ML20050A935

From kanterella
Jump to navigation Jump to search
Nonproprietary Safety Evaluation of Reactor Power Cutback Sys.
ML20050A935
Person / Time
Site: 05000470
Issue date: 03/31/1982
From:
ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY
To:
Shared Package
ML19268D122 List:
References
NUDOCS 8204020416
Download: ML20050A935 (38)


Text

Enclosure 3-NP to LD-82-039 a

SAFETY EVALUATION OF THE REACTOR POWER CUTBACK SYSTEM REACTOR DESIGN MARCH 1982 8

i COMBUSTION ENGINEERING, INC. I NUCLEAR POWER SYSTEMS l POWER SYSTEMS GROUP l WINDSOR, CT l

1 0204020416 820330 PDR ADOCK 05000470 A PDR L

y i LEGAL NOTICE This response was prepared as an account of work sponsored by Combustion Engineering, Inc. Neither Combustion Engineering nor any person acting on its behalf:

a. Makes any warranty or representation, express or implied including the warrantics of fitness for a particular purpose or merchantability, with respect to

, the accuracy, completeness, or usefulness of t.1e information contained in this response, or that the use of any information, apparatus, method, or process disclosed in this response may not infringe privately owned rights; or

b. Assumes any liabilities with . 9spect to the use of, or for damages resulting from the use of, any information, apparatus, method or process. disclosed in this response.

t S

,4

i 4

l SAFETY EVALUATION OF THE REACTOR POWER CUTBACK SYSTEM I

l .

REACTOR DESIGN MARCH 19E2 4

t COMBUSTION ENGINEERING, INC.

Nuclear Power Systems Windsor, Connecticut, 06095 G

r a

I r t

1

, ABSTRACT This report provides a brief desci'ption of the C-E Reactor Power Cutback System (RPCS). The interactions of the RPCS with the Core Protection Calculators (CPC) and the accommodations necessary in the CPC to make them compatible with the RPCS are also discussed. The report presents the results of evaluations of the performance of CPC for events that require RPCS ac'.uation. These evaluations cover normal operation of the RPCS, single failures of the RPCS, and the effect of CPC/CEAC modifications for other events considered in the FSAR. This report demonstrates that the safety of the plant can be assured with the RPCS installed.

This report is generic for Reactor Power Cutback on CE plants that use the CPC system and has specific applicability to Waterford 3 and the CE System 80 plants.

e i

l

SAFETY EVALUATION OF THE REACTOR POWER CUTBACK SYSTEM TABLE OF CONTENTS

~

1.0 Introduction 2.0 RPCS Operation 2.1 Functional Description of CE's RPCS 2.2 RPCS Interaction with CPC 2.2.1 CEA Dynamic Misalignment Effects 2.2.2 CPC Dynamic Algorithm Effects 2.3 CPC Accommodation of RPCS 2.4 References 3.0 Safety Evaluation 3.1 Normal Operation 3.1.1 Local Power Response to CEA Drops 3.1. 2 Minimum Duration of RPCS Mode of CPC 3.2 Failure Modes 3.2.1 Drop of Unplanned CEA Configurations 3.2.2 Other RPCS Single Failures 3.3 Maximum Duration of RPCS Mode of CPC 3.4 References 4.0 Conclusions ii

1.0 Introduction A significant number of reactor trips are currently caused by a large loss of load or by a loss of one of two main feedwater pumps. These events cause a power imbalance between the power generated by the reactor and the power removed by the turbine. If this power imbalance is not eliminated, a primary system heatup will result. Currently, the power imbalance is removed by a reactor trip. The Reactor Power Cutback System (RPCS) is designed to eliminate the power imbalance caused by the above events without a trip. This is mainly accomplished by the following two actions:

1. A " step" reduction in power by drop of preselected Control Element Assembly (CEA) bank (s)*.
2. Throttling the turbine admission valve to rebalance turbine and reactor power (on a loss of a feedwater pump).

The current design of the Core Protection Calculators (CPC) compensates for dynamic effects in the plant during transients. For the transients induced by a Reactor Power Cutback (RPC), the CPC dynamics are excessively conservative and could cause an unnecessary reactor trip. Therefore, CPC modifications have been made to more accurately handle the RPC transient and thus avoid the unneeded trip.

This document is an overview of RPCS operation and RPCS/CPC interaction. The CPC modifications are addressed as is the safety impact of the RPCS. The discussions and conclusions are generically applicable to Waterford 3 and the CE System 80 plants. Examples to illustrate various items were selected from either Waterford 3 or System 80. Specific numerical values are illustrative.

Plant specific values will be calculated as part of the CPC data base generation. l

  • For this report, "CEA Bank" and "CEA Group" are used interchangably.

1-1

2.0 RPCS Operation This section briefly describes the purpose and operation of th Reactor Power Cutback System (RPCS) and its interaction with the Core Protector Calculator (CPC). Without modifications to the CPC, the interaction of the systems during a Reactor Power Cutback (RPC) could result in an unnecessary reactor trip. The measures taken to accommodate RPC transients in the CPC are described.

2.1 Functional Description of CE's RPCS The purpose of the RPCS is to prevent a reactor trip following a large load rejection or a loss of a single main feedwater pump at high power. Without the RPCS, both of these events will result in reactor trips due to the temperature and pressure transients which result from the mismatch between core power generation and heat removal from the steam generators. The RPCS is designed to rapidly reduce the core power to eliminate the need for such a reactor trip.

