ML20042G102

Nonproprietary Summary Rept Process Protection Sys Eagle 21 Upgrade,Rtd Bypass Elimination,New Steam Line Break Sys, Medical Signal Selector,Environ Allowance Modifier & Trip Time Delay Implementation.

ML20042G102
Person / Time
Site:	Sequoyah
Issue date:	03/30/1990
From:	Erin L WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML19302E130	List: ML20042G100 ML20042G101 ML20042G102
References
WCAP-12548, NUDOCS 9005110095
Download: ML20042G102 (147)

Text

,

p ,

=

WESTINGHOUSE PROPRIETARY CLASS 3 I

WCAP 12548

,,' I L

SUMMARY

. REPORT PROCESS PROTECTION SYSTEM EAGLE 21 VPGRADE, RTDBE, NSLB, MSS,'EAM AND TTD IMPLEMENTATION l SEQUOYAH UNITS 1 & 2 MARCH 1990 3

L.E. Erin .

J.P. Kutz L.M.Schaub L.V.Tomasic C.R.Tuley R.M. Waters

. Z.A Yurko 1

I 5

l Westinghouse Electric Corporation Energy Systems ,

P. O. Box 355 Pittsburgh, Pennsylvania, 15230 i l' ~ 81990 Westinghouse Electric Corporation 9005110605 900508 PDR ADOCK 05000327 P PDC 1

- , s b

I_1 ACKNOWLEDGEMENTS

. The author of the non-LOCA section, L.M. Schaub, would like to acknowledge 4 J.P. Sechrist of the Nuclear Advanced Technology Division, Nuclear Safety Department, for his guidance and contributions during this project.

l l

I l

l 1

1 I

1

• 1 l

i I

l

.m l

4 i

l 1

1 l

TABLE OF CONTENTS  !

SECTION TITLE- PAGE l

~

1.0 INTRODUCTION

1-1 2.0 NON-LOCA SAFETY ANALYSES 2-1 2.1 RTD BYPASS ELIMINATION 2-3 2.1.1 Functional Description 2-3 2.1.2 Impact on Licensing Basis Non LOCA Safety 2s5 Analyses 2.1.2.1 Uncontrolled Rod Cluster Control Assembly' .2-5 Withdrawal at Power 2.1.2.2 Uncontrolled Boron Dilution 2-6 E

2.1.2.3 Loss of External Electrical Load and/or 2-6 Turbine Trip 2.1.2.4 Accidental Depressurization of the Reactor 2-7 Coolant System 2.1.2.5 Steamline Break with Coincident Rod Withdrawal 2-8 at Power 2.1.2.6 Steamline Break Mass / Energy Release Outside 2-8 Containment 2.2 NEW STEAMLINE BREAK PROTECTION 2-10 2.2.1 Functional Description 2-10 '

2.2.2 -Impact on Licensing Basis Non LOCA. Safety Analyses 2-11 E . 2.2'2.1

. Major Rupture of a Main Feedwater Pipe 2-11 2.2.2.2 Steamline Break Mass / Energy Releases Outside 2-12 Containment Limited Reanalysis) 2.3 ENVIR0 MENTAL ALLOWANCE MODIFIER / TRIP TIME DELAY 2-13 (EAM/TTD) 2.3.1 TTD/EAM Functional Description 2-13 2.3.2 Trip Time Delay Safety Analysis Limit (SAL) 2-15 Determination 2.3.3 Impact on Licensing Basis Non-LOCA Safety Analyses 2-17 1 2.3.3.1 Full Power Loss of Normal Feedwater 2-18 l (FSAR Section 15.2.8) 2.3.3.2 Loss of Offsite Power to the Station Auxiliaries 2-19 (Station Blackout) (FSAR 15.2.9) 2.3.3.3 Major Rupture of a Main Feedwater Pipe 2-21 2.3.3.4 Steamline Break Mass / Energy Releases Outside 2-24 Containment 2.4 ELIMINATION OF THE LOW FEEDWATER FLOW REACTOR TRIP 2-25

2.5 CONCLUSION

2-25 11

l TABLE OF CONTENTS (CONTINUED)

SECTION TITLE- PAGE l-.

3.0 INSTRUMENTATION AND CONTROL SYSTEM DESIGN 3-1 l 3.1 EAGLE 21 PROCESS PROTECTION SYSTEM 3-1 3 '. 2 RTD BYPASS ELIMINATION 3-5 .(

3.3 NEW STEAMLINE BREAK PROTECTION 3-11 1' 3.4 ENVIRONMENTAL ALLOWANCE MODIFIER / TRIP TIME DELAY 3-20 (EAM/TTD) 3.5 ELIMINATION OF LOW FEEDWATER FLOW REACTOR TRIP 3-28 l 3.6 CONTROL SYSTEMS 3-32 4.0 PROTECTION SYSTEM SETPOINT METHODOLOGY AND TECHNICAL 4-1 SPECIFICATION REVISIONS DISCUSSION i

5.0 RTD BYPASS ELIMINATION SUPPLEMENTAL INFORMATION 5 5.1 HISTORICAL BACKGROUND 51 5.2 MECHANICAL MODIFICATIONS 5-2 5.3 TESTING 5-3 I

6.0 REFERENCES

6 i 1 - 7.0 SUPPLEMENTAL DOCUMENTS- 7-1 l

iii 1

a

LIST OF TABLES Table Title Page 2.1 Sequoyah Units 1 & 2 Non Loca Affected Accidents Matrix 2-2 2.1.2.1 Sequence of Events Uncontrolled RCCA Withdrawal at Power 2-26 2.1.2.2 Sequence of Events Uncontrolled Boron Dilution 2-27 2.1.2.3 Loss of External Electrical Load and/or i Turbine Trip 2-28 '

1 Loss of External Electrical Load and/or l Turbine Trip (Cont.) 2-29 j 1

2.1.2.4 Accidental Depressurization of The Reactor l Coolant System 2-30 )

2.1.2.5 Steamline Break With Coincident Rod With- 1 Drawal At Power (Break size 1.0 ft2) 2-31 1

2.2.2.1 Major Rupture of A Main Feedwater Pipe 2-32 2.3.2-1 Loss of Normal Feedwater to Four Steam Generators At- 20% Rated Thermal Power 2-33 2.3.2-2 Loss of Normal Feedwater to One Steam l Generator at 20% Rated Thermal Power 2-34 Lo 2.3.3.1 Full Power Loss Of Normal Feedwater 2-35 2.3.3.2 Loss of Offsite Power To the Station Auxiliaries- 2-36 2.3.3.3 Major Rupture of A Main Feedwater Pipe At 30% RTP 2-37 3.6-1 Sequoyah Units LTOPS Setpoint Program 3-34 5.1-1 Response Time Parameters for RCS Temperature Measurement 5-8

. iv

i I

LIST OF FIGURES

. Figure Title Page 2.1.2.3 Loss Of Load / Turbine Trip- Pressurizer Spray h and Power Operated Relief Valves included End Of  ;

L. Life- Pressurizer Water Volume and Core Average l Temperature Versus-Time 2-38 2.1.2.3 5 Loss Of Load / Turbine Trip- Pressurizer Spray and ,

Power Operated Relief Valves not included, Beginning i of Life -Nuclear Power, Pressurizer Pressure, Core ,

Inlet Temperature, DNBR versus Time 2-39  :

2.1.2.3-6 Loss Of Load / Turbine Trip- Pressurizer Spray and .

Power Operated Relief Valves not included, Beginning i of Life-Pressurizer Water Volume and Core Average  !

Temperature versus Time 2-40  !

2.1.2.3-7 Loss Of Load / Turbine Trip- Pressurizer Spray and Power Operated Relief Valves not included, End of ,

Life -Nuclear Power,. Pressurizer Pressure, Core '

Inlet Temperature, and DNBR versus Time 2-41 2.1.2.3-8 Loss Of Load / Turbine Trip -Pressurizer Spray and Power Operated Relief Valves not included, End of Life- Pressurizer Water Volume and Core Average 3

'iamperature versus Time 2-42 2.1.2.4-1 Accidental Depressurization Of The Reactor Coolant System -Nuclear Power and Core Average a Temperature versus Time 2-43 l 1

2.1.2.4-2 Accidental Depressurization Of The Reactor Coolant System - Pressurizer Pressure and DNBR versus Time 2-44 2.1.2.5-1 Steamline Break With Coincident-Rod Withdrawal At Power - Nuclear Power and Core Average Temp-erature versus Time 2-45 2.1.2.1-1 Uncontrolled RCCA Bank Withdrawal At Power -

Pressurizer Pressure and Neutron Flux versus time-Full Power, Min. Reactivity Feedback, 75 pcm/sec reactivity insortion rate 2-46 2.1.2.1-2 Uncontrolled RCCA Bank Withdrawal At Power-Core Average Temperature and DNBR versus time -

Full Power, Min. Reactivity Feedback, 75 pcm/sec

. reactivity insertion rate 2-47 V

-% e e- ., y

. - . - . - - - . _ _ - - - _ - ~- . ._ . - .

i LIST OF FIGURES (Cont.) .

Figure Title Page

'~

2.1.2.1-3 Uncontrolled RCCA Bank Withdrawal At Power-L Pressurizer Pressure and Neutron Flux versus time-

. Full Power, min. Reactivity Feedback, 3pcm/sec L

reactivity. insertion rate 2-48 2.1.2.1-4 Uncontrolled RCCA Bank Withdrawal At Power-Core Average Temperature and DNBR versus time-Full Power Min. Reactivity Feedback, 3pcm/sec reactivity in-sertion rate 2-49 2.1.2.1-5 Uncontrolled RCCA Bank Withdrawal At Power- Min DNBR versus Insertion Rate at 100% RTP 2-50 2.1.2.1-6 Uncontrolled RCCA Bank Withdrawal AT Power - Min DNBR versus Insertio Rate at 60% RTP 2-51 2.1.2.1-7 Uncontrolled RCCA Bank Withdrawal At Power - Min DNBR versus Insertion Rate at 10% RTP 2-52 2.1.2.3- Loss Of Load / Turbine Trip -Pressurizer Spray and Power Operated Relief Valves included, Beginning of Life- Nuclear Power, Pressurizer Pressure, Core Inlet Temperature and DNBR versus Time 2-53 2.1.2.3-2 Loss Of Load / Turbine Trip - Pressurizer Spray and Power Operated Relief Valves included, Beginning of

- Life -Pressurizer Water Volume and Core Average i Temperature versus Time- 2-54 l -

2.1.2.3-3 Loss Of Load / Turbine Trip -Pressurizer Spray and Power Operated Relief Valves included, End Of Life- '

Nuclear Power, Pressurizer Pressure, Core Inlet Temperature, DNBR versus Time 2-55 l 2.1.2.5-2 Steamline Break With Coincident Rod Withdrawal At Power -Pressurizer Pressure and Steam Flow versus Time 2-56 2.2.1-1 Steamline Break-Protection Systems 2-57 l

2.2.2.1-1 Major Rupture Of A Main Feedwater Pipe, With Off-Site Power -Pressurizer Pressure and Water Volume versus Time 2-58 1

vi )

l 1

l l

l LIST OF FIGURES (Cont.) l Figure Title Page l l.

2.2.2.12 Major Rupture Of A Main Feedwate Pipe, With Off- l Site Power - RCS Loop Temperatures versus Time 2-59 1 N.

2.2.2.1-2 Major Rupture Of A Main Feedwater Pipe, With Offsite Power -RCS Loop Temperatures versus Time 2-60 2.2.2.1-3 Major Rupture Of A Main Feedwater Pipe, Without ,

Offsite. Power- Pressurizer Pressure and Water i Volume versus Time 2-61 l 2.2.2.1-4 Major Rupture Of A Main Feedwater Pipe, Without r Offsite Power -RCS Loop Temperatures versus Time 2-62 2.3.2-1 Calculated Trip Time Delays versus Power for Low-Low Steam Generator Level in Multiple Steam l' Generators 2-63 2.3.2-2 Calculated Trip Time Delays versus Power for Low-Low Steam Generator Level in One Steam Generator 2-64 4 2.3.2-3 Part-Power loss Of Normal Feedwater To Four Steam Generators - 20% RTP with N/4 Trip Time Delay -

Nuclear Power and RCS Flow versus Time 2-65 2.3.2-4 Part Power Loss Of Normal Feedwater To Four Steam Generators -20% RTP with N/4 Trip Time Delay -

Pressurizer Pressure and Pressurizer Water Volume ,

versus Time 2-66 2.3.2-5 Part-Power loss Of Normal Feedwater To Four Steam ,

Generators -20% RTP with N/4 Trip Time Delay -Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time 2-67 2.3.2-6 Part-Power Loss Of Normal Feedwater To Four Steam Generators - 20% RTP with N/4 Trip Time Delay -Steam Generator Pressure and Steam Generator Mass versus Time 2-68 2.3.2-7 Part-Power Loss Of Normal Feedwater To One Steam Generator 20% RTP with 1/4 Trip Time Delay -

Nuclear Fwer and RCS Flow versus Time 2-69

, 2.3.2-8 Part-Power Loss Of Normal Feedwater To One Steam L Generator - 20% RTP with 1/4 Trip Time Delay-l Pressurizer Pressure and Pressurizer Water Volume versus Time 2-70 vii o

i 5

~

LIST OF FIGURES (Cont.)

Figure Title Page 1.

l 2.3.2-9 Part-Power Loss Of Normal Feedwater To One Steam Generator -20% RTP with 1/4 Trip Time Delay'-Loop 1

-- and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time 2 2.3.2-10 Part-Power Loss Of Normal Feedwater To One Steam Generator - 20% RTP with 1/4 Trip Time Delay- Steam Generator Pressure and Steam Generator Mass versus

• Time 2-72 2.3.3.1-1 Full Power Loss Of Normal Feedwater- Nuclear Power and RCS Flow versus Time 2-73 2.3.3.1-2 Full Power Loss Of Normal Feedwater- Pressurizer

- Pressure and Pressurizer Water Volume versus Time 2-74 2.3.3.1-3 Full Power Loss OF Normal Feedwater -Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time 2-75 2.3.3.1-4 Full Power Loss Of Normal Feedwater -Steam Generator Pressure and Steam Generator Mass versus Time 2-76 2.3.3.2-1 Loss Of Offiste Power To The Station Auxiliaries-Nuclear Power and RCS Flow versus Time 2-77 2.3.3.2-2 Loss Of Offsite Power To The Station Auxiliaries -

, Pressurizer Pressure and Pressurizer Water Volume versus Time 2-78 2.3.3.2-3 Loss Of offsite Power To The Station Auziliaries-Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time 2-79 2.3.3.2-4 Loss Of Offsite Power To The Station Auxiliaries -

Steam Generator Pressure and Steam Generator Mass versus Time 2-80 2.3.3.3-1 Major Rupture Of A Main Feedwater Pipe AT 30% Power, With Offsite Power -Nuclear Power and Pressurizer Water Volume versus Time 2-81 ,

2.3.3.3-2 Major Rupture Of A Main Feedwater Pipe At 30% Power with Offsite Power -Hot Leg, Cold Leg, and Saturation Temperatures in the Faulted and Intact Loops 2-82 l

viii I

LIST OF FIGURES (Cont.)

L Figure Title

~

Page L* 2.3.3.3-3 Major Rupture Of A Main Feedwater Pipe At 30% Power, Without Offsite Power -Nuclear Power and Pressurizer-Water Volume versus Time 2-83 2.3.3.3-4 Major Rupture Of A Main Feedwater Pipe at 30% Power, l Without Offsite Power -Hot Leg, Cold Leg, and l Saturation Temperatures in the Faulted and Intact- l loops 2-84 3 .1 -'1 Typical I & C System Block Diagram 3-3 3.1-2 Analog System = Digital System 3-4 1

3.2-1 Digital Processing Diagram 3-8 I 3.2-2 Functional Logic Diagram (Teold) 3-9 3.2-3 Functional Logic Diagram (Thot) 3-10 I 3.3-1 . Existing Steamline Break Protection System 3-14

-.- Sheet 1 of 2 New Steamline Break Protection System 3-15 Sheet 2 of 2 3.3 Old Steamline Break Protection Logic Steamline Deferential- Pressure 3-16 Sheet 1 of 2 Old Steamline Break Protection Logic 3-17 Sheet 2 of 2

.3.3 New Steamline' Break Protection Logic High Steam Pressure Rate ( Rate-Lag Compensated) 3-18 Sheet 1 of 2 New Steamline Break Protection Logic Low Steamline Pressure ( Lead-Lag Compensated) 3-19 Sheet 2 of 2

.- ix

LIST DF FIGURES (Cont.) l Figure Title Page 3-25 3.4-1 Environmental Allowance Modifier ,

)

3.4 Trip Time Delay (Four Steam Generators) 3-26 l 1

1 3.4-3 Trip Time Delay (Two Steam Generators) 3 ,

1 3.5-1 Present Functional Design 3 )

3.5 Median Signal Selector Functional Design 3-31 3.6-1 Sequoyah Unit I COMS 3-35 3.6-2 Sequoyah Unit 2 COMS 3-36 l 5.2-1 Hot leg RTD Scoop Modification for Fast-Response J RTD Installation 5-5 J

'5.2-2 Cold Leg Pipe Nozzle Modification  ;

. Fast-Response- RTD Installation 5-6 4 5.2-3 Additional Boss for Cold Leg Fast Response RTD 5-7  !

1

-l l

X 1 1

• l

'N 1- _-, , _

e-?

v

1.0 INTRODUCTION

The purpose of this Summary Report is to essentially describe the process protection system changes involved and the FSAR Chapter 15 Accidents safety analyses performed to support these changes for the Eagle 21 Process Protection System Upgrade, RTD Bypass Elimination (RTDBE), New Steamline Break (NSLB), Median Signal Selector (MSS),

Environmental Allowance Modifier (EAM), and Trip Time Delay (TTD). ,

.The detailed plant changes are described in the Field Change Notices (FCNs), which were provided separately. Additionally, several other

' documents which support these changes were supplied separately.

These include, the Safety Evaluation, Technical Specification

. Mark-ups, FSAR Mark-ups for Chapters 7 and 15, Environmental and  :

Seismic Qualification Report, Noise, Fault, Surge Withstand Capability report, the EMI and RFI Qualification-Testing report, and the Verification and Validation report. The Safety Evaluation to support these changes (as described in this report and in the FCNs) provides the bases for both the Setpoint Methodology Document (WCAP-11239, Revision 4) and the Technical Specification Mark-ups.

This section summarizes the reasons and benefits for implementing these changes, Section 2.0 describes all of the Chapter 15 Accidents requiring reanalysis to support these changes, including providing the analyses results, Section 3.0 describes the Process Protection M System Changes, including the changes to the logic diagrams, Section l 4.0 summarizes the effect of these changes on the Setpoint Methodology and the Technical Specifications, Section 5.0 summarizes the RTDBE modifications, Section 6.0 provides references and Section 7.0 provides a listing of Supplemental Documents. (

The RTD Bypass Elimination (RTDBE) is being implemented to eliminate

,' potential plant shutdowns, bypass piping and valving maintenance, and radiation exposure due to. maintenance and radiation exposure

, throughout the loop compartments caused by crud traps. The RTDs will l' be installed in thermowells, which are pressure boundaries, which permits the RTDs to be replaced without draining the reactor coolant loops. Three RTDs installed in the hot leg will be spaced 120 l degrees around the periphery of the pipe to account for the L approximately [7 to 10 degrees F]a,c streaming effect and averaged l' to provide T-hot. The cold leg averages two RTDs. The appropriate Chapter 15 accidents (Uncontrolled RCCA Bank Withdrawal at Power, Accidental Depressurization of the Reactor Coolant System, Loss of External Electrical Load and/or Turbine Trip, Steamline Break

- Coincident with Rod Withdrawal at Power, Mode 1 Boron Dilution, and the Steamline Break Mass / Energy Release Outside Containment) were reanalyzed to accommodate the increase in OTAT and OPAP response time from 6 to 8 seconds. The response time of the RTDs (less than or equal to {6.5 seconds]a,c) will be verified by in-situ testing.

1-1 1

- ~ . -- _ -- - .

l The Eagle 21 Process Protection System is a digital microprocessor based system which replaces the existing Foxboro analog system on a l3 form, fit and functional basis. It provides the identical process 1

protection functions as well as adding microprocessor capability. l Features of Eagle 21 include the capability of automatic surveillance I testing, self calibration, self diagnostics, and expansion for future l upgrades. The protection system setpoints processed through the Eagle 21 racks were revised to reflect the different rack accuracies and 1 elimination of the analog comparator. These Setpoint changes are l listed in WCAP-11239, Revision 4. The Low Temperature Overpressure i

System (LTOPS) was addressed to account for the increase in instrument delay (250ms) added by Eagle 21, which affects the PORY pressure setpoints. The Environmental and Seismic Qualification, Noise, Fault, Surge Withstand Capability, EMI And RFI Qualification Testing, and Verification And Validation documents are provided separately.

-The New Steamline Break (NSLB) System is being implemented to reduce the' potential for spurious actuation of Safety Injection (SI) at low power by removing the requirement for coincident signals (for SI).

SI will occur on Steamline Pressure-Low. While some functions are being. deleted, a new trip setpoint (Negative Steamline Pressure Rate-High) is being added to provide protection when Steamline Pressure-Low SI is blocked in Mode 3. The applicable FSAR Chapter 15 accident (Major Rupture Of A Main Feedwater Pipe) has been reanalyzed. All later vintage Westinghouse plants have the New Steamline Break Protection System.

The Median Signal Selector (MSS) is being implemented to eliminate the low feedwater flow reactor trip to avoid the potential for spurious trips at low power levels during start-up. The low

. feedwater flow trip was previously used in conjunction with the steam generator low -low water level reactor trip to satisfy IEEE Standard 279-1971 control and protection system interaction. The MSS signal ,

selector process eliminates the need for this interacting protection, as described in WCAP-12417. The Chapter 15 accidents do not require reanalysis because the low feedwater flow trip is not assumed to be the primary functioning reactor protection.

