Valley
Issue date:	09/10/1980
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML19332B169	List: ML19332B168 ML19332B172
References
NUDOCS 8009260186
Download: ML19332B168 (28)

Text

{{#Wiki_filter:. en d 4 UNITED STATES 8' i NUOLEAR REGULATORY COMMISSION 4 j WASHINGTON, D. C. 20555 j \\"..ov/ ? SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 30 TO FACILITY OPERATING LICENSE NO. OPR-66 0UQUESNE LIGHT COMPANY OHIO EDIS0N COMPANY PENNSYLVANIA POWER COMPANY _B_EAVER VALLEY POWER STATION, UNIT NO. 1 DOCKET NO. 50-334 Introduction By letter dated October 27, 1978, Duquesne Light Coapany (the licensee) submitted to the NRC proposed Technical Specifications in support of a new Steamline Break Protection System. The licensee desires to install this new system during the refueling outage preceding Cycl ( 2 operation. The NRC Staff has completed its review of all information submitted by the licensee and has found the proposed Steamline Break Protection Sys e= to be acceptable assuming the plant proceoures are modified to address possible steamline breaks during heatup and cooldown of the Reactor Coclant System. For the purpose of this review, the Staff has evaluated the acceptance of each component of the proposed system during normal operation as well as during plant heatup and cooldown. This evaluation is presented in. Inasmuch as the proposed system entails significant modifi-cation of existing control circuitry, the electrical, instrumentation and control designs have been evaluated using IEEE Standard 279-1971 criteria and the requirements of 10 CFR Part 50. This evaluation is presented in. Neither of these evaluations have considered operation of the plant with less than three cooling loops in operation; consequently, operation with (N-1) cooling loops continues to be forbidden. Technical Soecification Chances Changes in the Radiological Technical Specifications as a result of this amendment are summarized as follows: Table 3.3-3 1.e (c. 3/4 3-15) Removal of "High Steamline Differential Pressure" trip and Substitution of " Low Steamline Pressure" trip for Safety Injection in Modes 1, 2 and 3. 800926O/RTv

I i I.! j 1.f (p. 3/4 3-16) .j Actuation of " Safety Injection" on the basis of "High Steam Line Flow" i (coincident with either " Low Steamline Pressure" or "Tavg Low-Low") has i been eliminated during Modes 1, 2 and 3. ii 4.d and 4.e (p. 3/4 3-18 and 3/4 3-19) Actuation of " Steam Line Isolation by High Steam Flow in Two Steam Lines" (coincident with either "Tavg, Low-Low" or " Low Steam Line Pressure") has been eliminated in favor of actuation by " Low Steam Line Pressure" (blocked during normal cooldown and heatup operation) or "High Steam Line Pressure i Rate" (only during normal cooldown and heatup operations) in Modes 1, 2, ? and 3. Table Notation (p. 3/4 3-20) j I Callout (!#) related to bypassing trip functions below P-12 has been eliminated with removal of the associated Functional Units, "High Steamline Differential Pressure", "High Steam Flow" and " Low Steam Line Pressure." Action Statements (p. 3/4 3-20) Actions 14 and 16 - These Action Statements no longer refer to Interlock P-12 inasmuch as Tavg has been eliminated from the Steam Line Break Pro-tection System. Engineered Safety Feature Inter 1ccks (c. 3/4 3-21) f Interlock P-12 is no longer used t'o control actuation of safety injection on high steam line flow and low steam line pressure or control of steam } line isolation on the basis of high steam flow. Table 3.3 4 1.e (p. 3/4 3-22) ~ The description of the trip setpoint of the "High Differential Pressure Between Steam Lines" system has been eliminated because this system has been removed from the Steam Line Break Protection System. A new specification refers only to the setting of the Low Steam Line Pressure trip point. 1.f (c. 3/4 3-22) The description of the setpoint of the coincident system of "High Steam i Flow in Two Steam Lines" with either Tavg Low-Low or Low Steam Line Pressure has been eliminated because this sytem is no longer a part of the Steam Line Protection System. l l l

4 ? 5 .E i 3-i

5 1

4.d (p. 3/4 3-24) -{ The description of the setpoint has been eliminated for the same reason i as in 1.f. A new specification has been included for the trip setpoint for low Steam Line Pressure only. } 4.e (p. 3/4 3-24) 5 i A new specification has been included for the trip setpoint for High Steam i Pressure Rate. This sytem is now used to actuate Steamline Isolation during 9 normal cooldown and warmup. g Table 3.3-5 (p. 3/4 3-26 and 3/4 3-27) 5 Section 4 f Section 4 now refers to actuation response times based on Low Steam Line ? Pressure rather than High Steam Line Differential Pressure. i 2 Section 5 All specifications based on coi ~.cidenre of High Steam Line Flow and Tavg Low-Low have been eliminated and tnis section now includes information previously in Section 7. Section 6 All specifications based on coincidence of High Steam Line Flow and Low Steam Line Pressure have been elin;inated and this section now includes information previously in -Section 8. Section 8 A nev section has been included to set the response time for the negative "Hign Steamline Pressure" signal for actuating Steamline Isolation. Table 4.3-2 (c. 3/4 3-29 and 3/? 3-31) 1.e and 1.f Surveillance requirements for the instrumentation associated with "High Steam Line Differential Pressure" and with coincidence of High Steam Line ,r e ,--,m-

