ML20059M158

Rev 0 to Engineering Evaluation

ML20059M158
Person / Time
Site:	Pilgrim
Issue date:	04/03/1992
From:	BOSTON EDISON CO.
To:
Shared Package
ML20059M157	List: ML20059M156 ML20059M158
References
FOIA-93-92 NUDOCS 9311180231
Download: ML20059M158 (10)

Text

^

s 3ENT BY:BECo  ; 4- 3-92 ~ 1:2SPM

• BRAINTREE 4th FLOOR

• 301 192 0259; 2

. s BOSTON EDISON COMPANY ENGINEERING EVAltlATION REVISION O

1. Initiatina Documents FLMRs 9'2-78, 79, 80

2. M(Etid Items (System. Subsystem. Train. Comconent. or Device)

LT79, Indication LT1001-65CA(B), Indication LT73A(B), Containment Cooling Permissive at 2/3 Core Height LT646ACB), Feedwater Control Signal LT120A(B,C,D). ATHS - Trip Recirc Pumps, ARI (-49") <

LI59A(B), Indication L157ACB) and LT58A(B),

Scram and Containment Isolation (+9*)

Group 1 Isolation - High Level (+48")

Group 1 Isolation, Recirc Pump Trip, Cont. 15o1. (-49")

LT72A(B,C.0), '

Initiate CSCS and RCIC, Start EDGs (-49")

Trip HPCI/RCIC (+48")

Close Main Turbine Stop Valves (+48")

3. Seecified Functions of Affected Items Devices that provide input to the Feedwater Control System do not perform an active safety function and are not evaluated below.

LT79, l.T1001-65CA(B), LI59A(B)

These devices provide local or control room indication of reactor water level.'  :

LT73A(B), Containment Spray Permissive at 2/3 Core Height During a pipe break inside containment, drywell or suppression pool pressure or temperature may become high enough that operators choose to initiate containment cooling. This permissive allows operators to initiate containment cooling only after the core has been reflooded and 2/3 core coverage has been achieved. After reflood, core cooling ficw requirements are reduced and diversion of LPCI flow is permitted (FSAR 7.4.3.5.4 and 3.3.6.5.2). The core can be cooled sufficiently should the water ; level be reduced to 2/3 core height (Tech. Spec. Bases 2.1.3).

I  ;

LT120A(B,C,0), ATHS - Trip Recirculation Pumps, Alternate Rod Insertion i

Theseidevices provide a signal to trip the recirculation pumps and actuate vent valves in the scram air header to initiate a reactor scram. These actions provide a backup means of introducing negative reactivity to the reactor in the unlikely event of RPS failure. (FSAR 3.9).

-1 l ]

9311180231 930518 PDR FOIA [ l LAMPERT93-92 PDR W  ;

EfvT BY:BECo  ; 4- 3-92 ; 1:2SPM BRAINTREE 4th FLOOR ~ 301 492 0259;: 3

.- }

~

LT57A(B) and LT58A(B) ,

t Reactor l Scram (+9")

A reactor scram provides timely protection against the onset and .

consequ'ent.es of conditions that threaten the integrity of the fuel barrier (byexclessivetemperature)andthenuclearsystemprocessbarrier(by '

excessive pressure). The reactor shall scram to prevent fuel damage for abnormal operational transients. A low level in the reactor vessel indicates that the reactor is in danger of being inidequately cooled. The effect of a decreasing water level is to decrease the reactor coolant inlet subcooling. The effect is the same as raising feedwater temperature. Should level decrease too far, fuel damage could result as steam forms around fuel rods. The level setting is selected high enough above the top of active fuel to assure that enough water is available to account for evaporation losses and displacements of coolant following the most severe level decrease transients. The selected setting is used in the development of thermal hydraulic operational limits (FSAR 7.2).