The Environmental Allowance Modifier (EAM) is being implemented to reduce the potential for unnecessary reactor trips by providing the capability of using smaller instrument errors for the Steam Generator Low-low Level Trip Setpoint than previously used for normal operation. The smaller instrument error minimizes the difference between the actual and indicated steam generator level. Previously, a single setpoint was used for both normal and adverse operation and was based upon the instrument accuracy for adverse conditions. EAM will use two steam generator low-low level trip setpoints based upon L* the detection of containment pressure, which corresponds to .

containment temperature as described in WCAP-11342-P-A. The setpoint l

. [

1-2 1

for normal operation will be based upon a maximum containment

. temperature of 180 degrees F, which has a smaller instrument accuracy than the setpoint for adverse conditions, which is based on a L containment temperature exceeding 180 degrees F. The containment I analysis documented in WCAP-11342-P-A has been determined to be l applicable to Sequoyah. No Chapter 15 Accidents were required to be t

reanalyzed.

The implementation of the Trip Time Delay (TTD) reduces the potential for unnecessary steam generator low low level reactor trips below 50%

' power by delaying the trip based upon the safety analysis acceptance criteria at the power level the Steam Generator Low-Low Level setpoint is reached rather than initiating tripping at the time the

~

setpoint .is reached.' The TTD varies with power level, with the .

longest delay at 0 % power. The delay time is based upon the power level and whether one steam generator or multiple (more than one) steam generators are involved. The digital Eagle 21- process protection system provides the capability of using a continuous time delay curve from 0 to 50 % power rather than requiring the selection-of discrete power levels when using an analog system. The TTD methodology is described in WCAP-11325-P-A. The applicable FSAR Chapter 15 accidents (Full Power loss of Normal Feedwater, Loss of Offsite Power to the Station Auxiliaries (Station Blackout), Major Rupture of a Main Feedwater Pipe, Steamline Break Mass / Energy 1 Releases Outside Containment) have been reanalyzed. ,

1 i

1 l

l l

l

. j l

1 I

1-3 -

a l

l l.

2.0 NON LOCA ANALYSES / EVALUATIONS The following functional upgrades will be included with the Eagle 21 digital reactor protection system scheduled to be installed in the

~

Sequoyah plant before the beginning of Unit 1 Cycle 5 and Unit 2 Cycle 5:

Elimination of the RTO Bypass System

- New Steamline Break Protection

- Elimination of the Low Feedwater Flow Reactor Trip

- Environmental Allowance Modifier / Trip Time Delay (EAM/TTD)

This section addresses those non LOCA safety analyses which were impacted by these changes to the protection system.

The digital electronics of the Eagle 21 system do not impact the non LOCA safety analyses without the functional upgrades because the time delays and inaccuracies associated with the Eagle 21 system tre not greater than those previously assumed for the analog system. The epgrades, however, affeet the protection system modeling which was used in some of the original analyses of the licensing basis non LOCA transients.

Table 2.1 shows which non LOCA analyses are affected by each of the upgrades such that reanalysis of the licensing basis transient was required. The results of the analyses are presented after a brief discussion of the methodology used for each analysis. The reasoning behind why specific accidents are affected is provided in the following sections. It should be noted that the transients discussed in the  !

following sections were analyzed because of specific upgrades however all the upgrades were incorporated where appropriate in each of the analyses.

e i

2-1 j

i i

1

)

f TABLE 1.1 L.

SEQU0YAH UNITS 1 AND 2 l NON LOCA AFFECTED ACCIDENTS MATRIX )

I KEY: . = tvaluation 1 = Rennalyn EAW/ MEW ES RfD WWPASS

- AcceENT TfD PR6fEumeW EMM.

Roo WmeRAaML PMoM supoRmos .

= . N MOD WffMDRAWAL M POWER

. =* .

ft00AtNBAMONW NT W j j-LE-5E='* EC95 M m0N . .

PAfm E Lees W PupW . ,

START UP W AM emeTWE Leap . .. . l i

= . N LOSS W WhAD/fUfWME TOWP .

L" W De00 MAL MATER M .

STATNIN ALAege0UT N

. . . =

PEEDWATER MAWUNODON .

c , StetssNE WhAD MofEASE . n

_w+Tu . .

' 2 W. . .

=

f DEPfERSufMEATION W MAIN STEAM SYSTEM . .

j. M@tRTENT OPERATNIN W EDOS '

00MPLEft ubes W PupW .

- . l ameLE M &arfr^i At POWWI * = .

MAM STEAMUNE RUPTUfE =

MAIN PEEDWATER PM RUPTUIE N N

• SmeLE rop LeeMED ItWTOR *

-_ '. "_-Es76 SLS M/E RELKASE MSIDE CONTAINMENT . M =

SLS W/E RELEASE OUTSIDE CONTAINMENT = = W STEAMUNE OREAN Wri SEWAP I

2-2 l

i

2.1 RTD BYPASS ELIMINATION 2.1.1 Functional Description

. The primary impact.cf the RTD bypass elimination on the non LOCA licensing basis safety analyses is the increased response time associated with the I

thermowell RTD system. Currently, the overall response time of the Sequoyah Unit I and 2 bypass system assumed in the safety analyses is 6.0 l

seconds. For the thermowell system, the overall response time assumed will be approximately 8.0 seconds.

This increased response time results in longer delays from the time when the fluid conditions in the RCS indicate the need for an Overtemperature AI or Overpower AT reactor trip until a trip signal is actually .

generated. Therefore, those transients that rely on the above mentioned -

trips must be reanalyzed to incorporate the longer res sense time. The affected transients include Uncontrolled RCCA Bank Witidrawal at Power, Accidental Depressurization of the Reactor Coolant System, Loss of External Electrical Load and/or Turbine Trip Steamline Break Coincident with Rod Withdrawal at Power, Mode 1 Boron Dilution, and the Steamline Break Mass / Energy Release Outside Containment.

2.1.1.1 Overtemoerature AT and Overnower AT Eauntions Changes have been made in the reactor protection system setpoints to account for the new thermowell mounted RTDs. In addition, the equations for Overtemperature and Overpower AT have been slightly altered. The Overtemperature equation is as follows:

1+r4s 1+r3s AT( ) 5 ATo(K 2 )(TT')+K(P-P')-f(AI))

3 3 l ,

1+r55 3 K (N72 5 .

i 1+r4s

. Lead Lag compensator on measured AT 1+r55 P' = 2235 psig (Nominal RCS operating pressure)

T' s 578.2 deg F (Nominal Tev1 at rated thermal power)

ATo = indicated AT at rated t.1ermal power s = Laplace transform operator T = Average Temperature l P = Pressurizer Pressure, psig l f(AI)= Al penalty function as specified in the Technical l Specifications K3 = 1.15 (Safety Analysis Limit = 1.2357)

K2 = 0.011 K3 = 0.00055 73 = 33 seconds rp = 4 seconds 74 = 12 seconds 75- 3 seconds 2-3

~, - - ... -__. . - - - - -- _ - _ -- - - . . - - _ _ _ _ .

The Overpower equation is as follows:

1+f s fs3 AT( 4 5 )T-K(T-T*)-f(AI)}

6 2 1+r5s4 ) 1 ATo(K - K (1+r3s 1+r4s

= lead-Lag compensator on measured AT 1+755 T' = Indicated average temperature at rated thermal power)

ATo = indicated AT at rated thermal power sa Laplace transform operator T = Average Temperature )

f(AI) = 0.0 for all AI K 1.087 (Safety Analysis Limit = 1.15g01) l K4 = 0.02/deg-F for increasing T 5=0.0/deg-FfordecreasingT

=

K6 = 0.0011/deg F for T>T

= 0/0/deg F for T 5 T' f

3 - 10 seconds 74 - 12 seconds 75= 3 seconds With a few exceptions, the current values of the nominal setpoints as defined by the Sequoyah Technical Specifications remain valid. The only

, nominal setpoints which require modification are the AT lead / lag compensation described in Table 2.2-1 of the Technical Specifications. -

As can be seen from the above equation, the lag compensator on measured delta T and the lag compensator on measured Tavg have been eliminated.

This setpoint change affects only the Overtemperature and Over>ower '

delta-T reactor trip functions and thus does not affect any otier protection functions. Using this form of the OTAT and OPAT equations allcws lead / log compensation on measured delta-T. The result of using this compensation is a faster reactor trip on Overtemperature and l Overpower delta T. Since all the events which take credit for this trip

! were reanalyzed to account for the RTD Bypass system elimination, this

[ report is a complete evaluation for the use of the increased lead / lag compensation.

l l

l l

i .

2-4 L

2.1.2 Impact of the RTD Bypass Elimination on the Non.LOCA Safety Analyses

. 2.1.2.1 Uncontrolled RCCA Eank Withdrawal at Power The Uncontrolled RCCA Bank Withdrawal at Power event is described in UFSAR I

. section 15.2.2. An uncontrolled RCCA bank withdrawal at power causes a l positive reactivity insertion which results in an increase in the core heat flux. Since the heat extraction from the steam generator legs behind the core power generation, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the increase in coolant temperature and sower could result in DNB. For this event, the Power Range High Neutron riux and Overtemperature AT reactor trips are assumed to provide protection against DNB. Therefore, 1 this event was reanalyzed with increased time constants to show that the DNBR limit is met.  ;

1 I

Method With the exception of the items noted here and in section 2.1.1, the assumptions used are consistent with the UFSAR. The continuous rod withdrawal is simulated by the modeling of various reactivity insertion rates in order to establish the minimum DNBR as a function of insertion rate. The maximum value of the reactivity insertion rate must be greater ,

than that which corresponds to the most conservative set of two banks moving together at their maximum speed (with overlap in the highest worth regions). The minimum value of the reactivity insertion rate is typically 1 pcm/sec or less. Each insertion rate is analyzed assuming both minimum and maximum reactivity feedback and levels of 10%, 60%, and 100% power, ,

l In addition to the previously mentioned reactor trip protection, the following protection system features are assumed to function:

- Opening of the pressurizer safety valves

- Opening of the steam generator safety valves at the lowest set pressure (i.e.,'with no accumulation)

Control systems are assumed to function if their operation yields more severe accident results. The following control systems are assumed to be

, operating:

l l

- Pressurizer power operated relief valves

- Pressurizer spray Results For both the minimum and maximum reactivity insertions, at the various power levels analyzed, the DNBR safety analysis limit is met. A calculated sequence of events for a fast and slow insertion rate from full o power is presented on Table 2.1.2.1. The transient response for a fast insertion case and a slow insertion case from full power is shown starting with Figure 2.1.2.1-1. The plots of minimum DNBR versus reactivity

- insertion rate at the analyzed power levels are shown starting with Figure 2.1.2.1-5.

2-5

2.1.2.2 Uncontrolled Baron Dilution The Boron Dilution event is analyzed to identify the amount of time available for operator or automatic mitigation of an inadvertent boron

• dilution prior to complete loss of shutdown margin. This event is described in section 15.2.4 of the Sequoyah UFSAR. Prior to complete loss of shutdown margin, RCS and core transient parameters are within the ,

bounds of those calculated for other licensing basis non LOCA transients.

Therefore, the boron dilution accident is not limiting with respect to other non LOCA acceptance criteria such as minimum DNBR, maximum RCS pressure, maximum steam generator secondary pressure and core decay heat removal. The scenario considered for this event is the inadvertent opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. This transient is required to be considered for Secuoyah for operational modes 1, 2, and 6.

The Mode 2 analysis is unaffectec by the RTD Bypass Elimination because an automatic reactor trip is not assumed. The Mode 6 transient is ,

administrative 1y precluded by the limitations of the Technical Specifications.

The Mode 1 event is analyzed in two separate cases which assume either l that the control rods are in manual mode of operation or automatic. If l the control rods are in automatic, the operator would be alerted to the I occurrence of a boron dilution by the rod insertion limit alarms. If the l rods are in manual, the first indication may be the Overtemperature AT )

reactor trip. The Mode 1- rods in manual analysis is impacted by the RTD ,

Bypass Elimination because the time of reactor trip on OTDT is taken from i the Uncontrolled RCCA Bank Withdrawal at Power (RWAP). The time of j reactor trip is taken from the RWAP case which has a reactivity insertion rate equal to or less than that calculated for the boron dilution event and then subtracted from the amount of time available between start of .

event and loss of shutdown margin. ,

Results .

The Mode 1 analysis demonstrated that there are more than 40 minutes remaining between the time of reactor trip and loss of shutdown margin.

Therefore, the criteria of greater than 15 minutes available for operator action between the initiation of the event and the loss of shutdown margin is met.

2.1.2.3 Loss of External Electrical Load / Turbine Trio l The Loss of Lond/ Turbine Trip event is analyzed to demonstrate that the i pressurizer and steam generator safety valves are adequately sized to ,

prevent overpressurization of the RCS and steam generators, respectively.

Also, the analysis ensures that the increase in RCS temperature does not result in DNB in the core. This event is described in section 15.2.7 of the Sequoyah UFSAR. The Reactor Protection System is designed to automatically terminate any such transient before the DNBR falls below the

• limiting value. A reactor trip for this event is assumed on either High l Pressurizer Pressure, Overtemperature AT, or Low-Low Steam Generator l

Water Level. Thus, the increase in RTD response time caused by .

elimination of the bypass system may have an effect on the results of this transient.

2-6

511ADA The accident is simulated by setting both steam flow and feedwater flow to .

zero at the start of the transient. In addition to the previously mentioned reactor trips, the following protection system features are assumed to function:

- Opening of the pressurizer safety valves i 1 - Opening of the steam generator safety valves at a pressure assumed to be 103% of the steam generator shell design pressure.

I The event is analyzed using two sets of reactivity parameters one corresponding to Beginning of Life (BOL) and one corresponding to End of Life (EOL). Each of these cases is analyzed assuming both with and without automatic pressure control to assure that the reactor is protected for either mode of operation. The pressure control which is assumed includes the pressurizer spray and the opening of the pressurizer power operated relief valves.

Results The BOL- with pressure control case is the only case during which the DNBR decreased. The DNBR did not fall below the safety analysis limit value.

As is seen on Table 2.1.2.3, the reactor tri) in all cases is from High Pressurizer Pressure except for the E0L- wit) pressure control case which trips on Low Low Steam Generator Water Level. The additional time delay i on the Overtemperature LT reactor trip associated with the RTD Bypass Elimination may have caused this change in reactor trips from the cases previously presented in the FSAR. The primary system pressure remains l

below 110% of the design value for all of the cases. The sequence of

. events for each case is presented on Table 2.1.2.3. The figures associated with this event are presented starting with Figure 2.1.2.3-1.

2.1.2.4 Accidental Deoressurization of the Reactor Coolant System An accidental depressurization of the reactor coolant system (RCS) could occur as the result of an inadvertent opening cf a pressurizer relief or safety valve. This event is described in section 15.2.12 of the UFSAR.

l Initially the event results in rapidly decreasing RCS pressure until the pressure reaches a value corresponding to the hot leg saturation l pressure. At that time, the pressure decrease is slowed considerably.

The reduction in pressure could result in DNB unless terminated by manual or automatic action. For this event, the Overtemperature AT function or the Low Pressurizer Pressure reactor trip is assumed to provide protection against DNB. Since the OTAT reactor trip may actuate, the RCS depressurization incident is analyzed with increased RTD time constants to show the DNBR limit is met.

4 2-7

l The accident is simulated by the opening of one pressurizer safety valve at the start of the event. The model assumes 120% capacity of the safety valve. .

1 Results The results demonstrate that DNBR decreased prior to rod motion after <

reactor trip on Overtemperature AT. The DNBR did not fall below the design limit value. The sequence of events is presented on Table 2.1.2.4.

The figures associated with this event are presented starting with  ;

Figure 2.1.2.4-1 ,

l 2.1.2.5 Steamline Break with Coincident Rod Withdrawal at Power In Septemoer of 1979, IE Information Notice 79 22 was issued by the NRC addressing a potential unreviewed safety question resulting from Control and Protection Systems interaction. One of the postulated scenarios ,

identified was the operation of the rod control system following an inside containment steamline rupture. The rod control system derives its signal from, among other inputs, the Nuclear Instrumentation System (specifically the Power Range Neutron Detectors) which is currently classified as Category 'C", as defined in NUREG 0588, Rev. 1, Appendix E. Equipment l whose failure is deemed not detrimental to plant safety or accident mitigation, in an adverse environment, is classified as Category "C" equipment. The Nuclear Instrumentation System is not qualified to withdrawal due to preclude an adversethe steamline rupture environment. from to In addition causing a rod (bank)d the potential ro withdrawal, the i Power Range High Neutron Flux Trip may not be available.

Method This analysis is simulated by modeling a steamline rupture and a

• coincident withdrawal of control bank D at full power conditions. A spectrum of steamline break sizes was analyzed to determine the limiting condition. The reactivity assumption associated with the rod withdrawal was 15.0 pcm/sec, based on the rod speed controller maximum speed and a maximum differential rod worth of control bank D at HFP. - This maximum worth is verified with each fuel reload.

The following reactor trip functions may actuate during this postulated steamline rupture with a consequential rod withdrawal transient depending on the break size:

a. A reactor trip is actuated if any two out of four AT channels exceed the Overpower AT setpoint.

b. A reactor trip is generated subsequent to Safety Injection System and Steamline Isolation actuation caused by Low Steamline Pressure. (New .

Steamline Break Protection was assumed for this analysis.)

2-8

B112111 The limiting case, in terms of DNBR, occurred for a break size of 1.0 ft2 and resulted in a reactor trip on Overpower AT. Break sizes larger

'- than 1.0 ft2 received a reactor trip on Low Steamline Pressure. The results demonstrate that DNBR decreased prior to rod motion and began to rise shortly thereafter. The DNBR did not fall below the safety analysis o limit value. The sequence of events for the 1.0 ft2 break size case is presented on Table 2.1.2.5. The figures associated with this event are presented starting with Figure 2.1.2.5-1.

2.1.2.6 Steamline Break Mass /Enerav Dutside containment A brief discussion of the effects of RTD Bypass Elimination on this event is included in the New Steamline Break Protection safety analysis section.

4 l

e 2-9

2.2 NEW STEAMLINE BREAK PROTECTION 2.2.1~ Functional Description The current configuration of the Sequoyah Nuclear Plant reactor protection system includes safety injection and steamline isolation actuation logic commonly known in Westinghouse plants as Old Steamline Break Protection. *'

With the introduction of the Eagle 21 digital electronics, the protection system will be upgraded to the most recent standard Westinghouse safety injection and steamline isolation actuation logic commonly known as New Steamline Break Protection. The differences between the logic are illustrated in Figure 2.2.1 1.

The New Steamline Break protection actuation of safety injection will result from any of the following:

1. Low Steamline Pressure

2. Low Pressurizer Pressure

3. High Containment Pressure i

Steamline Isolation is provided by:

1. Hi Hi Containment Pressure )

2. High Steamline Pressure Rate '

3. Low Steamline Pressure I

The design basis non-LOCA safety analyses such as the Accidental l

Depressurization of the Main Steam System, Rupture of a Steam Pipe, Steamline Break Mass / Energy Release Inside Containment, Inadvertent Operation of the Safety Injection System and Steamline Break Mass / Energy Release Outside Containment specifically model steamline break protection ,

functions although they may or may not actuate.

The only event which was completely reanalyzed to incorporata the New .

Steamline Break protection logic was the Major Rupture of a Main Feedwater-Pipe.. In feedline break analyses for plants with old steamline break protection, steamline isolation and safety injection does not occur because the setpoints are not reached. With New Steam 11ne Break protection, the Low Steamline Pressure setpoint will be reached since the coincidence with High Steamline Flow has been eliminated. The potential impact of safety injection and steamline isolation on the feedline break i

event warranted reanalysis.

A partial reanalysis of the Steamline Break Mass / Energy Release Outside Containment was completed to demonstrate that acceptable results would be obtained with the New Stormline Break Protection system.

The remaining events mentioned above are not impacted by the change from old steamline break protection to new steamline break protection. In these events, either Low Steamline Pressure (with coincident High Steam -

Flow), Low Pressurizer Pressure or the High and High High Containment Pressure signals actuated steamline isolation and safety injection. Of these signals, only the Low Steamline Pressure with coincident High Steam '

Flow is impacted by the logic change. The coincidence will be removed but 2-10

the Low Steam 11ne Pressure setpoint will remain unchanged. Although the .

! coincidence logic will be removed, an evaluation has shown that the events  !

would either benefit from an earlier actuation due to eliminating the coincidence or would r,0t be impacted because Low Steamline Pressure was l l the second signal received.

l .

L 2.2.2 Impact of New Steamline Break Protection Logic on the Non LOCA Safety Analyses 2.2.2.1 Maior Ruoture of a Main Feedwater Pine The feedline rupture event is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedline between the check valve and the steam generator, fluid from i the steam generator will be discharged through the break. Furthermore, a i break in this location could preclude the subsequent addition of auxiliary .

feedwater to the affected steam generator depending upon the auxiliary feedwater piping location. Depending on the break size and operating conditions at the time of the rupture, the break could cause either a reactor coolant system cooldown or heatup. This event is analyzed as a heatup transient since the effects of a cooldown on the RCS are considered in the steamline break transients. The criteria for this ANS Condition IV -

event is that the core remains in place and geometrically intact with no loss of core cooling capability because the core remains covered with water. Pressurizer overfill and water relief is acceptable for this event.

A feedline rupture reduces the ability of the secondary system to remove heat generated by the primary. Therefore, the most limiting single failure to exacerbate the heatup is a loss of one auxiliary feedwater train.

l Method l

The feedline break is modeled after the transient runs at steady state conditions for 10 seconds. The initial power level assumed for this analysis was 102% of the Engineered Safeguards Features power (104.5%).

Following the rupture, all main feedwater is assumed to spill out the break and main feedwater is stopped to all steam generators. The Low Low Steam Generator Water Level is credited to actuate a reactor trip. One motor driven auxiliary feedwater pump is assumed to deliver 410 gpm to two steam generators after a delay of 60 seconds following reactor trip. The l

flow from the other motor driven pump is assumed to be lost out the break.