f e I Flow and either Tavg Low-Low or Low Steam Line Pressure have been eliminated for the purposes of actuating Safety Injection and Feedwater Isolation. A 3 new requirement based on Low Steam Line Pressure has been added. i 4.d The surveillance requirements for instrumentation associated with High Steam Line Flow and either Tavg Low-Low or Lme Steam Line Pressure have ~: been eliminated for the purposes of actuating Steam Line Isolation. A new requirement based on Low Steam Line Pressure has been added. 4.e A new surveillance requirerent for the instrumentation of High Steam Line Pressure Rate has been added. 3.4.1.1 (p. 3/4 4-1 and 3/4 4-2) i Former Action "a" (relating to startup or continued operation above P-7 ~ (>l1% rated power) with one reactor coolant loop and associated pump not in operation) has been revised through the elimination of all references (Sections a.1, a.2, a.3 and a.4) to the components of the replaced Steam Line Break Protection System. Sections b.3, b.4, b.5 and b.6 of Action 5.1.(b), that relate to startup or power operation above 26% of rated thermal power have been eliminated for the same reason. 4.4.1.1.1 (c. 3/4 4-2a) ~ Paragraph "A" has been revised to remove reference to ESF actuation system instrumentation channels that have oeen elininated in the new SLEP system. 4.1.1.1.1 (p. 3/4 1-2 and B 3/4 1-1) A new surveillance requirement has been added to provide positive assurance that the new Steam Line Break Protection System (blocking of Low Pressurizer Pressure trip during cooldown or heatup operations) cannot be enabled until the Reactor Coolant System is borated to a cold shutdown condition. Summary Eased on the evaluations in Attachments 1 and 2 we find that the proposed Steam Line Ereak Protection System is acceptable. During normal operation the proposed system is equivalent to or exceeds tue capabilities of the present system. During heatup and/or cooldown operations the proposed system provides a reduced level of protection in that there are no primary trips that actuate Safety Injection if a steam line break occurs insice or cutside containment. The proposed system is acceptable for use during heatup and cooldown operations, however, because the licensee has additional

= t l E 1 protection, through a new surveillance technical specification for assuring i adequately borated Reactor Coolant, new procedural action to assure adequate charging flow rate, and through an analysis that demonstrates the core F will always be covered and the Reactor Coolant System remains subcooled with Safety Injection. Acceptable implementation of the required procedures must be made before restart and will be monitored by the NRC Office of Inspection and Enforcement. Environmental Consideration We have determined that the amendment does not authorize a change in effluent types or total amounts nor an increase in power level and will not result in any significant environmental impact. Having made this determination, we have further concluded that the amendment involves an action which is insignificant from the standpoint of environmental impact and, pursuant to 10 CFR 551.5(d)(4), that an environmental impact statement or negative I declaration and environmental impact appraisal need not be prepared in connection with the issuance of this amendment. Conclusion We have concluded, based on the considerations discussed above, that: (1) because the amendment does not invcive a significant increase in the pr0b-ability or consequences of accidents previously consicered and does not involve a significant decrease in a safety margin, the amendment does not involve a significant hazards consideration, (2) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner,. and (3) such activities will be con-ducted in compliance with the Cornission's regulations and the issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public. 3 Date: September 10, 1980 w =

~ ATTACHMENT 1 Introduction By letter dated October 27, 1978,1 Duquense Light Company (the licensee) requested changes to the Beaver Valley Power Station, Unit 1 (BVPS) Technical Specifications and FSAR related to several plant features, one of which is a modification to the BVPS Main Steam Line Break Protection System (SLBPS). The licensee requested changes to the electronics, logic and setpoints such that virtually a new SLBPS would resul t. The staff, licensee and representatives of Westinghouse (E) met on February 23, 1979 to discuss the proposed SLBPS. Questions were given to the licensee at that meeting. Responses to these questions were transmitted to the staff in the licensee's March 7,3 May 7,4 and August 28, 1979 submittal s. 5 Staff concerns raised during the review of these submittals r-ited in an addi-tional meeting with the licensee and representatives of E on. -ber 9, 1979.6 The information presented at this meeting was formally submit.: to the staff in the licensee's October 18, 1979 letter. This safety evaluation presents a discussion of the existing and proposed SLBPSs, the operation of each system during normal operation as well as during plant heatups or cooldowns, and the staff's evaluation of the proposed system. Backaround This section provides a general discussion of the purposes of safety injection (SI) and steam line isolation (SLI) during steam line break (SLB) accidents. Also, the BVPS existing and proposed SLB protection systems (SLBPS) are described. l l