Reference 2.1 provides more detailed descriptions of the present design of the RPCS. In general, the Steam Bypass Control System and the Feedwater Control System will provide redundant signals to the RPCS to indicate the occurrence of either a large load rejection or the loss of a main feed pump at high power.

The RPCS will then send a signal to the CEA Drive Mechanism Control System (CEDMCS) requiring that one or more sequentially ordered CEA groups be dropped. The particular CEA groups selected for RPCS drop are periodically

. determined in the plant computer and transmitted to the RPCS but can be changed by operator action. The selected CEA's will reduce the core power rapidly to a preselected final power level (typically from 50% to 70% of rated power). The selection process accounts for time in cycle, CEA group reactivity worth, power level, temperature effects, etc.

The selection algorithms are constrained to select only complete CEA groups to be dropped. That is, if a particular CEA group is made up of more than one subgroup of symetrically located CEA's, either none or all of the subgroups could be selected to drop. The selection process would not select one of the subgroups to drop and leave the other subgroup at its initial location. The 2-1

CEA' group selection is further constrained to only select CEA groups in the normal insertion order and to never select Part length CEA (PLR) groups. Due to these constraints, the CEA configuration in the reactor core that could occur after an RPCS activation will be very similar to that which could occur during normal insertion. The only exception to this is the departure from the normal group overlap requirements as specified in the Power Dependent Insertion Limit (PDIL) Technical Specification.

If the initiating event that leads to a RPC is the loss of a main feedwater pump, the RPCS also initiates a turbine setback / runback to match the turbine demand to the power production after the CEA drops. This is designed to prevent a major power mismatch and the associated transient which could result in a reactor trip.

2.2 RPCS Interaction with CPC The protection system on CE plants that have a RPCS includes a four channel Core Protection Calculator (CPC) System and a two channel CEA Calculator (CEAC) system. The CPC system receives measurements of the hot leg and cold leg temperatures, the primary system pressure, the main coolant pump speed, and the CEA positions while the CEAC only receives the CEA positions. Using these inputs, the CPC/CEAC systems determine the core-average and hot-pin power distributions, the margin to Linear Heat Generation Rate (LHGR) limits, and margin to Departure from Nucleate Boiling (DNB) limits. If these limits are exceeded or if the projection of present transient behavior indicates that these limits may shortly be exceeded for any CPC channel, that channel issues a trip signal. The simultaneous occurrence of trip signals on two or more of the CPC channels results in a reactor trip. More details of the complete behavior of the CPC/CEAC system can be found in References 2.2 to 2.4.

Two portions of the CPC/CEAC system are of particular interest in the interaction between the RPCS and the CPC/CEAC. First, all CEA's in the groups that are dropped during a RPC may not fall at exactly the same speed. It is thus possible for the CPC/CEAC system to detect, and overpenalize, the 2-2

l 1

)

temporary misalignments that occur during the drop. In addition, O e dynamic compensation algorithms used to assure conservative treatment of typical tr'ansient events will introduce excess conservatism into the assessment of DNBR and LHGR margins during the specific transients associated with a RPC.

2.2.1 CEA Dynamic Misalignment Effects

~

Both the CPC and the CEAC receive CEA position information. The CEAC examines CEA positions every , ,

seconds for significant deviations between the position of various members of a subgroup and determines an appropriate penalty factor to account for the power distribution effects of such a deviations, if present. The CPC's examine their CEA information every , ,

seconds for a significant deviation between the subgroups of any CEA group and for any out of sequence insertions of the regulating groups. If such a deviation is found, its effects on power distribution are accommodated by a suitable penalty factor. These penalty factors are applied to the precalculated planar radial power peaking factors (Fxy) which represent the undeviated power distributions.

This system performs satisfactorily during normal CEA motion at speeds up to a maximum of 30 inches per minute (1/2 inch /sec). It also provides the necessary protection for single, subgroup, or group CEA drop events, for single, subgroup, or group CEA withdrawal events, ard for static position deviations that may occur during otherwise normal operation. However, it can misinterpret the need for CEA deviation penalties during a RPCS actuation.

When the RPCS initiates a drop of one or more CEA groups, the variation in

, holding coil release time and in CEA drop speed can cause temporary deviations and/or out of sequence conditions to develop. The CEAC system scans the CEA

. positions , ,

times during the time th,e CEA's are falling and the CPC system scans the CEA positions , ,

times. Thus, it is possible that either or both systems could detect the temporary deviations and apply penalty factors that are applicable for other situations. The actual penalty factors 2-3

. =. a. . . . .

i

)

required for the RPC transient situation are substantially lower than the staticpenaltyfactorsappliedbyCPCandthus,theyimposeasubstantial excess conservatism during a RPC.

2.2.2 CPC Dynamic Algorithm Ef fects The CPC system includes several algorithms to assure its proper behavior during plant transient events. These algorithms correct the CPC transient response for such items as the location of the inlet temperature sensor (in the cold leg rather than in the inlet plenum), the non-instantaneous response of the temperature sensors to changes in temperature, etc. The application of these algorithms to the measured data provides estimates of core heat flux and power that behave conservatively relative to the actual plant parameters. That is, calculated power and heat flux will rise faster than actual values during increasing power events and will fall slower than actual values during decreasing power events.

The algorithm module that has the major effect of this type applies the dynamic correction to " delta-T" power. The static " delta-T" power is calculated from the inlet to outlet enthalpy difference and the core flow every ,,

seconds.