The Feed 11ne Break event was analyzed both with and without offsite power available.

2-11 l -- . . - - - . _. ._ __ __ _ - _ _ _ _ _ _ _ _ _ _

h Results Acceptable results were found for both cases. The auxiliary feedwater system was sufficient to remove decay heat and turnaround the primary -

heatup. The sequence of events is presented on Table 2.2.2.1. The figures associated with this event are presented starting with Figure 2.2.2.1 1. ,

2.2.2.2 Steamline Break Mass /Enerav Release Outside Containment The Steamline Break Mass / Energy Releases Outside Containment were initially determined in res >onse to NRC equipment qualification concerns.

The method and results of tie original analyses were presented in reference 1. Sequoyah at the time of the original analysis was placed in analysis Category 2 in part because of the old steamline break protection logic. In ref.1, a number of cases were analyzed which covered a range of break sizes at full power and 70% power. The old steamline break protection signals of Low Steamline Pressure with coincident High Steam Flow and High Differential Pressure were used to actuate reactor tri), .'

steamline isolation, and safety injection in a number of cases. Wit) the switch to new steamline break protection logic, it was necessary to .

evaluate the impact of the elimination of tie coincidence logic and the High Differential Pressure signal. Limiting cases were reanalyzed which represent the group of affected cases to determine if the previously >

calculated mass / energy releases were impacted.

An additional case of the Steamline Break Mass / Energy Releases outside Containment documented in reference I was reanalyzed to support the RTD Bypass Elimination. The limiting case of those which received a reactor trip on Overpower AT was reanalyzed to demonstrate that the increase _

in RTD response time did not significantly impact the calculated mass / energy releases.

Results The result of this limited reanalysis was that the Sequoyah Eagle 21 upgrades had an insignificant impact on the previously calculated mass / energy releases. It has also been determined that the changes to the mass / energy releases due to the Eagle 21 upgrades had no effect on the equipment qualification study detailed in reference 2.

6 2-12

I 2.3 Environmental Allowance Modifier / Trip Time Delay The Steam Generator Low Low Level 1 rip Environmental Allowance Modifier ,

(EAM) and Trip Time Delay (TTD) conceptual designs resulted from the  ;

Westinghouse Owners Group Trip Reduction and Assessment Program (WOG-TRAP) efforts to develop a means to reduce the frequency of unnecessary  ;

, feedwater related reactor trips. The development of these concepts is I documented in WCAP-ll342-P A (reference 2) and WCAP-11325 P-A (reference 3), respectively. In January 1981, the NRC issued Safety Evaluation Reports (SERs) approving TTD/EAM conceptual designs of WCAP-11325 P-A and WCAP-ll342-P-A for Westinghouse PWRs. As documented in the SERs, NRC approval is based on the review of a conceptual design for each system, representative functional requirements, description of the safety analysis i methodology and generic safety analysis results. The SERs also list the i licensing submittals that will be required by the NRC for review of l plant-specific designs, j The Sequoyah Plant design is a Westinghouse digital implementation of the TTD/EAM logic located in each S/G Low Low Level protection set of the Eagle 21 Digital Protection system. This section is to provide safety analysis support, consistent with the requirements specified in the SERs, i for the implementation of the TTD/EAM concepts in the Sequoyah Units, i This section provides: )

1. Basic functional description of the Sequoyah Plant TTD/EAM  ;

design.

2. Results of calculations performed, consistent with the WCAP-11325 P A approved methodology, to develop the Safety Analysis Limits (SALs) for the S/G Low Low Level, power dependent trip time delays.

l 3. Evaluation of the impacts of the SALs specified above on the <

l non-LOCA safety analysis design bases.

l 2.3.1 TTD/EAM Functional Description The conceptual design of WCAP 11342 P A (EAM) may be described as an automatic switch that raises the Steam Generator Low Low Level trip setpoint (to increase the environmental error allowance in the setpoint) whenever a harsh environment is indicated by detection of an elevated containment pressure. The EAM can reduce the frequency of unnecessary feedwater-related trips by increasing the difference between the nominal steam generator water level and the low low level trip setpoint during normal operation. The S/G Low Low Level trip setpoint is automatically raised to include the full enviromental error allowance for protection during accidents which produce a harsh containment environment.

l

. Once the low-low level trip setpoint (either the normal environment setpoint or the harsh environment setpoint) is reached, the TTD acts to delay reactor trip, and auxiliary feedwater system actuation to allow time for operator corrective action or for natural stabilization of 2 13

i shrink / swell water level transients. The TTD is designed for low startup operations. The conceptual design of WCAP-11325-P-Amay (TTD) be power or generally described as a system of pre detemined programed trip delay .

times that are based upon (1) the prevailing power level at the time a

• low low level trip setpoint is reached, and by (2) the number of steam generators that are affected.

The Sequoyah TTD design is based on the introduction of a continuous time delay curve as a function of power (between 0 and 50% rated thermal power), and the addition of a 2/4 steam generator trip logic to the ,

existing 1/4 loop logic. The prevailing power level at the time the '

low low level trip setpoint is reached will be detemined from a delta-T signal dedicated to the TTD logic. The protection system will enable the transmission of the low low level trip signal at the expiration of the  !

enabled TTD delay if steam generator water level has not been recovered.

Consistent with the WCAP-11325 P A methodology, appropriate Safety Analysis Limits will therefore be determined for:

1/4 Steam Generator Logic

Indicated Power 150% of Rated Thermal Power (RTP)

Multiple Steam Generator Logic (at least 2/4 S/Gs)

Indicated Power 1 50% of RTP No time delays are considered for this report for indicated power levels greater than 50% of RTP.

When the low-low level trip setpoint as determined by the EAM logic, is reached, an elapsed time trip delay timer is actuated. As indicated above, the magnitude of the trip delay is pre-set according to the power level with which it is interlocked and with the low low logic path in ,

which it is placed (e.g., low low level in a single steam generetor or low low level in more than one steam generator).

If a low-low level condition is detected in one steam generator, then only ,

the time delay that is associated with the single low-low level logic path and interlocked to the appropriate power level can satisfy the logic for transmission of the trip signal at the expiration of its trip delay. If,

, at any time during this trip delay, a low-low level condition is detected in a second steam generator, then the time delay that is associated with the multiple low low level logic path and interlocked to the appropriate power level can also satisfy the logic for transmission of the trip signal 4

at the expiration of its trip delay. Since, at any given power level, the trip delay setpoint for two or more steam generators will be shorter than the trip delay setpoint for one low steam generator, reactor trip will occur at the end of the shorter effective trip delay, thus providing timely protective action for the more severe transient. Should the level be restored in all but one steam generator before the multiple affected steam generator time delay is expired, the remaining time from the single affected steam generator time delay will still be applied before reactor -

trip. Since the elapsed time trip delay timer is actuated by a single low low level trip signal, it is possible for a second steam generator to reach its low low level trip setpoint after the appropriate multiple '

low low level trip delay has ex) ired, in that case, the reactor trip i signal would be transmitted witicut further delay. l 2 14 l

l l

, _ , , -. - .-- . - . - - . _ - - . . - - _ , _ __.._______-_--_--________--_N

If the power level decreases during a trip delay interval, this logic does not permit the lengthening of effective trip delays, which could result from switching to time delays associated with lower power ranges. If

. power level increases, the effective trip delays are shortened as higher power levels become effective. If the water levels in all steam generators are not restored before the expiration of the shortest enabled

• trip delay, then the EAM/TTD logic transmits the low low level trip signal into the SSPS channel logic.

1 2.3.2 Trip Time Delay Safety Analysis Limit (SAL) Detemination Implementation of the TTD/EAM in the Sequoyah Units 1 and 2 will require modification of the existing S/G Low Low Level protection system setpoints and the introduction of time delays. Consistent with the approved analysis methodology of WCAP 11325 p A, analyses have been performed to determine revised SALs for input to the S/G Low Low Level Technical Specification limits. Sequoyah specific loss of Normal Feedwater analyses have been performed to provide the saf4ty analysis limits for 1/4 and 2/4 logic time delay curves. The following cases were analyzed to detemine S/G Low Low Level trip setpoint and time delay SALs:

- Loss of Normal Feedwater to Four Steam Generators at 0%,10%,

20%, 30%, 40% and 50% RTP, S/G Low Low Level Trip Setpoint - 0%

of span.

- Loss of Normal Feedwater to One Steam Generator at 0%,10% 20%,

30%, 40% and 50% RTP, S/G Low-Low Level Trip Setpoint = 0% of span. 7, Methods The time delays were determined by permitting the results of the analysis to approach the acceptance criteria without permitting the part power loss ,

of normal feedwater an'alyses to be more limiting than the full power analysis discussed in sectiot. 2.3.3.1. Since the Loss of Normal Feedwater event is an ANS Condition !! transient, the criteria is that the Reactor Coolant System and Main Steam System pressure remain below 110% of system design pressure and the minimum DNBR remains above the safety analysis limit. In order to meet these requirements, the analysis should demonstrate that the auxiliary feedwater heat removal capacity is sufficient to offset the core decay heat and that the pressurizar does not fill.

The key analysis assumptions used for these cases are as follows:

1. Initial Conditions Consistent with the WCAP-11325 P A analysis methodology, appropriate

- power level dependent initial conditions were assumed.

O 2-15

2. Decay Heat Consistent with the WCAP-11325 P A analysis methodology, all cases

. The analyses -

used assumption the ANS 1979aDecay considers Heat model power rampdown rate(reference from 5) full power of 5% per minute prior to the initiation of the loss of normal feedwater transients. This assumption is consistent with the maximum power '

coastdown rate documented in the Sequoyah FSAR Section 15.1.

3. Uncertainties Of particular importance to the part power loss of normal feedwater cases is the uncertainty in power level indication since this function is integral to the TTD design. Each part power case was analyzed assuming a maximum uncertainty in power level indication of 9% RTP.

For example, the analysis to determine the time delay at 10% RTP had  ;

an initial power assumption of 19% RTP.

4. S/G Low Low Level Trip Setpoint  !

Th9 S/G Low Low Level trip setpoint assumed in these analyses is 0% of span.

5. S/G Low-Low Level Trip Time Delays I

The total S/G Low Low Level trip time delays assumed in the analysis of each part power LONF event include the SAL for the power level dependent time delays and an additional 2 second allowance for the '

time between receipt of the signal and when the control rods are free to drop. ,

i

6. 1/4 Loop Loss of Normal Feedwater  !

The 1/4 loop loss of Normal Feedwater cases assume a loss of normal feedwater to one steam generator. The loss of normal feedwater to one ,

steam generator is not explicitly analyzed for the current Sequoyah j FSAR since it is not necessary for any setpoint determination and its consequences, given the current plant automatic protection system, are l bounded by those shown in the FSAR for loss of normal feedwater to all four steam generators. WCAP-ll325 P A introduced the analysis of loss of feedwater to one steam generator to support the concept of using ,

2/4 loop protection logic and 1/4 loop protection logic to respond to l low level conditions in one or more steam generators. <

7. Auxiliary Feedwater Flow Rate l 1

For the analysis of all the part power loss of normal feedwater  !

events, failure of the Turbine Driven Auxiliary Feedwater pump is l postulated as the most limiting single failure. In :ddition, it is j conservatively assumed that one of the motor driven auxiliary .i feedwater pumps is inoperable. As a result, auxiliary feedwater is l assumed to be equally delivered to two of the four steam generators by l 1

,I 1

I 2-16 4

the one remaining motor driven auxiliary feedwater pump at a rate of  :

410 rps. This assumption is more limiting than the current Tech.

Spec. limit on AFW flow rate of 440 gpa from the motor driven pumps.

. The auxiliary feedwater pump is assumed to start 60 seconds after the reactor trip signal is generated. ,

' P Results l

A maximum, acceptable time delay on reactor trip and auxiliary feedwater  ;

actuation was calculated for each of the twelve cases discussed above. In each case, the auxiliary feedwater heat removal capability is sufficient i to remove the decay heat and the pressurizer does not fill. These transient characteristics ensure that all applicable Condition !! safety analysis acceptance criteria are met.

l Since the Trip Time Delay will be implemented as a continuous function of i power, the data was fit to a third order polynomial equation. A seperate curve was determined for both the low-low level signal in multiple steam '

generators and the low low level signal in one steam generator. These  ;

curves are showr, on Figures 2.3.2-1 and 2.3.2 2.

A representative sequence of events from the 20% RTP Loss of Normal Feedwater to Four Steam Generators case and the 20% RTP Loss of Normal -

Feedwater to One Steam Generator case is presented in Table 2.3.2-1 and l 2.3.2 2, respectively. The transient response for these cases is shown in Figures 2.3.2 3 through 2.3.2 10.

2.3.3 Impact on Non LOCA Licensing Basis Safety Analyses The analyses described in Section 2.3.2 established Safety Analysis Limits l

for the S/G Low Low Level signal delay times and trip setpoint. The purpose of this section is to document the evaluation of these Safety Analysis Limits on the design basis safety analyses. A number of other '

events credit the low Low Steam Generator Water Level reactor trip. These events must be analyzed with consistent assumptions on the Low-Low Stean Generator Water Level reactor trip setpoint and in a manner which permits ,

easy comparison of the results. As was previously stated, it was the i intention of this project to keep, if possible, the current licensing basis events presented in the FSAR as the limiting transients. The

• transients which credit the Low Low Steam Generator Water Level reactor trip include:

1) Full Power Loss of Normal Feedwater (FSAR Section 15.2.8)

2) LossofOffsitePowertotheStationAuxiliaries(Station Blackout) (FSARSection15.2.9) i

3) MajorRuptureofaMainFeedwaterPipe(FSARSection15.4.2.2)

4) Steamline Break Mass / Energy Releases Outside Containment (WCAP10961-P)

The following sections will discuss the potential impact on each of the above licensing basis events.

2-17

7.....,..

t 2.3.3.1 Full Power Loss of Normal Feedwater (FSAR Section 15.2.8)

Loss of Normal Feedwater is analyzed for the sequoyah Plant in FSAR Section 15.2.8. This Condition !! accident postulates a loss of normal feedwater to all steam generators. The FSAR loss of nomal feedwater -

analysis is performed to demonstrate the adequacy of the reactor protection system and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing long-tem decay heat and preventing excessive heatup of the RCS with possible resultant overpressurization or loss of RCS water inventory. The FSAR safety analysis assumptions are conservatively chosen to maximize the resulting primary side heat-up transient and, therefore, the dependency on the auxiliary feedwater system to adequately remove decay heat. The FSAR transient assumes full power i initial conditions and accident protection due to receipt of the S/G Low Low level trip signal.

The analysis currently in the Sequoyah FSAR was analyzed using the BLK0UT (reference 4) computer code. The current methodology for analyzing the Loss of Nomal Feedwater event calls for use of the LOFTRAN (reference 6) computer code and thus the part power Loss of Ncrmal Feedwater cases were analyzed in this manner. The full power Loss of Normal Feedwater case was reanalyzed to be consistent with the TTD methodology and thus pemit easy 2 comparison of the results. 4 Method e The following assumptions were used in the reanalysis of the Loss of Nomal Feedwater event:

1. Initial Conditions This event was perfomed with an initial condition power level  ;

assumption of 102% RTP.

7. Decay Heat .

The ANS 1979 Decay Heat model (reference 5) assuming long term full power operation has been incorporated into these analyses.

3. Uncertainties l Initial condition and protection system uncertainties and allowances are the same as described in FSAR Section 15.1 except as described below.

4. S/G Low-Low Level Trip Setpoint To support the minimum setpoint study determination of a S/G Low-Low Level trip setpoint for r.omal containment environmental conditions, the safety analysis assumption is 0% of span. .

4 2-18 L

5. S/G Low-Low Level Trip Time Delays Full power safety analyses do not incorporate a S/G Low Low Level trip time delay other than the 2 second delay to account for the time from receipt of the signal to the time when control rods are free to drop.

6. Auxiliary Feedwater Flow Rate For the full power Loss of Nomal Feedwater event, failure of the Turbine Driven Auxiliary Feedwater pump is postulated as the most limiting single failure. In addition, it is conservatively assumed that one of the motor driven auxiliary feedwater pumps is inoperable.

As a result, auxiliary feedwater is assumed to equally delivered to two of the four steam generators by the one remaining motor driven auxiliary feedwater sump at a rete of 410 gpm. This assumption is more limiting than tie current Tech. Spec. limit on AFW flow rate of 440 gpm from the motor driven pumps. The auxiliary feedwater pump is assumed to start 60 seconds after the reactor trip signal is generated.

Results The transient results indicate that the auxiliary feedwater heat removal capacity is sufficient to offset the core decay heat and that the pressurizer does not fill. These transient characteristics ensure that <

the applicable Condition 11 acceptance criteria are met.

The sequence of events for the Loss of Normal Feedwater is presented in Table 2.3.3.1. The associated figures are presented startinD with Figure

. 2.3.3.1-1.

2.3.3.2 LossofOffsitePowertotheStationAuxiliaries(Station Blackout) (FSAR 15.2.9)

Loss of Offsite Power to the Station Auxiliaries is analyzed for the Sequoyah Plant FSAR in section 15.2.9. The Condition 11 accident postulates the loss of all power to the station auxiliaries due to a complete loss of the offsite grid acccmpanied by a turbine generator trip or due to loss of the onsite AC distribution system. Two consequences of this event are loss of forced reactor coolant flow and loss of normal feedwater due to the loss of power to the reactor coolant pumps and the condensate pumss, respectively. The Station Blackout event currently described in tie FSAR demonstrated that sufficient natural circulation flow would be estabitshed following a loss of offsite power. This analysis was also analyzed using the BLKOUT computer code (ref. 4). The updated, LOFTRAN (ref 6) ve'sion of the Loss of Offsite Power analysis is performed to demonstrate the adequacy of the reactor protection system, the engineered safeguards systems (e.g., the auxiliary feedwater system) and natural circulation to remove long term decay heat and prevent excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water inventory. Therefore, in order to create a consistent licensing basis, the loss of Offsite Power to the Station Auxiliaries was reanalyzed.

2 19

1 The safety analysis assumptions for the loss of offsite power are conservatively chosen to maximite the resulting primary side heatup ,

transient and, therefore, the dependency on the auxiliary feedwater system l to adequately remove decay heat. For this reason, no credit is taken for  ;

the immediate control rod insertion which would occur upon loss of power

~

to the control rod drive mechanisms or the initiation of auxiliary 1 feedwater pumps within one minute of the receipt of a loss of power signal. Instead, actuation of these safety features is assumed to occur due to the eventual receipt of the S/G Low tow Level trip signal as a result of the loss of normal feedwater to the steam generators.

The TTD/EAM logic is designed to avoid unnecessary feedwater related reactor trips on S/G Low :.ow Level. Since, in the event of an actual loss of offsite power, plant protection design provides for a reactor trip in advance of reaching the S/G Low Low Level setpoint, the TTD/EAM would not i delay reactor trip upon loss of offsite power to the station auxiliaries.

However, since the FSAR conservatively assumes reactor trip to occur on I S/G Low Low Level, it is appropriate to evaluate the effects of the introduction of the TTD/EAM logic on the transient under the same analysis assumptions. ,

The limiting loss of offsite power case is that occurring from full power. ,

As was the case for the full power Loss of Normal Feedwater, the full power Loss of Offsite Power to the Station Auxiliaries was reanalyzed to form a consistent licensing basis.

Method The analysis assumptions from the full power Loss of Normal Feedwater described in section 2.3.3.1 are applicable to the Loss of Offsite Power to the Station Auxiliaries. Since this analysis is performed at power 1evels not applicable to the TTD, the transient results are unaffected by l

the TTD. ,,

Results The results of the loss of Offsite Power to the SMtion Auxiliaries (Station Blackout) indicate that the natural circulation and auxiliary feedwater heat removal capacity are sufficient to offset the core decay heat and that the pressurizer does not fill. In addition, it was demonstrated that the results of the original analysis, which formed the acceptance criteria for the natural circulation startup test, were more limiting than those which would currently have been calculated.

The sequence of events for this analysis are presented in Table 2.3.3.2.

The associated figures are presented starting with Figure 2.3.3.2 1.

[

ja,c .

2-20 l

l

"* -.-,,...w.,

V

^

ja,c 2.3.3.3 Major Rupture of a Main Feedwater Pipe A reactor coolant system heatup caused by a main feedwater line rupture is a Condition IV transient analyzed for the Sequoyah plant in FSAR Chapter 15.4.2.2. This transient was reanalyzed and is discussed in section 2.2.2.1 in relation to the change from old steamline break protection to new steamline break protection. Results of the Feedline break transient, with and without offsite power, are presented in the FSAR to assure that the overheating, and consequently the radiation release limits of 10CFR100 are not exceeded. The FSAR transients are performed assuming full power initial conditions. For the present protection system, this assumption l maximizes the heatup. Acceptable transient results, as presented in section 2.2.2.1, demonstrate that:

1. Peak transient RCS and Steam Generator pressures are less than 110% of design pressures,

11. Sufficient liquid in the RCS is maintained so that the core remains in place and geometrically intact with no loss of core cooling capability. This criterion is met by ensuring that bulk boiling does not occur before the transient is turned around by auxiliary feedwater addition.

The feedline break transient presented in the Sequoyah FSAR assumes reactor trip and actuation of auxiliary feedwater to occur due to receipt of a S/G Low Low Level trip signal. Each of these safety features actuations is essential for the successful mitigation of the accident consequences as conservatively predicted by the safety analyses. Rod insertion due to automatic reactor trip terminates the nuclear power contribution to the primary heatup. The delivery of auxiliary feedwater is essential for the removal of core decay heat and, therefore, the prevention of fuel damage and core uncovery.

The Feedline Break analysis discussed in section 2.2.2.1 assumed a S/G ,

Low Low Level trip setpoint of 0% of span. Unlike the loss of offsite i power and loss of normal feedwater events, the feedline break transient is postulated to result in harsh containment environment conditions. The current Technical Specification S/G Low Low Level trip setpoint is based on the feedline break SAL and includes the full environmental allowance.