Primary and Secondary Centainment Isolation (+9")

For pipe breaks inside containment (P8ICs), the icw water level isolation function provides timely protection against the onset and consequences of '

gross release of radioactive materials from the fuel and nuclear system process barrier by closing off release routes through primary cortainment. For pipe breaks outside containment (PBOCs), the low water

.evel isolation provides a barrier between the reactor and the breach, thus stopping the release of radioactive materials and conserving reactor  ;

coolant. For PBOCs, the isolation valves for the break shall be closed prior to core uncovery. A low level in the reactor vessel could indicate either a pipe break or level reducing transient such as a loss of feedwater. (FSAR 7.3 and 5.2). For pipe breaks inside containment, the standby gas treatment and reactor building isolation systems create another barrier to the release of radioactive materials that could lead to offsite doses in excess of 10 CFR100 guidelines (FSAR 5.3).

High Level Group 1 Isolation (+48")

The high level Group 1 isolation protects against rapid depressurization due to a pressure regulator system malfunction during startup. (FSAR 7.3)

Containment Isolation and Recirt Pump Trip (-49")

The containment isolation signal at (-49") serves the same function as the

(+9") setting but was selected to allow the removal of heat from the vessel for a predetermined time after reathing the (+9") scram level setting, and high enough relative to the TAF to assure CSCS performance in the event of a large break in the nuclear process barrier. The (-49")

containment isolation setting completes the isolation of containment and the reactor vessel by closing main steam isolation valves and other minor l process lines (FSAR Section 7.3).  :

j I l

_ . y mw SENT BY:BECo  ; t- 3-92 : 1:29;M ; BRAINTREE 4th FLOOR ~ 301 192 0259:: 4 The (-49") recirculation pump trip protects the recirculation pump from damage due to low NPSW. This function is not a safety function.

LT72A (B.C.D)

Initiate CSCS and RCIC, Start EDGs (-49")

Reactor vessel icw-low water level is indicative of a loss of coolant event and the potential to overheat the fuel clad. These devices initiate high pressure coolant injection and reactor core isolation cooling immediately. Core Spray and RHR-LPCI are initiated if these devices trip coincident with reactor vessel low pressure, or if low-low water level is sustained beyond a preset time delay. The integrated response of the CSCS systems assures the fuel is adequately cooled under abnormal and accident conditions.

Starting of the diesel generators immediately after reaching low-low water level is an anticipatory measure that assures the availability of AC power for CSCS and mitigative systems without any diesel start time dalay if offsite power is subsequently lost. If offsite power is available, the diesel ' generators will start and run without closing onto safety buses.

The HPC1/RCIC trip at (+48") terminates the addition of water to the reactor vessel because water level is near the top of the steam separators and the trip prevents gross moisture carryover to the HPCI and RCIC turbines.

The turbine stop valves trip at (+48") to protect the main turbine from moisture carryover when the MSIVs are open. This protective feature is not safety-related.

4. References

1. Drawing H253, SH 1

2. FSAR Sections 7.2, 7.3, 7.4, 7.8, 3.9, 7.10

3. Technical Specifications 2.1, 3.1, 3.2, 3. 5

4. GE-NE-187-38-1091, November 1991, Safety Evaluation of the Water Level Spiking Phenomenon Observed at Pilgrim Nuclear Power Station

5. GE-NE-187-69-1291, December 1991, New Analytical Limit for Low-Low Water Level (SUDDS/RF 91-178)

GE Letter LLC-52-91, November 15, 1991 L.L. Chi to J. Gosnell, 5.

Analytical Limit for Scram Water Level and HPCI/RCIC High Water Level Trip

7. NEDC-31852P, SAFER /GisiR-LOCA naalysis

8. FSAR Section 14 and Appendix R

9. NEDO-24708A, Additional Information Required for NRC Staff Generic Report on BWRs f

5. Safety Concern During shutdowns of FNPS, water level fluctuations have been observed at zero power, low pressure (roughly 470 psig or lower) conditions. The peaks :of these fluctuations are small (approximately 5 inches) at 470 psig and progressively increase to an observed maximum of 22 inches at 10 psig.f The maximum duration of observed peaks has been approximately 40 to i

I  !

l

kn a k h A G:aanaW _ ,_

," $ENT BV'OECo . L- 3-32 ; 1: 30PM ; BRAINTREE ath FLOOR

• 301 492 0250:: 5 60 seconds. Since protection systems are receiving erroneously high level indications, there is a safety concern that actual low water level conditions may not initiate required safety actions in the time required to fulfill their safety functions. Also, under actual normal water level conditions, inadvertent false high level actuations may affect safety functions.