2 Safety Injection and Steam Line Isolation The actuation of the safety injection system and the automatic closure of the main steam isolation valves (MISV) ensures the consequences of the steam line break accident (SLB) are bounded by the safety analysis (FSAR). The high head safety injection system provides RCS makeup to account for the shrinkage caused by the cooldown, and highly concentrated boric acid to ensure adequate shutdown margin should a control rod fail to be inserted into the core. Steam line isola-tion ensures that at most only one steam generator blows down through the broken steam line. BVPS Existino and Proposed SLBPS The existing and proposed BVPS SLBPSs consist of various detectors, electronics and logic arranged to provide two functions during SLB: 11 Actuation of the SI and 2) SLI. Figures 1 and 2 show block diagrams of the existing and pro-posed SLBPSs. Both figures represent only one of the two trains of actuation logic. The proposed SLBPS has deleted the following SIS actuation signals: - High differential pressure signals between steam lines. r I w steam line - High steam line flow coincident with either low-low TAVE pressure. The proposed SLSPS has added the following SIS actuation signals: - Two-out-of-three low steam line pressure in any single steam line. The proposed SLBPS has deleted the following SLI signals: r low steam line - High steam line flow coincident with either low-low RCS TAVE pressure.

l i [ l I I High low Low High Lo lo S:eamhne Pressutster H:-l Steamline Steamline T Differential Pressure Conta.etmcar m Pressure Flow Pressure Pre: sue e 4 tt tt AND AND / / L locke'c Durmg / B He - 4 Containmeng Hestup and Pressure Cooldown if 1 P 1r 1r 1r ir 1r m Steamime Safety ^ isofation insection D**}D }D'S Y M o Ju. S.kinl) w o Ju Finure 1 Existing Steamline Break Protection System

.B2cvar Vc11sy Pc pr Statica, Unit N3. 1 (USED ONLY OURING (SLOCKEDOURIt[GNORMAL NORMAL C00LCOM AND C00LDOWN AMD HEATUP HEATUPOPERATIONS) OPERATIONS) MIGN i LO" ni. t ns. tow PREstuRIZER Con T Al =NEN T 3II'""E STE1HLINE c mTAinwEnr PRE!!u2E PRE 55UAE PRE!!uRE. PRF35URE PtES!UAE RATE Ak Y Y Y Y -Y Y STEAMLINE 3 AF ETY 130LATICn tNJECTICM Figure 2 New Steamline Break Protection System o i D"*D D 3l] V $ o0\\..JUN L l-o oJ

And has modified the containment pressure trip setpoint from "high-high" to " intermediate-high."* The proposed SLBPS has added the following SLI signal (s): - Low steam line pressure (above P-11) - High negative steam line pressure rate (below P-11). The low steam line pressure log t circuitry in the existing SLBPS actuated if two-out-of-three steam lines had pressure below 500 psig.** However, the pro-posed SLBPS low steam line pressure logic enploys " lead-lag" conditioning circuitry. The circuit takes the steam line pressure as an input and outputs a signal proportional to the derivative of the input, which decays to the value of the input at the time constant T Thus, the " lead-lag" signal conditioner results in a faster response to changing steam line pressure. The high negative rate of change of steam line pressure function employs a " derivative-lag" signal compensation. This type of signal compensation is the same as that used in the T input to the overpower AT reactor trip set-AVE point calculator. The " derivative-lag" signal conditioner takes the input sig-nai, steam line pressure, and outputs a signal representative of the lagged version of the derivative of the input. Thus, if a steam line break occurred below P-11, SLI would occur only if the break area was large enough so. that the rate of change of steam line pressure resulted in a conditioned signal that exceeded the trip value. If the break area was below that " trip" area, then SLI would not occur

• This is an acministrative error in the technical specifications.
  • There are 3 pressure sensors on each steam line.

If 2 out of 3 sensors went below 500 psig, the steam line pressure logic for that loop tripped.