However, the sensors (other than flow) uvad are the hot and cold leg temperatures which are some distance away from the core. In dynamic situctions, the enthalpy at the core inlet and outlet will differ from those at the sensors. Thus an algorithm was included in the original CPC design (Reference 2.4) , ,

. This provides a conservatively high estimate of power if temperature is increasing (risingpowertransient). However, if temperature is falling, no correction is made since the correction could be non-conservative in certain situations.

Without a correction, the power calculation is excessively conservative on decreasing power events since there are several physical time delays between a power change and a temperature sensor signal change. For example, there is a j delay after a neutron flux decrease before the surface heat flux changes, l another delay until the cooler coolant reaches the hot leg sensors, and yet l

l 2-4

another delay while the sensor output responds to the changed temperature.

Thus'the power used by CPC during a rapid decreasing-power transient will remain substantially higher than true power in the early parts of the transient and then slowly drop towards the true power as the plant stabilizes in its new conditions. This conservative estimate of power could be sufficient, either by itself or in conjunction with the excess conservatism in the deviation penalty factor calculations, to result in an unnecessary reactor trip.

2.2.3 CPC Accommodation of RPCS As noted, the behavior of the existing CPC system during the transient events associated with a RPC could result in an unnecessary reactor trip. The CPC/CEAC system was thus modified to reduce unnecessary reactor trips while still assuring that a trip will occur if necessary. The details of these changes are discussed in Reference 2.5. In brief, the CEAC detects the

~

occurrence of a RPC by comparing the present and previous positions of all CEA's in the core. CEAC determines that a RPC is in progress if:

1. Some CEA's are moving into the core at a speed that is consistent with a freely falling CEA (that is, their speed is substantially faster than the maximum CEDM insertion speed), and 2.

The CEA's that are moving, as above, form a single group or a set of groups that have been prespecified to the CEAC as a " legal" RPCS group (s)*,and

3. There are no extra CEA's inserting, and
  • As specific examples, for Cycle 1 of both the Waterford 3 and the System 80 plants, the " legal" groups are the lead bank alone or the combination of the i I

lead and first follow banks.

I 2-5 t _ o

4.

,All members of the " legal" group (s) that is found to be inserting are, in fact, moving at free falling speeds or have already reached the bottom of the core.

~ When CEAC determines that a RPC has occurred, a timer is started and a flag is sent to the CPC's as part of the penalty factor word. When the timer in CEAC

~ reaches a preset limit, the flag in the penalty factor word is again turned off.

CPC uses this flag to modify the evaluation of power margin for the special conditions that exist during a RPC.

The CPC UPDATE algorithm monitors the status of the "RPCS" flag in the CEAC penalty factor word and sets its own "RPCS" flag when the CEAC flag changes from off (no RPC) to on (RPC in progress) for both CEAC channels *. CPC also starts its own RPCS timer. The CPC "RPCS" flag remains on until either the CEAC flag is turned off or until the CPC RPCS timer reaches a preset value.

This redundant determination of the time at which to end the use of the special calculation procedure assures that a single problem in either the CPC or the CEAC will not prevent the CPC from ending the "RPCS mode" and returning to the normal calculational mode.

During the period that it is in the "RPCS" mode, the CPC calculation of the hot pin power distribution is revised as follows:

1.

Of f-line calculated, bounding adjustment factors are used in lieu of the instantaneous, on-line single CEA deviation penalty factors and out-of-sequence penalty factor.

. 2.

The last calculated values of the subgroup deviation penalty factor, planar radial peaking factors and rod shadowing factors are used without update.

  • Note that if one CEAC is inoperable, then the CPC will set its "RPCS" flag based on only the one operational CEAC.

I 2-6 I

i - - - - - - -

Section 3 will discuss the determination of the values of the applicable adjustment factors necessary to assure conservative calculation of the margin to LHGR and to DNB during a RPC. These calculations also determine the maximum time after the initiation of a RPC during which it is valid to use these adjustment factors before returning to the normal calculational procedures.

2.4 References 2.1 " Nuclear Generating Station Performance Improvement Using the Reactor Power Cutback System", J. H. Bickel, C. R. Musick, TIS-5391, presented at the ANS Winter Meeting, November 1977.

2.2 " Functional Design Specification for a Control Element Assembly Calculator", CEN-148(S)-P, January 1981.

'l 2.3 "CPC-Assessment of the Accuracy of PWR Safety System Actuation as Performed by the Core Protection Calculators", Reactor Design /

Instrumentation and Control Departments, (CENPD-170-P), July 1975.

2.4 " Functional Design Specification for a Core Protection Calculator",

CEN-147(S)-P, January 1981.

2.5 "CPC/CEAC Software Modifications for System 80", Enclosure 1-P to LD-82-039, March 1982.

2-7

1 l

3.0 Safety Evaluation The CPC/CEAC system provides the primary plant protection for DNB and Linear Heat Generation Rate (LHGR) related events. Thus, it is necessary to assess the impact on safety of any alterations to the CPC system. Since the CPC was l'.tered to accommodate the RPCS, it is necessary to assure that the plant remains adequately protected during a RPC for normal operation of the RPCS as well as for single failures within the RPCS. In addition, consideration must be given to other events that will be treated differently by the CPC due to the alterations made to accommodate the RPCS.

The discussion presented below focuses solely on the impact of the RPCS and CPC/CEAC changes on DNB margin. The LHGR margin required by the Loss of Coolant Accident is sufficient to preclude violation of the LHGR Specified Acceptable Fuel Design Limit (SAFDL).