With introduction of the EAM, the harsh environment trip setpoint will continue to be determined on this basis. The trip time delay assumed in the section 2.2.2.1 analysis was 2 seconds. Because that analysis was completed at 104.5% of full power conditions, no additional delays are imposed due to the TTD. Therefore ",he analysis discussed in section 2.2.2.1 is consistent and adequate to cover EAM/TTD implementation at Sequoyah.

2-21 , l

i l

It must also be verified however, that imposition of trip delays at

. part-power do not invalidate the FSAR conclusions regarding the consequences of the feedline break transient. A part power feedline break analysis was completed to verify that the SALs for the S/G Low Low Level i time delay curve do not invalidate the conclusions of the full power analysis discussed in section 2.2.2.1. ,

j Method. )

Consistent with the WCAP-11325-P A analysis methodology, a spectrum of feedwater line rupture cases over a range of power levels and break sizes were analyzed. Specifically, feedwater line rupture areas up to and including the rupture area ocuivalent to a full double ended rupture and power levels up to and inclucing the highest power level at which a time delay will be applied were considered. Otherwise, the analyses were '

generally performed using FSAR methods and assumptions. I 1

The following assumptions were used in the part-power feedline break j transient:  ;

3. Initial Conditions Power level dependent initial conditions of 10%, 30%, 40%, and 50% RTP are assumed.

2. Decay Heat Consistent with the WCAP-11325 P-A analysis methodology, this analysis

. The analysis used the ANS assumption considers 1979aDecay Heat Model power rampdown rate(reference from 5) full power of 5% per

• minute prior to the initiation of the feedline break transient. This assumption is consistent with the maximum power coastdown rate documented in Sequoyah FSAR Section 15.1. ,

3. Uncertainties As with the part-power loss of Normal Feedwater cases, the initial power level assumed a maximuni uncertainty in power level indication of 9% RTP.

4. S/G Low Low Level Trip Setpoint The S/G Low-Low Level trip setpoint assumed is 0% of span. This assumption is consistent with the Feedline Break analysis documented in Section 2.2.2.1.

5. S/G Low Low Level Trip Time Delay

' The total S/G Low-Low Level trip time delay assumed includes the SAL for the power level dependent time delays and an additional 2 second -

l allowance for the time between receipt of the signal and when the control rods are free to drop. ,

{

2 22 l

l

, - - . . - . . . - - . . ~ , - . _ . . , , , . , - - , . , . - , . . , . . . , ~ < , , - . - . _ . , -, ,

6. Auxiliary Feedwater Flow Rate The auxiliary feedwater system is assumed to supply a total of 410 gpm

- to two unaffected steam generators as follows:

a) The turbine driven pump is assumed to fail.  ;

b) The motor driven pump supplying the faulted steam generator is assumed to conservatively spill all its flow out the break. The intact steam generator aligned to that pump is therefore assumed to receive no flow, c) The remaining motor-driven pump supplies flow to two intact steam 4 generators after a start delay of 60 seconds following reactor  !

trip.

The part power feedwater line break analysis was completed assuming both with ar.6 without available offsite power even though the without offsite power case is not considered to be credible because a reactor trip would occur upon loss of offsite power.

Results In all the feedwater line rupture cases analyzed, the reactor protection _

system initiated the required protection functions in time to ensure the i Condition IV acceptance criteria are met.

Figure 2.3.3.3-1 and Figure 2.3.3.3-2 show the calculated plant parameters following the feedline rupture transient for the worst case combination of break area and power level analyzed. This case is the 30% power double-ended rupture with offsite power. Figure 2.3.3.3 3 and Figure 2.3.3.3 4 shows the same case with the loss of offsite power. The calculated sequences of events for both cases analyzed are presented in Table 2.3.3.3.

The major difference between the two 30% power cases can be seen in the plots of hot and cold leg temperatures. It is apparent from the initial portion of the transient (-300 seconds), that the case without offsite power results in higher temperatures in the hot leg. For longer times, however, the case with offsite power results in a more severe rise in temperature due to pump heat addition. Hence, water is relieved for the case with power. However, the core remains covered with water for both cases. The results also show that pressures in the RCS and main steam system remain below 110% of the respective design pressures.

All part-power feedline rupture transients are similar to the 30% power cases, except that as the initial power level increases and the break size decreases, the effective range for the Low Steamline Pressure safety

. injection reactor protection function decreases. <

2-23

l 2.3.3.4 Steamline Break Mass / Energy Releases outside Containment )

The Westinghouse Steamline Break Mass and Energy Releases outside Containment, both those documented in WCAP 10961-P (reference 1 and the -

cases confirmed for the Eagle 21 upgrades (see Section 2.2.2.2)), were calculated assuming the availability of the S/G Low Low Level signal. The power levels examined for this event include 7M and 10M of RTP, -

Analyses of lower power levels were not performed because for the same l protection system assumptions, lower initial power levels yield less  !

limiting mass / energy releases. Given that the implementation of the TTD in the Sequoyah Units introduces no time delays at indicated power levels greater than 5M RTP and that the analyses were calculated assuming a SAL  ;

$/G Low Low Level trip setpoint of M of span, the conclusions remain valid for the SALs determined in Section 2.3.3.2.

[ A sensitivity study has demonstrated that mass / energy releases calculated  !

at low power with the appropriate TTD on S/G Low-Low Level reactor trip and auxiliary feedwater addition and decay heat assumptions consistent with those used in the part power loss of normal feedwater cases resulted I J

inmasg'gndenergyreleaseswithintherangeofthehighpower Therefore, it is concluded that introduction of the TTD will cases .

not invalidate the conclusions presented in reference 1 or in Section 2.2.2.2 of this report.

.) 1 I

l c l l l l

1 l

2-24 l

2.4 Elimination of the Low Feedwater Flow Reactor Trie Elimination of the Low Feedwater Flow Reactor trip does not require any reanalysis of the non LOCA safety analyses because this trip was never assumed to be the primary functioning reactor protection. However, in a

. plant which only has three steam generator level transmitters per channel for steam generator low low level protection, these transmitters also provide signals used for feedwater control. As a result, the Low Feedwater low Reactor trip was implicitly credited as a diverse trip to the steam generator low-low level reactor trip to address control and protection interaction concerns.

The elimination of the Low Feedwater Flow Reactor trip in Sequoyah will be accompanied by the introduction of a Median Signal Selector (MSS). The addition of an MSS addresses any control and protection interaction concerns and insures that the removal of the subject trip does not. impact (implicitly or explicitly) the non LOCA transients.

2.5 CONCLUSION

S The preceding discussion demonstrated that the functional upgrades associated with the introduction of the Eagle 21 digital protsetion system are acceptable with respect to the non LOCA safety analyses. The analysis results met all applicable safety criteria.

9 9

f L. *

! 2-25

l TABLE 2.1.2.1 J

SEQUENCE OF EVENTS UNCONTROLLED RCCA WITHDRAWAL AT POWER ,

$AAt Event Time (sees)

Full Power, Initiation of uncontrolled RCCA 0.0 Minimum reactivity withdrawal at maximum reactivity feedback insertion rate, 75 pen /sec Power range high neutron flux 1.50 t reactor trip setpoint reached Time of rod motion 2.00 Minimum DNBR occurs 2.90 Full Power, Initiation of uncontrolled RCCA 0.0 Minimum reactivity withdrawal at a small reactivity feedback insertion rate, 3 pcWsec Overtemperature AT 34.33 reactor trip setpoint reached

• Tire of rod motion 35.83 Minimum DNBR occurs 36.20 e

e 4

4 2-26

e TABLE 2.1.2.2 ,

SEQUENCE OF EVENT'S 1

UNCONTROLLED BORON DILUTION ,

gang Event Time Isecs) l Dilution during Full Dilution begins 0.0 Power Operation Manual Reactor Control Reactor trip setpoint reached < 120 Shutdown margin is lost (if > 2400 l

' dilution continues after I reactortrip) l b

i e

4 6

6 2-27 '

. TABLE 2.1.2.3 SEQUENCE OF EVENTS

. yr EXTERNAL ELECTRICAL LOAD and/or TURBINE TRIP (113 Event Time (secs) i BOL, with pressurizer loss of Electrical Load 0.0 control '

Initiation of steam release 8.0 from steam generator safety valves High Pressurizer Pressure reactor 8.9 trip setpoint reached Rods begin to drop 10.9 Minimum DNBR occurs 11.5 ,

Peak pressurizer pressure occurs 12.0 BOL, without loss of Electrical Load 0.0 pressurizer control High Pressurizer Pressure reactor 6.3 trip setpoint reached initiation of steam release 8.0

. from steam generator safety valves Rods begin to drop 8.3 Minimum DNBR occurs (1)

Peak pressurizer pressure occurs 9.0 (1) DNBR does not decrease below its initial value.

e 2-28 l

[ . - _ - . . - -

. . s.

i I

1 TABLE 2.1.2.3 *

(CONT.)

SEQUENCE OF EVENTS

• LOSS OF EXTERNAL ELECTRICAL LOAD and/or TURBINE TRIP L11g Event Time (secs)

EOL, with pressurizer Loss of Electrical Load . 0.0 -

control Initiation of steam release 8.0 from steam generator safety valves Peak pressurizer pressure occurs 9.5 Low-Low Steam Generator Level 26.2 reactor trip setpoint reached Rods begin to drop 28.2

' Minimum DNBR occurs (1)

EOL, without Loss of Electrical Load 0.0 pressurizer control High Pressurizer Pressure reactor 6.2 trip setpoint reached

• Initiation of steam release 8.0 from steam generator safety valves -

Rods begin to drop 8.2 ,

Minimum DNBR occurs (1)

Peak pressurizer pressure occurs 8.5 (1) DNBR does not decrease below its initial value.

1 l

=

2-29 1

. TABLE 2.1.2.4 SEQUENCE OF EVENTS

- ACCIDENTAL DEPRESSURIZATION 0F THE REACTOR COOLANT SYSTEM Event Time (secs)

Inadvertent Opening of one RCS Safety Valve 0.0 Reactor trip on Overtemperature AT 33.8 Rod motion begins 35.3 Minimum DNBR occurs 35.8

'f 1

a

. f 5

i 9

2-30

i TABLE 2.1.2.5-SEQUENCE OF EVENTS-STEAMLINE BREAK WITH COINCIDENT R00 WITHDRAWAL AT POWER *

(Break size- 1.0 ft2) .

EVENT TIME (SECS)

' Steamline ruptures /RCCA withdrawal occurs 0.0 Overpower AT reactor trip setpoint reached 10.04 t

Rods motion begins 11.54-Minimum DNBR occurs 12.20 i

-S

} .

= l 2-31

- _ - . - . . ~. .

TABLE 2.2.2.1 SEQUENCE OF EVENTS

. MAJOR RUPTURE OF A MAIN FEEDWATER PIPE L&SL, EVENT.. TIME fSECS)

With Offsite Power Main Feedline rupture occurs 10.0 Available Low-Low steam generator level reactor 15.0 trip i

Rods begin to drop 17.0' Auxiliary feedwater started 75.0 SIS Low Pressurizer Pressure 140.0 Low Steamline pressure setpoint reached 192.5 Peak relief rates from pressurizer 767.0 safeties (1.267lb/ft3)

Core decay heat plus pump heat < 8000

decreases to auxiliary feedwater heat removal capacity Without Offsite Main Feedline rupture occurs 10.0

. Power Available low Low steam generator-level reactor 15.0 trip Rods begin to drop 17.0 Auxiliary feedwater started 75.0 Low steamline pressure setpoint reached 100.3 Peak relief rates from pressurizer 363.0 safeties (1.677 lb/ft3)

Core decay heat decreases to auxiliary < 3000 feedwater heat removal capability O

E 2-32

i

'j TABLE 2.3.2 1 ]

. 1 TIME SEQUENCE OF EVENTS--

LOSS OF NORMAL FEEDWATER TO FOUR STEAM GENERATORS I

AT 20% RATED THERMAL POWER M TIME (sec)  ;

q Main feedwater flow stops 0.0 1

S/G Low Low Level setpoint reached 204.0 in multiple Steam Generators low Low Level trip signal transmitted 404.0 Rods begin to drop 406.0 One motor driven auxiliary feedwater 464.0 pump starts ,

Maximum water level in pressurizer 3092.0 occurs Core decay heat plus pump heat -3100 decreases to auxiliary feedwater heat removal capacity e

i e

2-33

. j TABLE 2.3.2 2 TIME SEQUENCE OF EVENTS' t'

LOSS OF NORMAL FEEDWATER TO ONE STEAM GENERATOR AT 20% RATED THERMAL POWER

{YllfI TIME (sec)

Main feedwater flow stops 0.0  !

to one steam generator ,

S/G Low-Low Level setpoint reached 183.6 1.1 the faulted loop ,

Low Low Level trip signal transmitted 418.6 Rods begin to drop 420.6 One motor driven auxiliary feedwater 478.6 pump starts i

Maximum water level in pressurizer 423.0 occurs Core decay heat plus pump heat (1) decreases to auxiliary feedwater heat removal capacity.

l-l . (1) Auxiliary feedwater heat removal capacity is not challenged for this ,

I case.

k e

2-34 i

i TABLE 2.3.3.1 ,

TIME SEQUENCE OF EVENTS FULL POWER LOSS OF NORMAL FEEDWATER (FSAR15.2.8)

EXIHI TIME (secs)

Main feedwater flow stops 10.0 S/G Low-Low Level setpoint reached 58.4 <

Low Low level trip signal transmitted 58.4 Rods begin to drop 60.4 First peak water level in pressurizer 64.0 occurs One motor driven auxiliary feedwater 118.4 pump starts Feedwater lines are purged and cold 556.0 auxiliary feedwater is delivered to  :

two steam generators Second peak water level in pressurizer ~6450 -

occurs Core decay heat plus pump' heat -7000 decreases to auxiliary feedwater ,

heat ' removal capacity k

e 2-35 l

1 1

l l-TABLE 2.3.3.2 o

1 TIME SEQUENCE OF EVENTS- l

• i LOSS OF 0FFSITE POWER TO THE STATION AUXILIARIES l

H (FSAR15.2.9) 1 TIME (secs) illHI Main feedwater flow stops 10.0 S/G Low-Low Level setpoint reached 58.6 Low-Low Level trip signal transmitted 58.6 Rods begin to drop 60.6 ,

First peak water level in pressurizer 65.0 occurs One motor driven auxiliary feedwater 118.6 pump starts .

Feedwater itnes are purged and cold 557.0 auxiliary feedwater is delivered to two steam' generators

'- Second peak water level in pressurizer 2844 occurs l-

^

Core decay heat decreases to auxiliary -3000 feedwater heat removal capacity

?

e 2-36

i i

TABLE 2.3.3.3 ,

TIME SEQUENCE OF EVENTS MAJOR RUPTURE OF A MAIN FEEDWATER PIPE AT 30 PERCENT RTP (ML, LUjil_ TIME fSECSi i With Offsite Power Main Feed 11ne rupture occurs 10.0 Available low-Low steam generator level setpoint 23.7-reached in faulted loop Rods begin to drop 155.7 Low steamline pressure setpoint reached 178.9 Auxiliary feedwater is started 215.7 Pressurizer water relief begins 700.0 Core decay heat plus pump heat - 2550  ;

decreases to auxiliary feedwater heat i removal capacity Without Offsite Main Feedline rupture occurs 10.0 ,

Power Available Low Low steam generator level setpoint 23.7 reached -

Rods begin to drop 155.7 Low steamline pressure setpoint reached 178.7 Auxiliary feedwater is started 215.7 Core decay heat decreases to auxiliary -850 feedwater heat removal capacity 2-37

i i

l.~

g 1688. <

h 1488. < i erg

1. w 5*

1288. < [  !

gM i888. )'

tf$

g-m

.88. . .

g 688.

8. 18. 28. St. de. Es. Se, 78, 33. eig , 33g,  !

, TIME ISECl 1

I.

l i

3 640. <

E22. l w' 688.

, e >

g3 see.<

i w

i l- g 568.

t w

v 548.

8. le. 28. 58. de. 58, 48. 18. 88. 86 8 . 198..

l TIME ISECl -

I FIGURE 2.1.2.3-4 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray

.. and Power Operated Relief Valves included, End Of Life -

Pressurizer Water Volume and Core Average Temperature versus Time 2-38

.- . . . . -. .~ . . . - - . . . _ . . _ .

L

(;

1

~ 1 .ii .

t ' '

D=

..?

sEg 4 g .. . c 8'g, 3g, 3g. 30. 43. 58. St. 79. St. 4. 488.

Ilot ISCCI N00.< 8 E 'F 2400.

2798.'

r f20 00.

' 4. 104.

8. 10. 30. St. 40. 50. St. 70. 08.

TIMC llCCI 400. <

Ste.

W 570.-

(: ,

E lot.

I 550.

I

's. 13. 30. St. 44. 58. St. 70. 08. 4. 188.

Titt 45CCI .. ,

4.<

E.5 S.

2.l <

3.

1.5 <

l.

8. 18. 30. 50. 40. 50. OS. 70. es. 4. 330.

IllE IICCI FIGURE 2.1.2.3-5 Loss 0F LOAD / TURBINE TRIP - Pressurizer Spray and Power Operated Relief Valves not included, Beginning of Life .

- Nuclear Power, Pressurizer Pressure, Core Inlet Temperature, DNBR versus Time .

M 2-39

i 3

.. +

1480. <

l '

W* 1200. <

50 i .ee . .

5-

~

g_g .88.

m

{ 688.

8. le. 20. 58. 48. 58. 60. 78. te sie, 333, TIME ISECl 1

l l-W 640.

l N. 620.

600.

g /

g_ see.

668.

Lee.

• W e. le. 28. St. 48. 58. St. 78. St. Ele. lee.

TIME ISCCI l

I, FIGURE 2.1.2.3-6 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray and Power Operated Relief Valves not included, Beginning of Life-Pressurizer Water Volume and Core Average Temperature versus Time 2-40

- . . . .. - . . . . . . ~ - . . .._ . . .. ._ .-

8.8 < l

1. <

lg .9 ' .  !

g, ...

4'

.3 ' u M. St. et. M. M. 78. M. 8l8. IM.

t. 30.

TIIE INCL M80. .

E 2dM .

• l 2700.

m k 2000.

1998.

8. 18. 28. 58. 40. St. St. 70. 30. ele. 33e, T!nt ISCCI g see.

64.

[

570.

W 568.

j. E 558.

's. 18, 20. 58. de. 50. W. 70. te. its. Ide. ~

TIMC (SCCI

- d.<

I 5.54 5.

2.5 '

2.

1.5 -

's. 10. 30. M. 48. M. M. 19. M. g. IM.

18tE tECl FIGURE 2.1.2.3-7 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray E and Power Operated Relief Valves not included, End of Life -

' Nuclear Power, Pressurizer Pressure, Core Inlet Temperature, and

• DNBR versus Time L 2-41 s

s i

a l

l I

i l

g i . .. . . <

l f*

1288. ~

gE 1890.

u EE p

m k

Epe.

8. le. 28. St. 48. 58. 68. 78. 88. 90. 188. t TIME istti l '. s . - 648.

E (20.

E 620.

w g-f 560. '

w a: 568.

Ede.

l W 8. 18. 20. St. de. 52. 68. 78. 82. 92. 180.

ll TIME (SECl l'

l L-l FIGURE 2.1.2.3-8 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray

- and Power Operated Relief Valves not included, End of Life-Pressurizer Water Volume and Core Average Temperature versus Time 2-42

- 3.4 < ,

l .8 <

b -

8.< j

.9 '

.6 <

g .4 <

• 2' k

8. 5. 18. 15. 28. 25. St. 55. 48, 45. St. 85. SS.

11 tit tEtCi 628. <

420. <

I 503.

-se .

E

~

E

! st. < -

540. <

628. <

8. 5. 18. 15. 28. al. 58. 55. 48. 45. 58. 85. 68.

TIME tStti FIGURE ? 1.2.4-1 ACCIDENTAL DEPRESSURIZATION OF THE REACTOR COOLANT SYSTEM - Nuclear Power and Core Average Temperature vertas Time e

2-43

2488. < 1 l

j #328. <

t

. 2988. '

E 1998. <

Y l 1688. < j 5 1 1488.

, ]

l1288.

iS88. < l l

888.

8. 5. 18. 15. 28. 25. 58. 55. 48. 45. 58. 55. 48.

T!PC ISCCI 4.< .j 1

5.5 <

l 5.-

2.5 -

l l 2.< l l __

b l I .5 - /

l 1.

8. 5. 18. 15. 28. 25, 58. 55. de 45. 58. 55. 68.

TIME 15CC)

FIGURE 2.1.2.4-2 ACCIDENTAL DEPRESSURIZATION OF THE REACTOR ~

COOLANT SYSTEM - Pressurizer Pressure and DNBR versus Time en 2-44

u~ t* -

O i, Y

13 t .4 -

1.3 =

j 1.2 =

i.i .

l g 1.0 --

0-3

~ 0.8 -

p '

0.7 -

O.6 -

f .e = l h 04 -

f 0.3 -

0.2 = _-

l 0.1 -

-4 00 , , , , . , , , , , , , , , , , , , , ,

0 2 4 6 8 10 12 14 16 18 20 TWE (Secones) 690.0

$65.0 - 1 T

p e

{ 680.0 -

! . 576.0 -

- 2 l Y

2 570.0 -

w l $ Ssb.0 -

,-- a

l. Y w $60 0 -

B

, u ,

1' ess 0 -

L

$50.0 , , , , , , , , , , , , , , , , , ,

)

0 2 4 6 8 10 12 14 16 18 20 TwE (seconds) h FIGURE 2.1.2.5-1 STEAMLINE BREAK WITH COINCIDENT R0D WI1HDRAWAL I- AT POWER - Nuclear Power and Core Average Temperature versus L

r Time

. I l l l I 2-45 1

, .. m -.

.. ,x 4

.7 2600.

2500.

E -

g 2400. .

tiet.

1200. e b

2100.

l 2000.'

1900. <

1800.

e. 1. 2. 3. 4. 5. 6. F. 8. 9. 10.