4 Evaluation This section of the safety evaluation presents the staff's overall evaluation of the proposed SLBPS. Since the operation of the new system differs depending ~ on the plant condition, the staff's evaluation is presented by the appropriate plant condition. Nomal Plant Operation (i.e., pressurizer pressure above P.U, and reactor critical at any power level). During nomal plant operation, with pressurizer pressure above the P-11 setpoint, 2010 psig, the new SLBPS must provide protection from all credible SLBs. Since no new accident analyses have been performed, the existing FSAR analyses must remain applicable with the proposed new SLBPS. The BVPS FSAR analysis for steam line breaks upstream of the MSIV and inside containment, at che non-return valve (NRV) in the broken steam line fails to close. Thus, steam from all three SGs is assumed to flow out the break until SLI occurs on high steam flow coincident with low steam line pressure (on two steam lines). Once the MSIVs are closed, steam flow is only from the associated SG. No credit is taken for the isolation provided by the NRY. Also, no credit is taken in the analysis for the high-1 containment pressure or the high steam line differential pressure safety injection signals. The analysis assumes safety injection initia-tion only after two steam line high flows coincident with two steam line low pressures have occurred, whereas in reality the high steamline differential pressure signal would initiate SI significantly earlier. For steam line breaks outside containment, downstream of the NRV, the FSAR analysis assumes SI initiation and SLI on high steam flow coincident with low steam line pressure. The analysis does not take credit for the low pressurizer

TABLE 1 Trip Functions Provided by the Existing and Proposed BVPS SLBPSs During Nonnal Plant Operations (at power)3 SAFETY INJECTION STEAM LINE ISOLATION, Actual Trip FSAR Actual Trip FSAR Existing New Assumed Existing New Assumed Break Location SLBPS SLBPS Trip SLBPSs SLBPS Trip Breaks Upstream Trip liigh St AP Low SLP liigh SF + NRV provides NRV provides liigh 5' + Low of NRV (Inside Low SLP isolation isolation SLP Containment)- g Back liigh-1 P liigh-1 Pc High SF + Low High-2 Pc c Ug LwP Low P SLPl 2 p p Trips liigh SF + Low liigh-2 P c SLPI Low SLP liigh SF + Low Breaks Down - Trip liigh SF + Low SLP High SF + liigh SF + Stream of NRV Low SLP Low SLP Lbw SLP SLP (Outside Con-tainment) Back Low P Low P None None P P UE 2 Trips I These signals provide SI or SLI if the NRV falls. 2Hanual SI and SLI is also always available. 3See Table 2 for Abbreviations and Setpoints

TABLE 2 Abbreviations and Trip Values l i Abbreviation Trip Function Trip Value High SL t.P High steam line differential 100 psi ~ pressure High-1 p High-1 containment pressure 1.5 psig c High-2 p High-2 containment pressure 10 psig c Low P Low pressurizer pressure 1845 psig p High SF High steam flow in two steam 0-20% power, trip is lines and low steam pressure constant at 40% steam in two steam lines flow, from 20% to 100% power, trip increases linearly from 40% to 110%. LLT; Low-Low average temperature 5430F Low SLP Steam pressure in any single 500 psig steam line is low ITrip values are from Technical Specification Table 3.3-4, " Trip Setpoint" column, which represents the numerical value. i l 1

o pressure SI, which may occur before the assumed signal (depending on break size). Table 1 summarizes the actual and assumed signals that initiate SI and SLI in the existing and the proposed SLBPSs, and the backup signals fur each function of each system. Table 2 shows the trip signal setpoint shown in Table 1. As shown in Table 1, for SLBs inside containment, SI is afforded by the High SL AP signal in the existing system, and by the low SLP signal in the proposed sys tem. The FSAR assumes that the NRV fails, and assumes that SI occurs when two-out-of-three steam lines generate a High flow signal, coincident with two-out-of-three steam lines in a low pressure condition (<500 psig). In fact, Westinghouse has stated that the High SF portion of the signal is established alrost immediately after the SLB, and the SI trip was " waiting" until steam lir.e pressure reached 500 psig, at about 1.25 seconds.1 I The existing SLBPS affords SI by the High SL aP signal, and analyses have shewn that for the design base SLB, this' trip occurs in about 0.50 seconds. That is, pressure in the broken steam line decays to 100 psi below the other two steam lines in about 0.50 seconds, including instrument delay times. Anal-l yses have shown that the proposed SLBPS yields an SI trip by the low SLP trip signal about 0.13 seconds after the SLB. The faster response of this signal is due to the lead-lag signal conditioning. Therefore, for the design base SLS inside containment, the proposed SLBPS affords SI earlier than both the existing SLBPS and the assumed FSAR trip. "Tr.e calculations are from WCAP 9226, Rev.1, " Reactor Core Response to Excessive Secondary Steam Release," January 1978, Table 3.1-2. This analysis was for a 5' B on a 3 loop, 2785 MWt PWR with a SLBPS similar to the exi.st1.ng BVPS system L:igure 1). The table also sfiows results with. the proposed SLBPS.