3.1 Normal Operation 3.1.1 Local Power Response to CEA Drops This section presents the results of an analysis of the local power response to CEA group drops. The local power response is important due to its effect on thermal margin. As will be discussed in Section 3.3, the maximum allowable duration of the RPCS mode of CPC is dictated by consideration of DNBR margin loss for events that appear as a RPC to the CPC or for RPC events that involve a single failure within the RPCS. As noted in Section 3.3, one of the limiting events is the drop of the lead bank since it is interpreted by the CPC as a  ;

RPC. This event was analyzed for the purpose of determining the core local power response to CEA group drops. The calculation of this maximum allowable duration of the RPCS mode of CPC in Section 3.3 is based on the conclusion that the core local power is everywhere decreasing during the first several seconds. The purpose of this section is to support that conclusion. An l analysis of a typical CEA group drop was performed and the results are herein .

discussed.

l 3-1

a Calculations were performed using the HERMITE space-time kinetics computer code (Reference 3.1). A one dimensional axial HERMITE model was used to model the core average effects. The hot channel was simulated by the imposition of a conservative radial peaking factor as a function of CEA insertion. The results of this analysis are shown in Figure 3.1-1. In this figure the normalized hot channel power is shown for 10 seconds of transient time. The normalized power

~

is based on setting the initial power in the node to 1.0. The time scale has been adjusted such that 0.0 seconds refers to the time that the CEA bank enters the given plane (modeled by a HERMITE axial node). Negative time refers to the time between the start of the CEA bank drop and time the CEA's enter the given plane. Three representative core planes are shown. They are: 95% of core height, 70% of core height, and 45% of core height. The points labeled "A" in the figure are the respective times on the shifted time scale when the CEA bank was dropped. The points labeled "B" represent the time the CEA bank reaches the lower electrical limit.

The important analysis results which are illustrated by Figure 3.1-1 are as follows:

1. Power decreases in a given node prior to the time when the CEA's enter the node.
2. Power continues to decrease for 2 to 3 seconds after the CEA's begin to move.
3. The power reaches a minimum within 2 seconds of when CEA's enter node.
4. Nodal power then increases due to moderator and doppler feedback effects.

. 5. The power reaches a new steady state which is lower than the initial nodal power.

The aforementioned results are representative of a typical CEA group drop.

However, significant conservatisms were included in the analysis. The major conservatisms are as follows:

1. The System 80 lead bank was used rather than the Waterford Unit 3 lead bank. The drop of a System 80 lead bank causes a smaller power reduction as well as a larger radial peak increase than the Waterford 3 lead bank.

This causes the power in a given node to return to a higher level.

3-2

.a . . . . - - . . - . . . -

2. A strongly negative moderator temperature coefficient and large doppler

. coefficient typical of end cycle were used.. This has the effect of producing a higher new steady state power.

3. A conservatively large value_of radial peak change between unrodded and CEA group radial peaks was used . This yields a higher steady state power. - "

' ~

, 4. The radial peak was ramped in over a period of seconds starting from

' ~

the time the rod entered a given node. A more rea11stic , amount of time for the radial power to shift is expected to be greater than ,,

seconds. The higher ramp rate yields a faster return to power and thus a higher power level after 10 seconds of transient time.

This analysis assumed constant inlet conditions. It should be noted that only the first approximately 5 seconds of the analysis are relevant.to the RPC events since, after this time, inlet temperature and pressure changes begin.

However, the relevant conclusion is that for the first five seconds following drop of a RPC group or groups, core local power is everywhere decreasing.

Thus, DNB margin is increasing.

3.1.2 Minimum Duration of RPCS Mode of CPC Section 2.2 describes the impact of a RPC transient on the previous CPC algorithm and the modification that was made to avoid unnecessary plant trips.

This modification causes the CPC to use an alternate calculation of margin during the early parts of an RPC transient. The duration of this period of alternate calculation, called the RPCS mode, is selected to achieve two objectives. First, the RPCS mode should last long enough to prevent unnecessary plant trips due to RPC transients during proper operation of the system. Second, the RPCS mode must end soon enough that a RPC with a single failure or an event which appears to CPC as a RPC will be safely terminated.

This latter objective, which is safety related, is discussed in Section 3.3.

As noted earlier, there are two portions of the CPC algorithms that have the potential to cause an unnecessary plant trip. The specific areas are the determinatM of the CEA deviation penalty factors and the determination of the

" delta T" power. Section 3.1.1 discusses the immediate response of the core i

j 3-3

1 power to a CEA drop due to a RPC. That section shows that the CEA's reach the l full'y inserted condition in less than approximately 5 seconds and that, during this 5 second period, the local power is decreasing everywhere in the core.

Thus, the CPC can use an alternate calculation during this period since real margin is increasing. The use of the RPCS mode should last through this period to avoid the possibility of an inadvertent trip due to CEA deviation penalty

, factors caused by variations in CEA drop speed.

l The situation with regard to the CPC dynamic algorithms is somewhat more complex. Section 2.2 noted that there were several delays between changes in core average heat flux and the perception of such a change by the CPC for decreasing power events. This is illustrated in the lower graph of Figure 3.1-2. This figure shows a typical response calculated for the Waterford 3 plant to a RPC caused by a loss of one feedwater pump. For this case, it is assumed that the turbine steam flow is reduced to of rated

  • flow and that

~

the lead bank and the first follow bank are inserted by the RPCS.

CPC's perception of the heat flux (shown as the dashed curve) has the same general characteristics as the true heat flux but lags the true curve by seconds. This delay is due to:

1) The time delay from a change in heat flux to a change in coolant temperature.
2) The time lag from a change of coolant temperature in the core to the change in coolant temperature at the hot leg sensor.
3) The time delay in the response,of the hot leg temperature sensor.