This evaluation focuses on the ability of the reactor vessel water level (RWL) instrumentation to initiate automatic protective actions in response to an actual RWL decrease or increase coincident with onset of spiking (a highly improbable event). Each specific accident / transient crediting low or high RWL with a protective action initiating signal is discussed. It is recognized that this spiking could also cause a conservative (but necessary) Group 1 isolation during a normal

~

cooldown/depressurization sequence. This eventuality is addressed since it results in temporary loss of access to the preferred heat sink.

This evaluation assesses safety impact based on observed empirical data.

As such, the following generai assumptions are implicit in the evaluation:

• Spiking does not occur above 600 psig.

. The spiking phenomenon occurs similarly during transient and accident conditions as has been actually observed.

Specific assumptions are discussed in the body of the evaluation.

6. Safety Assessment The water level spiking phenomenon has occurred on at least four separate occasions. The phenomenon has been random in frequency but is generallyAt repeatable in magnitude and duration at various low reactor pressures.

accelerated cooldown/depresserization, spiking tends to occur more frequently. It has not been observed above roughly 470 psig and has occurred only during depressurizations during shutdown operations. The

'B' Train instruments experienced spiking beginning at roughly 470 psig (approximately 5 inch spikes), whereas the ' A' Train instruments began spiking at 70 psig (approximately 2 inch spikes). 'A' Train responses have generally been bounded by 'B' Train responses in amplitude, duration, and reactor pressure when spiking began to occur.

Although the magnitude, duration, and frequency of level spiking is substantially less on the ' A' train instrument rack, the ' A' train will be assumed to respond similar to 'B' Train in this evaluation for cons e rvati sm. Typically, spike amplitudes have increased as reactor pressure decreased with largest observed spikes occurring at 10 psig (approximately 22 inches). Above approximately 100 psig, the largest observed spikes have been 6" in the 'B' Train and no spiking has occurred  ;

in 'A' Train. Durations are typically 20 to 30 seconds and have been as long as 60 seconds. Spikes have always indicated higher than actual water level. Smaller spikes at higher pressures tend to be shaped like a plateau (i.e.l square wave). The he1ght of these spikes is often sustained. The larger spikes it lower pressures typically ramp up and down, with the peak values existing only momentarily. Although apparently random in occurrence, spiking does not generally occur simultaneously in both trains.

_4_

" ' ' ^ ^ ^

.' . _ a.a . . a .-

SENT BY:BECo .

4- 3-92 1:31FM ; BRAINTREE ath FLOOR- 301 492 0259:s 5 q

Variations in water level indications are not an unknown phenomenon in BHRs. Level indications are sensitive to changes in pressure, temperature, .i static head and flow across the sensing nozzle. All.of these variables change rapidly during transient and accident conditions in the reactor. ,

During a LOCA, water will be flashing and boiling throughout the vessel. j Actual level will exist more as a range of levels as opposed to a specific value with indicated level tending to oscillate about the actual level (see Reference 9). Level oscillations as small as two to four inches i would tend to mask most observed level spiking above 100 psig. At trip .

setpoint levels, little or no trip delay is therefore expected. Below 100 i psig, spiking may not be completely masked by oscillations but the  !

durations of the spikes would be shortened.

Various possible mechanisms may be the cause for this phenomenon.

Although the exact cause has not been identified, the empirical data over the last four shutdowns demonstrates that the spikes, although random in

.j frequency, are generally predictable and repeatable in the associated -

reactor l conditions. i Postula!t ed Abnormal Oeerational Transients I  !