-S-During a SLB outside contairinent, Table 1 shows that the existing SLBPS yields an SI trip when two-out-of-three steam lines generate a high flow signal coin-cident with two-out-of-three steam line pressures below 500 psig. Table 1 also shows that the FSAR takes credit for this trip. However, the proposed SLBPS does not have this trip function, but uses the low steam line pressure (in any single steam line) signal. Since the new Low SLP signal is processed through the lead-lag conditioner, the trip occurs faster than for the original circuitry where the trip had to actually wait for two-out-of-three steam line pressures to reach 500 psig.* Therefore, for the design base SLB outside containment, the proposed SLBPS affords SI trip earlier than the existing SLBPS and the assumed FSAR trip. Table I shows that for breaks inside containment, the NRV on the damaged steam line isolates the break from the remaining intact SGs, thus limiting steam flow to only from the associated SG. The NRVs are not being removed for the proposed SLBPS, therefore they would continue to provide isolation. However, if the NRV should fail, then isolation is provided by the SLI function which, on the original SLBPS, was generated on a High SF and low SLP signal. The new SLBPS would initiate SLI on just a low SLP signal, which has been processed by the lead-lag circuitry. SLBs outside containment would result in SLI due to the High SF plus low SLP on the existing SLBPS, and due to the low SLP on the proposed SLBPS. The FSAR takes credit for the SLI on High SF plus low SLP. Since the signal conditioner

• ine nign steam line flow portion of the trip occurs almost immediately after the SLB.

. on the low SLP signal results in an earlier trip than the unconditional lo'w SLP signal, SLI for breaks outside containnent with the proposed SLPBS would occur earlier than the existing SLBPs or the trip assumed in the FSAR. There-fore, with respect to SLI, the proposed SLBPS should afford earlier trips for breaks both inside and outside containment. For SLBs either inside or outside containment, the SI and SLI trip times assumed in the FSAR are all greater than the trips which would occur with the proposed SLBPS. Therefore, the FSAR analysis bounds. the plant response with the proposed SLBPS. Also, the plant response (time of SI and SLI) in most cases is better with the proposed SLBPS than with the existing SLBPS, due mainly to the lead-lag conditioning circuitry. However, for SLBs smaller than the design base SLB inside containment, SI with the proposed SLBPS may occur later than with the existing SLBPS, but in no case later than assumed in the FSAR. According to Westinghouse, in these cases where SI would occur later with the proposed system, the low pressurizer pressure SI signal affords SI such that the plant response is not significantly different than the response with the existing SLBPS. Based on the comparison of the trips and trip times afforded by the existing and proposed SLBPSs, and the trips assumed in the BVPS FSAR, the staff concludes that the new SLBPS affords acceptable protection for SLBs during normal plant opera-tions (the plant is critical at any power level). Startuo and Shutdown Operation (i.e., pressurizer pressure below P-11) Whenever the reactor coolant is being heated up to the normal system temperature, or cooled down for system shutdown operation, the proposed SLBPS must be able to provide protection from SLSs such that acceptable core cooling and offsite l l-

doses result. Table 3 shows the existing and proposed SLBPS trip functions which provide protection for SLBs in this mode of plant operation. As shown in Table 3, for SLBs inside containment, the existing SLBPs affords SI on High SL AP, with High-1 Pc serving as a backup trip signal. However, the proposed SLBPS affords no automatic SI initiation for these break locations in this mode of p' ant operation.' The High-1 Pc is a backup signal, and may initiate SI depending on the initial plant conditions and break area. If a break occurred outside containment, the existing SLBPS may, depending on initial plant conditions, initiate SI on the High SF (in two-out-of-three trip, however the proposed SLBPS does not steamlines) coincident with the LLTA afford any SI trip, regardless of the initial plant conditions. The staff asked the licensee to justify the removal of SI initiating trips while in this mode of operation. The licensee was ask'ed to show how adequate core shutdown margin is always assured without the addition of concentrated boric acid (from the boron injection tank (BIT) in the high-head safety injection systen - HHSIS), and to demonstrate acceptable core cooling wi,thout the mass addition from the HHSIS to make up for the coolant shrinkage. With respect to core shutdown margin, the licensee agreed to proposed technical specifications requiring the RCS boron concentration to be established at that required for adaquate shutdown margin at the cold shutdown condition before blocking during RCS heatups and cooldowns, the SI function associated with the j

TABLE 3 Safety Injection and Steam Line Isolation Trips Afforded by the Existing and Proposed SLBPSs During RCS lleatup and Cooldown Operations SAFETY INJECTION STEAM LINE ISOLATION Break location Existing SLBPS Proposed SLBPS Existing SLBPS Proposed SLBPS 3 4 Break Upstream Trip liigh SL AP None None liigh Neg SLPR of NRV (Inside Conta innent) Back liigh-I Pc liigh-1 P liigh-2 P liigh-2 P 1 c c 1 c Up liigh SF + LLT liigh SF + LLT Trips 2 3 Breaks Down-Trip liigh SF + LLT None liigh SF + LLT liigh Neg SLPR A stream of flRV (Outside Back None None None None of Containment) LJg 2 Trips IThese trips would actuate only if the NRV failed. 2Manual SI and SLI is always available. 3The liigh-1 P trip may afford SI depending on initial plant conditions and break area. Therefore, liigh-1 P c c is listed as a backup trip. 4The liigh-2 Pc trip, sililac to the liigh-1 P trip discussed in Note 3, may afford backup SLI trip. c