~

4) The calculational algorithm which does not dynamically correct the

" delta-T" power for decreasing power events.

~ ~

  • The actual setback will be to approximately '

of rated steam flow for Waterford 3 and to approximately for System 8O. The use of a higher steam flow results in a higher final power and thus a lower margin to the DNB limit. This combination causes the longest period until the CPC " catches up" to the real core and, hence, the longest period that it is necessary to use the RPCS mode of margin calculation.

3-4

i 1

5) The CPC heat flux filter which delays the sensed " delta-T" power to convert it to heat flux.

The combination of rapid application of radial peaking factors and delayed perception of the decrease in heat flux causes the CPC to perceive a

~

significant loss of margin even though the margin in the plant 'is increasing.

This is illustrated in the upper graph of Figure 3.1-2 for the event just discussed. The calculation of DNB margin for both the plant and the CPC was relative to an assumed minimum initial value. For the plant, the initial margin was taken to be , ,

which is representative nf the minimum margin at full power that is assured by the Core Operatint, Limit Supervisory System (COLSS). The CPC initial margin was taken as which represents the minimum.

expected CPC margin when the plant is operated at tne COLSS operating li, nit at any time during the cycle.

As is evident from the figure, the CPC perception of margin decreases rapidly and then returns to zero in about ,,

seconds. Thus, for this transient, the CPC should operate in the RPCS mode for at least ,,

seconds to avoid an unnecessary trip during a RPC. However, this transient was selected to maximize the time period during which the RPCS mode should'oe used to avoid unnecessary trips. Therefore, this sample calculation indictes that the ,

minimum duration of the RPCS mode for Waterford 3 should be at least seconds. A similar analysis will be performed for each plant that incorporates a Reactor Power Cutback System.

Note that the off-line calculated RPCS mode adjustment factors used in the above calculation are ' '

as described in Section 3.3. Had this not been the case, the required minimum time for the RPCS mode would be increased since the impact of these adjustment factors would be to decruase the CPC perceived margin. l 3.2 Failure Modes

.J As discussed previously the RPCS will calculate-that a given number of banks need to be dropped in order to reduce power to the desired level. This will typically amount to the nex' available one or two banks. However, under 3-5

certain circumstances more banks may be required. The current Waterford 3 and System 80 designs only allow the first two banks to be used in a reactor power cutback.

An examination of the RPCS design was made and a number of single failures identi fied. The following sections address the impact of these single ,

failures. No single failure in the RPCS was identified that would cause spurious CEA group drops or turbine setback when a RPCS actuation is not requested. This is due to the 2 out of 2 control logic of the RPCS. Thus, the failures identified will only impact loss of load or loss of feedwater events that generate a RPCS actuation. t

~ '

Section 3.2.1 discusses the effects of any drop of unplanned CEA

.' configurations. Following this, Section 3.2.2 discusses other possible i failures of the RPCS.  !

3.2.1 Drop.of Unplanned CEA Configuration All possible CEA ' drop configurations were examined as to their impact on plant sa fety. The various CEA drop configurations that could occur have been broken dnwn into five categories. For ease of discussion two definitions were necessary.

First, legal banks refer to banks recognized by CEAC and CPC as useable for a reactor, power cutback. For example, in the current Waterford and System 80 design, only the lead b'ank and the first follow bank are legal banks. The CPC/CE C system wil1~ never identify the drop of a non-legal bank as indicative

. of a reactor power cutback.

Second, a sequential drop refers to a simultaneous drop of some number of sequentially numbered banks (in the PDIL sequencing scheme) starting with the higheit numbered bank'that is not fully inserted. For example, in a 6 CEA bank core, insertion of bank 6 or 6 and 5 or 6 and 5 and 4 etc., would be considered sequential. Insertion of bank 5 or 5 + 4 etc., would not be considered sequential unless bank 6 was fully inserted.

3-6

d The five categories of CEA drop configurations are as follows:

1. Legal bank (s) dropping sequentially
2. Bank (s) dropping sequentially (including non-legal bank (s))
3. Bank (s) dropping non-sequentially (legal or not)
4. Incomplete legal bank (s) dropping (i.e., bank (s) missing 1 or more subgroups or missing 1 or more individual rods)
5. Any member of a non-legal bank dropping (with or without legal members dropping)

Table 3.2-1 shows the method of protection appropriate for each of the above categories of drop. Note that for categories 2-5, the reaction of the CPC is not affected by the current modification to accommodate the RPCS.

Only category 1 is recognized by CPC as a RPC. This is due to the fact that only a drop of legal bank (s) in a sequential manner is recognized by CPC as a RPC. Category 1 is broken up into 3 events. Table 3.2-2 shows the protection for each of these events. These events and their protection will now be discussed individually.

1. Correct RPC Event An analysis described in Section 3.3 determined the maximum time the CPC can be in the RPCS mode. During this time period it is shown that sufficient thermal margin exists to prevent violation of the SAFDL*. When CPC comes back into I

normal operation the normal protection is provided.

. 2. Inadvertent Drop of the Highest Numbered Bank Which is Not Fully Inserted This event would appear to the CPC as a RPC. Thus, the CPC would go into the RPCS mode. As in the above event, the analysis in Section 3.3 demonstrates adequate protection is provided.