Scram and Isolation Functions (+9") t I

The only transient event where a low level (+9") scram is credited for l performing the scram function is the total loss of feedwater flow. Other transients either do not result in a low level or receive scrams from 1 other initiators. (References 4 and 8). For a loss of feedwater flow event '

at full' power, reactor pressure is well above 600 psig and the low level '

scram function is unaffected (FSAR Appendix R.2.4.3). For other reduced -

power operation conditions where a loss of feedwater flow occurs, the reactor will scram when and if reactor pressure drops below approximately {

I 880 psig (in RUN mode) due to MSIV closure. Otherwise, since the event is above 600 psig, no level spiking will occur.

j IftheIeventoccurswiththereactornotinRUNmodebutatpower(i.e. i STARTUP mode), feedwater flow will initially be low and a loss of feedwater will not cause a significant reactor pressure drop (i.e. below l 600 psig) before scram level is reached. Level scram response would, 'j i

therefore, be unaffected.

i i

For plant Startup operation below 600 psig, reactor power and feedwater flow will be very small or zero. A loss of feedwater in this. condition l

would be a very mild transient and.does not lead to low . level prior to operator intervention. For plant Shutdown, all control rods are inserted l

prior to going below 600 psig.  !

l CSCS, Containment Isolation, RCIC, Diesel Generator. Functions (-49")

l Loss of feedwater, loss of offsite power, and pressure regulator failure events; may result in a low-low level with initial full reactor power (see References 4 and 8). For the loss of feedwater event in RUN mode, reactor pressdre will remain above 880 psig due to MSIV closure. For the Diesel loss of offsit'e power event, MSIVs close on loss of power to PCIS logic.

1 l

_ _ . . . _ , , _ - ~__ . .~ . - . . . .- . i

%-w N i z W s -- J - --- E r ,

~ -n-mw~

~

SENl SY:BECo  ; 4- 3-92 ; 1:31PM : BRu s7sEg atn F e m m ga 7 I

generators start on emergency bus low voltage. For the pressure regulator failure event, MSIVs close due to Icw reactor pressure (less than 880 psig in RUN mode). These events then become reactor isolation events at high pressure; If reactor level reaches the icw-low level CSCS initiation point (-49"), the reactor will be above 600 psig and no level spiking concerns exist.

If the reactor is cperating at low power in STARTUP mode during a pressure regulator f ailure, a high water level (+48") MSIV closure would occur returning the reactor to high pressure (FSAR 7.3). Therefore, a pressure regulator failure in STARTUP mode will not result in coincident low reactor pressure and icw-low level. If the reactor is operating at low power in STARTUP mode during a loss of feedwater event, the transient will be mild. At low power and low feed flows, steaming rates will be low. Level would drop relatively slowly and tne pressure drop would be small (FSAR Appendix R.2.4.3). Spiking would not be expected and plant response would be unaffected.

With plant conditions initially below 600 psig, these transients would be mild because reactor power and feedwater flev to the reactor would be very small or zerc, Reference 5 indicates that reactor level drops no lower after RCIC initiation, assuming only RCIC is available, a high initial Considering reactor. power, and using a level initiation point of -57".

the timeframes associated with the observed spikes and the low steaming rates when shutdown below 600 psig, substantial level exists above top of active fuel.In the unlikely event that water level spiking occurs for events initially belcw 600 psig, considerable margin exists for core cooling, High Level Isolation Functions (+48")

Transient events that could lead to high water level conditions are not affected since the level spikes are in the high direction and will only cause the required functions to occur sooner. Premature trip of the HPCI/RCIC systems is not a concern because the water level is still substantially above top of active fuel.

Pice Breaks Inside Containment (PBIC)

At Rated Pcwer Reference 4 indicates that for pipe breaks inside containment at full power conditions (other than the large steam line breaks), reactor pressure will exceed 500 psig when low and low-low water levels are reached, thereby demonstrating that no water level spike effects will occur.

l l

i l

-e-l

,- .SENT By:BEco  ; 4- 3-92 : 1:32PM ; BRAINTREE 4% FLOOR- 301 492 0250 a 8 Large steam line breaks may cause depressurization below 600 psig.