-g-SLBPS. This action would guarantee that criticality would not occur following a cooldown to cold shutdbwn caused by a SLB. The licensee and Westinghouse perfomed calculations to demonstrate that the core always remained covered and the RCS remained subcooled following any SLB without HHSIS flow during RCS cooldowns and heatups. These calculations, shown in References S. 6, and 7, show that with the largest SLB outside containment which does not initiate SLI on High Negative SLPR, without mass addition from the charging system, SI accumulators or HHSIS, and with the lowest. initial RCS pressure.and highest initial RCS temperature, (to maximize the stored energy and minimize RCS subcooling), the following results were found:* - The pressurizer drains in about 4 minutes. - RCS pressure decays at about 47 psi / min. - RCS temperature initially drops at abcut 160F/ min then at about SOF/ min. 0 - The RCS is initially about 10 F subcooled. During the blowdown, the sub-cooling is at least 200-30oF until about 18 min., when the RCS is approaching 0 saturation and the subcooling is only'10 F. The results are bounding since: - Smaller breaks result in lower cooldown rates, hence slower plant response. - Larger breaks, outside containment, result in SLI thus a temination of the blowdown. - Larger breaks, inside containment, would actuate the SI High-1 P trip, thus c ensuring sufficient RCS subcooling. 2 'Tnese results are for s 0.12 f t break, outside containment with the RCS initially at a temperature and pressure of 5470F and 1000 psia, and the accumulators are isolated.

, - If the initial RCS temperature were lower, or if pressure were higher, system response would be less severe and more subcooling would exist. The analysis predicts that RCS subcooling is adequate for the first 18 minutes, but the operator must take action at that time. The following conservatisms and conclusions apply: 1. The RCS mass inventory is such that the core would remain covered, even if the cooldown proceeded to cold shutdown. 2. Subcooling conditions would be rapidly regained following reestablishment of normal charging flow at 18 minutes. 0 3. The initial RC5 temperature used in the analysis is about 150 F above the normal temperature consistent with the initial RCS pressure used. 4. If charging flow were not lost at the time of the event, the pressurizer would not empty. 5. The following alarms would alert the operator to a loss of charging and/or the SLB j - Charging pump discharge pressure low (<2200 psig) - CMrgi:g purnp discharge flow low (<20 gpm) - Pressurizer control level deviation (/5% of program level) l l - Pressurizer control level low (14%) ( - Pressurizer control heater Group Automatic trip (414;} With respect to this event, we conclude that these are sufficient indications for the operator to know charging flow has been lost, and he could regain the charging flow before saturatiors conditions occurred.

. The staff also asked the licensee to compare the protection afforded by the existing and the proposed SLBPS for SLBs during heatup/cooldown. The licensee, in Reference 5, provided Figure 3, below, which shows how the existing and proposed SLBPSs compare in providing' protection for all SLBs downstream of the NRV (outside containment). The figure shows that SLI will occur for both systems if the break area is about 0.44 ft2 and the initial 0 RCS temperature is about 435 F. If RCS temperature is below 435 F, generally the existing SLBPS provides SLI for a larger spectrum of break areas than the proposed SLBPS.* If RCS temperature is above 4350F, the new SLBPS affords greater protection than the existing system.** Therefore, the existing SLBPS provides better system response to SLBs downstream of the MSIVs for temperature Selow 4350F, but the system respons-e with the proposed SLBPS has been shown to be acceptable (i.e., adequate core cooling, acceptable offsite doses (no DNB occurs) and the system remains subcooled). Therefore, even though the proposed SLBPS affords less protection than the existing SLPBS (for certain initial RCS temperature), the results of a SLB with the proposed SLBPS are acceptable, and therefore the proposed SLBPS is acceptable for protection from SLBs during heatup and cooldown operation. Technical Specifications The licensee submitted, in Reference 7, proposed Technical Specifications which require the RCS to be borated to at least the cold shutdown boron 0

• For example if RCS temperature is 400 F, the gxisting system shuts the MSIVs for SLBs with area greater than about 0.90 ft, whereas the proposed system will not shut the MSIVs, regardless of the break area.
  • For example, if RCS temperature is 5000F, the existing system shuts the MSIVs 2

for SLB with area greater than 0.34 ft, whereas the proposed system gives SLI 2 for break area.s greatr.v than 0.18 f t. Therefore, at the RCS temperature of 5000F, the new system provides protection for break areas 0.18 to 0.34 f t, 2 wnich the existing systs, does not.