Specified Acceptable Fuel Design Limit 3-7 L ______________

3. Inadvertent Drop of More Than 1 Legal Bank - Falling Sequentially This event would also appear to the CPC as an RPC since the banks involved are

?

both legal and falling sequentially. However, no single failure was identified l that could cause this event. Thus, the event is not a design basis event.

However, should it occur, CPC protection will be provided.

This event is

, bounded by the events analyzed in Section 3.3.

[

Y l

i I

I l

I J

1 i

1

! l 3-8

3.2.2 Other RPCS Single Failures This section addresses single failures other than those resulting in a drop of unplanned CEA configurations (discussed in Section 3.2.1). As discussed previously, the RPCS is designed to rapidly reduce the reactor power by dropping pre-selected control rods in response to either a large load rejection or loss of one feedwater pump (these are referred to as the initiating events) without tripping the plant. The RPCS response to a large load rejection is to reduce reactor power, while the RPCS response to a loss of one feedwater pump is to both reduce reactor power as well as setback the turbine (reduce steam flow to the turbine). The following two sections will address the single failures which impact each initiating event.

Large Load Rejection:

As stated above, the response of the RPCS to this event is to reduce reactor power by dropping CEA's. Table 3.2-3 shows the possible single failures for this event as well as the appropriate method of protection. The NSSS response to these failures will now be discussed.

FAILURE 1: Failure to drop CEA's Since the Chapter 15 analysis did not credit RPCS operation, this failure is covered by the transients presented in the FSAR (Section 15.2)

FAILURE 2: Drop of Incorrect CEA's This is discussed in Section 3.2.1.

FAILURE 3:

Indavertent Excessive Setback of the Turbine for a Less than Complete loss of Load.

No single failure has been identified which would cause this to occur. In any case, this event would be bounded by the FSAR analysis of the total loss of load (Section 15.2).

3- 9

i Loss _ of One Feedwater Pump:

As stated above, the RPCS response to this event is to both reduce reactor power and setback the turbine. Table 3.2-4 shows the failures identified for

, this event as well as the method of protection.

. FAILURE 1: Failure to drop CEA's - Turbine Setback Accomplished This event could result in a heatup slightly worse than a loss of feedwater alone. However, the heatup caused by turbine closure due to loss of condenser vacuum (presented in Section 15.2 of the FSAR) would result in a faster heatup and higher RCS pressure. The FSAR analysis of this event assumed that a total loss of feedwater would occur simultaneously with the turbine trip.

FAILURE 2: Failure to Setback Turbine - CEA Drop Accomplished This event could produce an excess heat removal transient. The ensuing cooldown would raise core power due to moderator feedback. However, the cooldown transient that would be caused by this event is considered in Section 3.3. As discussed in this section, adequate protection against violation of the SAFDL will be provided during and after the time that CPC is in the RPCS mode.

FAILURE 3: Failure to Setback Turbine and Failure to Drop CEA's This event would be simply the loss of one feedwater pump. Thus, it is bounded by the analysis presented in FSAR Section 15.2.

FAILURE 4: Dropping Incorrect CEA's This is discussed in Section 3.2.1 Failures 5 and 6 represent a setback of the turbine that does not match the reactor power reduction caused by the dropped rods.

3-10

l l

FAILURE 5: Too Much Turbine Setback (CEA Drop Accomplished)

This event is bounded by the loss of condenser vacuum analysis (FSAR Section 15.2). This analysis assumed a concurrent turbine trip and loss of feedwater.

FAILURE 6: Too Little Turbine Setback (CEA Drop Accomplished)

This event is bounded by the analysis in Section 3.3 of this report.

i 1

e i

3-11

3.3 Maximum Duration of RPCS Mode of CPC The maximum allowable duration of the RPCS mode of CPC is dictated by consideration of DNB margin for events that appear as a RPC to the CPC/CEAC system or for RPC events that include a single failure within the RPCS. As noted in Section 3.2, most RPCS single failures will not appear to the CPC as a

, RPC. Since CPC detects a RPC by sensing that the members of a " legal" bank are falling (see Section 3.2.1), there are only a limited number of possible events in this class. These events are:

1) Proper CEA insertion with failure to runback the turbine on a loss of a feedwater pump (RPCS).
2) Insertion of two " legal" banks when only one bank is required on either a large loss of load or a loss of a feedwater pump (RPCS).
3) Insertion of one " legal" bank when two banks are required on either a large loss of load or a loss of a feedwater pump (RPCS).
4) Inadvertent drop of a " legal" bank (Non-RPCS) of these events, number 3 initially has the turbine demand less than the core power. Thus, the core power would decrease slowly to match the turbine demand through moderator temperature feedback with a negative Moderator Temperature Coefficient (MTC). This is an increasing margin event and, as such is not of significant interest. Note that the requirement to drop two banks will typically exist only later in cycle when the moderator temperature coefficient is negative. In any event, this occurrence would be similar to a partial loss of load event from less than full power. Therefore, this event is bounded by the loss of external load analysis presented in the FSAR which did not require a CPC trip.

l 1

The remaining three events initially have the core power less than the turbine l demand. Moderator temperature feedback causes the core power to return to nearly its original value but the CEA insertion has increased the radial l

peaking. This results in a loss of margin to DNB. Events 2 and 4 are very similar in that both involve the insertion of a single CEA bank more than the corresponding decrease in turbine demand (if any) would require. Of the two, event 4 would be the more limiting on DNB margin since it can occur at rated 3-12 1

steam demand while event 2 has reduced steam demand due to either the RPCS turbine runback or the loss of load event. Event 1, on the other hand,'can involve the insertion of two CEA banks without any decrease in turbine demand.