TIRE (8Et>

1.6 1.4 REACTIVITY INSERTION RATE = 75 x 10 5 d/$EC 1.2 g 1.

.8 B .6<

d

.4 I

.2

e. ~

0 1 2 3 4 5 6 7 8 9 10 fins test)

FIGURE 2.1.2.1-1 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER-Pressurizer Pressure and Neutron Flux versus time - Full Power, Min. Reactivity Feedback, 75 pcm/sec reactivity insertion rate 2-46

' J. ' , . s, 620 -

y 610 ' -

- 1 6 .0 190 '

580 570 < ,,

i ...

'I', g 3 3 6 s 6 7 8 9 10 TIRE (SEC) 4 2.5 ,

3. < -

2.$ <

t..

1.5 .

o g a 3 4 s o' 7 a 9 to 7 nt (stt)

FIGURE 2.1.2.1-2 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER- Core Average Temperature and DNBR versus time - Full Power, Min.

Reactivity Feedb:.ck, 75 pcm/sec reactivity insertion rate .

2-47 l

1 1

'1 l

. l 2s00. I 2500. '

l ,. 5 L C 2400. '

1. 4 2300. I

!!00.

~

l at W

2100.<

l 2000.

l 1900. < l 1

l 1800. 1

0. 5. 10. 15. 20. 25. 30. 35. 40. 45. 50. i TIME (SEC) i l

l- 1.4 -

1.4 REACTIVITY INSERTION RATE = 3 x 10 5 d/SEC

.'.- a g,g l 6

l. [ 1.

.S' l N I g .6  :

.4< .

.: y

'- a u n n o a

. . i. n 40 fint (stC)

FIGURE 2.1.2.1-3 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER-Pressurizer Pressure and Neutron Flux versus time - Full Power, Min. Reactivity Feedback, 3 pc# sec reactivity insertion rate l l- 1 l

l 2-48 .

l 1

, - s, l;

420 <;

i

_ y ' 610 <

~

$ a

.00

-190 '

W Sa0 570 <

i,.0 .

l

$50 el 50 9 S 10 il 20 25 30 35 40 j TIME (SEtt 4.

3.5

3. <

2.5 <

1 2.

j 1.5 -_

}

0 1 10 15 to 25 30 31 40 45 le TIRE (SEC)-

FIGURE 2.1.2.1-4 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER- Core '

Average Temperature and DNBR versus time - Full Power Min.

Reactivity Feedback, 3 pcm/sec reactivity insertion rate 2-49

. r k

1.45 I

L

\* I 1.40 -  % ,

% ~ sA 1

l Ofsf TRIP

~

i

)

,, s 1.36 - "

\ /

i g / n ,

NIGN NtVTa m FLut TRIP I' ~

--- RAIleam REMTIVITT Ftt9BACK MINIItm REACTIVITY FIEDBACK

. , v v v v v v v v v v v v v v v v v 10 6 2 5- 7 10-6 2 S 7 10'4 3 6 7 10*3 REACTIVITY IRBERTI.8R SAft (BELTA E/Stt) l' FIGURE 2.1.2.1-5 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER- Minimum DNBR versus Insertion Rate at 100% RTP

-e 2-50

.i

. \

.>j i

f i

1.M -

1.60 = /'

. I OTat TRIP k  %

I -

[\j? T [

l1.50a /-

/

j

' ^

). ,

1.40 =

--- 1111118m REACTIVITY Ftt00 ACE

- MIullam Rt&CTIVITT Ftt08ACK *'

Mim htWTR m FLUI TRIP

^

- 2 ^02^'

t.m 3o 6 2 5 7 10 5 e s 7 W"; e 5 7 W3 ggACTIVITT 8815tRT10ll BATE ' (BELTA E/ SIC)

FIGURE 2.1.2.1-6 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER- Minimum DNBR versus Insertion Rate at 60% RTP 4

2-51

4 1.90

=

Nulltft atACTitiff FtEBB40t Wiet IEVftut Fult Trit f t

RIRillSt REACTITITT Fttst4OL -

g

- i .= - I I

E 1.s0 =

/

lt s 3.s0 =

_- Ofat Trit 1.40 = t f 074T TRIP 3.3o  :  ; : ...:.. ,  : :.:.-  : . : ::^^:

s ; so 3 3o-s s ; in s  : i, 10-4' a stACTITm sustatie tatt (stLTA t/sts)

FIGURE 2.1.2.1-7 UNCONTROLLED RCCA BANK WITHDRAWAL AT POWER Minimum DNBR versus Insertion Rate at 10% RTP G

2-52

s

-I h

l.#

g ,. ,' .

gg ...

g .S ' .

4' g=5 .2- Q

~*

S. 10. M. 58. 48. 58. St. 70. te. 4. let.

TIE IKC l M80. -

E 3498.

M.

y MS..

1990.

O. 10. M. St. de. 50. 60. 70. te. 4. leg.

TIMC llCCI GSS.

=

44.

$ 500.' '

I?J. _

h w

$ 568.

Ele. .

s. -10. M. 58. 48. 58. 48. 78. 88. 4. 188.

TIE 15CCI 4  !

5.5 -

5.

2.5 '

2.

1. E '

S. 38. M. SS. 40. SS. 88. 70. SS. 4. 100.

11E ISCCI FIGURE 2.1.2.3-1 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray ^ l and Power Operated Relief Valves included, Beginning of Life -

Nuclear Power, Pressurizer Pressure, Core Inlet Temperature and DNBR versus Time .

i 2-53

1580. ,

IdSe, sc g e lase, u

5 2 8" 1800, g .e..

g ..e.

8. 10. 23. Se de. Ee. 68. 78, 30. ele, see, TIME ISECl 640. ]

.j

820. .j l

n 600.

" j sea.

w$

.g l l

g Est. <

=

w 548.

B 8. 18. ae. se de. se. se. ve se, g. jee. i TIME ISECl . (

l l

FIGURE 2.1.2.3 2 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray L -

and Power Operated Relief Valves included, Beginning of Life -

Pressurizer Water Volume and Core Average Temperature versus Time 2-54 ,

. . . - _ - - _ . . - - - - - ... . . .. .. - . ~ . - . - . . . -. - .

g s

m ' t .t <

1 18.. ..

Di .0

.0 < .

4' .

g .8 e

's. 30. M. St. 40. le. M. M. M. 4. 108.

IIE IECl MM. -

. $ #400.

E.-

2200.

2W90.

0. 10. M. St. 40. 50. 80. 70. 08. age, 3g0.

TIE IKCl , ,

40e .~

C Sg.

t; k 50s.

570.

~'

k3 w

540.

550. .

540.

8. 10. M. St. de. 54. St. 70. 80, sig , 33g, l 13 4 15CCI 4

5.5 -

5. <

. 2.5 - i 2.<

l .5 <

0. 10. M. BO. 40. 54. 08. 70. 08. 4. leg.

flE SEC1 ,

FIGURE 2.1.2.3-3 LOSS OF LOAD / TURBINE TRIP - Pressurizer Spray

• and Power Operated Relief Valves included End Of Life - Nuclear Power, Pressurizer Pressure, Core Inlet Temperature, DNBR versus Time .

L 2-55 L

4 2 260 e; 2 240 =

l^ 2 220 =

i

.. a 2200 =

.w 2 180 -

2 160 -

2 140 - ,

2120 = 'l 2 100 -

N 2 080 -

2 060 -

2 040 -

2 020 =

. i 2 000 . . . . . . . . > i i i i i i i i 4 6 8 to 12 14 16 18 20 0 2 w e < c.ae.) 1 1.S

- u-y N i

. l

. o i .3 -

! . i

.~.,

I e i .2 -

S u

E i .i -

l 1.0 . , , , , . -r . . . . . . . . .

. . i 0 2 4 6 8 10 12 14 16 18 20 '

l m t ( <.ae.) 1

-1 FIGURE 2.1.2.5-2 STEAMLINE BREAK WITH COINCIDENT RDD WITHDRAWAL i AT POWER - Pressurizer Pressure and Steam Flow versus Time l

l

• l' l

l l 2-56 u

l 1

'?

5 l

l LW N!M to.Le NIM LW NIGH -

l Tevg $TEAMLINE PRt$$URl!ER CONTAIMENT

$TEMLINE $TEMLINE O!FFERENTIAL PRCs5URE PRES $URE l PRE $$URE FLW 1 pat $$URE

\

i r

i, i i i, i, W M N1.N1 SLOCKt0 00 RING

,~

EONTAINMENT NEATUP AND PRES $URE C00LOOWN i, ii i, i, i l ., ,,

-* SAFETY

' STEAMLINE

!$0LAT10N INJECTION i SYSTEM 1 (OLD STEAMLINE BREAlt PROTECTION) .

(UEED ONLY OURING NORMAL COOL ANDNEATUPDPERATIONS)

N1* M1 HlW LW l LW NIGH PRES $URIZER CONTAINMENT CDN7AthMtWT ,$TEAML!ht STEAMLit.%

PRES $URE PRE $$URE Pitt$$URE P/ES$UM P451URE AAtt _

AL t ., <, <,

. ,, ., 4, STEAMLINE SAFETY

!$0LAT10N INJECTION SYSTEM 2(NEWSTEAMLINEBREAKPROTECTION)

Figure 2.2.1-1 Steamline Break Protection Systems I

i 1

2-57 i

. l 1

e.... l e 1 4 6 0. <

^^

. I

• 4 4 6 0. < 1 I

4 6 6 4. <

isso. -

g i.e s. <

ln in f i,.. . .

i.... y Ste.

ill $4i itI il8 il*

tint ettle .

4600.

ile t. '

E t i.ee.

i.s e. <

E se... x

! W icee.

I i l g .. . . .

r L g..... .

t a .

g .... ,

.... /

/

i.e sei see i. ...

l Timt flite FIGURE 2.2.2.1-1 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE, WITH 0FFSITE POWER Pressurizer Pressure and Water Volume versus Time 2-58

r; ,

I t

i 1

l ree.

T5AT .  !

- .S e . \  !

5 TH0T

~

h.....

1 I.... TCOLD g.....

W 99.

It' 198 llI $48 19' tiet ettte too.

TSAT TH0T ,_ g I .... ! l s .

ICOLD #

m. -= p gh / ,

h '\

p 448.

l

( eL6. *

.St.

8 It8 til iOI 143 13 tiet Iltil FIGURE 2.2.2.1 2 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE, WITH OFFSITE POWER - RCS Loop Temperatures versus Time e

2-59 .

_ _. _ . _ ._ _ ~ _ _ - . . - - - . . . . - . . - . . - . . . . _ - . _ . _ _ . . . ..

900.

Tggy .

c***.' Tg \ '

^

1 g

60 0. <

LD ise.

g .. . . . .

i eso.

It' lei set tel 86 8

tint sitti tee.

T5AT g '"*

\

-- . . . . . \ \

\

l . N

. 166. \

g -

N

.... \/ '

1 8 5 0. <

861.

8 It' 363 000 sol 33 ttnt IStte FIGURE 2.2.t.12 $UQOR RUPTURE OF A MAIN FEE 0 WATER PIPE WITH S 0FFSITE POWER - RCS Loop Temperatures versus Time l

2-60 1

L 9644.

lete. <

= .

g . ... . .

g 8000.

g.....

1 800. i 80 0. <

g,e ggi get 968 88 8 tint ettti i

teet.

g 4604. '

l, " ' ' '

r ... . . .

._ 3 N -

( '

l i

h \

l 8000. ' ,

' 8

,,, ggt 338 $80 88 ting IStti l

FIGURE 2.2.2.1 3 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE, WITHOUT OFFSITE POWER - Pressurizer Pressure and Water Volume versus Time 2-61

1 j

I l

.... l

)

.s e . <

I C...., MT l Tyoy see.

l ... . . .

s ... . . .

Teot0  ;

I ... . . .

lie. '

666. 8

' 14* tel ill 808 10 fint iltti I

960.

.St.'

E ..e. -

TS ai _.

Tg e

l'g. tit.

d ett.

b s... TCOLD ,

E -

s...

j e

ie* ses sea ses se

• fint 86tte FIGURE 2.2.2.1 4 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE, WITHOUT OFFSITE POWER - RCS Loop Temperatures versus Time e s l

• l 2-62

ese r

see -

ese .

a I --

I see-l-

l tes - i

, t ,

e . . . .

i e se 4e .

- Anus asmy Pesar w M. +

Os mP)ened eve ashy ,

i e

f 4

FIGURE 2.3.2 1 Calculated Trip Time Delays versus Power for Low Low Steam i Generator Level in Multiple Steam Generators

=

l l .

2-63

! J 1

ges .

ges .

! 400 -

get -

999 - ,

l 8 s . . .

e se 4e i

- Arasel Oster Peeer Level PL Cs m P'

+ Pb W l

F. elRE 2.3.2 2 Calculated Trip Time Dtisys versus Power for Low Low Steam Generator Level in One Steam Generator 4

I 2-64 l

1 l

l

_ . _ . . . _. .._ . _ . ~ .._ __ ._. _ _____. _ _ ._ . . _ -.._ _____ _ _ _. _ _

1

. )

1..

t.e -

i b

i ..  !

l 4 1

. 1 I

,ei $,i ter i,s $,4 l TIM 198tl

]

t.4 1.l ' i E i, b

W

b. '

g ., ,  :

~

9 .. .  ;

I .,

11M 4908) ,

i FIGURE 2.3.2-3 PART POWER LOSS OF NORMAL FEEDWATER TO FOUR STEAM i GENE 8tATORS - 20% RTP with N/4 Trip Time Delay - Nuclear Power and RCS Flow versus Time 2-65 1

l

. _ _ _ . . - . - - . . _ . . - . - _ . . _ . . - . . . ~ . ~ . . - . . _ ~, - . .. .

i i

. tote.

noe. .

i tote. .

~ m StM.-

I ln.

l e 1896. '

lett.

100 101 19I 163 104 TIM t$tti l

l I

I Ittt.

gii...

v .....

1460.

l,,....

,5 ....

888. -

E .... ,

360.

te' ist ,,r ,,i ,.

Tl*1 ($tti FIGURE 2.3.2-4 PART-POWER LOSS OF NORMAL FEEDWATER TO FOUR STEAM GENERATORS - 20% RTP with N/4 Trip Time Delay - Pressurizer

, Pressure and Pressurizer Water Volume versus Time t

2-66 l

r

- - . - .~._ ., . s-_- _

l

\

l l

1 Pet.

• l t

Tggy .

" Mt . -

646.

l .... -

e TH0T / 1 I....

• • • . TCOLD lit.

100 141 tot its it' 11 4 (9tti F60.

.4 0. '

TSAT i .... V

\ -

I....

,, TH0T

/

j } '

I ss..

us. - .

TCOLD lit.

ses sei iet ses sea TIM tlitt FIGURE 2.3.2-5 PART-POWER LOSS OF NORMAL FEEDWATER TO FOUR STEAM GENERATORS - 20% RTP with N/4 Trip Time Delay - Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time .

2-67

_._ __ _ . ~ . _ _ _ . _ _ . _ _ _ . . _ . _ , . _ _ ~ . . ._ _ . .. .. ._ .. _ . . . . __

i t

1660.

I

• 1660. '

l '

• 1960. '

/

l.....

I600. 600.

490.

800.

9. goe It' ili ist tel TIM (94tl 14068 6

.1860s.6 I .,.. .. . '

! I........

• *' IftM SINERATORs A,tt.i.lV,ING

. L. AU11Llaty g.....,

' ' STEM SINERATO _

~

AUllLIARY FELD.R$ Afft iib 1 RfCtlVING ,

4.

it' 109 198 163 104 a

flW ISICI FIGURE 2.3.2 6 PART-POWER LOSS OF NORMAL FEEDWATER TO FOUR '

STEAM GENERATORS - 20% RTP with N/4 Trip Time Delay - Steam

+ Generator Pressure and Steam Generator Mass versus Time i

+

l l

2-68 l

l l

[ l

[

l 1

1.s j t.:

l, .. l

.e i

5

.e .  ;

.s .

g

eis ist set ses to' TIM telta l k

5.4 i.I I i.

b 3

N 4 I.. .

iee set ter ses se4 TIM (Sill i

FIGURE 2.3.2 7 PART POWER LOSS OF NORMAL FEEDWATER TO ONE STEAM .

GENERATOR - 20% RTP with 1/4 Trip Time Delay - Nuclear Power and RCS Flow versus Time 2-59 l l

l o $660. ,

7 60. ,

lett.

J 8t90.

k '

L A ,

g.....

r 1860. ,

1660. == ----

it' thi tel 105 . _ _ ted 11 4 464t) 3660 ,

pii...

i....

. isee.

1800.

g ett, j

a ....

1 .... .

E use.

I .. ,,4 to' ist tot se fl4 tetti l

FIGURE 2.3.2 8 PART POWER LOSS OF NORMAL FEEDWATER TO ONE STEAM GENERATOR - 20% RTP with 1/4 Trip Time Delay - Pressurizer Pressure and Pressurizer Water Volume versus Time I

1 2-70 l

l l

1 l

Pet. .

we.

ISAT

$ 640.

640.

Isee.

H9 e'

- Hl . I M

~

Isee.

• • • . TCOLD lit. -

Ste. .

to' n' tot ul u*

4 11M (96tl 760.

Hl.

ISAT C 640. _

~1- e E ne.

1 no.Hl. TH0T _

g....

see.

TCOLD lit. ,

SH.

19' 401 i6t 101 104  :

TIM ($tti FIGURE 2.3.2 9 PART POWER LOSS OF NORMAL FEEDWATER TO ONE STEAM GENERATOR 20% RTP with 1/4 Trip Time Delay - Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time .

2-71

l l

l

~

1600.

l. ]

l l

3 tote.

l i

[ 1860. -

s ~

1990.

Ste.

I I690.

I 400.

I I see.

8. + -...

108 191 tot 163 104

! TIM flit) 14666*6

• STIM SENIUTOP.5 NOT 120 Die 6 MCIIVINO AUKILIAJty ftt0 WATER I.iD66t+)

i .864Diel

.6666tel g.....t.,

c Stim SENtnATORS RttilVING

,,,,,,,, Auxitt ur rtt0watra 4.

It' 101 103 163 144 11 4 (till FIGURE 2.3.2 30 PART POWER LOSS OF NORMAL FEEDWATER TO ONE

l. STEAM GENERATOR - 20% RTP with 1/4 Trip Time Delay - Steam l

Generator Pressure and Steam Generator Mass versus Time l

\

l 2-72

?

I l

e l i

s.e <

g i..

W l E- .e <  ;

t i

E g .. .

.e<

. mas. -

e. _ . . - , - . -

iin ie s sei sie ses )

. tsat osat6 .  ;

i..

)

i.e .

E

= . .

t b

[t ..< ,

5 s .. .

d IE .e. .

e.

i.e is ies ses se*

tint setti i

FIGURE 2.3.3.1-1 FULL POWER LOSS OF NORMAL FEEDWATER - l Nuclear Power and RCS Flow versus Time

)

=

l l' j i

1 l 2-73

\

i

- - .. .- - . - . - . - . - . . ._ . . .. . - . - ~ . . . . . - . . , . . . . . - . - . . - ... -.

8000.

E . . . . . .'

E esse. .

g ..... .

4099, '

..... 8 gg4 ggi i.I 148 i4 tint 80tti 4

8. i t , ;

E g ie. . <

b 1:! . . . . . <

8 i ....

P st...'

g .009.

W g .....

L E ....

h ... . .

E..... -

i.e i.: i.e i ,' ie*

vs.: isste FIGURE 2.3.3.1-2 FULL POWER LOSS OF NORMAL FEEDWATER -

Pressurizer Pressure and Pressurizer Water Volume versus

! Time e

2-74

i l

een.

TSAT ,

l

, u ....< _

h '.e . < .

.e.. Twot s

~

e.. , TCOLD ,,,,,

g .

ene. <

see. --

ie' sei see no ,,.

itse sekt see. ,

TSAT

..e.. f g .e., ,

IHOT j ,

E....

E TCOLD 4..

6ee. <

see, le' eel lee see g,4 else eless FIGURE 2.3.3.1-3 FULL POWER LOSS OF NORMAL FEEDWATER - Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time .

2-75

__ ___ - ._ _ .- _ = . - - - - -

- . . - .- -. - . - . . . . . _ . - . - . . - . . . . . - - - _ . - . ~ . __

. .  % I s

4600.

g lete. <

1 ..... .

y 400. '

$ 480.

W o

846.

g, .. a.

3et gli 800 tel 46' fl#4 (4tte

.58004 6 ,

.18 4 9 t

• 6 ' ,

= .19 8 4 8 6 <

$ .eesst.6 <

s1fAM 4tNERATOR$

RfCtlVING AUllLIARY

.6sses 6 ' Fit 0WAftR 6 '

E........

" STEAM SEN!RATOR$ 1101 RICtlVllIG AUKILIARY Fl[0 WATER .

,,,,,,,g, e.

i

..e ..: i.e i* ie*

fint Eltt6

.. FIGURE 2.3.3.1-4 FULL POWER LOSS OF NORMAL FEEDWATER - Steam Generator Pressure and Steam Generator Mass versus Time 2-76

1 l

s.e

=

l l

..e< l k .* l

.6' l*  ;

,,e ,,, - ,e. . i.> i..

tint ettle i.. -. =- 1 j .e E s. l b .

$e<

t:

g .e .

s .. .

af

• 5

• e< .

e.

ie' ses see i.e ...

una esic. I l

l l

FIGURE 2.3.3.2-1 LOSS OF 0FFSITE POWER TO THE STATION J AUXILIARIES - Nuclear Power and RCS Flow versus Time ,

2-77 1

1 1

I 1

I sess.

g 9600. ' 1 e=

i f ,, . . . .

9966. ,

t lie d . '

lett. it' get ggi 848 gge t i til '4 4 R t l i

tese.

i ee. . __

M 1669. i f_

g.....

g $ $ 6 t. <

W g ....<

E.....

g ... . . -

r Ste. '

6.