Mcwever{,largesteamlinebreaksinitiallyleadtolevelswellsdueto extenstpevoiding. Since response of level sensors to this event cannot provide necessary timeliness, other design features exist to mitigate '

these e'ent:v (i.e. high drywell pressure). Containment analysis does not credit !1ow water level scram; high drywell pressure is used (FSAR 14.5.3.1). The HSIVs close promptly on high steam line flow or low steam line pressure. Primary and secondary containment isolations and CSCS and EDG initiation occur promptly on high drywell pressure. The only actuations that do not occur on high drywell pressure or other designed acciderit response signals that would otherwise occur on low or low-low level signals are

• Reactor water cleanup isolation ,

• ADS actuation

• RCIC actuation The reactor water cleanup system receives isolation signals in response to reactor vessel icw water level (+9"), rupture of associated piping, ,

standby liquid control injection, or high system temperature that could effectiresin performance. Provided the RWCU isolation valves are closed prior to reactor level reaching the top of active fuel, no containment isolation concerns exist. LOCA analysis of the main steam line break (Reference 7) indicates that potential core uncovery does not occur until approximately 95 seconds after the break. Conservatisms associated with this analysis indicate that any core uncovery is unlikely. Original analys%s of this event indicated that core uncovery would not occur. (FSAR 5.2.8.3). With a RWCU isolation valve closure time of 25 seconds, a delay of greater than 70 seconds would be required to potentially have the valves!open with the core uncovered. Such delays concurrently associated ,

with large spiking are not expected based on empirical data. Margins indicate this is not a concern.

for large steamline breaks, reactor pressure drops so rapidly (Reference '

7) that the ADS and RCIC functions are unnecessary.

LOCA analyses are not affected because level responses are not credited in the analyses (Reference 4).

In ST RTUP Hode For bdeaks that occur in STARTUP mode, the above discussion is applicable.

MSIVslclose on high steam flow.

Less han 600 PSIG l l For breaks that occur with the plant initially below 600 psig, reactor power lwill be negligible, vessel blowdown rates will be reduced and the breaks are bounded by the above evaluations. CSCS initiation on high drywell pressure provides substantial coolant makeup for these conditions. Unlikely spiking that may slightly delay MSIV closure on low-low level (if not isolated on high steam flow) are not a concern.

I r

.- SENT BY:BECo ,

A- 3-92 ; 1

32PM ; BRAINTREE ath FLOOR-' 301 492 0259;s 9 i .

Based on the above discussions and considering that PNPS LOCA analyses (Reference 7) assume an initial power of 102%, initial pressure of 1050 psig, and reduced LPCI and core spray flow rates (51,and 101.

respect,1vely), considerable margin exists for PBICs to conclude that water level spikes will not prevent required safety functions.

I 2/3 Core Coverage A 2/3 core coverage condition is only expected for a recirculation pipe break. lThese are large break events with rapid level decreases and core level recovery to 2/3 height using core spray and/or LPCI pumps.

Diversion of LPCI flow to the containment cooling inode requires operator action.! LPCI flow will not be diverted for containment cooling unless directed by E0Ps. Therefore, if vessel level spiking were to occur coincident with initiation of containment cooling, the procedural controls provided by E0Ps (during design basis events) with respect to vessel level ensure .that actual water level is not below the 2/3 core coverage containment cooling permissive. The height difference between 2/3 core height -and TAF is approximately 4 feet, well above the worst observid momentary peak.

High w ter level conditions would only be expected during a PSIC for a small break where HPCI/RCIC flows exceed break losses. However, for breaks ;this small, reactor pressure will remain high and premature high level flPCI/RCIC trips or slightly delayed re-initiations on low-low level are not considered a concern.