Events 1 and 4 are discussed below since they are the limiting events that the CPC treats as a RPC.

As noted, the initial effect of either event is a core power level reduction resulting in an immediate increase in margin to DNB on a core average basis.

The impact on the hot pin margin depends on the speed of the core power decrease and the magnitude of the integrated radial peaking factor changes.

However, the fact that core local power is everywhere decreasing during the first several seconds, as was discussed in Section 3.1.1, assures that there will not be an immediate decrease in margin in the hot channel. Since neither of these events has a turbine runback, a core power / turbine power mismatch develops which drives the core inlet temperature down significantly.

Moderator temperature feedback effects from the decreased inlet temperature and core average temperature cause the power to increase to nearly the initial level. Local power is further affected by substantial changes in radial power peaking due to the changing CEA configuration. For the most severe of these events, the margin to DNB decreases following the initial increase.

The most rapid return to the original power level for these events occurs at E0C where Doppler and moderator feedbacks are the most negative. Both events have radial peakin[ factor increases during the event due to the insertion of one or more CEA groups. For each event, the maximum increase in radial peaking (with uncertainties) was assumed. CEA group reactivity worth was examined over the range of possible values. This was done to determine the shortest time at which the CPC had to be restored to its normal mode to prevent potential DNB SAFDL violations. It was found that the combination of low reactivity worth and the largest radial peaking factor change gave the earliest time at which return to the CPC normal mode was required.

The Nuclear Steam Supply System (NSSS) response to a RPC with a single failure is simulated using the CESEC computer program (Reference 3.2). The CESEC code is used to model power production, heat removal, and coolant system temperatures, pressures, and flow rates based on input driving functions such 3-13

I as feed flow, turbine steam demand, etc. To perform a bounding calculation of min'iinum margin to DNB for all possible initial conditions, the most extreme

~

conditions of temperature coefficients, bank worths, etc., were used in the CESEC model. The resulting changes in temperature, pressure, flow, and local power were used with the most conservative sensitivities of DNB overpower margin to these system parameters to determine the change in DNB margin. These overpower margin sensitivities were derived ie separate analyses which determine DNB dependencies over the plant operating space.

As an example of the above analysis, the maximum allowable duration of the RPCS mode of CPC was determined to be approximately seconds for the Waterford 3 plant. The most severe cases of faulted operation are presented here to illustrate how this value was determined. Figure 3.3-1 presents an evaluation of minimum margin to DNB for a minimum worth insertion of the lead CEA bank and first following bank due to RPC on loss of a feedwater pump with failure to provide a turbine runback. During the perf od of rod motion, local power, expressed as a product of gross core power and local power peaking, has been shown to decrease. After the CEA's have reached the bottom of the core, CESEC results can be used to model local power changes by application of revised planar radial peaking factors. Heat flux lags behind power changes, and at about seconds the margin to DNB has decreased relative to that before the RPCS actuation.

At seconds, the CPC margin calculation is removed from the RPCS mode and returned to normal. Depending on the original plant conditions, the conditions

.I . after this time may or may not require a plant trip. When a trip is required, CPC will give it. For the particular data of Figure 3.3-1, which assumes minimum initial margin, a rPC trip was assumed to occur immediately since the CPC perceived margin would be negative. The margin shown on the figure credits the minimum margin set aside by COLSS. Scram rod insertion will begin by i

~

seconds, reversing the trend in DNB margin loss. Using conservative scram worths, this event shows a minimum margin to DNB of for the limiting core power distribution.

i 3-14

l I

Figure 3.3-2 illustrates margin degradation for the less severe event of a lead bankMrop without turbine runback. At the time the CPC leaves the RPCS mode ma'rgin calculation at seconds, about loss in margin to DNB has occurred.

Again, the trend in loss of margin to DNB is reversed following reactor scram and reaches a minimum margin to DNB of . The selected value for the duration

~ ' ~

of the RPCS mode of CPC ensures sufficient margin to the DNBR SAFDL for all modes of normal RPCS operation and for RPCS operation with a single failure.

Similar calculations would be performed on a plant specific basis to identify the maximum allowable duration of the RPCS mode of CPC operation for that pl an t.

The CPC uses off-line calculated multipliers on radial peaking factor to calculate DNBR and LHGR during the RPCS mode. The calcu1ations given above assumed that these adjustment factors were equal to , ,

, Determination of the maximum duration of the RPCS mode with this assumption validates both the maximum duration and the assumed values of the adjustment factors. For the specific example shown above, the value of , ,

s econds for the maximum duration of the RPCS mode used in conjunction with values of , ,

for the adjustment factors was shown to be conservative (i.e., these values assure that the DNBR SAFDL is not violated during the most limiting RPCS related event).

3.4 References 3.1 "HERMITE Space-Time Kinetics", CENPD-188-A, March 1976.

. 3.2 "CESEC - Digital Simuilation of Combustion Engineering Nuclear Steam Supply System", CENPD-107-P, April 1974.

l L

i 3-15

i

., TABLE 3.2-1 RESPONSE TO DROP 0F UNPLANNED CEA CONFIGURATIONS

. RECOGNIZED BY CPC AS RPC

- TYPE OF DROP ** (YES/N0) METHOD OF PROTECTION **

1. Legal Bank (s) Dropping Yes See Table 3.2-2 Sequentially
2. Bank (s) Dropping Sequentially No* Prohibited by Interlock (Including Non-Legal Bank (s)) from being caused by RPCS. Can not be caused by any single failure.
3. Banks Dropping Non- No* CPC Protection by 00S PF Sequentially (Legal or Not) (Large Multiplier on Radial Peaks: . .

approximately

~ "

4. Incomplete Legal Banks Dropping No*

A. Missing 1 or More Subgroups A. CPC Protection by Subgroup Deviation PF B. Missing 1 or More Individual B. CPC Protection by CEA's Single CEA Deviation PF

5. Any Member of a Non-Legal Bank No* CPC Protection by 1 or Dropping (with or without Legal more of the following:

Bank Members Dropping)

~

a) 005 PF b) Subgroup Deviation PF c) Single CEA Deviation PF The reaction of the CPC to this event is not affected by the current modification of CPC.