808 tt' 408 800 30 8 1988 48880 FIGURE 2.3.3.2 2 LOSS OF 0FFSITE POWER TO THE STATION

• AUXILIARIES - Pressurizer Pressure and Pressurizer Water Volume versus Time 2-78 l

i

ees.

.s e . <

T'AT ll..e.< ,

see. ' '

TH0T ,

see. <

..o..

TCOLD , -

y - -

,, see.

see. <

see sei ist i.' i* ,

ii : . site 7ee.

.e .

..... TSAT _

$ .e s . <

$ **e '

TH0T E ..o.

E e .se. <

TCOLD .

..e.

Ste. '

le e . '-

le' tel lei ese ge8 9 tat estte FIGURE 2.3.3.2 3 LOSS OF 0FFSITE POWER TO THE STATION

• AUXILIARIES - Loop 1 and 3 Cold Leg, Hot Leg, and Saturation Temperatures versus Time 1

2-79

1 l

l 1

l l

l 1660.

,g lett. ' .

lett. < l I

l m 8000. ' i 968. i see. '  !

1 E ae e. < l fee.

I 8

330 ,ei gWI 800 86 ffht 46866

'I

. s < e s s . , -- --

- ~~

.43a98 6 a STEAM GENERATOR $

b .sesse" '

RECEIVING AUXILIARY FEEDWATER "k

E y.......'

W E

N......., STEAM GENERATOR $ NOT RECEIVING AUXILIARY

.seess.s ' FEEDWATER 8.

8 360 808 Otl it' 84 tint tltti FIGURE 2.3.3.2 4 LOSS OF 0FFSITE POWER TO THE STATION AUXILIARIES - Steam Generator Pressure and Steam Generator Mass versus Time l .

l l

l 2-80

. . . . . . .. . - . . - - . - ~. -. .- -

l l.

1

! 1.4 l , 1.E I

l i..

l .

i .

i f

.4

.3 i

0. . .

C __

100 101 10I 103 10' TIME (SEC) l

,000.. - . -

~

l g 1800.

u l M 1600.< h 1 E .

M 14 0 0. < .

1200. <

h .

, 1000. . .

M

$ 400.

w ,

M.

600.

g .00. .

f 200. .

C.

100 101 10I 103 it'

• TIME. (Sit)

FIGURE 2.3.3.3 1 MJOR RUPTURE OF A MIN FEEDWATER 91PE AT 30 PERCENT POWER, WITH OFF5ITE POWER Nuclear Power and "

Pressurizer Water Volume versus Time S'

2-81

.- , s +

i 700.

650. <

TSAT

_ { 660.

E 64.. <

l 620. <

l600.$80.

k 160. ,

TH0T TCOLD s

g $40.

$28.

500.

100 101 102 10 10' l lirit (St01

700. - - --

600.

660., ISAT 6

t!i 640.

620.<

l h 600.

l l Tgot l 4:t 580. < _

560. .

. 0. .

E,520.

TCOLD m[ -

500.

100 101 102 103 10' Tint tstt)

FIGURE 2.3.3.3 2 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE AT 30 PERCENT POW [R, Wi1H OFFSITE POWER Hot Leg. Cold Leg, and Saturation Temperatures in the Faulted and Intact Loops i

l 2-82 1

l 8

e

• 4 .

~

_ 1.2 I '-

.i 5 i

.8

.6 I

.s + - . -- A  :

1 J

t

(* I  ;

,, - t  :

g00 101 102 g03 I f,'

TIHE t8EC) 00C. ' ' ' ' ' - -

)

g 1300. < ,, ,

M 1600.< ,

$ 1400.

1200.<

, 1000.

W g 800.

E 600. '

h 400. <

200. <

tot tot tot 103 to' l l TIME (SEC)

FIGURE 2.3.3.3 3 MAJOR RUPTURE OF A MAIN FEEDWATER PIPE AT 30 PERCENT POWER, WITHOUT OFFSITE POWER Nuclear Power and l

Pressurizer Water Volume versus Time -

2-83 1

e

4 F00.

, 480. '

TSAI b

y .460.

0. . < D g.it.

.00. .

g Ste. < g I $60. Tggtp 1

g" 540. ~

g ut. ,

$n.1 - - - - -

. , _ _ - _ = - - i  ;

100 toi ts2 503 vre  !

TIME dt!C)

E *

80. - - = _

680.<

660.,

ISAT t

w 640.

M l 620. .

L 5 600. <

l [ TH0T u u0. ,

l '

{ 560. , TCOLD g . 0. ,

h,$20.

500.  ;

100 101 102 103 to' TIME (SEC)

FIGURE 2.3.3.3 4 MAJOR RUPTURE OF A MAIN FEEDWATER PlPE AT 30 PERCENT POWER, WITHOUT OFFSITE POWER - Hot Leg, Cold Leg, and

, Saturation Temperatures in the Faulted and intact Loops 2-84 1 l

- - . - , _ _ . - . . . . - . . . . - . . . . - - - . . . ~ . . . . - - .

- - - - - - - - - - - ------------O

__ ~_ _. . _ _ _ . _ _ _ _ . _ _ _ _ _

3.1 EAGLE 21 PROCESS PROTECTION SYSTEM 3.

1.1 DESCRIPTION

Process Instrumentation is comprised of those devices (and their y which measure and process signalt for

. temperature, interconnection into systems) pressure, fluid flow, and fluid levels and specifically excludes nuclear and radiation measurements. Process Instrumentation includes ecuipment which performs functions such as: process measurement, signal concitioning, dynamic compensation, calculations, setpoint comparison, alarm actuation, indication and recording, which are all necessary for day-to-day operation of the Nuclear 5taam Supply System as well as for monitoring the plant and providing initiation of protective functions upon approach to unsafe plant conditions.

The Westinghouse Eagle 21 microprocessor based process protection upgrade L system is applicable for those instrument systems which are l -"safety-related" as defined by IEEE Std. 279 1971, " Criteria for l Protection Systems for Nuclear Power Generating Stations'. The Eagle 21 portion of process instrumentation includes all necessary devices with the exception of transmitters, indicators, and recorders. Location of the process protection racks with respect to their interfaces within the nuclear power plant is depicted in Figure 3.1-1.

The Westinghouse Eagle 21 microprocessor-based process protection system is a functional replacement for existing analog process protection equeaent used to monitor process parameters at nuclear generating stadens and initiate actuation of the reactor trip and engineering -

safeguards systems. Features of the Eagle 21 equipment include the l following:

I '

A. ' Automatic surveillance testing to significantly reduce the time required to perform surveillance tests.

B. Self calibration to eliminate rack drift and time consuming ca.libration procedures.

C. Self diagnostics to reduce the time required for troubleshooting.

D. Significant expansion capability to easily accommodate functional upgrades and plant improvements.

E. Modular design to allow for a phased installation into existing process racks and use of existing field terminations.

In a typical Eagle 21 Process Protection Instrument Channel, field sensors

- are connected to cabinet mounted terminal blocks. The process electronics power the sensors and perform signal conditioning, calculetion, and l isolation operations on the input signals. However, each element of the

~

process is not an individual electronic module or printed circuit board 3-1 l

1

i

?

assembly. A multiple channel Analog Input module is used to power the field sensor (s) and perform signal conditioning. All calculations for the .i process. channel functions are performed by a centralized Loop Calculation Processor (LCP). Typical functions performed by the Loop Calculation Processor are as follows: summation, lead / lag, multiplication, . <

comparator, averaging, and square root conversion. Trip logic.is provided through multiple channel Partial Trip Output modules. Multiple channel isolated analog outputs are provided by Analog Output modules. In addition, all Eagle 21 process protection channels are configured to perform automatic surveillance testing via a centralized Test Sequence Processor (TSP).

l Typical protection channels which may be processed with the Eagle 21 process protection system are as follows:

A. Average Temperature and Delta Temperature B. Pressurizer Pressure C. Pressurizer Water Level D. Steam Flow and Feedwater Flow E. Reactor Coolant Flow F. Turbine Impulse Chamber Pressure G. Steam Pressure H. Containment Pressure I.- Reactor Coolant Wide Range Temperatures J. Reactor Coolant Wide Range Pressure >

K. Refueling Water Storage Tank Level  :

L. Containment Sump Level l-M. Steam Generator Narrow Range and Wide Range Water Level .

l The Eagle 21 equipment has been designed to fit into existing process .

I racks and to interface with other plant systems in a manner identical to -

l the existing analog equipment (Figure 3.1-2). The design maintains the existing field terminals to avoid new cable pulls or splices within the rack. The components for each rack are built into subassemblies which are easily installed into the existing racks. All internal rack cabling is .

pre-fabricated. The subassemblies are tested in a factory mock-up to L verify proper fit and operation. Detailed installation procedures and drawings are provided with each system.

l 1

3-2

I EAGLE-21 W >

IMPLEMENTATION .

= = =-i--is ii.

hPImitCrw

\ / 8 N "'llll1"1 'V \~P/

\

e-e .-:,

W / x  : / \

1.c W

/ t

,9 \ cm -

/ .

L ,,i; iii. . .it

////* / m ~~i J'/// '/

l '

f nw .* / '

nirs < ~a

, =/// * / ./ =1//' /a .

- / ..

y/ * / /

c*'" A** / /

ve ne n z, a

/ -

'J/4/ is s

2 -

f.

/, rp a

/ l Proc.ee

- " Process I -

i i

gs ~

Centrol 7.c _1;

.f/bs / .ssesor

./

_/)

/ r n *: I _/

Typicall8C System Block Diagram  ;

FIGURE 3.1-1

3 Q

EAGLE-21

. DESIGN PHILOSOPHY U-a e Form, fit and function replacement Analog System = Digital System a Tenninal Ml Power Supply Y -!

• g

' r PAMS Tm h  : Mh _

Control

• PAMS Leep  != w er E W W ) W Sensore oussue

-e. Lead /I.eg - Bletetde i

ESF , ,

ESF .

Reactor Trip Reactor Trip i

FIGURE 3.1-2 i i

l 3.2 RTD BYPASS ELIMINATION

!~

.3.

2.1 DESCRIPTION

The RTD BYPASS ELIMINATION ELIMINATION functional upgrade modification L affects the measurement of the RCS hot leg temperature. Prior to the modification, the RCS hot leg coolant was sampled by scoops in the main i piping and an average hot leg temperature was obtained from a single RTD i mounted in the hot leg bypass manifold. The RCS cold leg measurement was  !

obtained from a single RTD mounted in the cold leg bypass manifold. With  !

the elimination of the RTD bypass manifold, three (3) hot leg RTD's are  ;

installed in thermowells mounted in what was previously the bypass '

manifold scoops. The RTD's are in a single plane,120 degrees apart. The temperatures read at these locations are somewhat different because of streaming effects. Thus, the three temperatures are be processed to  ;

produce an average temperature (Thave) fcr each hot leg. The cold leg temperature measurement on each loop is accompitshed with two narrow range  !

RTD's installed in thermowells. One thermowell is mounted where the cold leg bypass connection previously existed. The second cold leg thermowell is installed in a newly drilled hole in the RCS cold leg piping. The cold leg sensors are inherently redundant in that either sensor can adequately represent the cold leg temperature measurement. Temperature streaming in the cold leg is not a concern due to the mixing action of the reactor coolant pump.

The process system used to calculate T ave and Tcold is designated the Temperature Averaging System (TAS). The Temperature Averaging System

. (TAS) becomes part of the Thermal Overpower and Overtemperature Protection System because the-TAS outputs (T.. ave and Tcold) replace the Thot and Tcold signals previously derived from the bypass manifold RTDs.

3.2.2 DESIGN AND' IMPLEMENTATION The Eagle 21 TAS system accepts RTD input signals representing two (2) cold leg and three (3) hot leg temperature measurements per loop (Figure 3.2-1). The two cold leg' temperatures are processed to produce an average cold leg temperature Tcold. The three hot leg temperatures are processed to produce.the average hot leg temperature T ave. T=. ave is then combined with Tcold to produce the loop swrage temperature (Tavg) and the loop difference temperature (Delta T). The resultant signals replace the same signals previously derived in the analog Thermal Overpower and Overtemperature protection channels.

The two cold leg temperature input signals are subjected to range and consistency checks and then averaged to provide a group value for Tcold (Figure 3.2-2). IV these signals agree within an acceptable interval

-(DELTAC), the group quality is set to GOOD. If the signals do not agree within the acceptable tolerance DELTAC, the group quality is set to BAD

. and the individual input signal qualities are set to P00R. The average 3-5

of the two Tcold input signals is used to represent the group in either case. DELTAC is an input parameter based on operating experience and is -

entered via the portable Man Machine Interface (MMI). One DELTAC is required for each temperature loop. ,

I The Eagle 21 TAS employs an algorithm that automatically detects a defective hot leg RTD input signal and eliminates that input from the T ave calculation. This is accomplished by incorporating a Redundant ,

Sensor Algorithm (RSA) into the hot leg temperature signal processing. -

The RSA determines the validity of each input signal and automatically  ;

rejects a defective input (Figure 3.2-3).

Each of the three hot leg temperature input signals is subjected to g,c range check. These signals are utilized to calculate an [ ]

average hot leg temperature which is then consistency checked agains['ghe '

other two estimates for average hot leg temperature. An [ ]

average hot leg temperature is derived from each Thot input signal [

'). Then, the average of the three [- jac averagehot;1a,c

[

~

.]a,8gtemperaturesiscomputedandtheindividual are checked to determine if they [

.]a,c the average value. If all of the signals do [ .

L group va'ue3a,cThave the average is set tovalue, the group the average of the quality _ is set to G00D]3' The three-[

average hot leg temperatures.

l If the signal values do not all [ Ja c the

[ -]a,c of the hot leg averagg'gemperature, the RSAThe will qua [ lity of

) from the average. 1 the [ ja,c signal is then set to POOR and a consistency check is L .

Ja,c. If the [. ,

I

-performed

] [c signals pass the consistengy check, the group value will be taken as [ ] ,c GOOD signals and the group quality will be set to POOR. i consistency check [ However,c,f

]a, thethese groupsignals value willagain be setfailtothe the [ average of the two]asc signal)s; but the group quality will be set to BAD. All of the individu81 signals will have their quality set to i POOR. [. ']a, parameter based upon temperature l distribution tests within the hot leg and is entered via the portable l

MMI. One [ ]a,c is required for each temperature loop. ,

The Eagle 21 system has been designed with the capability to perform automatic surveillance tests on the TAS algorithms associated with the RTD Bypass Elimination- functional upgrade.

3.2.3 ALARMS, ANNUNCIATORS AND STATUS LIGHTS Additional control room alarms, annunciators and status lights are provided as part of the RTD Bypass Elimination functional upgrade. These ~

additional indications are as follows:

1 3-6

~ . .- . . - . - . -- - - . - - . . -. . .

, 1. A " Trouble" status light is added (1 per loop). This light is actuated anytime the T ave group value for a coolant loop is set to POOR as described in Section 3.2.2. Thisstgtyslight

.- informs the operator that there are ( )' narrow range Thot signals for the loop in question.

2. An "RTD Failure" alarm and annunciator window is added (1 per loop). This alarm and annunciator is actuated anytime the Teold or T: ave group.value for a coolant loop is set to BAD as

-described in Section 3.2.2. This alarm and annunciator informs the operator that there is an invalid Tcold or Thave group' value for the. loop in question. A Technical Specification action statement will be in effect to cover this condition.

I e

I L

L.

l .

3-7 j 1

.i Ab d ]

1 l

l l

l 1

1 i

l i

1 I

1 1

l I

}

t 4

Figure 3.2-1 i

3-8 [

4 4 - - - - -- - - - - - - - - - _ . _ _ _ _ _ , . _ _ _ ,

1 o+  !

... 1 l.

L l

1 H

)

l I

l.l i.,

• s

~

. FUNCTIONAL LOGIC DIAGRAM (Teoid) <

Figure 3.2-2 3-9

A,C '

0 f

t l

i e

l' l

L L

1 I

)

l l

i t

FUNCTIONAL LOGIC DIAGRAM (Thot)

Figure 3.2-3 3-10 l

-1 1

l

, 3.3 NEW STEAMLINE BREAK PROTECTION 3.

3.1 DESCRIPTION

~'

The NEW STEAMLINE BREAK PROTECTION functional upgrade is incorporated with the installation of the Eagle 21 digital system. This new system will provide for a system protective action that will reduce the potential for spurious actuation of Safety InSction (SI) at low power by the high steamline differential pressure SI actuation signal.

The old steamline break protection utilizes steamline flow, Tavg and i steamline pressure as process inputs (Figure 3.3-1, Sheet 1). The process protecticn system uses these signals to generate comparator (bistable)  ;

outputs for High Steamline Differential Pressure and High Steamline Flow, i The reactor protection system logic generates SI on High Steamline Differential Pressure (2 out of 3 coincidence logic) or High Containment Pressure (2 out of 3 coincident logic), and SI plus Steamline Isolation on .

High Steamline Flow (2 out of 4 coincident logic) coincident with Low  !

Steamline Pressure (2 out of 4 coincidence logic) and Permissive P-12 to-Lo Tavg.

The NEW STEAHLINE BREAK PROTECTION (Figure 3.3 .1, Sheet 2) modifies both the Reactor Trip System (RTS) and the Engineered Safety Features Actuatlon L System (ESFAS) logic. This upgrade requires the deletion, retention and ,

addition of several functions. These changes are as follows:

L -Functions Deleted:

SI and Steamline Isolation on high steamline flow coincident with P-12 Lo-Lo Tavg SI and Steamline Isolation on high steamline flow coincident

• with low steamline pressure 1

l1 SI on high steamline differential pressure J 1

L L Functions Retained:

Low pressurizer pressure SI All high containment pressure signals l

Functions Added: I l

SI and Steamline Isolation on low steamline pressure l Steamline Isolation on high steamline pressure rate coincident  !

with P-11 Pressurizer Pressure l 3-11 1

1

l i

s 3.3.2 DESIGN AND IMPLEMENTATION j

g Incorporating the NEW STEAMLINE BREAK PROTECTION results in the deletion

, of two actestions (51 on high steamline differential pressure and

• l Steamline Isolation plus S! on high steamline flow coincident with low steamline pressure or Permissive P-12 Lo Lo Tavg) and the addition of two ,

actuations (Steamline Isolation on high steamline pressure rate and SI j

plus Steam 11ne Isolation on low steamline pressure). l 1

For the NEW STEAMLINE BREAK PROTECTION functional upgrade, the ESFAS is l modified to delete the Safety Injection on High Steamline Differential  !

Pressure (Figure 3.3-2, Sheet 1) and Steamline Isolation plus SI on i steamline flow coincident with low steamline pressure or P-12 Lo-Lo Tavg  !

functions (Figure 3.3-2, Sheet 2). The NEW STEAMLINE BREAK PROTECTION logic requires the addition of a Steamline Isolation signal on 2 out of 3 i coincidence of High Negative Steam Pressure Rate (rate-lag compensated) coincident with P-11 Pressurizer Pressure functions (Figure 3.3-3, Sheet  ;

l

1) and SI and Steamline Isolation on 2 out of 3 coincidence of low steamline pressure (lead-lag compensated) (Figure 3.3-3, Sheet 2). With the addition of the High Steamline Pressure Rate signal, srotection is provided to the plant when the plant is between cold and 1ot shutdown  ;

j conditions. Figure 2, shows the major additions and deletions to the t, Steamline Break Protection System.

In the Engineered Safeguards Actuation Logic cabinets the existing 2 out of 3 high steamline differential pressure logic for actuation of SI is-replaced with 2 out of 3 low steamline pressure logic (lead / lag i compensated) to initiate SI and Steamline Isolation.. Twelve (12) inputs .

L from the process protection system comparators are used for either of the two logic arrangements, resulting in no net increase or decrease in input or testing relays. The logic arrangements use identical comparator ,

signals and trip status lamps. A decrease of three (3) reactor trip first-out annunciators results from the implementation of the low steamline pressure logic.

l I

l Original 2 out of 4 logic for the high steamline flow coincident with low

• steamline pressure or P-12 lo-lo Tavg for Steamline Isolation and SI is -

replaced with 2 out of 3 high steamline pressure rate logic (rate / lag compensated)toinitiateSteamlineIsolation. Each logic arrangement uses l_ twelve (12) inputs from the process protection system comparators, resulting in no net increase or decrease in input or testing. relays. The same number of computer signals and trip status lamps are used for either

! logic arrangement. One existing reactor trip first-out annunciator is L

replaced with a standard annunciator, i 1 l l The Train A and B Steamline SI Block Control manual control board switches )

are used to block Steamline Isolation and SI from high steamline flow l

! coincident with low steamline pressure or low-low Tavg (P-12) are changed -

( with the implementation of the NEW STEAMLINE BREAK PROTECTION. Included in the new protection logic is an interlock on pressurizer pressure low ,

(P-11) to allow the operator to switch from the low steamline pressure protection to steamline pressure rate during normal heatup and cooldown 3-12 l l

l l

_ _ -operations. During this time, a manual block cf Safety Injection and Steamline Isolation on Low Steamline Pressure is provided. Additionally, Steamline Isolation on High Negative Steam 11ne Pressure Rate is permitted

. . when the manual block has been initiated. When pressurizer pressure increases above the P-11 setpoint, the normal protection system is automatically reinstated. During this time, Safety Injection and Steamline-Isolation are provided on Low Steamline Pressure and Steamline Isolstion on High Negative Steamline Pressure Rate are defeated.

Implementation of these changes do not require the associated computer signals and block status lamps to be modified.

The Eagle 21 system has been designed to perform automatic surveillance tests on the protection channels associated with the New Steamline Break Protection functional upgrade.

l ,

l 3.3.3 ALARMS, ANNUNCIATORS AND STATUS LIGHTS l Additional control room alarms, annunciators and status lights are provided as part of the New Steamline Break functional upgrade. These additional indications are as follows:

L

1. A trip. status light is provided for each High Steam Pressure Rate Comparator (3 per loop) and for each Low Steamline Pressure Comparator (3 )er loop). This status light informs the operator that a Hig1 Steam Pressure Rate or Low Steamline pa Pressure comparator has tripped for the channel in question.