_Pice Bhaks Outside Containment (PBOCl Analysis of PBOCs indicates that reactor pressure remains high because PBOCs are reactor isolation events. These events have PCTs substantially below PBICs because inventory loss is limited. If pressure is reduced later in the event (i.e., due to ADS actuation), it would be the result of a low-low level condition that existed at high pressure (i.e., above 600 psig). PBOC isolation capability is unaffected by level spikes because most PBCCs isolate on high flow or high area temperature. The only PBOC that isolates due to a level signal only is the shutdown cooling line break.l An analysis was performed of potential level spiking delays during a shutdown cooling line break. The safety concern is the requirement to have isolation valves closed before core uncovery. The analysis assumed i

i l

l i

i

,.. JENT BY*BECo  : 4- 3-92 : 1:33PN

• BRAINTREE-4% FLOOR

• 301-492 0259:a10-s .  ;

shutdown cooling isolation pressure (110 psig) to maximize level ,

i reductjon. Piping friction loss was not considered nor was contribution to level recovery from any CSCS. The analysis concluded that a 29 inch l spike of continuous duration (i.e. isolation does not begin until actual i level is 29 inches lower than the prescribed setpoint) would be required )

to unc6ver the core. A spike of 22 inch magnitude has been observed once ,

in the 'B' train at 50 psig. Also, 22 inches represents the spike peak l and is not a steady state condition. . Based on empirical data, it is j concluded that adequate margin exists to prevent core uncovery. Once the.  !

breakjsisolated,delaysinCSCSinitiationareboundedbyfullpower LOCA analyses (i.e. in shutdown cooling, only decay heat is being  ;

generated, a break no longer exists, reactor is at low pressure, etc. ).  :

Contro l Rod Drco Accident t This event leads to HSIV closure on high main steam line radiation. At .

that point, the event becomes an isolation event similar to loss-of- .

offsit's power and spiking is not expected.

I i Inadve'rtent Groue 1 Isolation Durino Shutdown Overations ]

I High water level spiking leading to Group 1 isolations (+48") during low ]

pressu'r e shutdown operations are bounded by a loss-of-offsite power or.

inadve'rtent HSIV closure event at full power. As such, these events are s of minor FSAR safety consequence. However, these events represent a loss  !

j of pre lferred heat sink which is considered an abnormal transient and a challenge to safety equipment.  !

Since;ltheobservedspikingistransientinnature,lossofthepreferred heat sink (main condenser) is a temporary condition. Operations personnel j have demonstrated the ability to restore the' preferred heat sink in a -

timely manner during actual isolations. Also, numerous standby systems i are asa11able to support decay heat removal (e.g. HPCI, RCIC, ADS, etc.). -!

Each of these systems can promptly be. operated from the control room.  !

Plant.! personnel are aware of the potential for spiking and will take l precadtions within practical operational-limits to preveat isolations. l i

ATHSkvents t i ~

The recirculation. pump trip function supports ATHS by reducing core power-and otherwise protects the pump from cavitation on low levels. ATHS i eventi generally involve high reactor pressures because the reactor i conti6ues to generate some power. E0Ps direct operators to primarily  !

contr61 pressure. In these cases, water level spiking is not expected (see '

Reference 4).

I  :

Fire Events .

I Fire events are also isolation events where reactor pressure remains f l

high.ld assume to be lost during these events.No spiking Operators will therefore manually perform occur. Automatic requi red actions.

!L

-. g- l I

k

, S,ENT BY:BEco  ; 4- 3-92 ; 1:34PM BRAINTREE 4th FLOOR

• 301 492 0259;#11

. Summary Based an the observed spiking phenomena, adequate margins exist in transient and LOCA analyses for conditions when spiking is predicted to occur.l Delays in initiation of some CSCS or containment isolation equipment by water level instruments will not affect the ability of the combin'ed systems to perform their safety functions assuming a single active failure.

Inadvertent high level isolations while shutting down represent an operat;ional difficulty. However, the condition does not prevent performance of any safety function and is bounded by FSAR analysis of MSIV closur'e at full power.

Finally, level fluctuations have no effect on limiting FSAR transient and accide,nt analyses because the fluctuations do not occur above 600 psig, i

7. Perfor ed By:

Review ledBy:

I Recommends Approval:

I Recommends Approval:

(ORC Chairman)

Plant Kanager Approval:

ORC Heeting Number i

I

1. 1470 l l

1 l

l