    • See definitions on the following page.

3-16

l TABLE 3.2-1 DEFINITIONS Definitions :

Sequential Orop = Simultaneous drop of some number of sequentially numbered banks (in the PDIL sequencing scheme) starting with the highest numbered bank that is not full inserted.

Legal Banks = Banks recognized by CEAC (and thus recognized by

CPC) as appropriate for a reactor power cutback.

00S = Out of Sequence PF = Penalty Factor G

(

3-17 i

l

TABLE 3.2-2 METHODS OF PROTECTION FOR EVENTS RECOGNIZED BY CPC AS AN RPC EVENT PROTECTION

1. Correct RPCS Event Discussed in Section 3.1.2 Sufficient thermal margin exists during time of RPCS mode of CPC. After this, CPC resumes the normal protection scheme.
2. Inadvertent Drop of the Highest Discussed in Section 3.3. Sufficient Numbered Bank Which is Not thermal margin exists during time of Fully Inserted RPCS n.cde of CPC. After this, CPC resumes the normal protection scheme.
3. Inadvertent Drop of More than Multiple Failure Event. This is One Legal Bank - Falling outside the design basis. However, CPC Sequentially protection is provided.

8 9

3-18 l

l l

TABLE 3.2-3 FAILURES FOR LARGE LOAD REJECTION EVENT FAILURE PROTECTION

1. Failure to drop CEA's Bounded by FSAR analysis in Section 15.2.
2. Drop of incorrect CEA's Discussed in Section 3.2.1.
3. Inadvertent setback of the turbine No single failure could be for a less than complete loss of identified which could cause this.

load Bounded by FSAR analysis in Section 15.2.

E 3-19

1

, TABLE 3.2-4 FAILURES FOR LOSS OF ONE FEEDWATER PUMP EVENT FAILURE PROTECTION

1. Failure to drop CEA's Bounded by FSAR analysis of loss of (Turbine setback accomplished) condensor vacuum.
2. Failure to setback turbine Discussed in Section 3.3. Adequate (CEA drop accomplished) SAFDL protection is provided during and after CPC is 1.n RPCS mode.
3. Failure to setback turbine and Bounded by FSAR analysis in Section failure to drop CEA's 15.2.
4. Dropping incorrect CEA's Discussed in Section 3.2.1.

(Turbine setback accomplished)

5. Too much turbine setback Bounded by FSAR analysis of loss of (CEAdropaccomplished) condenser vacuum in Section 15.1.
6. Too little turbine setback Bounded by FSAR analysis of excess (CEA drop accomplished) steam flow in Section 15.1.

3-20 i

\

Figure 3.1-1 TYPICAL CEA BANK DROP HOT CHANNEL POWER vs TIME FOR VARIOUS CORE PLANES A A A 95%*

1.00 N Fs s N 45%* N \ g707.* 95%* ,,__ __

E e' \

70%*

\ '

u O.95 -

g

/

[ - - --

t H

O I / -

/- \* 45%

Lu f \ \

\

//

/f 0.90 -

B 4

S $ \ J/

5 ' \

S \

//

//

0.85 -

j z \ /

\ f A = CEA BANK DROP INITIATED

"] \ / B = CEA BANK REACHES LOWER cr 0.80 - \g g

  • / ELECTRICAL LIMIT
  • CORE PLANE AT GIVEN PERCENT j

O V OF CORE HEIGHT I I I I I I ' ' '

0.75

-3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 CEA's TIME, SECONDS ENTER GIVEN RADIAL PLANE

Figure 3.12 REACTOR SYSTEM RESPONSE TO TYPICAL RPC, MAXIMUM ROD WORTH e

I t--

e I,

I i

e i

I P

i  ;

6 I

l  !

l ..

l

~

- 3-22

Figure 3.3-1 REACTOR SYSTEM RESPONSE TO RPC WITH FAILURE TO

- RUNBACK TURBINE, MINIMUM 2 BANK WORTH -

5 8

4 p

G m

3-23

Figure 3.3 2 REACTOR SYSTEM RESPONSE TO RPC WITH FAILURE TO

~ RUNBACK TURBINE, MINIMUM 1 BANK WORTH -

I i -

1 l

i I

i l

t I

I e

M 1

3-24 i l

i

l 4.0 Conclusions l

The preceeding sections described the operation of the RPCS and its interaction with the CPC/CEAC systems. The CPC/CEAC modifications to accomodate the RPCS were briefly described. Possible failure modes of the RPCS were also

, addressed.

It was demonstrated that the modified CPC/CEAC system can safely accomodate both normal and abnormal RPCS related transients (i.e., LHGR and DNBR SAFDL's will not be violated). Thus, CE reactors with the modified CPC/CEAC system can

! be safely operated with the RPCS.

i i

i, i

4 e

O l

l

4-1 l l l

_ _ _