f,. ...:.w../}/ Ei - --=9' . =.g Benvar Valloy Pcwe.r Station, Unit No."l r--y.o n w y g-2 g e d Q" v m un b O .,o m 4 O C8-2e w --g o o O mn g a eu e 0 u ~1

1. • • pf*

J h vt'3 si

o M

--O 6 y 7 5 2 b"4 C ~) 8 5 J a g O c- + 2b,/ ~Q m-9 H e o g Z 2 . ')/ ~% 2 \\ ~ OH 8 .2 a \\ ~0-u o. o v; N m ~ 13 i u 3e 8 E a e a 'o o o o tn 4 ci si S u?. m N. a o. Itid) dOO7. V3d W389 MW3'd8 e

. concentration prior to manually blocking the Low Pp SI signal, and then remain at or above this boron concentration whenever the Low Pp trip is blocked. Sihce this affords assurance that criticality will not occur due to a SLB with the proposed SLBPS, the proposed technical specification is acceptabl e. Conclusion Based on the preceding evaluation the staff concludes that the proposed SLBPS affords acceptable protection against SLB accidents while the RCS is at hot zero power or during power operations. Also, the present FSAR analysis bounds the plant behavior with the proposed SLBPS during these modes of operation. With respect to SLBs during RCS cooldown and heatups, the staff concludes that the proposed SLBPS provides adequate protection, even though there may be a reduction in protection below that afforded by the present SLBPS. The licensee has demonstrated that even if the normal charging system were lost at the moment of the SLB which gives the " worst" system response, there is sufficient time and indications for the operator to regain normal charging, or establish charging via another path, before the RCS reaches a saturation condition. Therefore, the staff concludes that the proposed SLBPS affords acceptable protection for SLBs during RCS heatup and cooldowns. We also conclude that the proposed technic:1 specifications regarding establishment of cold shut-down boron concentration prior to blocking the low Pp SI trip is necessary and acceptable. In a recent trip to BVPS, the staff noted that the present procedures are applicable only during normal plant operations and we conclude that the plant emergency procedures must be amended to reflect the necessary operator actions in the event of an SLB during heatup and cooldown. l

REFERENCES 1. Letter from Dusquesne Light Company (DLC), C. N. Dunn, to A. Schwencer, USNRC dated October 27, 1978. 2. Meeting minutes dated March 22, 1979. 3. Letter from C. N. Dunn, DLC to A. Schwencer, USNRC dated March 7,1979. 4. Letter from C. N. Dunn, DLC to A. Schwencer, USNRC dated May 7,1979. 5. Letter from C. N. Dunn, DLC to A. Schwencer, USNRC dated August 28, 1979. 6. Meeting minutes dated October 18, 1979. 7. Letter from C. N. Dunn, DLC, to A. Schwencer, USNRC, dated October 18, 1979. i l l

ATTACHMENT 2 TECHNICAL EVALUATION OF THE ELECTRICAL, INSTRUMENTATION, AND CONTROL DESIGN ASPECTS OF THE TECHNICAL SPECIFICATION CHANGE FOR THE MAIN STEAMLINE BREAK PROTECTION SYSTEM OF THE BEAVER VALLEY NUCLEAR POWER PLANT, UNIT 1 (Docket No. 50-334) James H. Cooper EG&G, Inc.-Energy Measurements Group, San Ramon Operations 1.0 Introduction In a letter to the U. S. Nuclear Regulatory Commission (NRC) dated 27 October 1978, the Duquesne Light Company requested an amendment to its operating license DPR-66 to incorporate a new steamline break protection system design for the Beaver Valley Nuclear Power Plant, steamline breaks and a range of loss-of-coolant accidents (gainst main Unit 1. The protection system changes provide protection a LOCAs). A description and discussion of the proposed change was presented to the NRC by the nuclear steam supply system designer (Westinghouse) and by the Licensee in Washington, D. C. on February 23, 1979. Additional written information forms part of the data evaluated (1, 2, 3, 4, 5, 6, 7,8). The protection system design has been reviewed and recommended for approval as reported in the technical evaluation report EG&G 1183-4121 (1 ). The purpose of this report is to evaluate the electrical, instrumentation. and control (EI&C) design aspects of the proposed technical specification change using the safety analysis of the license amendment request (2), IEEE Std.-279-1971 (9) criteria and the Code of Federal Regulations, ~ Title 10 Part 50. 2:0' Description of the New Main Steamline Break Protection System 2.1 Introduction In order to review the instrument changes to which this technical specification change applies, it is first necessary to describe the reactor protection functions that are involved. 2.2 The New Protection System The new system is ' designed to protect the reactor in case of a main steamline break which would result in a sudden and large energy removal from the secondary loop of the reactor cooling system. The energy loss would, in turn cause a drop in primary coolant temperature and pressure, and because of the negative coefficient moderator would result in a, positive reactivity effect. The licensee states in the safety