2. An alarm and annunciator is provided (1 per loop) for High Steam Pressure Rate and Low Steamline Pressure. This alarm and annunciator informs the operator that 2 out of 3 coincidence logic for a loop has been satisfied and that a Steamline Isolation (High Steam Pressure Rate interlocked with Permissive P 11) or Safety Injection and Steamline Isolation (Low Steamline Pressure without Permissive P-11) has been actuated.

9 3-13

l

)

l EXISTING STEAMUNE BREAK PROTECTION SYSTEM  !

L .

l HIGH LOW HIGH LOW HIGH STEAMUNE PRESSURIZER LO LO CONTAINMENT -

STEAMUNE STEAMUNE DIFFERENTIAL PRESSURE Tavg PRESSURE PRESSURE FLOW PRESSURE AND LEVEL

. a JLJL JLJL mD mD U

• o 1F

' LOCKED DURING HEATUP AND C00LDOWN Hi H1 CONTAINMENT PRESSURE 1r it 1r 1r 1r it it

' SAFETY f m STEAMUNE

' INJECTION ISOLATION SHEET 1 0F 2 FIGURE 3.3-1 eldsk-3-14

NEW STEAMUNE BREAK PROTECTION SYSTEM (USED ONLY DURING NORMAL COOLDOWN AND HEATUP DPERATIONS)

'N HI-HI LOW HIGH T MU" '

CONTAINMENT STEAMLINE CONTAINMENT pp g URE PRESS RE PRESSURE RE RATE AND LEVEL o

y v v vvv_

STEAMLINE SAFETY ISOLATION INJECTION.

r GU E 3.3.'

SHEET 2 0F 2 NEWSBR> -

3-15

!~

OLD STEAMLINE: BREAK PROTECTION LOGIC

i. (DELETED)

STEAMLINE DIFFERENTIAL PRESSURE i

I IV ll Ill - 11 I Ps - P4 Pi - P4 Pt - Ps P2 - Ps P2 - P4 PS - P2 a l PB ll PB l PB li PB' l l PB ll PB l I PB l PB- l l PB ll PB l l PB l l PB

b. l Y Y Y Y Y Y Y YY Y' YY Y l J 1 J l J l J l J l J E -

.ir 1r.+ 1r 1r i r_ _ _1r 1r 1r 1r-1r1r_

P4 Ps P2 Pt 2/3 LOW 2/s LOW 2/3 LOW */3 LOW I I I

$__t 1 r v f 1 1r SHEET 1 OF 2 .

FIGURE 3.3-2 SAFETY INJECTION

~ s- -

, -r - - e _ ._ - _ _ _ , -

- . _ - - _ _ . - _ _ _ . _ . - . _ _ . _ . _ . _ _ _ . - =

QLD STEAMLINE BREAK PROTECTION LOGIC (DELETED) STEAMUNE s.t HI STEAMUNE FLOW LOW STEAMUNE PRESSURE BLOCK CONTROL i

(DOP 1 LOOP 2 .AOP 3 ,AOP 4 , BOP 1 LDGP 1 LOOP 3 LOOP 4

"" ~~

J J J J J J J J 1 1 1 1 3 r 3 7{

l i i P-12

() O ;7 2'4 .

' ~'

E $1 ri n t _

1 r? j r1 ri r _

l l

2/4 1

O 1 7 t

kk i L

f "

STEAMUNE ISOLATION Figure- 3.3-2 se Sheet 2 of .2

NEW STEAMLINE BREAK PROTECTION LOGIC -

HIGH STEAM PRESSURE RATE (RATE - IAG COMPENSATED) -

3 LOOP 1 LOOP 2 LOOP 3 LOOP 4 1 11 N I 11 m I 11 NI- I N N '

I I 'I I I I I I I I I I u v1 r of

~

u nir u u1F r uir r t 2/3 2/3 2/3 2/3 I P-11

.t r TV "t ut -l O

~

uu u ISOLATION LOW STEAMUNE PRESSURE SwEn nuecnoN mo STEAMUNE ISOLATION Figure 3.3-3 ( w 2)

Sheet 1 of 2

NEW STEAMLINE BREAK PROTECTION LOGIC LOW STEAMLINE PRESSURE (LEAD-LAG COMPENSATED)

LOOP'1 i_oOP '2 i_OOP 3 i_OOP 4 si w i n sti i n in i n w I PB~ Il PB ll 8'8 l I PB ll PB ll PB { PB ll PB ll PB l l PB ll PB ll 'PB l YYYYY NYYYY YNYNY Y YY YY +

1 1 1 1 1 1 1 1 1 1 1 1

,r,r+ +,r+-- +,r+ +, r+

2/s 2/s 2/s 2/s Y

O O O 1r 1r 1r 1r 1r 1r 1 r 1 r__

+, r, r +-

l (h .

1 1r FIGURE 3.3-3 se INJECVON AND SHEET 2 OF 2 STEAMUNE ISOLATION LJDhD-tAS

.- ~ - . - - . . , - _u. :. : . .. --z. -- --- . . . . -.:---.

~

3.4 ENVIRONMENTAL ALLOWANCE MODIFIER / TRIP TIME DELAY (EAM/TTD) 3.

4.1 DESCRIPTION

l In June 1985, the Westinghouse Owners Group (WOG) established a Trip i

Reduction and Assessment Program (TRAP) to address the announced goai of  ;

'the Nuclear Utility Management and Resources Committee (an industry l oversight group) to achieve a "significant" reduction in unnecessary  :

reactor. trips. The WOG TRAP commissioned a review of operating experience i

between 1979 and 1985 at Westinghouse supplied plants, which revealed that  ;

the largest number of automatic reactor trips (about 40 percent)'were i associated with the feedwater system.-

This review was'followed by several feasibility studies to identify and estimate possible sources of available margin, which could be applied to reduce the frequency of unnecessary feedwater system related reactor l

trips. - Two approaches' were identified. The first~ approach automatically _

adjusts the allocation of instrument uncertainties in the steam generator low-low level trip setpoint. This approach was developed into the Environmental Allowance Modifier (EAM). The second approach delays the steam generator low low level protection function actuations at low power levels. The Steam Generator Low-Low Level Trip Time Delay (TTD) has-been

, developed to apply the second approach.

L 1 3.4.2 DESIGN AND IMPLEMENTATION

'a_ 3.4.2.1 ENVIRONMENTAL ALLOWANCE MODIFIER (EAM) ,

l With the implementation of the Environmental Allowance Modifier (EAM)

L, functional upgrade implemented as part of the Eagle 21 Process-Protection System, the steam generator low-low level trip setpoint is adjusted depending upon the containment environment as determined by state of the L containment pressure EAM setpoint. When containment pressure is below the EAM setpoint, the normal environmental allowance is added to the steam generator low-low level setpoint and when containment pressure is above '

the EAM setpoint, the adverse environmental allowance is added to the .

steam generator low-low level setpoint. The normal environment low-low level'setpoint will always be lower than the adverse environment low-low L level setpoint. By implementing this aiethodology, the frequency of unnecessary steam generator low-low level related trips will be decreased by increasing the operating margin (the difference between the normal environment steam generator low-low level setpoint and the adverse i environment low-low level trip setpoint) due to the environmental allowance adjustment. Figure 3.4-1 represents the EAM as it is L implemented in the Eagle 21 system.

l

• 3-20

The Eagle 21 system has 'been designed to allow the containment pressure channelsforsprayactuatignandsafetyinjectiontobetgsged(

l.) ,c . Thus, there is I.

~

. ..) ' for the associated Steam Generator Low-Low Level channels to default to the-adverse environment setpoints when the containment spray actuation and ,

safety. injection channels are in test.

The conceptual design of the EAM is. described in Reference 2. This report was reviewed by the NRC staff and approved. In January 1988, the staff issued a Safety Evaluation Report (SER) approving _the conceptual design of EAM. The NRC' staff found the report acceptable for-referencing the the licensing applications to the extent specified under the limitations delineated in the report and the SER.

The information contained in the SER will be used as a basis for licensing EAM. As noted in the WCAP, the conceptual design of the EAM consisted of the following:

1. All logic decisions were implemented in the SSPS.

2. Each protection set was represented by four (4) steam generator.

channels and a single containment pressure channel. ,

3. The decision logic, performed in the SSPS utilized a 2-out of 2 coincident logic between the 2 out of 4 coincident logic of the Adverse Low-Low Steam Generator level per Protection Set- and the 2 out cf 4 Containment Pressure above setpoint (adverse containment) ft,r all four protection sets. .

4. The EAM Adverse Contailmnt Pressure reset switch was located in the Process racks. .

Several differences exist between the conceptual design and functional-upgrade of EAM as it will be installed in Eagle 21. These include the following:. ,

1. The design and all logic decisions will be implemented in the Eagle 21 process protection system.

2. Only 2 steam generator level channels represent Protection Sets I and. II, while 4 steam generator level channels represent Protection Sets III ad IV. Additionally each protection set is represented by a single Containment Pressure channel.

3. Where the 2 out of 4 decision logic for all protection sets '

were present for the containment pressure above setpoint (adverse), this logic is replaced with a single adverse containment pressure channel input per protection set to the .

setpoint select circuitry to the Trip Time Delay circuitry.

3-21

l l

l I

. Although these differences exist, the changes to the overall conceptual design of the EAM as discussed in the WCAP will not impact the conclusions 1 reached in the SER due to the results derived from the re-analysis of the ,

i accident analysis as described in Section 2.3. '

3.4.2.1.1 ALARMS, ANNUNCIATDRS AND STATUS LIGHTS Additional control room alarms, annunciators and status lights are provided as part of the Environmental Allowance Modifier functional upgrade. These additional indications are as follows:

u 1. One annunciator window for the 4 containment pressure channels is provided in the control room to indicate to the operator that an adverse containment environment has been detected.

L Once this condition is indicated, the operator must determine which protection set enabled the annunciator. This is done by observing the channel specific containment pressure indicators in the control room. Once the condition has been confirmed and isolated to a protection set, then the operator will determine

l. which Steam Generator low low level channels have switched over to the adverse setpoint.

2. No new status lights are provided as part of the EAM functional upgrade.

• ~

3.4.2.2 TRIPTIMEDELAY(TTD)

With the implementation of the Trip Time Delay (TTD) functional upgrade as mart of the Eagle 21 Process Protection System Steam Generator Low-Low

.evel Reactor Trip, a series of programmed trip delay times are established. These time delay generated are based upon the prevailing power level at the time the steam generator low-low level condition is

' roached and on the number of steam generators that are affected. These delay times are longer at lower power versus high power. The delays are L also longer when only one steam generator has a low-low level condition as opposedtggrethanonesteamgenerator. For TVA - Sequoyah Units 1 and 2, the M. time delay is programmed into the TTD logic for Protection Sets I ar.d II since only two (2) steam generators are represented (Figure 3.4-3). By using this method, Protection Sets I and II will be provided with the most conservative. time delay. For Protection Sets III and IV, since all four (4) steam generators are represented, the time delay chosen is dependent upon power level and number of steam generators affected

. (Figure 3.4-2). This correlates to the use of the programmed time delay values which detain the actuation of reactor trip, main feedwater isolation and the initiation of auxiliary feedwater so that steam generator level anomalies such as shrink / swell transients may naturally stabilize.

3 22

?

- The Eagle 21 system has been designed to allow the Narrow Range Thot and "

Teold RTDs for Thermal Overpower and Overtemperagure Delta-T protection to

.Ja, . Thus, there is [.

-betegd[

)

for the associated Steam Generator Low-Low Level channels to ,

default- to a zero time delay setpoint when the Thermal Overpower and Otertemperature Delta-T channels are in test.

The conceptual design of the TTD is described in Reference 3. This report was reviewed by the NRC staff and approved. In January 1988, the staff issued a Safety Evaluation Report (SER) approving the conceptual design of TTD. The NRC staff found the report acceptable for referencing in licensing applications to the extent specified and under the limitations delineated in the report and the SER.

The information contained in the SER will be used as a basis for licensing TTD. As noted in the WCAP, the conceptual design of the TTD consisted of the following:

-1. All logic decisions were implemented in the SSPS. t

2. Each protection set was represented by four (4) steam generator channels.

3. Nuclear Flux was used as an input to TTD to enable the trip time delay select logic.

4. A series of discrete timers were installed to provide the time .

-delays when setpoints were reached.

^ '

Several differences exist between the conceptual design and functional upgrade of TTD as it will be installed in Eagle 21. These include-the following:

1. The design and all logic decisions will be implemented in the-Eagle 21 process protection system.

2. Only 2 steam generator level channels represent Protection Sets I and II, while 4 steam generator level channels represent Protection Sets III and IV.

3. Where Nuclear Flux was used as an input to the TTD logic, this I input is replaced by Delta-T due to the increased uncertainties associated with the nuclear flux detectors at low power levels.

l

4. The discrete analog timers are replaced with microprocessor

. controlled continuous time delays. By using these programmed time delays rather than the discrete timers, the signal path is ,

uninterrupted allowing for a more accurate signal to be processed.

3-23 l

. 1

I I

, Although these differences exist, the changes to the overall conceptual design of the TTD as discussed in the WCAP will not impact the conclusions reached in the SER due to the results derived from the re-analysis of the

, accident analysis as described in Section 2.3.

3.4.2.2.1 ALARMS, ANNUNCIATORS AND STATUS LIGHTS Additional control room alarms, annunciators and status lights are provided as part of the Trip Tine Delay functional upgrade. These additional indications are as follows:

1. A low-low level alarm and annunciator window will be provided for each Steam Generator to signify that the water level in at least one channel has dropped below the low low level setpoint in that steam generator and that the TTD time delays have started.' When this condition is indicated, the operator will then observe the ' individual steam generator level channel indicators to determine if the one-out-of-four (Protection Sets III and IV) or the two-out-of-four (Protection Sets I, II, III

-& IV) time delay is in effect. >

2.- No new status lights are provided as part of the TTD functional upgrade, t

Lo t.

I

[

3-24

. . .. .. 3 . .

~*

r 4

ENVIRONMENTAL ALLOWANCE MODIFIER M

~

nescr samm . .

h ,

e. @. ~

l=1 I=l i'

= _4 +

CALC STATE .

3

)

l l rN "mW Y3 l

_ ___ 1 4 ,r i r Z (o) 1r

• 1r 1 r 1 r .

~

vi r

(=)(=)(=)(=I )

I

+

l

+

I i

Co) e (a)

+

Co

+

o r3 i i = a='- "A";" "a? "&P V

f 0

FIGURE '3.4-1

~

semuson

-_,..._a

TRIP. TIME DELAY (FOUR STEAM GENERATORS)  ;

SO tJDOP 1 30 LOOP 2 50 LOOP 3 So LOOP 4 I I I I i

g __ .g ___.Y _

g --

+ + + + '

(4:::=-) (_4:a"-j _

( J:la"-j (Jll= =_)

o c -sgtny- o -sgtcy e so tmp

• Sb'N-

?  ?  ?  ?

bYd CW) CW_._) (_ W,__)

1r 1r 1r E

i' c S tifo,'"- J" tIEOe 2 ci* tIfor.

3 g- tIfoeY  ;

nr g oetra r

(=-)

-3 m

10P 1r1L_ 1 Li t. _.

1 r _1 r g &" -

" " ** smout vro-o m g ,< a mgv mg,1. m,gy X

4

$ e X $ =( m-A

=h}-, - m- ,- ,

V- 1r~ r- 1r  !

I ooc 1 i

l ooc 'l i

I ooc 1 i

l ,3oc l ,- we onAv Exceroen ,

tv ty ty ty 5 3 5 5

. As A1 __

bs tb < ,

m , o h Pero % ' b sr w FIGURE 3.4-2  :

N4 ,

_,,,-------------q-t 1

s n n b i

+ B

-+ g $> 5 g v d vl- -

o 8 -

O

{

o Y+l [l __i gl{ .

V . l .

h W <( "V a g - E l- 3 . ,,

6 o ,1 si o

i c i  ?

+

!Tr~*@*I+ $ 9 b- >O[g 4 o --

f! 23L-*l}j V '+ g g

l 0V "d

E

[ ar*ll V ,V "ge' 29 V 1. $ 11 5

e i

s n s. ,

Og .

6

~

b-g m -

->3[ n +o le

.. g - -

1 i  ! o +

,1bbi

.g 3,, ._

i i ,

in E l,

,q-- e $

- 1

+

L

-> sg 9

_ "a w

hl 11 L i

3-27

l 3.5 ELIMINATION OF LOW FEEDWATER FLOW REACTOR TRIP - MEDIAN SIGNAL v SELECTOR-3.

5.1 DESCRIPTION

l The basSc function of the reactor protection circuits associated with steam generator low low water level trip channels is to preserve the steam l

generator as a heat sink for removal of residual heat. This automatic protective action is taken before the steam generators are dry to maintain

-the heat sink, reduce the capacity and starting time requirements of the l Auxiliary Feedwater Systen (AFS , and to minimize the thermal transient on )

the Reactor Coolant System (RCS . This trip is actuated on coincidence of l two out of three low-low water evel signals in any steam generator. This  !

modification is not part of the Eagle 21 process protection system, but will be used to eliminate the Low "eedwater Flow Reactor Trip.

H Originally, the low feedwater flow reactor trip was used in conjunction '

! with the steam generator low-low water level reactor trip as a means of satisfying IEEE Std. 279-1971, Control and Protection System Interaction (CPI) criteria (Figure 3.5-1). Paragraph 4.7.3 of the standard states:

"Where a single random failure can cause a control system action that results in a generating station condition requiring protective action and can also prevent ) roper action of a protection system channel designed to i protect against tie condition, the remaining redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure."

i To address the CPI concern of the IEEE standard and eliminate the need for i the low feedwater flow reactor trip, in addition to enhancing the l reliability of the Feedwater Control System the following evaluation was 1 performed. It was determined that these objectives of the MSS ara accomplished by preventing a failed instrument channel from chusing a control system action which will initiate a plant transient that may require protective action. Since no adverse control system action may now -l result from a single, failed protection system instrument channel -a j second random protection system failure (as would otherwise be required by IEEE Std. 279-1971) need not be considered. Thus, the MSS together with separate steam generator narrow range level protection channels provides compliance with IEEE Std. 279-1971, control and protection interaction criteria, as specified in Paragraph 4.7.3, thereby satisfying the original basis for the low feedwater flow reactor trip. Additionally, it is noted that'the Sequoyah accident analyses have never taken credit for the low feedwater flow reactor trip. l Thus, since IEEE Std. 279 1971, control and protection interaction i

criteria is satisfied with implementation of the MSS and the accident analyses for steam generator low level protection is satisfied through the (L - steam generator low-low level reactor trip, there is no requirement to maintain the low feedwater flow reactor trip.

L

\. l l- 3-28 l -

l

5 3.5.2 DESIGN AND IMPLEMENTATION . ,

In order to eliminate the low feedwater flow reector trip and to improve the reliability of the Feedwater Control System (FCS), a Median Signal .

Selector control sy(MSS) stem (Figure for each 3.52.steam generator The MSS is installed selectt, the median ofinthree the plant steamprocess generator narrow range level) input signals which prevents an input channel failure from causing a control system transir.nt requiring protective ,

action. By preventing the control system transient from occurring, the MSS reduces challenges to the RPS and minimizes fatigue buildup on critical components thus increasing plant availability. In this role, the MSS serves as a functional isolator between the control and protection systems thereby eliminating the need for the low feedwater flow reactor trip which exists to satisfy control and protection system interaction criteria. The types of failures and human errors that initiate control system upsets in existing system designs and can be prevented by using the MSS are:

1. Failure of a sensor which is aligned to provide an input signal to the control system.

2. Malfunction of a process protection channel which provides an input signal to the control system.

3. Operator / technician error by performing surveillance test on a process channel aligned to the control system without switching to manual control.

The signal selection devices are physically located within the control system racks. The reasons for this location are three fold. First, no single prov.ction channel set has enough information to determine if the a electrical r.ignal for a given process variable is valid. To provide the necessary information would require a considerable increase in the amount ,

of interchannel communication among the protection channel sets. This i would lead to concerns about the independence of the redundant portions of the protection system. Second, is that it is not relied upon to perform a ,

safety function such as reactor trip or engineered safety features actuation. Third, a failure of the MSS would not compromise the ability of the protection system to perform its safety related functions (i.e.,

failure of the signal selector will not disable a protection system channel).

For a detailed description of the design and implementation of the MSS for elimination of the low feedwater flow reactor trip, refer to Reference 8.

3.5.3 ALARMS, ANNUNCIATORS AND STATUS LIGHTS ,

With the elimination of the Low Feedwater Flow Reactor Trip, all alarms, annunciators and trip status lights have been removed. There are no new -

indications provided to the operator as a result of the installation of the MSS.

3 29

---

,,u __ _,,,g, --- - _ , , -- ,

e e e e e PRESENT FUNCTIONAL DESIGN tt"". , t X.,!^ .aWlll"

• • F FW L8'E A F FW LT } l Fr { rr rr er .

AAA u.y qy q.y

<<A. , -(A.y g,,

c , , , ,

T"" T"- 1 1" 1 1 1 E g- g; ..

H V- .

.L2. ++

2/3 l2/2l 1 e.1

-. ~ .,

ISOL )

_._ g _ _____

Feofee.or surCaserel

~

FIGURE 3.5-1

- *. - - ~ _ . . _ .-_

MEDIAN SIGNAL SELECTOR FUNCTIONAL DESIGN

-t -- -

La* A w I"~m""I W A w Im7

' il 9

'Ih"Q c n n > fin I hlr hlr h1 ;11"3) b I I' di (te c- 1 l ..

1 I H I g

I fL G g I

, ,t, ,1,, I

= I I =<= I

" I dnG a to . I ( ,=

I I

,--- g_ a f.

_,,,, _,_ ,3

- ."." I f

~ " ~ ~

FIGURE 3.5-2 .

I 3.6 Control Systems 3.6.1 Control Systems Setpoint Evaluation Replacement of the existing protection system with Eagle 21 hardware and elimination of the RTD bypass loops in the Sequoyah units, introduces add-itional signal processing delays that may require modification of control system setpoints in order to prevent the challanging of safety system setpoints in the event of certain unit transients; e.g., large load re-jections. Nuclev Safety has determined that, with the addition of a lead lag functir.*: on the measured Delta-T, the remaining gains and time constants for the Overpower and Overtemperature Delta T equations have not changed from the current version of the Sequoyah Technical Specifications.

Therefore, the Technical Specification values currently in force, together with the values for the new lead / lag requested by Nuclear Safety were used to evaluate the margin-to trip.

The transient used to evaluate the margin-to-trip was a 50% load rejec-tion from full power. For all of the cases analyzed (different initial rod positions, ramp and step load ch nges, etc.), the minimum margin to an Overtemperature Delta-T was 5.3 F, thus providing sufficient margin to preclude a challange to the safety systems. The overtemperature trip was the most limiting of the delta-T protection functions.

3.6.2 LTOPS Setpoint Evaluation The wide range pressure signals used by the Low Temperature Overpressure Protection System (LTOPS) will be processed through the Eagle 21 system.

The Eagle 21 will replace the old Foxboro protection gear, resulting in a nominal additional instrument time delay of 250 ms. The peak pressures following an overpressure event are sensitive to instrumentation time de- ,

lays, so that the overpressures determined from previous analyses are no longer a viable basis for setpoint determination.

The setpoint program specified in Table 3.6-1, and shown in Figures 3.6.1 and 3.6.2, includes the impact of the added process instrument delay time resulting from Eagle-21 implementation, as well as the reactor gressure-temperaturelimitsbasedonrevision2ofNRCReg. Guide 1.99, Radiation Embrittle- ment of Reactor Vessel Materials'. The pressure-temperature limits are based on a reactor vessel exposure of 16 Effective Full Power Years (EFPY) for both Sequoyah units. The temperature dependent setpoint function also accounts for a 500F thermal transport gffect (steam generator tube water swept pass the cold leg RTO), and a 27

• F temperature streaming and instrumentation uncertainty. Consistant with current Westinghouse practice, the setpoint program assumes nominal values and steady-state pressure-temperature limits.

3 32

The setpoints have been selected to prevent opening both PORV's at the -

same time, while providing reactor coolant pump number 1 seal protection.

Additionally, PORV setpoint pressure was selected to be above the residual heat removal system relief valve setpoint of 450 psig, although t.10%

accumulation would re: ult in opening the first PORY (PCV 455A) in Unit 1.

a e

f 4

3-33

x

. Table 3.61 Seouovah Units LTOPS Setnoint Procram Seouovah Unit 1 (TVA) LTOPS Setnoints PORY Setnoint insio)

RCS Temp (deo. F) PCV-455A PCV-456 70.0 480.0 505.0 150.0 480.0 505.0 l 180.0 500.0 530.0 '

200.0 525.0 560.0 230.0 570.0 610.0 280.0 705.0 750.0 330.0 695.0 745.0 380.0 685.0 740.0 450.0 2350.0 2350.0 .

4 Seouovah Unit 2 (TEN) LTOPS Setnoints PORV Setooint fosia)

RCS Temp '

(Dec. F) PCV-455A PCV-456 70.0 520.0 545.0 150.0 520.0 545.0 180.0 555.0 585.0 200.0 595.0 630.0 240.0 720.0 760.0 280.0 705.0 750.0 330.0 695.0 745.0 380.0 685.0 740.0 450.0 2350.0 2350.0 3-34 l 1

e Sequo,yah Uni'; 1. COMS Nominal Appadir-G Unit and 7087 Setpl L600 r

\'

to

- )

l . .

/

Yesul Irpiurs = 16IFFT l

1200

/ )

2,000

/ / .

1,800

/ / .

v

$ /QMedir-G, Stendr8t .

1,600 y

1,400

, f

/ /j ,

j 1,200 .

g--

/ g ,

7 1,000 l g PcV- M i l f 5- .

600 p

-] -y '5M g - -

200 I i l 0

t  % 150 250 ' 350 450 RCS femprature (*F) -

FIGURE 3.6-1 L .

o 3-35

i Secuoyah init 2 COMS l Iomlaal Appendix-8 limit and POW 8etyt 1,600 o

' i l.

. , 1.400 l .

un YesselIrposure= 16 IFM -

f } I o00

/ i 8

1.000

/  ;

i v 1,600

/'

/ '

1

e b 1,400 1,200

/ / -

l ,

/

f k

s' -r Appendir-G, Stea dy-Siste ON

. /

/ PG'- l56 U gg t

8 --

/

600 ..-

j f PN-45!

?

! 400 9

r 200 l

0 50 150 250 350 450 RCS femperature ('F) l .

FIGURE 3.6-2 3-36 l

,-. -- - - . - - _ - .- . .-- - - - - - _ ~ _- _

. j 4

i 4.0 PROTECTION SYSTEM SETPOINT METHODOLOGY AND TECHNICAL $PECIFICATION REVISIONS DISCUS $10N i Westinghouse performed calculations to determine new instrument uncertainties for most of the protection functions (both RPS and ESF)

< - for the Sequoyah plants. This was necessary to reflect changes due  !

tol removal of the Foxboro process racks and installation of the l Eagle 21 process racks, RTD bypass piping elimination (RTDBE) and the and Trip Time addition ofonthe Environmental Steam Generator WaterAllowance Modifier (EAM) Removal Level - Low Low. of the Delay (TTD) break Protection System and replacement with the "New" "Old" Steam l version resulted in the elimination of several protection functions, and addition of one new function. The effects of these changes are  ;

noted on the following pages. J 4.1 Effects of Use of Eagle 21 Process Racks Removal of the Foxboro process racks and installation of the Eagle-21 process racks resulted in at least a small change for each protection function affected. The NIS cabinets were not affected by this change, thus NIS Power Range High Setpoint, NIS Power Range Low Setpoint, NIS Power Range Positive Rate - High and NIS Power Range Negative Rate - High Nominal Trip Set >oints and Allowable Values remain unchanged from the current Tecinical Specifications.

Undervoltage RCP and Underfrequency RCP Reactor Trips do not feed the ,

process racks, thus their setpoints and uncertainties are also unaffected. All remaining protection functions were affected for several reasons; 1) the calibration accuracy (RCA), drift (RD) and temperature effect (RTE) values are significantly different from the

! Foxboro process racks, 2) there is no physical comparator (RCSA), now performed in the microprocessor, thus that term has been eliminated.

The changes in these values have a significant impact on the magnitude of the 'T" value and thus the determination of the A310wable Value. A comparison of Appendix "A" for WCAP-11239 Rev 3 and for Rev 4 will note these changes quite quickly. Even though

! there .is a reduction in the magnitude of the "T" value, it is still sufficient to encompass the expected drift of the digital process racks. .

ThemostsignificantShange,fromasurveillancegointofview,is the addition of testing an inoperable channel in Bypass". The l Eagle-21 process racks allow bypassing an inoperable channel when performing surveillance tests on an operable channel. Placing the inoperable channel in " Bypass" results in ii.dication to the operator and allows placing an operable channel in the " Test" mode (which results in it being placed in " Trip"). The applicable " Action" l

statements in the Sequoyah Technical Specifications (Tables 3.3-1 and

! . 3.3 3) have been modified to reflect this capability. >

1

• 41 1

l L _

4.2 Effects of 'New' Steambreak Protection System The 'New' Steambreak Protection System is somewhat of a misnomer. In .

reality the 'New' part is the reliance on Steamline Pressure Low for $1 and Steamline Isolation actuation by itself rather than on the coincidence of Steam Flow in Two Steam 11nes HIch with either -

Steamline Pressure or Tavg. There is also the deletlon of Differential Pressure in Two Steamlines High and the addition of Negative Steamline Pressure Rate - High (for when Steamline Pressure

-Feedwater Low $1 is blocked Flow in Mode Mismatch coinci 3) dent with steam Generator Water Level -Finally, as an adjunc Low Reactor Trip is eliminated. The Nominal Trip setpoint for Steamline Pressure - Low was not changed as part of this effort. The identified trip functions were eliminated and a Nominal Trip Setpoint was defined for the new actuation function (Negative Steamline Pressure Rate - High). The new trip setpoint is identified in the Technical Specifications and Appendix 'A' of WCAP-1123g Rev 4.

4.3 Effects of EAM/TTD The addition of the EAM/TTD results in several significant changes to the Sequoyah Technical Specifications. First, two Steam Generator Water Level . One Low Low reactor based on a maximum containment am trigient temperature of 180setpointsaredeterminegF (inbeled Steam Generator Water Level - Low-Low (EAM)) and one based on the maximum containment ambient temperature postulated for an inside containment Steamline break (labeled Steam Generator Water Level - Low-Low (Adverse)). The second trip setpoint (Adverse) is enabled by a new containment pressure function, Containment Pressure

- EAM. When the containment ambient temperature is less than 180 F for 0 , the expected Containment Pressure containment EAM. Whenpressure the is less temperature than the exceeds setpoingF, 180 the containment aressure exceeds the EAM trip setpoint and Steam Generator Water .evel - Low Low Adverse is enabled. Larger environmental errors are assumed in the determination of the Low Low Adverse trip setpoint, thus its setpoint is significantly higher than the Low Low EAM trip setpoint. This results in a reactor trip sooner and with a higher indicated Steam Generator water level.

in actuation of a Steam Generator Water The Level - Low Low reactor trip TTD function results in a delay (either EAM when the or Adverse)lized power level is less than 50 % RTP. -Two algorithms are uti , one based on only one Steam Generator indicating Low-Low level and the other based on multiple Steam Generators indicating Lowdow level.

These algorithms calculate a delay in reactor trip actuation based on the reactor power at the time the logic for trip was fulfilled.

These are continuous functions over the power range of 0 to 50 %

RTP. This is possible due to the use of the digital process racks. .

Use of the analog process racks generally results in discrete, stepwise time delays as a function of power level. .

4-2

The Sequoyah Technical Specifications and Appendix A of WCAP-11239 i . Rev 4 were modified to reflect the addition of the EAM and TTD functions. The Steam Generator Water Level Low Low EAM trip setpoint reflects the instrgment uncertainties for operation below an

- ambient temperature of 180 F and the Low Low Adverse trip setpoint reflects temperaturethe instrupF.nt of 180 uncertainties for operation The 1TD delays above reflect single or an ambient multiple affected Steam Generators and a power range of 0 to 50 % RTP.

4.4 Effects of RTD Bypass Elimination RTDBE affects those functions (both control and protection) which receive an input from TH . This includes, Rod Control, OT delta-T, OP delta-T, Vessel delta T Equivalent to Power, the Precision RCS Flow Calorimetric and thus the Loss of Flow reactor trip and indicated RCS Flow. These affects are due to the number of RTDs assumed to be operational and the revised streaming uncertainties assumed for the Hot Leg. Sequoyah has installed not only the standard three Hot Leg RTDs but also a second Cold Leg RTD. This is reflected in the uncertainty calculations for the Precision RCS Flow Calorimetric. For control and protection functions, loss of one Hot Leg and one Cold Leg RTD is assumed for the uncertainty calculations. Since the digital process racks are being installed, the uncertainty [

~

' )+&,c. As for past plants that have installed the Westinghouse RTDBE, the uncertainty calculations aerformed for the above noted functions reflect the number of opera)1e RTDs and the corresponding streaming values.

4.5 Uncertainty calculations The uncertainty calculations reflecting the effects noted in sections 4.1, 4.2, 4.3 and 4.4 above are explicitly noted in WCAP-11239 Rev 4 for the following functions:

Overtemperature delta-T (Table 3-5)

Overpower delta-T (Table 3-6)

Pressurizer Pressure - Low reactor trip (Table 3 7)

Pressurizer Pressure - High (Table 3-7)

Pressurizer Level - High (Table 3-8)

Loss of Flow (lable 3 9)

Steam Generator Water Level - Low Low (Adverse) (Table 3-10)

Steam Generator Water Level - Low-Low (EAM) (Table 3-10)

Containment Pressure - EAM (Table 3-12)

Containment Pressure - High (Table 3-12)

Containment Pressure - High-High (Table 3-12) 4-3

l 5.0 RTD BYPASS ELIMINATION SUPPLEMENTAL INFORMATION Westinghouse Electric Corporation has been contracted by The Tennessee Valley Authority to remove the existing Resistance Temperature Detector (RTD) Bypass

. System and replace this hot leg and cold leg temperature measurement method with fast response thermowell mounted RTDs installed in the reactor coolant loop piping. This section discusses the historical background of the modification, the mechanical modifications mode, the response time requirement and supporting temperature streaming tests.

5.1 HISTORICAL BACKGROUND Prior tc 1968, PWR designs had been based on the assumption that the hot leg temperature was uniform across the p M*. Therefore, placement of the temperature instruments was not consicered to be a factor affecting the accuracy of the measurement. The hot leg temperature was measured with direct immersion RTDs extending a short distance into the pipe at one location. By the late 1960s, as a result of accumulated operating experience at several plants, the following problems associated with direct immersion RTDs were identified:

Temperature streaming conditions; the incomplete mixing of the coolant leaving regions of the reactor core at different temperatures produces significant temperature gradients within the pipe.

The reactor coolant loops required cooling and draining before the RTDs could be replaced.

. The RTD bypass system was designed to resolve these problems; however, operating plant experience has now shown that operation with the RTD bypass loops has created it's own obstacles such as:

plant shutdowns caused by excessive primary leakage through valves, flanges, etc., or by interruptions of bypass flow due to valve stem failure.

Increased radiation exposure due to maintenance on the bypass line and to crud traps which increase radiation exposure throughout the loop compartments.

The proposed temperature measurement modification has been developed in response to both sets of problems encountered in the past. Specifically:

Removal of the bypass lines eliminates the components which have been a major source of plant outages as well as Occupational Radiation Exposure (ORE).

o Three thermowell mounted hot leg RTDs provide an average measurement (equivalent to the temperature measured by the bypass system) to account for temperature streaming.

Use of thermowells permits RTD replacement without draining the reactor coolant loops.

5-1 ,

i I

Following is a detailed description of the effort required to perform this 4

modification.

i 5.2 MECHANICAL MDDIFICATIONS The individual loop temperature signals required for input to the Reactor )

Control and Protection System will be obtained using RTDs installed in each -

i reactor coolant loop. l 5.2.1 Hot Leg a) The hot leg temperature measurement on each loop will be accomplished with three fast response, narrow range, i i

single element RTDs mounted in thermowells. To accomplish the sampling function of the RTD bypass manifold system and minimite the need for additional hot leg piping penetrations, the thermowells will be located within the three existing RTD bypass manifold scoops. [

. . N'C. These three RTDs will l measure the hot leg temperature which is used to ,

calculate the reactor coolant loop differential l temperature (AT) and average temperature (Tayg).

b) This modification will not affect the single wide range RTD currently installed near the entrance of each steam generator. This RTD will continue to provide the hot leg temperature used to monitor reactor coolant temperature '

during startup, shutdown, and post accident conditions.

5.2.2 Cold Leg ,

a) Two fast response, narrow range, single-element RTD will be located in each cold leg at the discharge of the reactor coolant pump (as replacements for the cold leg RTDs located in the bypass manifold).

These RTDs will measure the cold leg temperature which is used to calculate reactor coolent loop AT and T . The existing cold leg R1% bypass penetration n85Elewillbemodified(Figure 5.2-2)toacceptoneRTD thermowell. A separate new cold leg boss and penetration i' will be added to accommodate the second thermowell and RTD (Figure 5.2-3). I b) This modification will not affect the single wide range 1 RTD in each cold leg currently installed at the discharge 1 of the reactor coolant pump. This RTD will continue to . l provide the cold leg temperature used to monitor reactor ,

coolant temperature during startup, shutdown, and post -

I accident conditions. 1 52

. I

1 l

5.2.3 Crossover Leg The RTD bypass manifold return line will be capped close to the nozzle on the crossover leg.

5.3 TESTING There are two specific types of tests which are performed or have been performed to support the installation of the thermowell mounted fast-response RTDs in the reactor coolant piping: RTD response time tests and hot leg temperature streaming tests. The response time for the Sequoyah Units 1 & 2 application will be verified by in-situ testing. Data from thermowell/RTD performance at operating plants provide additional support for the system by confirming the stability of the temperature streaming.

5.3.1 RESPONSE TIME TEST These RTD/thermowells must exhibit a response time bounded by the values shown in Table 5.1-1. The revised response time has been factored into the transient analyses discussed in Section 2.0.

In order to verify the response time of Table 5.11 response time testing of the Rdf RTDs will be performed in situ at Sequoyah Units 1 & 2. This testing will demonstrate that the RdF RTDs can satisfy the response time requirement when installed in the plant.

5.3.2 STREAMING TEST Past testing at Westinghouse PWRs has established that temperature stratification exists in the hot leg (pipe with a tempegaguregradientfrommaximumtominimumof

)' A test program was implemented at an operating plant to confirm the temperature streaming magnitude and stability with measurements of the RTD bypass branch line temperatures on two adjacent hot leg pipes.

Specifically, it was intended to determine the [

J a', c are used to determine an average temperatur'e. This plant specific data is used in conjunction with data taken from other Westinghouse designed plants to determine an appropriate temperature error for use in the safety analysis and calorimetric flow calculations.

Section 4 will discuss the specifics of these uncertainty

• considerations.

. The test data was reduced and characterized to answer the three objectives of the test program. [ '

Ja,c, 53

In addition. [

38,'Thisis- ,

inferred by the[ ,

8

• 36,c,

[

.)a.c. The measurements at the operating plants, obtained from thermowell RTDs installed inside the bypass scoops, were expected to be, and were found to be, consistent with the measurements obtained previously from the bypass loop RTDs.

4 s

1 i

l

'l l

i 4

e 54 i

1

7 -q p ,

r 5

4. , C, 1 1

l 1

1

)

l l

l l

1 1

l l

l I I l

l l

cl' l

t' Figure 5.21 Hot Leg RTD Scoop Modification for Fast Response RTDinstallation e

ootonio4iino 5-5 4

-,e,- ., < . - - - - . - - . - - - - _ _ _ . - - - ,v-., , - - , - - .--~,,n, .. . ,-,. --- .---,,....,,-.w-+ ,

l 3 i

j AC J

4 s

Figure 5.2 2 Cold Leg Pipe Nozzle Modification Fast Response RTD installation 0010h10411790 b'0

L oc.

e Figure 5.2 3 Additional Boss for Cold Leg Fast Response RTD s

4 ocio7:toctino 5-7

TABLE 5.1-1 RESPONSE TIME PARAMETERS FOR RCS TEMPERATURE MEASUREMENT RTDFast Resmonse Bypass System Tiermowell RTD -

System

~

~ ~ ~

RTD Bypass Piping and Thermal Lag (sec).

RTD Response Time (sec)

Electronics Delay (sec)

Total Response Time (sec) 6.0 sec 8.0 sec l

. l 5-8 .

6.0 REFERENCES

i Love, D. S., et. al., 'Steamline Break Mass / Energy '

1. Butler, J. C.,

Releases For Equipment Qualification outside Containment - Report to the Westinghouse Owners Group High Energy Line Break / Superheated , ,

Blowoowns Outside Containment Subgroup *, WCAP 10961 Rev.1, Oct.1985.

2. Catullo, W. J., Kolano, J. A., Wooten, L. A., " Modification of the Steam Generator Low Low Level Trip Setpoint to Reduce Feedwater Related Trips", WCAP 11342 P A Rev. 1, March 1988.

3. Miranda, S., LaMuro, R. C., McHugh, C. J., ' Steam Generator Low Water '

Level Protection System Modifications to Reduce Feedwater Related Trips", WCAP-11325 P A Rev. 1. February 1988  ;

4. J. M. Geets R. Salvatori, 'Long Term Transient Analysis Program for l PWRs (BLK0UT Code),

• WCAP 7898, June 1972. l S. ANSI /ANS-5.1+1979 American National Standard for Decay Heat Power in Light Water Reactors, August 29, 1979

6. Burnett, T.W.T., McIntyre, C. J., Buker, J. C., 'LOFTRAN Code Description", WCAP-7907-P A, April 1984.

7. Erin, L.E., ' Topical Report Eagle 21 Microprocessor Based Process Protection System", WCAP 12374, September 1989.

8, Hermigos, J. ,' Median Signal Selector For Foxboro Series Process  !

Instrumentation, Application To Deletion Of Low Feedwater Flow Reactor , )

Trip", WCAP 12417, October 1989.

e 6-1

7.0 SUPPLEMENTAL DOCUMENTS t

1. Functional Requirements (TVA/300),

4

2. FSAR Chapter 7 Mark-ups.

3. FSAR Chapter 15 Mark-ups.

4. Technical Specifications Mark-ups.

5. Safety Evaluation (SECL-89 863).

6. Environmental and Seismic Qualification, WCAP 8687, Supplement 2-E69A and E-69B (Proprietary), and WCAP-8587, Supplement 1, EQDP ESE-69 (Non-Proprietary).

7. Noise, Fault, Surge Withstand Capability report, the EMI And RFI Qualification Testing report, WCAP-11733 (Proprietary),and WCAP 11896 (Non-Proprietary).

8. Median Signal Selector (MSS), WCAP 12417 (Proprietary), and WCAP-12418 (Non-Proprietary).

9. Setpoint Methodology, WCAP- 11239, Revision 4, (Proprietary), and WCAP-11626, Revision 4,(Non-Proprietary).

10. Eagle Topical Report, WCAP-12374 (Proprietary), and WCAP-12375 (Non-Proprietary). *

11. Verification And Validation Report.

12. Field Change Notices.

TENO-40467B RTDBE 40569, A MSS 40570, A MSS, NSLB 40572, A MSS 40574, A SG WIDE RANGE LEVEL PAMS TVAO-40568B RTDBE 40570, A MSS 40571, A MSS, NSLB 40572, A MSS 40573, EAGLE 21 40574, A SG WIDE RANGE LEVEL PAMS 8

7-1

,