~ , analysis that for a worst cast stuck rod condition, safety injection is required to unconditionally terminate power operation by the neutron poisoning effect of the boron of the safety injection solution. 2.3 The Licensee's Submittal The licensee's submittal for a license change to incorporate a new main steamline break protection system included a safety analysis by the nuclear steam supply system designer that demonstrated that the new system meets the required criteria of 10 CFR 50 and 10 CFR 100. In the meeting in Washington, D. C. (Reference 4) the statement was made by the NSSS designer that the new instrument system is as comprehensive for protection as the former system, and that it is expected to be more reliable. 2.4 Instrument System The instrument system for the main steamline break protection system consists of; the reactor trip system whose initiating signals are un-changed, the safety injection system with two additional initiating signals and the deletion of three initiating signals, the steam generator feedwater line isolation system which is unchanged and the main steam isolation stop valve trip system with the two initiating signals replaced by three new initiating signals. A new permissive, p-ll is also added with the change. 3.0 The Technical Specification Change Evaluation The initiating signals for the plant parameters that are unchanged are covered by the existing plant technical specification. The new initiating signals developed in the safety analysis must be added to the technical specification by the amendment change. The initiating signals added for safety injection are low steamline pressure in any loop set at 500 psig, and high containment pressure at 1.5 psig. The channel check, calibration, test and surveillance modes are unchanged from the original system requirements. The initiating signals added for steam line isolation are low steamline pressure at 500 psig, high negative steam pressure rate at 100 psig/sec, and high containment pressure at 5 psig. There are three channels per loop with two channels required to trip, and applicable in all three operating modes for all the added steam line isolation signals. The added signal set points are listed in the revised technical specification and the values are the ones used in the safety analysis. The set points and allowable values are in a plausible range to meet the described conditions. The response times of the added signals are noted in the safety analysis and are added to the revised technical specification under the appropriate reactor safety function. The response times are in the same range as the ones replaced.

! The limiting condition for operation in the revised technical specification primarily involves shutdown margin and (N-1) cooling loop operation which are not in the domain of the report, or will be reviewed for a subsequent application. The new permissive, P-ll is an interlock for the engineered safety features system and is set at a pressure of 2010 psig for the pressurizer, which corresponds approximately to full power. 4.0 Conclusions In reviewing the revised technical specification it was difficult to follow the requirements with respect to shutdown margin, baration levels required and the corresponding operating mode for these levels. Since the (N-1) cooling loop operating mode is not being reviewed for approval at this time, references to two loop conditions in the original submittal add to the confusion. It is recommended that this aspect of the technical specification be reviewed by the appropriate branch for consistency. The revised technical specification covers the plant variables and initiating signals required in the safety analysis presented by the licensee. They are found to be of appropriate magnitude and redundancy to mitigate the consequences of a main steamline break accident, and approval is recommended. I = l l

. References 1. EG&G 1183-4142: Technical Evaluation of the Electrical Instrumentation and Control Design Aspects of the Proposed Main Steamline 8reak Protection System of the Beaver Valley Nuclear Power Plant Unit 1 April 1980. 2. Duquesne Light Company (C. N. Dunn) letter to NRC (A. Schwencer), "Duquesne Docket No. 50-334 License Amendment Request, Beaver Valley Power Station, Unit No.1", dated 27 October 1978. 3. Duquesne Light Company License Amendment Request, Technical Specification Revision Beaver Valley Power Station Unit No.1, Revised August 24,1978/ October 18, 1979. 4. Westinghouse /Duquesne Logic Diagrams, presented in Washington, D. C. 23 February 1979. 5. Westinghouse WCAP-7672: Solid State Logic Protection System Description, June 1971. 6. Westinghouse WCAP-7706: An Evaluation of Solid-State Logic Reactor Protection in Anticipated Transients, July 1971. 7. Westinghouse WCAP-7819: Nuclear Instrumentation System Isolation Amplifier, April 1975. 8. Westinghouse WCAP-8904: WestinghoJse Emergency Core Cooling System Evaluation Model for Analyzing (N-1) Loop Ooeration of Plants witn Loop Isolation Valves, December 1976. 9. IEEE Std-279-1971: Criteria for Protection Systems for Nuclear Power Generating Statiqns.

10. Code of Federal Regulations, Title 10, Part 50.46: Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors, January 1,1978.

11. Code of Federal Regulations, Title 10, Part 50, Appendix A:

General Design Criteria for Nuclear Power Plants, January 1,1978.

12. Duquesne Light Company, Beaver Valley Final Safety Evaluation Report (FSAR), October 1976.

l e}}